Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12-09-2024 10:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8369597aaeb4f20987229c901e124280N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
8369597aaeb4f20987229c901e124280N.exe
-
Size
75KB
-
MD5
8369597aaeb4f20987229c901e124280
-
SHA1
3d0df5b1a1ea8af70cbec9215080f3b4a80665ae
-
SHA256
b4dd576cb8f3d90fcb0232943c96f0905cff35804fd9cee5b88034cfd316e372
-
SHA512
8e0d640004bd171a4463b204e58e608eb2f0aae194b079846418908d10cf705e89f595aa7ac94f0836bcbc90232ee7c526377bd5f4aea9bba41d09037168dc3f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmP1:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHk
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4708-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-49-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2268-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2628-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1728-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2648-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1672-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3440 jvdvv.exe 4780 9jvjp.exe 4940 rrxrfff.exe 2368 3tbbbh.exe 1720 jpvjd.exe 2268 ppdvp.exe 2200 fxxxxxf.exe 1548 pvvdd.exe 116 djpjd.exe 2628 bhnnhn.exe 4652 dvpjj.exe 3976 xfllfff.exe 2248 tbtbtb.exe 4932 nttnhh.exe 624 pdjvj.exe 372 fflxxfx.exe 3480 nttttn.exe 4552 tnttnn.exe 2828 pjpjj.exe 3052 rxxrlll.exe 1664 rlxfxfx.exe 1728 bhntnn.exe 2648 jdjjj.exe 4628 xrrrrrr.exe 2716 xrllrrr.exe 2920 nhnhhh.exe 1196 pddjj.exe 4012 pjdvp.exe 1112 xlxxxfx.exe 3320 frrxxxr.exe 1672 3bnnnn.exe 1984 ppjpj.exe 3328 flllflr.exe 1008 tbbbnt.exe 2704 bhhhbt.exe 3496 jdvpp.exe 3004 9pvpj.exe 3536 frrrrxx.exe 1220 llrfxxx.exe 1084 thbnbb.exe 2056 nhhbtn.exe 2404 vpvpj.exe 2988 xxllfff.exe 2856 nnntnn.exe 2336 nhhbtt.exe 2476 jdpjd.exe 2200 dvpjj.exe 1460 fxfxxxr.exe 2660 5xxlxll.exe 4772 hhhhhh.exe 1892 btttnn.exe 4700 5pvvv.exe 4652 pjdjv.exe 3236 xllrlll.exe 2124 htttnn.exe 2848 hnbbhh.exe 2248 xrlfxfx.exe 208 lfllxrf.exe 4428 9bhhbb.exe 948 ddvvj.exe 3552 7vvvd.exe 428 flfflll.exe 1444 fxrrxxr.exe 3668 ttbhtb.exe -
resource yara_rule behavioral2/memory/4708-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2628-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2628-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2628-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2648-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3llfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4708 wrote to memory of 3440 4708 8369597aaeb4f20987229c901e124280N.exe 83 PID 4708 wrote to memory of 3440 4708 8369597aaeb4f20987229c901e124280N.exe 83 PID 4708 wrote to memory of 3440 4708 8369597aaeb4f20987229c901e124280N.exe 83 PID 3440 wrote to memory of 4780 3440 jvdvv.exe 84 PID 3440 wrote to memory of 4780 3440 jvdvv.exe 84 PID 3440 wrote to memory of 4780 3440 jvdvv.exe 84 PID 4780 wrote to memory of 4940 4780 9jvjp.exe 85 PID 4780 wrote to memory of 4940 4780 9jvjp.exe 85 PID 4780 wrote to memory of 4940 4780 9jvjp.exe 85 PID 4940 wrote to memory of 2368 4940 rrxrfff.exe 86 PID 4940 wrote to memory of 2368 4940 rrxrfff.exe 86 PID 4940 wrote to memory of 2368 4940 rrxrfff.exe 86 PID 2368 wrote to memory of 1720 2368 3tbbbh.exe 87 PID 2368 wrote to memory of 1720 2368 3tbbbh.exe 87 PID 2368 