Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 15:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
98823d081f9d8f5b7ec5dbd17a9e0ad0N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
98823d081f9d8f5b7ec5dbd17a9e0ad0N.exe
-
Size
230KB
-
MD5
98823d081f9d8f5b7ec5dbd17a9e0ad0
-
SHA1
9da4a69ecc34731a23cc1f8c0391535c609f7bb8
-
SHA256
5bb121b3a6d6dc16354110ad8849eec1e632567eef4b3b8f55d54d6eecd81fde
-
SHA512
8fc578d1ec11c309b42fdbe50560328009579cfa78776fd07424f23c521049627e78b55a98cff6b55ab3bb1c4941f23f529b887c6d22eee4a4a203934ccf3d61
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLjBeG+d:n3C9BRo7MlrWKo+lxKu
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3232-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/924-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2860-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2856 dpdvv.exe 4804 pjvdd.exe 2164 5lfxffl.exe 980 thbthh.exe 2480 vjpvp.exe 2756 vvppj.exe 3284 lrrllll.exe 712 hbhhbb.exe 3920 vvppj.exe 1260 1fllflf.exe 4612 hbhbtt.exe 924 9vddd.exe 5032 ffrlllf.exe 1040 nhnnhh.exe 2936 xxxrlll.exe 3100 bhttnn.exe 2256 bhbbtt.exe 1104 xrrxlll.exe 3868 hbnnhh.exe 4960 jddvp.exe 3816 rllxfrx.exe 2860 xlxrllf.exe 4716 nbnthb.exe 2352 7vdjj.exe 4544 frrlxfr.exe 4120 ntbnht.exe 4560 1ntnhh.exe 2948 5jdvv.exe 2636 9rrllfl.exe 1480 ntnhbt.exe 3360 ppppp.exe 1308 lxxrxxr.exe 1304 1jpjj.exe 5104 lffxxxx.exe 3736 xlrrxxf.exe 4568 hhttbh.exe 1580 bbbthh.exe 5116 vjvdp.exe 3480 lrxrxxf.exe 3356 xxrlllf.exe 3676 ntbtnn.exe 4240 7vdvp.exe 3476 vjjdv.exe 4864 fxlfxfx.exe 3820 nhhbbt.exe 1808 tbnbtt.exe 2000 dvjdv.exe 2756 pvdpj.exe 5012 xfllffl.exe 2888 5tbttt.exe 4288 3pdvj.exe 3212 dddvv.exe 2464 lllffff.exe 3420 9htntt.exe 2140 nnbtnn.exe 4456 pvvdp.exe 4796 flxlffx.exe 1040 fxfxxrr.exe 392 5hnhhh.exe 608 dvvpp.exe 4208 vjjjd.exe 2864 lxrlxxr.exe 4400 xlffxxr.exe 224 5nnnhh.exe -
resource yara_rule behavioral2/memory/3232-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/924-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3232 wrote to memory of 2856 3232 98823d081f9d8f5b7ec5dbd17a9e0ad0N.exe 85 PID 3232 wrote to memory of 2856 3232 98823d081f9d8f5b7ec5dbd17a9e0ad0N.exe 85 PID 3232 wrote to memory of 2856 3232 98823d081f9d8f5b7ec5dbd17a9e0ad0N.exe 85 PID 2856 wrote to memory of 4804 2856 dpdvv.exe 86 PID 2856 wrote to memory of 4804 2856 dpdvv.exe 86 PID 2856 wrote to memory of 4804 2856 dpdvv.exe 86 PID 4804 wrote to memory of 2164 4804 pjvdd.exe 87 PID 4804 wrote to memory of 2164 4804 pjvdd.exe 87 PID 4804 wrote to memory of 2164 4804 pjvdd.exe 87 PID 2164 wrote to memory of 980 2164 5lfxffl.exe 88 PID 2164 wrote to memory of 980 2164 5lfxffl.exe 88 PID 2164 wrote to memory of 980 2164 5lfxffl.exe 88 PID 980 wrote to memory of 2480 980 thbthh.exe 89 PID 980 wrote to memory of 2480 980 thbthh.exe 89 PID 980 wrote to memory of 2480 980 thbthh.exe 89 PID 2480 wrote to memory of 2756 2480 vjpvp.exe 90 PID 2480 wrote to memory of 2756 2480 vjpvp.exe 90 PID 2480 wrote to memory of 2756 2480 vjpvp.exe 90 PID 2756 wrote to memory of 3284 2756 vvppj.exe 91 PID 2756 wrote to memory of 3284 2756 vvppj.exe 91 PID 2756 wrote to memory of 3284 2756 vvppj.exe 91 PID 3284 