Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 04:05
Static task
static1
Behavioral task
behavioral1
Sample
9a57e31feb952579b3afd3ec2500c9f406bbc51ccdb4e362ed60b377c5573a96N.exe
Resource
win7-20240903-en
General
-
Target
9a57e31feb952579b3afd3ec2500c9f406bbc51ccdb4e362ed60b377c5573a96N.exe
-
Size
80KB
-
MD5
12246cb1a0faf835fa557a75e9cd2670
-
SHA1
2e1f80f56471931325b0fa9fc833a08cde38dbfa
-
SHA256
9a57e31feb952579b3afd3ec2500c9f406bbc51ccdb4e362ed60b377c5573a96
-
SHA512
96f0b66c27216b6ac4c22d390eb2cfae09df316a63a66472c51ba43736c8cbab22acb7b70e01fbbb7af663510c7fddb5b461cb8689edf03401a1573344d26cb5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeha:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4Ka
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4228-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/264-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3552-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3340-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/984-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2128-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4996 ttbttn.exe 3956 ddvpd.exe 4284 lllxflf.exe 4232 5btbtn.exe 4968 pjdvp.exe 3172 vpvpj.exe 4172 lxxlffx.exe 3592 nhhbnt.exe 1072 bbnnhn.exe 1864 pvvpj.exe 2108 lfllxfr.exe 2044 nnthnb.exe 2808 jpvpd.exe 264 frlfxrl.exe 2888 hthbbn.exe 3552 bnnbnh.exe 4108 dpvpv.exe 4468 lrlflrx.exe 3340 btnnhn.exe 4576 jpjvj.exe 1652 1ppdv.exe 2768 hnntnh.exe 984 5tthnb.exe 1328 pddpp.exe 2128 fxlxrlr.exe 1412 xrrfxrl.exe 4732 3nhnhn.exe 4648 3ppvj.exe 2436 dvvpd.exe 3720 lrrfrlx.exe 3708 dvdvd.exe 1668 vjpvj.exe 1856 lffrfxl.exe 1988 hnnntt.exe 3920 vjvpd.exe 3416 1vjdv.exe 2708 rrfffrr.exe 2840 1lxxlrf.exe 2220 3nbtnh.exe 2556 nhbnbn.exe 2592 vpppd.exe 760 pdjdd.exe 1940 rlrlrrl.exe 2692 hbbbtn.exe 4696 nhbnhb.exe 1476 jppjp.exe 4512 djjdj.exe 4480 frxlrll.exe 4912 1htnhh.exe 4228 thhbtt.exe 4564 pdvpj.exe 1852 jjdvd.exe 1332 xxfrffx.exe 3668 1rlxrlx.exe 3304 bhttnh.exe 4232 hbtntt.exe 4272 dvpjj.exe 4156 5rlllrr.exe 4004 rfrrffx.exe 3580 7tnnhn.exe 3168 nntnbb.exe 5100 9pppv.exe 2008 xlffxrl.exe 3248 fxxrlfx.exe -
resource yara_rule behavioral2/memory/4228-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/264-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3552-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/984-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1328-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2128-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4228 wrote to memory of 4996 4228 9a57e31feb952579b3afd3ec2500c9f406bbc51ccdb4e362ed60b377c5573a96N.exe 82 PID 4228 wrote to memory of 4996 4228 