wrote to memory of 1720 2368 3tbbbh.exe 87 PID 1720 wrote to memory of 2268 1720 jpvjd.exe 88 PID 1720 wrote to memory of 2268 1720 jpvjd.exe 88 PID 1720 wrote to memory of 2268 1720 jpvjd.exe 88 PID 2268 wrote to memory of 2200 2268 ppdvp.exe 89 PID 2268 wrote to memory of 2200 2268 ppdvp.exe 89 PID 2268 wrote to memory of 2200 2268 ppdvp.exe 89 PID 2200 wrote to memory of 1548 2200 fxxxxxf.exe 90 PID 2200 wrote to memory of 1548 2200 fxxxxxf.exe 90 PID 2200 wrote to memory of 1548 2200 fxxxxxf.exe 90 PID 1548 wrote to memory of 116 1548 pvvdd.exe 91 PID 1548 wrote to memory of 116 1548 pvvdd.exe 91 PID 1548 wrote to memory of 116 1548 pvvdd.exe 91 PID 116 wrote to memory of 2628 116 djpjd.exe 93 PID 116 wrote to memory of 2628 116 djpjd.exe 93 PID 116 wrote to memory of 2628 116 djpjd.exe 93 PID 2628 wrote to memory of 4652 2628 bhnnhn.exe 94 PID 2628 wrote to memory of 4652 2628 bhnnhn.exe 94 PID 2628 wrote to memory of 4652 2628 bhnnhn.exe 94 PID 4652 wrote to memory of 3976 4652 dvpjj.exe 96 PID 4652 wrote to memory of 3976 4652 dvpjj.exe 96 PID 4652 wrote to memory of 3976 4652 dvpjj.exe 96 PID 3976 wrote to memory of 2248 3976 xfllfff.exe 97 PID 3976 wrote to memory of 2248 3976 xfllfff.exe 97 PID 3976 wrote to memory of 2248 3976 xfllfff.exe 97 PID 2248 wrote to memory of 4932 2248 tbtbtb.exe 98 PID 2248 wrote to memory of 4932 2248 tbtbtb.exe 98 PID 2248 wrote to memory of 4932 2248 tbtbtb.exe 98 PID 4932 wrote to memory of 624 4932 nttnhh.exe 99 PID 4932 wrote to memory of 624 4932 nttnhh.exe 99 PID 4932 wrote to memory of 624 4932 nttnhh.exe 99 PID 624 wrote to memory of 372 624 pdjvj.exe 100 PID 624 wrote to memory of 372 624 pdjvj.exe 100 PID 624 wrote to memory of 372 624 pdjvj.exe 100 PID 372 wrote to memory of 3480 372 fflxxfx.exe 101 PID 372 wrote to memory of 3480 372 fflxxfx.exe 101 PID 372 wrote to memory of 3480 372 fflxxfx.exe 101 PID 3480 wrote to memory of 4552 3480 nttttn.exe 102 PID 3480 wrote to memory of 4552 3480 nttttn.exe 102 PID 3480 wrote to memory of 4552 3480 nttttn.exe 102 PID 4552 wrote to memory of 2828 4552 tnttnn.exe 104 PID 4552 wrote to memory of 2828 4552 tnttnn.exe 104 PID 4552 wrote to memory of 2828 4552 tnttnn.exe 104 PID 2828 wrote to memory of 3052 2828 pjpjj.exe 105 PID 2828 wrote to memory of 3052 2828 pjpjj.exe 105 PID 2828 wrote to memory of 3052 2828 pjpjj.exe 105 PID 3052 wrote to memory of 1664 3052 rxxrlll.exe 106 PID 3052 wrote to memory of 1664 3052 rxxrlll.exe 106 PID 3052 wrote to memory of 1664 3052 rxxrlll.exe 106 PID 1664 wrote to memory of 1728 1664 rlxfxfx.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\8369597aaeb4f20987229c901e124280N.exe"C:\Users\Admin\AppData\Local\Temp\8369597aaeb4f20987229c901e124280N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\jvdvv.exec:\jvdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\9jvjp.exec:\9jvjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\rrxrfff.exec:\rrxrfff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\3tbbbh.exec:\3tbbbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\jpvjd.exec:\jpvjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\ppdvp.exec:\ppdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\fxxxxxf.exec:\fxxxxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\pvvdd.exec:\pvvdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