wrote to memory of 712 3284 lrrllll.exe 92 PID 3284 wrote to memory of 712 3284 lrrllll.exe 92 PID 3284 wrote to memory of 712 3284 lrrllll.exe 92 PID 712 wrote to memory of 3920 712 hbhhbb.exe 93 PID 712 wrote to memory of 3920 712 hbhhbb.exe 93 PID 712 wrote to memory of 3920 712 hbhhbb.exe 93 PID 3920 wrote to memory of 1260 3920 vvppj.exe 94 PID 3920 wrote to memory of 1260 3920 vvppj.exe 94 PID 3920 wrote to memory of 1260 3920 vvppj.exe 94 PID 1260 wrote to memory of 4612 1260 1fllflf.exe 95 PID 1260 wrote to memory of 4612 1260 1fllflf.exe 95 PID 1260 wrote to memory of 4612 1260 1fllflf.exe 95 PID 4612 wrote to memory of 924 4612 hbhbtt.exe 96 PID 4612 wrote to memory of 924 4612 hbhbtt.exe 96 PID 4612 wrote to memory of 924 4612 hbhbtt.exe 96 PID 924 wrote to memory of 5032 924 9vddd.exe 98 PID 924 wrote to memory of 5032 924 9vddd.exe 98 PID 924 wrote to memory of 5032 924 9vddd.exe 98 PID 5032 wrote to memory of 1040 5032 ffrlllf.exe 99 PID 5032 wrote to memory of 1040 5032 ffrlllf.exe 99 PID 5032 wrote to memory of 1040 5032 ffrlllf.exe 99 PID 1040 wrote to memory of 2936 1040 nhnnhh.exe 100 PID 1040 wrote to memory of 2936 1040 nhnnhh.exe 100 PID 1040 wrote to memory of 2936 1040 nhnnhh.exe 100 PID 2936 wrote to memory of 3100 2936 xxxrlll.exe 102 PID 2936 wrote to memory of 3100 2936 xxxrlll.exe 102 PID 2936 wrote to memory of 3100 2936 xxxrlll.exe 102 PID 3100 wrote to memory of 2256 3100 bhttnn.exe 103 PID 3100 wrote to memory of 2256 3100 bhttnn.exe 103 PID 3100 wrote to memory of 2256 3100 bhttnn.exe 103 PID 2256 wrote to memory of 1104 2256 bhbbtt.exe 104 PID 2256 wrote to memory of 1104 2256 bhbbtt.exe 104 PID 2256 wrote to memory of 1104 2256 bhbbtt.exe 104 PID 1104 wrote to memory of 3868 1104 xrrxlll.exe 105 PID 1104 wrote to memory of 3868 1104 xrrxlll.exe 105 PID 1104 wrote to memory of 3868 1104 xrrxlll.exe 105 PID 3868 wrote to memory of 4960 3868 hbnnhh.exe 106 PID 3868 wrote to memory of 4960 3868 hbnnhh.exe 106 PID 3868 wrote to memory of 4960 3868 hbnnhh.exe 106 PID 4960 wrote to memory of 3816 4960 jddvp.exe 108 PID 4960 wrote to memory of 3816 4960 jddvp.exe 108 PID 4960 wrote to memory of 3816 4960 jddvp.exe 108 PID 3816 wrote to memory of 2860 3816 rllxfrx.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\98823d081f9d8f5b7ec5dbd17a9e0ad0N.exe"C:\Users\Admin\AppData\Local\Temp\98823d081f9d8f5b7ec5dbd17a9e0ad0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\dpdvv.exec:\dpdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\pjvdd.exec:\pjvdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\5lfxffl.exec:\5lfxffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\thbthh.exec:\thbthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\vjpvp.exec:\vjpvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\vvppj.exec:\vvppj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\lrrllll.exec:\lrrllll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\hbhhbb.exec:\hbhhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
