Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 22:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b905c244355bd79f7a65b9dcc7fbb00N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
2b905c244355bd79f7a65b9dcc7fbb00N.exe
-
Size
71KB
-
MD5
2b905c244355bd79f7a65b9dcc7fbb00
-
SHA1
feaaa6077fe0774320833d7092bf91ccab293815
-
SHA256
12ace5f535a91baa4616d297c4accdea3c415e04198a64afd225c692ca2db0db
-
SHA512
0a6bec48597fcb0c9a3de6b69eaeb680ea45cd7da2462a9a5b58ba767611aff6ceff59f4ad4e52391a6a64b53c5388fad77925007f2848968932de9f3c4eaa99
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfj4W:ymb3NkkiQ3mdBjFI4VIW
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4720-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2916-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1308-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/672-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4696 ntthbb.exe 4744 3pjdv.exe 4940 vvvvp.exe 2916 lflfffx.exe 1468 bnbbbb.exe 4532 dpjdv.exe 4120 xrlfxfx.exe 1308 pjppd.exe 4916 llflfxr.exe 2136 nhhbhh.exe 3668 vvvjd.exe 828 1lxxllf.exe 4136 rlxxrll.exe 1756 tnnnhn.exe 4252 djdpd.exe 4452 fxrrlll.exe 2904 1rrrlff.exe 2012 7bnhhh.exe 876 pjppj.exe 4232 rxxxrxx.exe 4360 thtnhh.exe 2596 tthhhh.exe 4444 vpjdv.exe 1292 dddvj.exe 1164 lllxrxx.exe 3080 bttnnh.exe 3672 thhhhb.exe 2200 pjvpv.exe 672 flrrllf.exe 3612 rlrlxxf.exe 4448 nhttnb.exe 4352 ppvpv.exe 4620 ddjdv.exe 3508 3rfxrlf.exe 3948 bhhhhh.exe 4744 tbhhhh.exe 2376 htnhnn.exe 1656 pjvpd.exe 4940 vpppp.exe 1416 llxxrrl.exe 3952 rrxxxff.exe 4008 btbtnt.exe 1672 nhhbtt.exe 1872 pvddp.exe 544 jpjdp.exe 3528 rflfffl.exe 920 xrffllf.exe 4296 fxrrllf.exe 1308 hbthbb.exe 864 ttttnh.exe 4288 dpvpv.exe 2600 jdpjj.exe 3668 flxrxxf.exe 4576 xrrxrrr.exe 3748 5nhnnh.exe 2204 tnnhbb.exe 4148 jpvjv.exe 2016 djpjp.exe 1700 rrrxxff.exe 1880 rrlrrxr.exe 520 bthhnn.exe 2176 bhbnhh.exe 3944 3dvvp.exe 1496 jdjdj.exe -
resource yara_rule behavioral2/memory/4720-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2916-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1308-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/672-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4720 wrote to memory of 4696 4720 2b905c244355bd79f7a65b9dcc7fbb00N.exe 83 PID 4720 wrote to memory of 4696 4720 2b905c244355bd79f7a65b9dcc7fbb00N.exe 83 PID 4720 wrote to memory of 4696 4720 2b905c244355bd79f7a65b9dcc7fbb00N.exe 83 PID 4696 wrote to memory of 4744 4696 ntthbb.exe 84 PID 4696 wrote to memory of 4744 4696 ntthbb.exe 84 PID 4696 wrote to memory of 4744 4696 ntthbb.exe 84 PID 4744 wrote to memory of 4940 4744 3pjdv.exe 85 PID 4744 wrote to memory of 4940 4744 3pjdv.exe 85 PID 4744 wrote to memory of 4940 4744 3pjdv.exe 85 PID 4940 wrote to memory of 2916 4940 vvvvp.exe 86 PID 4940 wrote to memory of 2916 4940 vvvvp.exe 86 PID 4940 wrote to memory of 2916 4940 vvvvp.exe 86 PID 2916 wrote to memory of 1468 2916 lflfffx.exe 87 PID 2916 wrote to memory of 1468 2916 lflfffx.exe 87 PID 2916 wrote to memory of 1468 2916 lflfffx.exe 87 PID 1468 wrote to memory of 4532 1468 bnbbbb.exe 88 PID 1468 wrote to memory of 4532 1468 bnbbbb.exe 88 PID 1468 wrote to memory of 4532 1468 bnbbbb.exe 88 PID 