\djpjd.exec:\djpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\bhnnhn.exec:\bhnnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\dvpjj.exec:\dvpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\xfllfff.exec:\xfllfff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\tbtbtb.exec:\tbtbtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\nttnhh.exec:\nttnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\pdjvj.exec:\pdjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\fflxxfx.exec:\fflxxfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\nttttn.exec:\nttttn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\tnttnn.exec:\tnttnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\pjpjj.exec:\pjpjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\rxxrlll.exec:\rxxrlll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\rlxfxfx.exec:\rlxfxfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\bhntnn.exec:\bhntnn.exe23⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jdjjj.exec:\jdjjj.exe24⤵
- Executes dropped EXE
PID:2648 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe25⤵
- Executes dropped EXE
PID:4628 -
\??\c:\xrllrrr.exec:\xrllrrr.exe26⤵
- Executes dropped EXE
PID:2716 -
\??\c:\nhnhhh.exec:\nhnhhh.exe27⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pddjj.exec:\pddjj.exe28⤵
- Executes dropped EXE
PID:1196 -
\??\c:\pjdvp.exec:\pjdvp.exe29⤵
- Executes dropped EXE
PID:4012 -
\??\c:\xlxxxfx.exec:\xlxxxfx.exe30⤵
- Executes dropped EXE
PID:1112 -
\??\c:\frrxxxr.exec:\frrxxxr.exe31⤵
- Executes dropped EXE
PID:3320 -
\??\c:\3bnnnn.exec:\3bnnnn.exe32⤵
- Executes dropped EXE
PID:1672 -
\??\c:\ppjpj.exec:\ppjpj.exe33⤵
- Executes dropped EXE
PID:1984 -
\??\c:\flllflr.exec:\flllflr.exe34⤵
- Executes dropped EXE
PID:3328 -
\??\c:\tbbbnt.exec:\tbbbnt.exe35⤵
- Executes dropped EXE
PID:1008 -
\??\c:\bhhhbt.exec:\bhhhbt.exe36⤵
- Executes dropped EXE
PID:2704 -
\??\c:\jdvpp.exec:\jdvpp.exe37⤵
- Executes dropped EXE
PID:3496 -
\??\c:\9pvpj.exec:\9pvpj.exe38⤵
- Executes dropped EXE
PID:3004 -
\??\c:\frrrrxx.exec:\frrrrxx.exe39⤵
- Executes dropped EXE
PID:3536 -
\??\c:\llrfxxx.exec:\llrfxxx.exe40⤵
- Executes dropped EXE
PID:1220 -
\??\c:\thbnbb.exec:\thbnbb.exe41⤵
- Executes dropped EXE
PID:1084 -
\??\c:\nhhbtn.exec:\nhhbtn.exe42⤵
- Executes dropped EXE
PID:2056 -
\??\c:\vpvpj.exec:\vpvpj.exe43⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xxllfff.exec:\xxllfff.exe44⤵
- Executes dropped EXE
PID:2988 -
\??\c:\nnntnn.exec:\nnntnn.exe45⤵
- Executes dropped EXE
PID:2856 -
\??\c:\nhhbtt.exec:\nhhbtt.exe46⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jdpjd.exec:\jdpjd.exe47⤵
- Executes dropped EXE
PID:2476 -
\??\c:\dvpjj.exec:\dvpjj.exe48⤵
- Executes dropped EXE
PID:2200 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe49⤵
- Executes dropped EXE
PID:1460 -
\??\c:\5xxlxll.exec:\5xxlxll.exe50⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hhhhhh.exec:\hhhhhh.exe51⤵
- Executes dropped EXE
PID:4772 -
\??\c:\btttnn.exec:\btttnn.exe52⤵
- Executes dropped EXE
PID:1892 -
\??\c:\5pvvv.exec:\5pvvv.exe53⤵
- Executes dropped EXE
PID:4700 -
\??\c:\pjdjv.exec:\pjdjv.exe54⤵
- Executes dropped EXE
PID:4652 -
\??\c:\xllrlll.exec:\xllrlll.exe55⤵
- Executes dropped EXE
PID:3236 -
