Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 20:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e62493d8d5956aa18ba9beb262a4f940N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
e62493d8d5956aa18ba9beb262a4f940N.exe
-
Size
82KB
-
MD5
e62493d8d5956aa18ba9beb262a4f940
-
SHA1
1f12cf9711fe1b8dd3df072ac3262072e21a2de7
-
SHA256
e5845b89a61117a091f7773254c2f4506f5d2a7860a5e82864f5582552780663
-
SHA512
b3e778e782f17490dc26e738c17208a5cf797b1683519674e9906303514633394218a64974cad473d3c23daa43a64e86fced7461934eed095d6e22022b58ae71
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QQ3:ymb3NkkiQ3mdBjFIIp9L9QrrA8B3
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2728-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1288-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2160-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2500-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3016 7jjjd.exe 2340 pdjdp.exe 1952 lllfxxx.exe 1288 lxxrrrl.exe 516 nnhbbt.exe 3428 xxxlfxr.exe 2604 bhnntt.exe 4856 bnnhbb.exe 3160 pppjp.exe 4844 lxffffx.exe 4892 bnbbtt.exe 440 vdjvp.exe 1852 xlllxxr.exe 5036 btnnhh.exe 2160 vdvvv.exe 2324 9pjdv.exe 1176 llfxllx.exe 4520 httbht.exe 4512 jvvpj.exe 2308 rlxfxff.exe 1008 nhbttt.exe 2264 hhnhbb.exe 3992 djvdv.exe 2064 rflflrx.exe 4160 ntbttt.exe 3700 bbttnb.exe 220 pdvpv.exe 2500 jpvpd.exe 2140 xfxlffx.exe 3108 nhhbtn.exe 2328 htbtnt.exe 1980 ddvpj.exe 4884 rflxlll.exe 1920 fxffxxr.exe 1220 tnhbnn.exe 4352 nbnhhb.exe 3604 pjdpp.exe 1424 5vvvv.exe 1500 lllfxrr.exe 2256 hhbbtt.exe 2240 thhthn.exe 4472 jdvpd.exe 3956 dpvjd.exe 3912 xllfrrl.exe 3260 xflfffx.exe 3624 hhbthb.exe 4928 bnnbtt.exe 1088 vvpjd.exe 4316 dvddp.exe 4292 rrrlffx.exe 3140 lrxrrll.exe 856 thttbb.exe 468 bhnhbt.exe 1716 dvjpj.exe 440 dvvvv.exe 4620 rxrlfff.exe 3180 rfllffx.exe 376 nnhhbb.exe 4064 hbtnhh.exe 2696 pvjdd.exe 2568 pvvpj.exe 2968 xrrlffx.exe 4972 7xxxrrr.exe 1504 nhhbtt.exe -
resource yara_rule behavioral2/memory/2728-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1288-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1008-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2500-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-215-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2728 wrote to memory of 3016 2728 e62493d8d5956aa18ba9beb262a4f940N.exe 85 PID 2728 wrote to memory of 3016 2728 e62493d8d5956aa18ba9beb262a4f940N.exe 85 PID 2728 wrote to memory of 3016 2728 e62493d8d5956aa18ba9beb262a4f940N.exe 85 PID 3016 wrote to memory of 2340 3016 7jjjd.exe 86 PID 3016 wrote to memory of 2340 3016 7jjjd.exe 86 PID 3016 wrote to memory of 2340 3016 7jjjd.exe 86 PID 2340 wrote to memory of 1952 2340 pdjdp.exe 87 PID 2340 wrote to memory of 1952 2340 pdjdp.exe 87 PID 2340 wrote to memory of 1952 2340 pdjdp.exe 87 PID 1952 wrote to memory of 1288 1952 lllfxxx.exe 88 PID 1952 wrote to memory of 1288 1952 lllfxxx.exe 88 PID 1952 wrote to memory of 1288 1952 lllfxxx.exe 88 PID 1288 wrote to memory of 516 1288 lxxrrrl.exe 89 PID 1288 wrote to memory of 516 1288 lxxrrrl.exe 89 PID 1288 wrote to memory of 516 1288 lxxrrrl.exe 89 PID 516 wrote to memory of 3428 516 nnhbbt.exe 90 PID 516 wrote to memory of 3428 516 nnhbbt.exe 90 PID 516 wrote to