Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11-09-2024 21:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5b60838c6380a4c6cc3a503e84ff4ec0N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
5b60838c6380a4c6cc3a503e84ff4ec0N.exe
-
Size
74KB
-
MD5
5b60838c6380a4c6cc3a503e84ff4ec0
-
SHA1
3f876b2adb4a2911a9e46f1c37367bc90e776b76
-
SHA256
63ba6d3e08dfd15f19d6555ca2b75e86feb817fd16ebf77ff98c611ba91bcb54
-
SHA512
660cfd7cbcaaaeadbc768e2bffb8fac3815ac5b28e6a671bce8aeb3a19d63ef28809e48d29ed20a3c05db0a8efa3e7f3e07027160bb44b9684ea6f13e862f685
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmsu:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHk
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/2516-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1276-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1876-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2872-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2656-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3404-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1276 bntttt.exe 4624 tntttb.exe 4748 ppjjp.exe 3176 hbttnn.exe 3468 5ddjp.exe 1876 tntntb.exe 4740 hbtnnn.exe 5016 ddjdd.exe 2872 bnnbtn.exe 2272 ddjdd.exe 4744 fxfxlrl.exe 5116 nnbtnn.exe 5004 hbhbnt.exe 2656 ppjdv.exe 1632 ddpdd.exe 4120 bbnbbt.exe 640 tnnhtt.exe 3652 pddjd.exe 3836 rllflfl.exe 3228 ttttbb.exe 3416 hbhhhh.exe 544 dddvj.exe 4020 rfrrllf.exe 2716 hhnbtn.exe 2388 tnntth.exe 3604 dpvdv.exe 1016 llfrxxf.exe 3952 tnbnhh.exe 1224 hnbtnn.exe 2320 vjpdv.exe 3404 llllffl.exe 760 hnhhhh.exe 1956 jpvpp.exe 388 dpvvd.exe 2336 rllfrrl.exe 4936 xfffxxx.exe 4484 btnbtn.exe 4440 tbhnhb.exe 116 ddjjd.exe 1276 jdjjj.exe 4212 ffffrxx.exe 3036 fxrxxff.exe 2292 5thhtb.exe 3380 ntbnnh.exe 4856 vjpjj.exe 1380 ppppj.exe 3596 flrllrr.exe 1236 9rrrrrr.exe 2064 hbbbbb.exe 3208 nnbbth.exe 1464 7pvpp.exe 2404 pddpv.exe 3132 xrlxrrr.exe 3636 xlffrfx.exe 2808 hhhhnn.exe 2272 bhttnn.exe 5000 1jpjd.exe 4872 7pdpj.exe 4932 lflfrrl.exe 1108 fxflrxx.exe 1616 nntthn.exe 1020 htbhhn.exe 4828 vpppp.exe 764 xllrxrf.exe -
resource yara_rule behavioral2/memory/2516-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1276-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1876-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2872-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1224-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxflfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnnh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2516 wrote to memory of 1276 2516 5b60838c6380a4c6cc3a503e84ff4ec0N.exe 83 PID 2516 wrote to memory of 1276 2516 