9a57e31feb952579b3afd3ec2500c9f406bbc51ccdb4e362ed60b377c5573a96N.exe 82 PID 4228 wrote to memory of 4996 4228 9a57e31feb952579b3afd3ec2500c9f406bbc51ccdb4e362ed60b377c5573a96N.exe 82 PID 4996 wrote to memory of 3956 4996 ttbttn.exe 83 PID 4996 wrote to memory of 3956 4996 ttbttn.exe 83 PID 4996 wrote to memory of 3956 4996 ttbttn.exe 83 PID 3956 wrote to memory of 4284 3956 ddvpd.exe 84 PID 3956 wrote to memory of 4284 3956 ddvpd.exe 84 PID 3956 wrote to memory of 4284 3956 ddvpd.exe 84 PID 4284 wrote to memory of 4232 4284 lllxflf.exe 85 PID 4284 wrote to memory of 4232 4284 lllxflf.exe 85 PID 4284 wrote to memory of 4232 4284 lllxflf.exe 85 PID 4232 wrote to memory of 4968 4232 5btbtn.exe 86 PID 4232 wrote to memory of 4968 4232 5btbtn.exe 86 PID 4232 wrote to memory of 4968 4232 5btbtn.exe 86 PID 4968 wrote to memory of 3172 4968 pjdvp.exe 87 PID 4968 wrote to memory of 3172 4968 pjdvp.exe 87 PID 4968 wrote to memory of 3172 4968 pjdvp.exe 87 PID 3172 wrote to memory of 4172 3172 vpvpj.exe 88 PID 3172 wrote to memory of 4172 3172 vpvpj.exe 88 PID 3172 wrote to memory of 4172 3172 vpvpj.exe 88 PID 4172 wrote to memory of 3592 4172 lxxlffx.exe 89 PID 4172 wrote to memory of 3592 4172 lxxlffx.exe 89 PID 4172 wrote to memory of 3592 4172 lxxlffx.exe 89 PID 3592 wrote to memory of 1072 3592 nhhbnt.exe 90 PID 3592 wrote to memory of 1072 3592 nhhbnt.exe 90 PID 3592 wrote to memory of 1072 3592 nhhbnt.exe 90 PID 1072 wrote to memory of 1864 1072 bbnnhn.exe 91 PID 1072 wrote to memory of 1864 1072 bbnnhn.exe 91 PID 1072 wrote to memory of 1864 1072 bbnnhn.exe 91 PID 1864 wrote to memory of 2108 1864 pvvpj.exe 92 PID 1864 wrote to memory of 2108 1864 pvvpj.exe 92 PID 1864 wrote to memory of 2108 1864 pvvpj.exe 92 PID 2108 wrote to memory of 2044 2108 lfllxfr.exe 93 PID 2108 wrote to memory of 2044 2108 lfllxfr.exe 93 PID 2108 wrote to memory of 2044 2108 lfllxfr.exe 93 PID 2044 wrote to memory of 2808 2044 nnthnb.exe 94 PID 2044 wrote to memory of 2808 2044 nnthnb.exe 94 PID 2044 wrote to memory of 2808 2044 nnthnb.exe 94 PID 2808 wrote to memory of 264 2808 jpvpd.exe 95 PID 2808 wrote to memory of 264 2808 jpvpd.exe 95 PID 2808 wrote to memory of 264 2808 jpvpd.exe 95 PID 264 wrote to memory of 2888 264 frlfxrl.exe 96 PID 264 wrote to memory of 2888 264 frlfxrl.exe 96 PID 264 wrote to memory of 2888 264 frlfxrl.exe 96 PID 2888 wrote to memory of 3552 2888 hthbbn.exe 97 PID 2888 wrote to memory of 3552 2888 hthbbn.exe 97 PID 2888 wrote to memory of 3552 2888 hthbbn.exe 97 PID 3552 wrote to memory of 4108 3552 bnnbnh.exe 98 PID 3552 wrote to memory of 4108 3552 bnnbnh.exe 98 PID 3552 wrote to memory of 4108 3552 bnnbnh.exe 98 PID 4108 wrote to memory of 4468 4108 