memory of 3428 516 nnhbbt.exe 90 PID 3428 wrote to memory of 2604 3428 xxxlfxr.exe 91 PID 3428 wrote to memory of 2604 3428 xxxlfxr.exe 91 PID 3428 wrote to memory of 2604 3428 xxxlfxr.exe 91 PID 2604 wrote to memory of 4856 2604 bhnntt.exe 92 PID 2604 wrote to memory of 4856 2604 bhnntt.exe 92 PID 2604 wrote to memory of 4856 2604 bhnntt.exe 92 PID 4856 wrote to memory of 3160 4856 bnnhbb.exe 94 PID 4856 wrote to memory of 3160 4856 bnnhbb.exe 94 PID 4856 wrote to memory of 3160 4856 bnnhbb.exe 94 PID 3160 wrote to memory of 4844 3160 pppjp.exe 95 PID 3160 wrote to memory of 4844 3160 pppjp.exe 95 PID 3160 wrote to memory of 4844 3160 pppjp.exe 95 PID 4844 wrote to memory of 4892 4844 lxffffx.exe 96 PID 4844 wrote to memory of 4892 4844 lxffffx.exe 96 PID 4844 wrote to memory of 4892 4844 lxffffx.exe 96 PID 4892 wrote to memory of 440 4892 bnbbtt.exe 97 PID 4892 wrote to memory of 440 4892 bnbbtt.exe 97 PID 4892 wrote to memory of 440 4892 bnbbtt.exe 97 PID 440 wrote to memory of 1852 440 vdjvp.exe 99 PID 440 wrote to memory of 1852 440 vdjvp.exe 99 PID 440 wrote to memory of 1852 440 vdjvp.exe 99 PID 1852 wrote to memory of 5036 1852 xlllxxr.exe 100 PID 1852 wrote to memory of 5036 1852 xlllxxr.exe 100 PID 1852 wrote to memory of 5036 1852 xlllxxr.exe 100 PID 5036 wrote to memory of 2160 5036 btnnhh.exe 101 PID 5036 wrote to memory of 2160 5036 btnnhh.exe 101 PID 5036 wrote to memory of 2160 5036 btnnhh.exe 101 PID 2160 wrote to memory of 2324 2160 vdvvv.exe 102 PID 2160 wrote to memory of 2324 2160 vdvvv.exe 102 PID 2160 wrote to memory of 2324 2160 vdvvv.exe 102 PID 2324 wrote to memory of 1176 2324 9pjdv.exe 104 PID 2324 wrote to memory of 1176 2324 9pjdv.exe 104 PID 2324 wrote to memory of 1176 2324 9pjdv.exe 104 PID 1176 wrote to memory of 4520 1176 llfxllx.exe 105 PID 1176 wrote to memory of 4520 1176 llfxllx.exe 105 PID 1176 wrote to memory of 4520 1176 llfxllx.exe 105 PID 4520 wrote to memory of 4512 4520 httbht.exe 106 PID 4520 wrote to memory of 4512 4520 httbht.exe 106 PID 4520 wrote to memory of 4512 4520 httbht.exe 106 PID 4512 wrote to memory of 2308 4512 jvvpj.exe 107 PID 4512 wrote to memory of 2308 4512 jvvpj.exe 107 PID 4512 wrote to memory of 2308 4512 jvvpj.exe 107 PID 2308 wrote to memory of 1008 2308 rlxfxff.exe 108 PID 2308 wrote to memory of 1008 2308 rlxfxff.exe 108 PID 2308 wrote to memory of 1008 2308 rlxfxff.exe 108 PID 1008 wrote to memory of 2264 1008 nhbttt.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\e62493d8d5956aa18ba9beb262a4f940N.exe"C:\Users\Admin\AppData\Local\Temp\e62493d8d5956aa18ba9beb262a4f940N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\7jjjd.exec:\7jjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\pdjdp.exec:\pdjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\lllfxxx.exec:\lllfxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\lxxrrrl.exec:\lxxrrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\nnhbbt.exec:\nnhbbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\xxxlfxr.exec:\xxxlfxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\bhnntt.exec:\bhnntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\bnnhbb.exec:\bnnhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\pppjp.exec:\pppjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\lxffffx.exec:\lxffffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\bnbbtt.exec:\bnbbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\vdjvp.exec:\vdjvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\xlllxxr.exec:\xlllxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\btnnhh.exec:\btnnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\vdvvv.exec:\vdvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\9pjdv.exec:\9pjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\llfxllx.exec:\llfxllx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\httbht.exec:\httbht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\jvvpj.exec:\jvvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\rlxfxff.exec:\rlxfxff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\nhbttt.exec:\nhbttt.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\hhnhbb.exec:\hhnhbb.exe23⤵
- Executes dropped EXE
PID:2264 -
\??\c:\djvdv.exec:\djvdv.exe24⤵
- Executes dropped EXE
PID:3992 -
\??\c:\rflflrx.exec:\rflflrx.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2064 -
\??\c:\ntbttt.exec:\ntbttt.exe26⤵
- Executes dropped EXE
PID:4160 -
\??\c:\bbttnb.exec:\bbttnb.exe27⤵
- Executes dropped EXE
PID:3700 -
\??\c:\pdvpv.exec:\pdvpv.exe28⤵
- Executes dropped EXE
PID:220 -
\??\c:\jpvpd.exec:\jpvpd.exe29⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xfxlffx.exec:\xfxlffx.exe30⤵
- Executes dropped EXE
PID:2140 -
\??\c:\nhhbtn.exec:\nhhbtn.exe31⤵
- Executes dropped EXE
PID:3108 -
\??\c:\htbtnt.exec:\htbtnt.exe32⤵
- Executes dropped EXE
PID:2328 -
\??\c:\ddvpj.exec:\ddvpj.exe33⤵
- Executes dropped EXE
PID:1980 -
\??\c:\rflxlll.exec:\rflxlll.exe34⤵
- Executes dropped EXE
PID:4884 -
\??\c:\fxffxxr.exec:\fxffxxr.exe35⤵
- Executes dropped EXE
PID:1920 -
\??\c:\tnhbnn.exec:\tnhbnn.exe36⤵
- Executes dropped EXE
PID:1220 -
\??\c:\nbnhhb.exec:\nbnhhb.exe37⤵
- Executes dropped EXE
PID:4352 -
\??\c:\pjdpp.exec:\pjdpp.exe38⤵
- Executes dropped EXE
PID:3604 -
\??\c:\5vvvv.exec:\5vvvv.exe39⤵
- Executes dropped EXE
PID:1424 -
\??\c:\lllfxrr.exec:\lllfxrr.exe40⤵
- Executes dropped EXE
PID:1500 -
\??\c:\hhbbtt.exec:\hhbbtt.exe41⤵
- Executes dropped EXE
PID:2256 -
\??\c:\thhthn.exec:\thhthn.exe42⤵
- Executes dropped EXE
PID:2240 -
\??\c:\jdvpd.exec:\jdvpd.exe43⤵
- Executes dropped EXE
PID:4472 -
\??\c:\dpvjd.exec:\dpvjd.exe44⤵
- Executes dropped EXE
PID:3956 -
\??\c:\xllfrrl.exec:\xllfrrl.exe45⤵
- Executes dropped EXE
PID:3912 -
\??\c:\xflfffx.exec:\xflfffx.exe46⤵
- Executes dropped EXE
PID:3260 -
\??\c:\hhbthb.exec:\hhbthb.exe47⤵
- Executes dropped EXE
PID:3624 -
\??\c:\bnnbtt.exec:\bnnbtt.exe48⤵
- Executes dropped EXE
PID:4928 -
\??\c:\vvpjd.exec:\vvpjd.exe49⤵
- Executes dropped EXE
PID:1088 -
\??\c:\dvddp.exec:\dvddp.exe50⤵
- Executes dropped EXE
PID:4316 -
\??\c:\rrrlffx.exec:\rrrlffx.exe51⤵
- Executes dropped EXE
PID:4292 -
\??\c:\lrxrrll.exec:\lrxrrll.exe52⤵
- Executes dropped EXE
PID:3140 -
\??\c:\thttbb.exec:\thttbb.exe53⤵
- Executes dropped EXE
PID:856 -
\??\c:\bhnhbt.exec:\bhnhbt.exe54⤵
- Executes dropped EXE
PID:468 -
\??\c:\dvjpj.exec:\dvjpj.exe55⤵
- Executes dropped EXE
PID:1716 -
\??\c:\dvvvv.exec:\dvvvv.exe56⤵
- Executes dropped EXE