5b60838c6380a4c6cc3a503e84ff4ec0N.exe 83 PID 2516 wrote to memory of 1276 2516 5b60838c6380a4c6cc3a503e84ff4ec0N.exe 83 PID 1276 wrote to memory of 4624 1276 bntttt.exe 84 PID 1276 wrote to memory of 4624 1276 bntttt.exe 84 PID 1276 wrote to memory of 4624 1276 bntttt.exe 84 PID 4624 wrote to memory of 4748 4624 tntttb.exe 85 PID 4624 wrote to memory of 4748 4624 tntttb.exe 85 PID 4624 wrote to memory of 4748 4624 tntttb.exe 85 PID 4748 wrote to memory of 3176 4748 ppjjp.exe 86 PID 4748 wrote to memory of 3176 4748 ppjjp.exe 86 PID 4748 wrote to memory of 3176 4748 ppjjp.exe 86 PID 3176 wrote to memory of 3468 3176 hbttnn.exe 87 PID 3176 wrote to memory of 3468 3176 hbttnn.exe 87 PID 3176 wrote to memory of 3468 3176 hbttnn.exe 87 PID 3468 wrote to memory of 1876 3468 5ddjp.exe 88 PID 3468 wrote to memory of 1876 3468 5ddjp.exe 88 PID 3468 wrote to memory of 1876 3468 5ddjp.exe 88 PID 1876 wrote to memory of 4740 1876 tntntb.exe 89 PID 1876 wrote to memory of 4740 1876 tntntb.exe 89 PID 1876 wrote to memory of 4740 1876 tntntb.exe 89 PID 4740 wrote to memory of 5016 4740 hbtnnn.exe 91 PID 4740 wrote to memory of 5016 4740 hbtnnn.exe 91 PID 4740 wrote to memory of 5016 4740 hbtnnn.exe 91 PID 5016 wrote to memory of 2872 5016 ddjdd.exe 92 PID 5016 wrote to memory of 2872 5016 ddjdd.exe 92 PID 5016 wrote to memory of 2872 5016 ddjdd.exe 92 PID 2872 wrote to memory of 2272 2872 bnnbtn.exe 93 PID 2872 wrote to memory of 2272 2872 bnnbtn.exe 93 PID 2872 wrote to memory of 2272 2872 bnnbtn.exe 93 PID 2272 wrote to memory of 4744 2272 ddjdd.exe 95 PID 2272 wrote to memory of 4744 2272 ddjdd.exe 95 PID 2272 wrote to memory of 4744 2272 ddjdd.exe 95 PID 4744 wrote to memory of 5116 4744 fxfxlrl.exe 96 PID 4744 wrote to memory of 5116 4744 fxfxlrl.exe 96 PID 4744 wrote to memory of 5116 4744 fxfxlrl.exe 96 PID 5116 wrote to memory of 5004 5116 nnbtnn.exe 97 PID 5116 wrote to memory of 5004 5116 nnbtnn.exe 97 PID 5116 wrote to memory of 5004 5116 nnbtnn.exe 97 PID 5004 wrote to memory of 2656 5004 hbhbnt.exe 98 PID 5004 wrote to memory of 2656 5004 hbhbnt.exe 98 PID 5004 wrote to memory of 2656 5004 hbhbnt.exe 98 PID 2656 wrote to memory of 1632 2656 ppjdv.exe 99 PID 2656 wrote to memory of 1632 2656 ppjdv.exe 99 PID 2656 wrote to memory of 1632 2656 ppjdv.exe 99 PID 1632 wrote to memory of 4120 1632 ddpdd.exe 100 PID 1632 wrote to memory of 4120 1632 ddpdd.exe 100 PID 1632 wrote to memory of 4120 1632 ddpdd.exe 100 PID 4120 wrote to memory of 640 4120 bbnbbt.exe 101 PID 4120 wrote to memory of 640 4120 bbnbbt.exe 101 PID 4120 wrote to memory of 640 4120 bbnbbt.exe 101 PID 640 wrote to memory of 3652 640 tnnhtt.exe 102 PID 640 wrote