\??\c:\vvppj.exec:\vvppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\1fllflf.exec:\1fllflf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\hbhbtt.exec:\hbhbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\9vddd.exec:\9vddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\ffrlllf.exec:\ffrlllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\nhnnhh.exec:\nhnnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\xxxrlll.exec:\xxxrlll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\bhttnn.exec:\bhttnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\bhbbtt.exec:\bhbbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\xrrxlll.exec:\xrrxlll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\hbnnhh.exec:\hbnnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\jddvp.exec:\jddvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\rllxfrx.exec:\rllxfrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\xlxrllf.exec:\xlxrllf.exe23⤵
- Executes dropped EXE
PID:2860 -
\??\c:\nbnthb.exec:\nbnthb.exe24⤵
- Executes dropped EXE
PID:4716 -
\??\c:\7vdjj.exec:\7vdjj.exe25⤵
- Executes dropped EXE
PID:2352 -
\??\c:\frrlxfr.exec:\frrlxfr.exe26⤵
- Executes dropped EXE
PID:4544 -
\??\c:\ntbnht.exec:\ntbnht.exe27⤵
- Executes dropped EXE
PID:4120 -
\??\c:\1ntnhh.exec:\1ntnhh.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4560 -
\??\c:\5jdvv.exec:\5jdvv.exe29⤵
- Executes dropped EXE
PID:2948 -
\??\c:\9rrllfl.exec:\9rrllfl.exe30⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ntnhbt.exec:\ntnhbt.exe31⤵
- Executes dropped EXE
PID:1480 -
\??\c:\ppppp.exec:\ppppp.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3360 -
\??\c:\lxxrxxr.exec:\lxxrxxr.exe33⤵
- Executes dropped EXE
PID:1308 -
\??\c:\1jpjj.exec:\1jpjj.exe34⤵
- Executes dropped EXE
PID:1304 -
\??\c:\lffxxxx.exec:\lffxxxx.exe35⤵
- Executes dropped EXE
PID:5104 -
\??\c:\xlrrxxf.exec:\xlrrxxf.exe36⤵
- Executes dropped EXE
PID:3736 -
\??\c:\hhttbh.exec:\hhttbh.exe37⤵
- Executes dropped EXE
PID:4568 -
\??\c:\bbbthh.exec:\bbbthh.exe38⤵
- Executes dropped EXE
PID:1580 -
\??\c:\vjvdp.exec:\vjvdp.exe39⤵
- Executes dropped EXE
PID:5116 -
\??\c:\lrxrxxf.exec:\lrxrxxf.exe40⤵
- Executes dropped EXE
PID:3480 -
\??\c:\xxrlllf.exec:\xxrlllf.exe41⤵
- Executes dropped EXE
PID:3356 -
\??\c:\ntbtnn.exec:\ntbtnn.exe42⤵
- Executes dropped EXE
PID:3676 -
\??\c:\7vdvp.exec:\7vdvp.exe43⤵
- Executes dropped EXE
PID:4240 -
\??\c:\vjjdv.exec:\vjjdv.exe44⤵
- Executes dropped EXE
PID:3476 -
\??\c:\fxlfxfx.exec:\fxlfxfx.exe45⤵
- Executes dropped EXE
PID:4864 -
\??\c:\nhhbbt.exec:\nhhbbt.exe46⤵
- Executes dropped EXE
PID:3820 -
\??\c:\tbnbtt.exec:\tbnbtt.exe47⤵
- Executes dropped EXE
PID:1808 -
\??\c:\dvjdv.exec:\dvjdv.exe48⤵
- Executes dropped EXE
PID:2000 -
\??\c:\pvdpj.exec:\pvdpj.exe49⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xfllffl.exec:\xfllffl.exe50⤵
- Executes dropped EXE
PID:5012 -
\??\c:\5tbttt.exec:\5tbttt.exe51⤵
- Executes dropped EXE
PID:2888 -
\??\c:\3pdvj.exec:\3pdvj.exe52⤵
- Executes dropped EXE
PID:4288 -
\??\c:\dddvv.exec:\dddvv.exe53⤵
- Executes dropped EXE
PID:3212 -
\??\c:\lllffff.exec:\lllffff.exe54⤵
- Executes dropped EXE
PID:2464 -
\??\c:\9htntt.exec:\9htntt.exe55⤵
- Executes dropped EXE
PID:3420 -
\??\c:\nnbtnn.exec:\nnbtnn.exe56⤵
- Executes dropped EXE
PID:2140 -
\??\c:\pvvdp.exec:\pvvdp.exe57⤵
- Executes dropped EXE