PID:440 -
\??\c:\rxrlfff.exec:\rxrlfff.exe57⤵
- Executes dropped EXE
PID:4620 -
\??\c:\rfllffx.exec:\rfllffx.exe58⤵
- Executes dropped EXE
PID:3180 -
\??\c:\nnhhbb.exec:\nnhhbb.exe59⤵
- Executes dropped EXE
PID:376 -
\??\c:\hbtnhh.exec:\hbtnhh.exe60⤵
- Executes dropped EXE
PID:4064 -
\??\c:\pvjdd.exec:\pvjdd.exe61⤵
- Executes dropped EXE
PID:2696 -
\??\c:\pvvpj.exec:\pvvpj.exe62⤵
- Executes dropped EXE
PID:2568 -
\??\c:\xrrlffx.exec:\xrrlffx.exe63⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7xxxrrr.exec:\7xxxrrr.exe64⤵
- Executes dropped EXE
PID:4972 -
\??\c:\nhhbtt.exec:\nhhbtt.exe65⤵
- Executes dropped EXE
PID:1504 -
\??\c:\btttnb.exec:\btttnb.exe66⤵PID:1460
-
\??\c:\jjpdd.exec:\jjpdd.exe67⤵PID:3120
-
\??\c:\vvjvv.exec:\vvjvv.exe68⤵PID:3104
-
\??\c:\xrxxllf.exec:\xrxxllf.exe69⤵PID:1956
-
\??\c:\7xxrllf.exec:\7xxrllf.exe70⤵PID:1056
-
\??\c:\1nhhbh.exec:\1nhhbh.exe71⤵PID:2556
-
\??\c:\tnnhhh.exec:\tnnhhh.exe72⤵PID:1488
-
\??\c:\djddv.exec:\djddv.exe73⤵PID:1196
-
\??\c:\jpvpp.exec:\jpvpp.exe74⤵PID:4736
-
\??\c:\9fffxxx.exec:\9fffxxx.exe75⤵PID:3700
-
\??\c:\rxffxxx.exec:\rxffxxx.exe76⤵PID:3380
-
\??\c:\hnnhbt.exec:\hnnhbt.exe77⤵PID:1380
-
\??\c:\5thbbn.exec:\5thbbn.exe78⤵PID:2540
-
\??\c:\pjpjj.exec:\pjpjj.exe79⤵PID:4480
-
\??\c:\3vpjp.exec:\3vpjp.exe80⤵PID:720
-
\??\c:\rlxxrlr.exec:\rlxxrlr.exe81⤵PID:2328
-
\??\c:\flfffxx.exec:\flfffxx.exe82⤵PID:412
-
\??\c:\nbbbtt.exec:\nbbbtt.exe83⤵PID:2772
-
\??\c:\nhnhhh.exec:\nhnhhh.exe84⤵PID:3232
-
\??\c:\ppdvp.exec:\ppdvp.exe85⤵PID:3748
-
\??\c:\fxrrffx.exec:\fxrrffx.exe86⤵PID:4796
-
\??\c:\lrffxxr.exec:\lrffxxr.exe87⤵PID:5104
-
\??\c:\jdvpp.exec:\jdvpp.exe88⤵PID:1576
-
\??\c:\dvdvd.exec:\dvdvd.exe89⤵PID:3296
-
\??\c:\xxxrlll.exec:\xxxrlll.exe90⤵PID:2340
-
\??\c:\lfrrlrl.exec:\lfrrlrl.exe91⤵PID:4420
-
\??\c:\nhtnnn.exec:\nhtnnn.exe92⤵PID:2136
-
\??\c:\pvddv.exec:\pvddv.exe93⤵PID:4920
-
\??\c:\1jpjd.exec:\1jpjd.exe94⤵PID:4276
-
\??\c:\flrrrfl.exec:\flrrrfl.exe95⤵PID:3488
-
\??\c:\hthhhh.exec:\hthhhh.exe96⤵PID:4800
-
\??\c:\httnhh.exec:\httnhh.exe97⤵PID:1972
-
\??\c:\dvdvd.exec:\dvdvd.exe98⤵PID:4500
-
\??\c:\7xrlxrl.exec:\7xrlxrl.exe99⤵PID:2168
-
\??\c:\flllxrl.exec:\flllxrl.exe100⤵PID:2272
-
\??\c:\hnbbtt.exec:\hnbbtt.exe101⤵PID:5076
-
\??\c:\dddvp.exec:\dddvp.exe102⤵PID:5004
-
\??\c:\dpppj.exec:\dpppj.exe103⤵PID:2288
-
\??\c:\frxxrrl.exec:\frxxrrl.exe104⤵PID:4624
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe105⤵PID:3676
-
\??\c:\btbbtt.exec:\btbbtt.exe106⤵PID:1712
-
\??\c:\hbhhbn.exec:\hbhhbn.exe107⤵PID:2408
-
\??\c:\pdvpv.exec:\pdvpv.exe108⤵PID:4792
-
\??\c:\pjpjd.exec:\pjpjd.exe109⤵PID:4304
-
\??\c:\fxlllfl.exec:\fxlllfl.exe110⤵PID:2508
-
\??\c:\7rxxfxl.exec:\7rxxfxl.exe111⤵PID:2004
-
\??\c:\btttbh.exec:\btttbh.exe112⤵PID:1580
-
\??\c:\3ttnnt.exec:\3ttnnt.exe113⤵PID:608
-
\??\c:\pvddd.exec:\pvddd.exe114⤵PID:2308
-
\??\c:\1rlfxrl.exec:\1rlfxrl.exe115⤵PID:2944
-
\??\c:\1lrrrrl.exec:\1lrrrrl.exe116⤵PID:2100
-
\??\c:\thhbtt.exec:\thhbtt.exe117⤵PID:2300
-
\??\c:\hbbnhb.exec:\hbbnhb.exe118⤵PID:4308
-
\??\c:\pjpdv.exec:\pjpdv.exe119⤵PID:1928
-
\??\c:\djdvp.exec:\djdvp.exe120⤵PID:4108
-
\??\c:\rflfxrr.exec:\rflfxrr.exe121⤵PID:4144
-
\??\c:\fxrxxrx.exec:\fxrxxrx.exe122⤵PID:3392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-