to memory of 3652 640 tnnhtt.exe 102 PID 640 wrote to memory of 3652 640 tnnhtt.exe 102 PID 3652 wrote to memory of 3836 3652 pddjd.exe 103 PID 3652 wrote to memory of 3836 3652 pddjd.exe 103 PID 3652 wrote to memory of 3836 3652 pddjd.exe 103 PID 3836 wrote to memory of 3228 3836 rllflfl.exe 105 PID 3836 wrote to memory of 3228 3836 rllflfl.exe 105 PID 3836 wrote to memory of 3228 3836 rllflfl.exe 105 PID 3228 wrote to memory of 3416 3228 ttttbb.exe 106 PID 3228 wrote to memory of 3416 3228 ttttbb.exe 106 PID 3228 wrote to memory of 3416 3228 ttttbb.exe 106 PID 3416 wrote to memory of 544 3416 hbhhhh.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b60838c6380a4c6cc3a503e84ff4ec0N.exe"C:\Users\Admin\AppData\Local\Temp\5b60838c6380a4c6cc3a503e84ff4ec0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\bntttt.exec:\bntttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\tntttb.exec:\tntttb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\ppjjp.exec:\ppjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\hbttnn.exec:\hbttnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\5ddjp.exec:\5ddjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\tntntb.exec:\tntntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\hbtnnn.exec:\hbtnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\ddjdd.exec:\ddjdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\bnnbtn.exec:\bnnbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\ddjdd.exec:\ddjdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\fxfxlrl.exec:\fxfxlrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\nnbtnn.exec:\nnbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\hbhbnt.exec:\hbhbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\ppjdv.exec:\ppjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\ddpdd.exec:\ddpdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\bbnbbt.exec:\bbnbbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\tnnhtt.exec:\tnnhtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\pddjd.exec:\pddjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\rllflfl.exec:\rllflfl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\ttttbb.exec:\ttttbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\hbhhhh.exec:\hbhhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\dddvj.exec:\dddvj.exe23⤵
- Executes dropped EXE
PID:544 -
\??\c:\rfrrllf.exec:\rfrrllf.exe24⤵
- Executes dropped EXE
PID:4020 -
\??\c:\hhnbtn.exec:\hhnbtn.exe25⤵
- Executes dropped EXE
PID:2716 -
\??\c:\tnntth.exec:\tnntth.exe26⤵
- Executes dropped EXE
PID:2388 -
\??\c:\dpvdv.exec:\dpvdv.exe27⤵
- Executes dropped EXE
PID:3604 -