\??\c:\htttnn.exec:\htttnn.exe56⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hnbbhh.exec:\hnbbhh.exe57⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xrlfxfx.exec:\xrlfxfx.exe58⤵
- Executes dropped EXE
PID:2248 -
\??\c:\lfllxrf.exec:\lfllxrf.exe59⤵
- Executes dropped EXE
PID:208 -
\??\c:\9bhhbb.exec:\9bhhbb.exe60⤵
- Executes dropped EXE
PID:4428 -
\??\c:\ddvvj.exec:\ddvvj.exe61⤵
- Executes dropped EXE
PID:948 -
\??\c:\7vvvd.exec:\7vvvd.exe62⤵
- Executes dropped EXE
PID:3552 -
\??\c:\flfflll.exec:\flfflll.exe63⤵
- Executes dropped EXE
PID:428 -
\??\c:\fxrrxxr.exec:\fxrrxxr.exe64⤵
- Executes dropped EXE
PID:1444 -
\??\c:\ttbhtb.exec:\ttbhtb.exe65⤵
- Executes dropped EXE
PID:3668 -
\??\c:\nthnbb.exec:\nthnbb.exe66⤵PID:4368
-
\??\c:\vjdvp.exec:\vjdvp.exe67⤵PID:1532
-
\??\c:\jvvdd.exec:\jvvdd.exe68⤵PID:3948
-
\??\c:\lfrfrlr.exec:\lfrfrlr.exe69⤵PID:2632
-
\??\c:\7llrllf.exec:\7llrllf.exe70⤵PID:2168
-
\??\c:\bbbbbb.exec:\bbbbbb.exe71⤵PID:3884
-
\??\c:\thtbth.exec:\thtbth.exe72⤵PID:4132
-
\??\c:\djvpj.exec:\djvpj.exe73⤵PID:2460
-
\??\c:\dpvdd.exec:\dpvdd.exe74⤵PID:4992
-
\??\c:\xfxfrfr.exec:\xfxfrfr.exe75⤵PID:2920
-
\??\c:\lxlfrrl.exec:\lxlfrrl.exe76⤵PID:1296
-
\??\c:\nttbbh.exec:\nttbbh.exe77⤵PID:1304
-
\??\c:\jddvj.exec:\jddvj.exe78⤵PID:1404
-
\??\c:\ppvdj.exec:\ppvdj.exe79⤵PID:3460
-
\??\c:\ppdvj.exec:\ppdvj.exe80⤵PID:2608
-
\??\c:\rlrlrrr.exec:\rlrlrrr.exe81⤵PID:4288
-
\??\c:\rlxrllf.exec:\rlxrllf.exe82⤵PID:4976
-
\??\c:\nhhntt.exec:\nhhntt.exe83⤵PID:1008
-
\??\c:\pvvvd.exec:\pvvvd.exe84⤵PID:2704
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe85⤵PID:3496
-
\??\c:\lxrrrll.exec:\lxrrrll.exe86⤵PID:400
-
\??\c:\hhbbtt.exec:\hhbbtt.exe87⤵PID:3196
-
\??\c:\pjpjj.exec:\pjpjj.exe88⤵PID:4512
-
\??\c:\7vjpj.exec:\7vjpj.exe89⤵PID:1364
-
\??\c:\fflrlxr.exec:\fflrlxr.exe90⤵PID:1888
-
\??\c:\xfflxlr.exec:\xfflxlr.exe91⤵PID:4208
-
\??\c:\tbbnhh.exec:\tbbnhh.exe92⤵PID:3024
-
\??\c:\1hnnhh.exec:\1hnnhh.exe93⤵PID:2396
-
\??\c:\vvdvv.exec:\vvdvv.exe94⤵PID:4672
-
\??\c:\pdvjp.exec:\pdvjp.exe95⤵PID:4468
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe96⤵PID:2404
-
\??\c:\nbnntt.exec:\nbnntt.exe97⤵PID:1300
-
\??\c:\5nhnnn.exec:\5nhnnn.exe98⤵PID:4476
-
\??\c:\dpdvv.exec:\dpdvv.exe99⤵PID:2336
-
\??\c:\rrllxll.exec:\rrllxll.exe100⤵PID:1276
-
\??\c:\rxfxxfx.exec:\rxfxxfx.exe101⤵PID:1548
-
\??\c:\7tbbtb.exec:\7tbbtb.exe102⤵PID:1460
-
\??\c:\nbttbn.exec:\nbttbn.exe103⤵PID:2660
-
\??\c:\jpjjv.exec:\jpjjv.exe104⤵PID:4952
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe105⤵PID:2036
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe106⤵PID:388
-
\??\c:\tbbbtb.exec:\tbbbtb.exe107⤵PID:432
-
\??\c:\pvvvj.exec:\pvvvj.exe108⤵
- System Location Discovery: System Language Discovery
PID:4240 -
\??\c:\pjpjj.exec:\pjpjj.exe109⤵PID:4956
-
\??\c:\9fflffx.exec:\9fflffx.exe110⤵PID:4424
-
\??\c:\tnthbn.exec:\tnthbn.exe111⤵PID:3476
-
\??\c:\pjpjd.exec:\pjpjd.exe112⤵PID:4696
-
\??\c:\7pvdp.exec:\7pvdp.exe113⤵PID:372
-
\??\c:\ttttbb.exec:\ttttbb.exe114⤵PID:2084
-
\??\c:\tbbttt.exec:\tbbttt.exe115⤵PID:2528
-
\??\c:\jjjdv.exec:\jjjdv.exe116⤵PID:532
-
\??\c:\xffllxx.exec:\xffllxx.exe117⤵PID:3988
-
\??\c:\bttnhn.exec:\bttnhn.exe118⤵PID:3600
-
\??\c:\1bhbbb.exec:\1bhbbb.exe119⤵PID:1532
-
\??\c:\pjjpj.exec:\pjjpj.exe120⤵PID:396
-
\??\c:\5lffxxx.exec:\5lffxxx.exe121⤵PID:4244
-
\??\c:\nnttnt.exec:\nnttnt.exe122⤵PID:3972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-