4532 wrote to memory of 4120 4532 dpjdv.exe 89 PID 4532 wrote to memory of 4120 4532 dpjdv.exe 89 PID 4532 wrote to memory of 4120 4532 dpjdv.exe 89 PID 4120 wrote to memory of 1308 4120 xrlfxfx.exe 91 PID 4120 wrote to memory of 1308 4120 xrlfxfx.exe 91 PID 4120 wrote to memory of 1308 4120 xrlfxfx.exe 91 PID 1308 wrote to memory of 4916 1308 pjppd.exe 93 PID 1308 wrote to memory of 4916 1308 pjppd.exe 93 PID 1308 wrote to memory of 4916 1308 pjppd.exe 93 PID 4916 wrote to memory of 2136 4916 llflfxr.exe 94 PID 4916 wrote to memory of 2136 4916 llflfxr.exe 94 PID 4916 wrote to memory of 2136 4916 llflfxr.exe 94 PID 2136 wrote to memory of 3668 2136 nhhbhh.exe 95 PID 2136 wrote to memory of 3668 2136 nhhbhh.exe 95 PID 2136 wrote to memory of 3668 2136 nhhbhh.exe 95 PID 3668 wrote to memory of 828 3668 vvvjd.exe 96 PID 3668 wrote to memory of 828 3668 vvvjd.exe 96 PID 3668 wrote to memory of 828 3668 vvvjd.exe 96 PID 828 wrote to memory of 4136 828 1lxxllf.exe 97 PID 828 wrote to memory of 4136 828 1lxxllf.exe 97 PID 828 wrote to memory of 4136 828 1lxxllf.exe 97 PID 4136 wrote to memory of 1756 4136 rlxxrll.exe 98 PID 4136 wrote to memory of 1756 4136 rlxxrll.exe 98 PID 4136 wrote to memory of 1756 4136 rlxxrll.exe 98 PID 1756 wrote to memory of 4252 1756 tnnnhn.exe 99 PID 1756 wrote to memory of 4252 1756 tnnnhn.exe 99 PID 1756 wrote to memory of 4252 1756 tnnnhn.exe 99 PID 4252 wrote to memory of 4452 4252 djdpd.exe 100 PID 4252 wrote to memory of 4452 4252 djdpd.exe 100 PID 4252 wrote to memory of 4452 4252 djdpd.exe 100 PID 4452 wrote to memory of 2904 4452 fxrrlll.exe 101 PID 4452 wrote to memory of 2904 4452 fxrrlll.exe 101 PID 4452 wrote to memory of 2904 4452 fxrrlll.exe 101 PID 2904 wrote to memory of 2012 2904 1rrrlff.exe 102 PID 2904 wrote to memory of 2012 2904 1rrrlff.exe 102 PID 2904 wrote to memory of 2012 2904 1rrrlff.exe 102 PID 2012 wrote to memory of 876 2012 7bnhhh.exe 103 PID 2012 wrote to memory of 876 2012 7bnhhh.exe 103 PID 2012 wrote to memory of 876 2012 7bnhhh.exe 103 PID 876 wrote to memory of 4232 876 pjppj.exe 104 PID 876 wrote to memory of 4232 876 pjppj.exe 104 PID 876 wrote to memory of 4232 876 pjppj.exe 104 PID 4232 wrote to memory of 4360 4232 rxxxrxx.exe 105 PID 4232 wrote to memory of 4360 4232 rxxxrxx.exe 105 PID 4232 wrote to memory of 4360 4232 rxxxrxx.exe 105 PID 4360 wrote to memory of 2596 4360 thtnhh.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b905c244355bd79f7a65b9dcc7fbb00N.exe"C:\Users\Admin\AppData\Local\Temp\2b905c244355bd79f7a65b9dcc7fbb00N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\ntthbb.exec:\ntthbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\3pjdv.exec:\3pjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\vvvvp.exec:\vvvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\lflfffx.exec:\lflfffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\bnbbbb.exec:\bnbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\dpjdv.exec:\dpjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\xrlfxfx.exec:\xrlfxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\pjppd.exec:\pjppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\llflfxr.exec:\llflfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