dpvpv.exe 99 PID 4108 wrote to memory of 4468 4108 dpvpv.exe 99 PID 4108 wrote to memory of 4468 4108 dpvpv.exe 99 PID 4468 wrote to memory of 3340 4468 lrlflrx.exe 100 PID 4468 wrote to memory of 3340 4468 lrlflrx.exe 100 PID 4468 wrote to memory of 3340 4468 lrlflrx.exe 100 PID 3340 wrote to memory of 4576 3340 btnnhn.exe 101 PID 3340 wrote to memory of 4576 3340 btnnhn.exe 101 PID 3340 wrote to memory of 4576 3340 btnnhn.exe 101 PID 4576 wrote to memory of 1652 4576 jpjvj.exe 102 PID 4576 wrote to memory of 1652 4576 jpjvj.exe 102 PID 4576 wrote to memory of 1652 4576 jpjvj.exe 102 PID 1652 wrote to memory of 2768 1652 1ppdv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a57e31feb952579b3afd3ec2500c9f406bbc51ccdb4e362ed60b377c5573a96N.exe"C:\Users\Admin\AppData\Local\Temp\9a57e31feb952579b3afd3ec2500c9f406bbc51ccdb4e362ed60b377c5573a96N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\ttbttn.exec:\ttbttn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\ddvpd.exec:\ddvpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\lllxflf.exec:\lllxflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\5btbtn.exec:\5btbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\pjdvp.exec:\pjdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\vpvpj.exec:\vpvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\lxxlffx.exec:\lxxlffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\nhhbnt.exec:\nhhbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\bbnnhn.exec:\bbnnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\pvvpj.exec:\pvvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\lfllxfr.exec:\lfllxfr.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\nnthnb.exec:\nnthnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\jpvpd.exec:\jpvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\frlfxrl.exec:\frlfxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\hthbbn.exec:\hthbbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\bnnbnh.exec:\bnnbnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\dpvpv.exec:\dpvpv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\lrlflrx.exec:\lrlflrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\btnnhn.exec:\btnnhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\jpjvj.exec:\jpjvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\1ppdv.exec:\1ppdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\hnntnh.exec:\hnntnh.exe23⤵
- Executes dropped EXE
PID:2768 -
\??\c:\5tthnb.exec:\5tthnb.exe24⤵
- Executes dropped EXE
PID:984 -
\??\c:\pddpp.exec:\pddpp.exe25⤵
- Executes dropped EXE
PID:1328 -