\??\c:\llfrxxf.exec:\llfrxxf.exe28⤵
- Executes dropped EXE
PID:1016 -
\??\c:\tnbnhh.exec:\tnbnhh.exe29⤵
- Executes dropped EXE
PID:3952 -
\??\c:\hnbtnn.exec:\hnbtnn.exe30⤵
- Executes dropped EXE
PID:1224 -
\??\c:\vjpdv.exec:\vjpdv.exe31⤵
- Executes dropped EXE
PID:2320 -
\??\c:\llllffl.exec:\llllffl.exe32⤵
- Executes dropped EXE
PID:3404 -
\??\c:\hnhhhh.exec:\hnhhhh.exe33⤵
- Executes dropped EXE
PID:760 -
\??\c:\jpvpp.exec:\jpvpp.exe34⤵
- Executes dropped EXE
PID:1956 -
\??\c:\dpvvd.exec:\dpvvd.exe35⤵
- Executes dropped EXE
PID:388 -
\??\c:\rllfrrl.exec:\rllfrrl.exe36⤵
- Executes dropped EXE
PID:2336 -
\??\c:\xfffxxx.exec:\xfffxxx.exe37⤵
- Executes dropped EXE
PID:4936 -
\??\c:\btnbtn.exec:\btnbtn.exe38⤵
- Executes dropped EXE
PID:4484 -
\??\c:\tbhnhb.exec:\tbhnhb.exe39⤵
- Executes dropped EXE
PID:4440 -
\??\c:\ddjjd.exec:\ddjjd.exe40⤵
- Executes dropped EXE
PID:116 -
\??\c:\jdjjj.exec:\jdjjj.exe41⤵
- Executes dropped EXE
PID:1276 -
\??\c:\ffffrxx.exec:\ffffrxx.exe42⤵
- Executes dropped EXE
PID:4212 -
\??\c:\fxrxxff.exec:\fxrxxff.exe43⤵
- Executes dropped EXE
PID:3036 -
\??\c:\5thhtb.exec:\5thhtb.exe44⤵
- Executes dropped EXE
PID:2292 -
\??\c:\ntbnnh.exec:\ntbnnh.exe45⤵
- Executes dropped EXE
PID:3380 -
\??\c:\vjpjj.exec:\vjpjj.exe46⤵
- Executes dropped EXE
PID:4856 -
\??\c:\ppppj.exec:\ppppj.exe47⤵
- Executes dropped EXE
PID:1380 -
\??\c:\flrllrr.exec:\flrllrr.exe48⤵
- Executes dropped EXE
PID:3596 -
\??\c:\9rrrrrr.exec:\9rrrrrr.exe49⤵
- Executes dropped EXE
PID:1236 -
\??\c:\hbbbbb.exec:\hbbbbb.exe50⤵
- Executes dropped EXE
PID:2064 -
\??\c:\nnbbth.exec:\nnbbth.exe51⤵
- Executes dropped EXE
PID:3208 -
\??\c:\7pvpp.exec:\7pvpp.exe52⤵
- Executes dropped EXE
PID:1464 -
\??\c:\pddpv.exec:\pddpv.exe53⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xrlxrrr.exec:\xrlxrrr.exe54⤵
- Executes dropped EXE
PID:3132 -
\??\c:\xlffrfx.exec:\xlffrfx.exe55⤵
- Executes dropped EXE
PID:3636 -
\??\c:\hhhhnn.exec:\hhhhnn.exe56⤵
- Executes dropped EXE
PID:2808 -
\??\c:\bhttnn.exec:\bhttnn.exe57⤵
- Executes dropped EXE
PID:2272 -
\??\c:\1jpjd.exec:\1jpjd.exe58⤵
- Executes dropped EXE
PID:5000 -
\??\c:\7pdpj.exec:\7pdpj.exe59⤵
- Executes dropped EXE
PID:4872 -
\??\c:\lflfrrl.exec:\lflfrrl.exe60⤵
- Executes dropped EXE
PID:4932 -
\??\c:\fxflrxx.exec:\fxflrxx.exe61⤵
- Executes dropped EXE
PID:1108 -
\??\c:\nntthn.exec:\nntthn.exe62⤵
- Executes dropped EXE
PID:1616 -
\??\c:\htbhhn.exec:\htbhhn.exe63⤵
- Executes dropped EXE
PID:1020 -
\??\c:\vpppp.exec:\vpppp.exe64⤵
- Executes dropped EXE
PID:4828 -
\??\c:\xllrxrf.exec:\xllrxrf.exe65⤵
- Executes dropped EXE
PID:764 -
\??\c:\frrlffx.exec:\frrlffx.exe66⤵PID:2664
-
\??\c:\pvdpj.exec:\pvdpj.exe67⤵PID:2424