\nhhbhh.exec:\nhhbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\vvvjd.exec:\vvvjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\1lxxllf.exec:\1lxxllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\rlxxrll.exec:\rlxxrll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\tnnnhn.exec:\tnnnhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\djdpd.exec:\djdpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\fxrrlll.exec:\fxrrlll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\1rrrlff.exec:\1rrrlff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\7bnhhh.exec:\7bnhhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\pjppj.exec:\pjppj.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\rxxxrxx.exec:\rxxxrxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\thtnhh.exec:\thtnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\tthhhh.exec:\tthhhh.exe23⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vpjdv.exec:\vpjdv.exe24⤵
- Executes dropped EXE
PID:4444 -
\??\c:\dddvj.exec:\dddvj.exe25⤵
- Executes dropped EXE
PID:1292 -
\??\c:\lllxrxx.exec:\lllxrxx.exe26⤵
- Executes dropped EXE
PID:1164 -
\??\c:\bttnnh.exec:\bttnnh.exe27⤵
- Executes dropped EXE
PID:3080 -
\??\c:\thhhhb.exec:\thhhhb.exe28⤵
- Executes dropped EXE
PID:3672 -
\??\c:\pjvpv.exec:\pjvpv.exe29⤵
- Executes dropped EXE
PID:2200 -
\??\c:\flrrllf.exec:\flrrllf.exe30⤵
- Executes dropped EXE
PID:672 -
\??\c:\rlrlxxf.exec:\rlrlxxf.exe31⤵
- Executes dropped EXE
PID:3612 -
\??\c:\nhttnb.exec:\nhttnb.exe32⤵
- Executes dropped EXE
PID:4448 -
\??\c:\ppvpv.exec:\ppvpv.exe33⤵
- Executes dropped EXE
PID:4352 -
\??\c:\ddjdv.exec:\ddjdv.exe34⤵
- Executes dropped EXE
PID:4620 -
\??\c:\3rfxrlf.exec:\3rfxrlf.exe35⤵
- Executes dropped EXE
PID:3508 -
\??\c:\bhhhhh.exec:\bhhhhh.exe36⤵
- Executes dropped EXE
PID:3948 -
\??\c:\tbhhhh.exec:\tbhhhh.exe37⤵
- Executes dropped EXE
PID:4744 -
\??\c:\htnhnn.exec:\htnhnn.exe38⤵
- Executes dropped EXE
PID:2376 -
\??\c:\pjvpd.exec:\pjvpd.exe39⤵
- Executes dropped EXE
PID:1656 -
\??\c:\vpppp.exec:\vpppp.exe40⤵
- Executes dropped EXE
PID:4940 -
\??\c:\llxxrrl.exec:\llxxrrl.exe41⤵
- Executes dropped EXE
PID:1416 -
\??\c:\rrxxxff.exec:\rrxxxff.exe42⤵
- Executes dropped EXE
PID:3952 -
\??\c:\btbtnt.exec:\btbtnt.exe43⤵
- Executes dropped EXE
PID:4008 -
\??\c:\nhhbtt.exec:\nhhbtt.exe44⤵
- Executes dropped EXE
PID:1672 -
\??\c:\pvddp.exec:\pvddp.exe45⤵
- Executes dropped EXE
PID:1872 -
\??\c:\jpjdp.exec:\jpjdp.exe46⤵
- Executes dropped EXE
PID:544 -
\??\c:\rflfffl.exec:\rflfffl.exe47⤵
- Executes dropped EXE
PID:3528 -
\??\c:\xrffllf.exec:\xrffllf.exe48⤵
- Executes dropped EXE
PID:920 -
\??\c:\fxrrllf.exec:\fxrrllf.exe49⤵
- Executes dropped EXE
PID:4296 -
\??\c:\hbthbb.exec:\hbthbb.exe50⤵
- Executes dropped EXE
PID:1308 -
\??\c:\ttttnh.exec:\ttttnh.exe51⤵
- Executes dropped EXE
PID:864 -
\??\c:\dpvpv.exec:\dpvpv.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4288 -
\??\c:\jdpjj.exec:\jdpjj.exe53⤵
- Executes dropped EXE
PID:2600 -
\??\c:\flxrxxf.exec:\flxrxxf.exe54⤵
- Executes dropped EXE
PID:3668 -
\??\c:\xrrxrrr.exec:\xrrxrrr.exe55⤵
- Executes dropped EXE
PID:4576 -
\??\c:\5nhnnh.exec:\5nhnnh.exe56⤵
- Executes dropped EXE