\??\c:\fxlxrlr.exec:\fxlxrlr.exe26⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xrrfxrl.exec:\xrrfxrl.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1412 -
\??\c:\3nhnhn.exec:\3nhnhn.exe28⤵
- Executes dropped EXE
PID:4732 -
\??\c:\3ppvj.exec:\3ppvj.exe29⤵
- Executes dropped EXE
PID:4648 -
\??\c:\dvvpd.exec:\dvvpd.exe30⤵
- Executes dropped EXE
PID:2436 -
\??\c:\lrrfrlx.exec:\lrrfrlx.exe31⤵
- Executes dropped EXE
PID:3720 -
\??\c:\dvdvd.exec:\dvdvd.exe32⤵
- Executes dropped EXE
PID:3708 -
\??\c:\vjpvj.exec:\vjpvj.exe33⤵
- Executes dropped EXE
PID:1668 -
\??\c:\lffrfxl.exec:\lffrfxl.exe34⤵
- Executes dropped EXE
PID:1856 -
\??\c:\hnnntt.exec:\hnnntt.exe35⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vjvpd.exec:\vjvpd.exe36⤵
- Executes dropped EXE
PID:3920 -
\??\c:\1vjdv.exec:\1vjdv.exe37⤵
- Executes dropped EXE
PID:3416 -
\??\c:\rrfffrr.exec:\rrfffrr.exe38⤵
- Executes dropped EXE
PID:2708 -
\??\c:\1lxxlrf.exec:\1lxxlrf.exe39⤵
- Executes dropped EXE
PID:2840 -
\??\c:\3nbtnh.exec:\3nbtnh.exe40⤵
- Executes dropped EXE
PID:2220 -
\??\c:\nhbnbn.exec:\nhbnbn.exe41⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vpppd.exec:\vpppd.exe42⤵
- Executes dropped EXE
PID:2592 -
\??\c:\pdjdd.exec:\pdjdd.exe43⤵
- Executes dropped EXE
PID:760 -
\??\c:\rlrlrrl.exec:\rlrlrrl.exe44⤵
- Executes dropped EXE
PID:1940 -
\??\c:\hbbbtn.exec:\hbbbtn.exe45⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nhbnhb.exec:\nhbnhb.exe46⤵
- Executes dropped EXE
PID:4696 -
\??\c:\jppjp.exec:\jppjp.exe47⤵
- Executes dropped EXE
PID:1476 -
\??\c:\djjdj.exec:\djjdj.exe48⤵
- Executes dropped EXE
PID:4512 -
\??\c:\frxlrll.exec:\frxlrll.exe49⤵
- Executes dropped EXE
PID:4480 -
\??\c:\1htnhh.exec:\1htnhh.exe50⤵
- Executes dropped EXE
PID:4912 -
\??\c:\thhbtt.exec:\thhbtt.exe51⤵
- Executes dropped EXE
PID:4228 -
\??\c:\pdvpj.exec:\pdvpj.exe52⤵
- Executes dropped EXE
PID:4564 -
\??\c:\jjdvd.exec:\jjdvd.exe53⤵
- Executes dropped EXE
PID:1852 -
\??\c:\xxfrffx.exec:\xxfrffx.exe54⤵
- Executes dropped EXE
PID:1332 -
\??\c:\1rlxrlx.exec:\1rlxrlx.exe55⤵
- Executes dropped EXE
PID:3668 -
\??\c:\bhttnh.exec:\bhttnh.exe56⤵
- Executes dropped EXE
PID:3304 -
\??\c:\hbtntt.exec:\hbtntt.exe57⤵
- Executes dropped EXE
PID:4232 -
\??\c:\dvpjj.exec:\dvpjj.exe58⤵
- Executes dropped EXE
PID:4272 -
\??\c:\5rlllrr.exec:\5rlllrr.exe59⤵
- Executes dropped EXE
PID:4156 -
\??\c:\rfrrffx.exec:\rfrrffx.exe60⤵
- Executes dropped EXE
PID:4004 -
\??\c:\7tnnhn.exec:\7tnnhn.exe61⤵
- Executes dropped EXE
PID:3580 -
\??\c:\nntnbb.exec:\nntnbb.exe62⤵
- Executes dropped EXE
PID:3168 -
\??\c:\9pppv.exec:\9pppv.exe63⤵
- Executes dropped EXE
PID:5100 -
\??\c:\xlffxrl.exec:\xlffxrl.exe64⤵
- Executes dropped EXE
PID:2008 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe65⤵