PID:4456 -
\??\c:\flxlffx.exec:\flxlffx.exe58⤵
- Executes dropped EXE
PID:4796 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe59⤵
- Executes dropped EXE
PID:1040 -
\??\c:\5hnhhh.exec:\5hnhhh.exe60⤵
- Executes dropped EXE
PID:392 -
\??\c:\dvvpp.exec:\dvvpp.exe61⤵
- Executes dropped EXE
PID:608 -
\??\c:\vjjjd.exec:\vjjjd.exe62⤵
- Executes dropped EXE
PID:4208 -
\??\c:\lxrlxxr.exec:\lxrlxxr.exe63⤵
- Executes dropped EXE
PID:2864 -
\??\c:\xlffxxr.exec:\xlffxxr.exe64⤵
- Executes dropped EXE
PID:4400 -
\??\c:\5nnnhh.exec:\5nnnhh.exe65⤵
- Executes dropped EXE
PID:224 -
\??\c:\9djdp.exec:\9djdp.exe66⤵PID:1876
-
\??\c:\vvjdd.exec:\vvjdd.exe67⤵PID:3868
-
\??\c:\fxxlxrr.exec:\fxxlxrr.exe68⤵PID:4500
-
\??\c:\nbbtnn.exec:\nbbtnn.exe69⤵PID:2928
-
\??\c:\vjdvj.exec:\vjdvj.exe70⤵PID:3396
-
\??\c:\jdddv.exec:\jdddv.exe71⤵PID:3964
-
\??\c:\rxllfff.exec:\rxllfff.exe72⤵PID:4244
-
\??\c:\nnbtbb.exec:\nnbtbb.exe73⤵PID:1272
-
\??\c:\tnttnt.exec:\tnttnt.exe74⤵PID:1780
-
\??\c:\vvvpv.exec:\vvvpv.exe75⤵PID:4544
-
\??\c:\rlrrllf.exec:\rlrrllf.exe76⤵PID:3908
-
\??\c:\fflrrrr.exec:\fflrrrr.exe77⤵PID:4184
-
\??\c:\bthbhh.exec:\bthbhh.exe78⤵PID:1984
-
\??\c:\thhbtt.exec:\thhbtt.exe79⤵PID:1676
-
\??\c:\vpdvp.exec:\vpdvp.exe80⤵PID:4040
-
\??\c:\xlrlffx.exec:\xlrlffx.exe81⤵PID:3352
-
\??\c:\ffllfrr.exec:\ffllfrr.exe82⤵PID:2180
-
\??\c:\3hhhbh.exec:\3hhhbh.exe83⤵PID:4464
-
\??\c:\dpvjd.exec:\dpvjd.exe84⤵PID:4296
-
\??\c:\rrxrflf.exec:\rrxrflf.exe85⤵PID:2136
-
\??\c:\fffxllx.exec:\fffxllx.exe86⤵PID:1208
-
\??\c:\hthbbb.exec:\hthbbb.exe87⤵PID:2644
-
\??\c:\7pppp.exec:\7pppp.exe88⤵PID:4568
-
\??\c:\1llfffx.exec:\1llfffx.exe89⤵PID:4488
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe90⤵PID:1852
-
\??\c:\7nthnn.exec:\7nthnn.exe91⤵PID:2228
-
\??\c:\nnbnhh.exec:\nnbnhh.exe92⤵PID:2856
-
\??\c:\9vvpp.exec:\9vvpp.exe93⤵PID:4380
-
\??\c:\rlrlrrr.exec:\rlrlrrr.exe94⤵PID:4268
-
\??\c:\fxllxff.exec:\fxllxff.exe95⤵PID:4864
-
\??\c:\bthbhb.exec:\bthbhb.exe96⤵PID:3544
-
\??\c:\3dddd.exec:\3dddd.exe97⤵PID:1808
-
\??\c:\7vvpj.exec:\7vvpj.exe98⤵PID:3296
-
\??\c:\lfxrfff.exec:\lfxrfff.exe99⤵PID:2756
-
\??\c:\ffxrxxf.exec:\ffxrxxf.exe100⤵PID:5012
-
\??\c:\nhtnbb.exec:\nhtnbb.exe101⤵PID:4700
-
\??\c:\vpjdp.exec:\vpjdp.exe102⤵PID:4108
-
\??\c:\ppvvd.exec:\ppvvd.exe103⤵PID:3212
-
\??\c:\7xxrfff.exec:\7xxrfff.exe104⤵PID:2464
-
\??\c:\1lrlfff.exec:\1lrlfff.exe105⤵PID:3420
-
\??\c:\bhnnnn.exec:\bhnnnn.exe106⤵PID:3596
-
\??\c:\bbnhtn.exec:\bbnhtn.exe107⤵PID:4456
-
\??\c:\1jvpp.exec:\1jvpp.exe108⤵PID:4796
-
\??\c:\pjvpv.exec:\pjvpv.exe109⤵PID:1040
-
\??\c:\fflxllf.exec:\fflxllf.exe110⤵PID:2060
-
\??\c:\3hnbnn.exec:\3hnbnn.exe111⤵PID:608
-
\??\c:\ntttnn.exec:\ntttnn.exe112⤵PID:3552
-
\??\c:\ppvvp.exec:\ppvvp.exe113⤵PID:2468
-
\??\c:\rlrlffl.exec:\rlrlffl.exe114⤵PID:4948
-
\??\c:\5ddpj.exec:\5ddpj.exe115⤵PID:4144
-
\??\c:\lrxxrxx.exec:\lrxxrxx.exe116⤵PID:1116
-
\??\c:\rlllfff.exec:\rlllfff.exe117⤵PID:3868
-
\??\c:\bnhthb.exec:\bnhthb.exe118⤵PID:4500
-
\??\c:\djpvp.exec:\djpvp.exe119⤵PID:4856
-
\??\c:\xrffxxr.exec:\xrffxxr.exe120⤵PID:2128
-
\??\c:\xrllrrx.exec:\xrllrrx.exe121⤵PID:3892
-
\??\c:\hbnntt.exec:\hbnntt.exe122⤵PID:3728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-