PID:3748 -
\??\c:\tnnhbb.exec:\tnnhbb.exe57⤵
- Executes dropped EXE
PID:2204 -
\??\c:\jpvjv.exec:\jpvjv.exe58⤵
- Executes dropped EXE
PID:4148 -
\??\c:\djpjp.exec:\djpjp.exe59⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rrrxxff.exec:\rrrxxff.exe60⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rrlrrxr.exec:\rrlrrxr.exe61⤵
- Executes dropped EXE
PID:1880 -
\??\c:\bthhnn.exec:\bthhnn.exe62⤵
- Executes dropped EXE
PID:520 -
\??\c:\bhbnhh.exec:\bhbnhh.exe63⤵
- Executes dropped EXE
PID:2176 -
\??\c:\3dvvp.exec:\3dvvp.exe64⤵
- Executes dropped EXE
PID:3944 -
\??\c:\jdjdj.exec:\jdjdj.exe65⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe66⤵PID:5108
-
\??\c:\flrrffl.exec:\flrrffl.exe67⤵PID:5052
-
\??\c:\nhnnth.exec:\nhnnth.exe68⤵PID:1768
-
\??\c:\nthhhn.exec:\nthhhn.exe69⤵PID:3368
-
\??\c:\vpdvv.exec:\vpdvv.exe70⤵PID:3068
-
\??\c:\dddvp.exec:\dddvp.exe71⤵PID:4604
-
\??\c:\lxfxxxf.exec:\lxfxxxf.exe72⤵PID:3248
-
\??\c:\ffxrlrl.exec:\ffxrlrl.exe73⤵PID:1796
-
\??\c:\nbbttn.exec:\nbbttn.exe74⤵PID:3112
-
\??\c:\3djdd.exec:\3djdd.exe75⤵PID:3984
-
\??\c:\vjdvp.exec:\vjdvp.exe76⤵PID:4816
-
\??\c:\lffrlrr.exec:\lffrlrr.exe77⤵PID:344
-
\??\c:\3fxxlxl.exec:\3fxxlxl.exe78⤵PID:4848
-
\??\c:\bhhhtn.exec:\bhhhtn.exe79⤵PID:1956
-
\??\c:\hbhhht.exec:\hbhhht.exe80⤵PID:4280
-
\??\c:\vpjjp.exec:\vpjjp.exe81⤵PID:2392
-
\??\c:\rrrrfff.exec:\rrrrfff.exe82⤵PID:2816
-
\??\c:\llrrxxx.exec:\llrrxxx.exe83⤵PID:4372
-
\??\c:\hhhbnn.exec:\hhhbnn.exe84⤵PID:3396
-
\??\c:\nhnhhh.exec:\nhnhhh.exe85⤵PID:3916
-
\??\c:\ppvvv.exec:\ppvvv.exe86⤵PID:2736
-
\??\c:\pppjj.exec:\pppjj.exe87⤵PID:4700
-
\??\c:\flrlxxx.exec:\flrlxxx.exe88⤵PID:3512
-
\??\c:\nbhbbh.exec:\nbhbbh.exe89⤵PID:5048
-
\??\c:\thhbth.exec:\thhbth.exe90⤵PID:5032
-
\??\c:\vvvpd.exec:\vvvpd.exe91⤵PID:2744
-
\??\c:\xrrfrff.exec:\xrrfrff.exe92⤵PID:1976
-
\??\c:\5bhbtt.exec:\5bhbtt.exe93⤵PID:3500
-
\??\c:\vjdpd.exec:\vjdpd.exe94⤵PID:3808
-
\??\c:\dvpjd.exec:\dvpjd.exe95⤵PID:2712
-
\??\c:\lfffrlf.exec:\lfffrlf.exe96⤵PID:1804
-
\??\c:\rflfxrl.exec:\rflfxrl.exe97⤵PID:1296
-
\??\c:\bthnhn.exec:\bthnhn.exe98⤵PID:3388
-
\??\c:\nbbtnn.exec:\nbbtnn.exe99⤵PID:4796
-
\??\c:\jdjjd.exec:\jdjjd.exe100⤵PID:4140
-
\??\c:\ddddd.exec:\ddddd.exe101⤵PID:5000
-
\??\c:\rrxxflf.exec:\rrxxflf.exe102⤵PID:2960
-
\??\c:\bbttnh.exec:\bbttnh.exe103⤵PID:3132
-
\??\c:\hbtnnh.exec:\hbtnnh.exe104⤵PID:3972
-
\??\c:\pppdj.exec:\pppdj.exe105⤵PID:3712
-
\??\c:\pjpdv.exec:\pjpdv.exe106⤵PID:472
-
\??\c:\xrfxlfx.exec:\xrfxlfx.exe107⤵PID:2324
-
\??\c:\lllfffx.exec:\lllfffx.exe108⤵PID:2404
-
\??\c:\hnhttn.exec:\hnhttn.exe109⤵PID:1040
-
\??\c:\3tnhhn.exec:\3tnhhn.exe110⤵PID:4252
-
\??\c:\jddpj.exec:\jddpj.exe111⤵PID:4228
-
\??\c:\vvdjp.exec:\vvdjp.exe112⤵PID:4876
-
\??\c:\xrxfxfx.exec:\xrxfxfx.exe113⤵PID:2904
-
\??\c:\9xxrrll.exec:\9xxrrll.exe114⤵PID:4536
-
\??\c:\nbtbtb.exec:\nbtbtb.exe115⤵PID:4812
-
\??\c:\7tnhtt.exec:\7tnhtt.exe116⤵PID:2824
-
\??\c:\jpvvp.exec:\jpvvp.exe117⤵PID:4896
-
\??\c:\pjpjd.exec:\pjpjd.exe118⤵PID:1052
-
\??\c:\xrffllr.exec:\xrffllr.exe119⤵PID:2748
-
\??\c:\xfffxxr.exec:\xfffxxr.exe120⤵PID:4564
-
\??\c:\fllffxx.exec:\fllffxx.exe121⤵PID:1824
-
\??\c:\tnnnnn.exec:\tnnnnn.exe122⤵PID:2596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-