- Executes dropped EXE
PID:3248 -
\??\c:\nnnhbb.exec:\nnnhbb.exe66⤵PID:640
-
\??\c:\pdpvj.exec:\pdpvj.exe67⤵PID:2824
-
\??\c:\5jdjv.exec:\5jdjv.exe68⤵PID:4568
-
\??\c:\7frfrrx.exec:\7frfrrx.exe69⤵PID:112
-
\??\c:\bntnnh.exec:\bntnnh.exe70⤵PID:2820
-
\??\c:\tnhtnn.exec:\tnhtnn.exe71⤵PID:264
-
\??\c:\pjjdv.exec:\pjjdv.exe72⤵PID:3688
-
\??\c:\fxfrllf.exec:\fxfrllf.exe73⤵PID:3016
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe74⤵PID:2340
-
\??\c:\btnhbb.exec:\btnhbb.exe75⤵PID:4416
-
\??\c:\5pjvj.exec:\5pjvj.exe76⤵PID:1428
-
\??\c:\dpvjd.exec:\dpvjd.exe77⤵PID:4308
-
\??\c:\xxllxlx.exec:\xxllxlx.exe78⤵PID:464
-
\??\c:\bnbtnn.exec:\bnbtnn.exe79⤵PID:2112
-
\??\c:\5rfxllf.exec:\5rfxllf.exe80⤵PID:4796
-
\??\c:\9bthbt.exec:\9bthbt.exe81⤵PID:1672
-
\??\c:\3nhbnh.exec:\3nhbnh.exe82⤵PID:2676
-
\??\c:\nbhbhh.exec:\nbhbhh.exe83⤵PID:1328
-
\??\c:\dvvpp.exec:\dvvpp.exe84⤵PID:2000
-
\??\c:\1xrlflf.exec:\1xrlflf.exe85⤵PID:1772
-
\??\c:\bnthnh.exec:\bnthnh.exe86⤵PID:2560
-
\??\c:\5hnbnb.exec:\5hnbnb.exe87⤵PID:2608
-
\??\c:\vjvjd.exec:\vjvjd.exe88⤵PID:3464
-
\??\c:\dvpjv.exec:\dvpjv.exe89⤵PID:2320
-
\??\c:\lxxrxlx.exec:\lxxrxlx.exe90⤵PID:4800
-
\??\c:\thbthb.exec:\thbthb.exe91⤵PID:3460
-
\??\c:\tthnth.exec:\tthnth.exe92⤵PID:4684
-
\??\c:\dpvdd.exec:\dpvdd.exe93⤵PID:2904
-
\??\c:\3fflxxr.exec:\3fflxxr.exe94⤵PID:2520
-
\??\c:\lflfrll.exec:\lflfrll.exe95⤵PID:2816
-
\??\c:\bbtnbb.exec:\bbtnbb.exe96⤵PID:4388
-
\??\c:\nhhbbt.exec:\nhhbbt.exe97⤵PID:3532
-
\??\c:\dpvpj.exec:\dpvpj.exe98⤵PID:804
-
\??\c:\vpvpp.exec:\vpvpp.exe99⤵PID:3600
-
\??\c:\xxrllff.exec:\xxrllff.exe100⤵PID:2296
-
\??\c:\ffffllr.exec:\ffffllr.exe101⤵PID:4908
-
\??\c:\7nbtnh.exec:\7nbtnh.exe102⤵PID:4144
-
\??\c:\ttthbb.exec:\ttthbb.exe103⤵PID:5040
-
\??\c:\7jdpp.exec:\7jdpp.exe104⤵
- System Location Discovery: System Language Discovery
PID:4580 -
\??\c:\fxxllff.exec:\fxxllff.exe105⤵PID:2744
-
\??\c:\rfxflrx.exec:\rfxflrx.exe106⤵PID:4696
-
\??\c:\3ttnhh.exec:\3ttnhh.exe107⤵PID:4472
-
\??\c:\hbbbnt.exec:\hbbbnt.exe108⤵PID:3484
-
\??\c:\btnhth.exec:\btnhth.exe109⤵PID:1216
-
\??\c:\pddjd.exec:\pddjd.exe110⤵PID:3212
-
\??\c:\djpjd.exec:\djpjd.exe111⤵PID:1944
-
\??\c:\lfrrllf.exec:\lfrrllf.exe112⤵PID:2456
-
\??\c:\rrllffl.exec:\rrllffl.exe113⤵PID:2568
-
\??\c:\tttnhh.exec:\tttnhh.exe114⤵PID:4520
-
\??\c:\nhhbnt.exec:\nhhbnt.exe115⤵PID:4240
-
\??\c:\nhthnh.exec:\nhthnh.exe116⤵PID:2364
-
\??\c:\9jjpd.exec:\9jjpd.exe117⤵PID:1308
-
\??\c:\dvvpd.exec:\dvvpd.exe118⤵PID:1816
-
\??\c:\xllfxrf.exec:\xllfxrf.exe119⤵PID:2924
-
\??\c:\rlxrxxl.exec:\rlxrxxl.exe120⤵PID:1864
-
\??\c:\xrxrlll.exec:\xrxrlll.exe121⤵PID:2336
-
\??\c:\thbbtt.exec:\thbbtt.exe122⤵PID:324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-