-
\??\c:\dvjdv.exec:\dvjdv.exe68⤵PID:1992
-
\??\c:\ffrxxlx.exec:\ffrxxlx.exe69⤵PID:4808
-
\??\c:\tbthnb.exec:\tbthnb.exe70⤵PID:4044
-
\??\c:\hbbttn.exec:\hbbttn.exe71⤵PID:3228
-
\??\c:\jjvvv.exec:\jjvvv.exe72⤵PID:2500
-
\??\c:\fxlxrrr.exec:\fxlxrrr.exe73⤵PID:3104
-
\??\c:\xxfffll.exec:\xxfffll.exe74⤵PID:3576
-
\??\c:\thtttb.exec:\thtttb.exe75⤵PID:3108
-
\??\c:\dvjpp.exec:\dvjpp.exe76⤵PID:4228
-
\??\c:\jjpjj.exec:\jjpjj.exe77⤵PID:2388
-
\??\c:\xlfxxxr.exec:\xlfxxxr.exe78⤵PID:2252
-
\??\c:\xrflfff.exec:\xrflfff.exe79⤵PID:1016
-
\??\c:\nntbnn.exec:\nntbnn.exe80⤵PID:4620
-
\??\c:\jjddp.exec:\jjddp.exe81⤵PID:4468
-
\??\c:\jjpdj.exec:\jjpdj.exe82⤵PID:5036
-
\??\c:\rrxxrxr.exec:\rrxxrxr.exe83⤵PID:1048
-
\??\c:\lfffxxx.exec:\lfffxxx.exe84⤵PID:3212
-
\??\c:\bttttt.exec:\bttttt.exe85⤵PID:4796
-
\??\c:\nhtbth.exec:\nhtbth.exe86⤵PID:2288
-
\??\c:\ddddp.exec:\ddddp.exe87⤵PID:4724
-
\??\c:\vpvdd.exec:\vpvdd.exe88⤵PID:2552
-
\??\c:\xxlllll.exec:\xxlllll.exe89⤵PID:4268
-
\??\c:\nbhhbb.exec:\nbhhbb.exe90⤵PID:4852
-
\??\c:\tthbhh.exec:\tthbhh.exe91⤵PID:3172
-
\??\c:\vpjdp.exec:\vpjdp.exe92⤵PID:2092
-
\??\c:\pppjj.exec:\pppjj.exe93⤵
- System Location Discovery: System Language Discovery
PID:4508 -
\??\c:\lfrlxll.exec:\lfrlxll.exe94⤵PID:3484
-
\??\c:\xxffrxf.exec:\xxffrxf.exe95⤵PID:2940
-
\??\c:\hhtttt.exec:\hhtttt.exe96⤵PID:3644
-
\??\c:\nnbttt.exec:\nnbttt.exe97⤵PID:2976
-
\??\c:\1jjdv.exec:\1jjdv.exe98⤵PID:1944
-
\??\c:\vvddv.exec:\vvddv.exe99⤵PID:3928
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe100⤵PID:3672
-
\??\c:\3rxxxxx.exec:\3rxxxxx.exe101⤵PID:4972
-
\??\c:\hhnhhh.exec:\hhnhhh.exe102⤵PID:3156
-
\??\c:\hbbtnn.exec:\hbbtnn.exe103⤵PID:5012
-
\??\c:\pdjdj.exec:\pdjdj.exe104⤵PID:4628
-
\??\c:\frxfxxx.exec:\frxfxxx.exe105⤵
- System Location Discovery: System Language Discovery
PID:220 -
\??\c:\lxffffl.exec:\lxffffl.exe106⤵PID:2868
-
\??\c:\hnnnhn.exec:\hnnnhn.exe107⤵PID:5072
-
\??\c:\hhnhhh.exec:\hhnhhh.exe108⤵PID:4744
-
\??\c:\ddddd.exec:\ddddd.exe109⤵PID:396
-
\??\c:\dvjvv.exec:\dvjvv.exe110⤵PID:3460
-
\??\c:\xrrfxxx.exec:\xrrfxxx.exe111⤵PID:4872
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe112⤵PID:4932
-
\??\c:\hbttnb.exec:\hbttnb.exe113⤵PID:4820
-
\??\c:\7bnhnn.exec:\7bnhnn.exe114⤵PID:1616
-
\??\c:\jjvdv.exec:\jjvdv.exe115⤵PID:4528
-
\??\c:\vvdvd.exec:\vvdvd.exe116⤵PID:3676
-
\??\c:\rrlrlfr.exec:\rrlrlfr.exe117⤵PID:4492
-
\??\c:\btttnn.exec:\btttnn.exe118⤵PID:2932
-
\??\c:\jdvpp.exec:\jdvpp.exe119⤵PID:1724
-
\??\c:\pjjjj.exec:\pjjjj.exe120⤵PID:1992
-
\??\c:\lrxxrfx.exec:\lrxxrfx.exe121⤵PID:4808
-
\??\c:\xxrrfxf.exec:\xxrrfxf.exe122⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-