Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 06:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
891307c88d5cabb3b64d6f865db18f9ccae09c5952a8e6389b909de032985643N.exe
Resource
win7-20240729-en
windows7-x64
5 signatures
120 seconds
General
-
Target
891307c88d5cabb3b64d6f865db18f9ccae09c5952a8e6389b909de032985643N.exe
-
Size
49KB
-
MD5
33a45d5f2859b27f238a8beac41e60a0
-
SHA1
c72f278b821bb319018307dfe07102a72a1655ff
-
SHA256
891307c88d5cabb3b64d6f865db18f9ccae09c5952a8e6389b909de032985643
-
SHA512
04217b6f7afe2bef9393e8d1a9d394600f50dcc2d50ab02ff377dce2ef01324d9000c76abdb9c21ac86c26ca049ca4f45d87efd32ff243de584475dbed40dab8
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvFZ:0cdpeeBSHHMHLf9RyI0Z
Malware Config
Signatures
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2684-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/940-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/496-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1972-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1912-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1224-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-260-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2124-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-323-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2172-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-338-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-344-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-351-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2656-364-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/1132-386-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1132-391-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2924-411-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-413-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-425-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-445-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2484-444-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/1120-464-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-471-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/884-491-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1108-535-0x0000000001B50000-0x0000000001B79000-memory.dmp family_blackmoon behavioral1/memory/1452-548-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-599-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2968-598-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2152-701-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2848-703-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1208-718-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1628-768-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/856-812-0x00000000003B0000-0x00000000003D9000-memory.dmp family_blackmoon behavioral1/memory/1220-815-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1220-819-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/592-973-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2524-1074-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-1108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-1142-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2800-1171-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/828-1194-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2564-1208-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2896 5ffrxrr.exe 2288 bntnnb.exe 2868 ntnbbt.exe 2820 7vvvp.exe 2788 3rlllrx.exe 1672 1vjdp.exe 2600 vvpjj.exe 2680 lllrxxf.exe 2024 bbthbn.exe 2376 7ddpp.exe 1608 ppdjd.exe 2996 xrxfxrl.exe 2924 rlxffll.exe 2704 1bntbb.exe 2664 hhnnnt.exe 940 jjvdj.exe 496 xrlfrlx.exe 1100 lflflll.exe 1972 tthnnn.exe 2236 vvpdd.exe 2184 3dpjj.exe 2272 rlxlllx.exe 1912 7nhnbh.exe 1636 5thhnn.exe 1812 3dvpj.exe 1224 xxllrll.exe 2536 xxfxxxf.exe 2524 tnbhtn.exe 1268 vdpvv.exe 288 1xfrlll.exe 2684 5frrrrr.exe 2896 7bhtbb.exe 2508 tnbbbb.exe 2124 ddjdp.exe 2740 dvvpp.exe 2812 xrfrrxl.exe 2172 rrllffr.exe 2692 5htnnh.exe 2744 3bntnn.exe 2620 vppjp.exe 2660 jdvpp.exe 2656 xxfrlfx.exe 2784 htbbhb.exe 2024 nhttbb.exe 2376 jjppv.exe 1132 ddjjd.exe 2996 7xrxffl.exe 2952 7fxrrlr.exe 2924 1nbnnt.exe 2704 nbhbhb.exe 1784 5djvp.exe 2416 ddppv.exe 1052 1lffrxl.exe 2484 fxffrlx.exe 2408 bbhhhn.exe 2072 nhbbht.exe 1120 xffflrx.exe 1952 rrfllrf.exe 2204 tbthth.exe 1596 hnhhbh.exe 884 3pjpd.exe 1912 jjvvd.exe 1636 rrrlrxl.exe 1812 xxlxrxf.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fflxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lflxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2896 2684 891307c88d5cabb3b64d6f865db18f9ccae09c5952a8e6389b909de032985643N.exe 30 PID 2684 wrote to memory of 2896 2684 891307c88d5cabb3b64d6f865db18f9ccae09c5952a8e6389b909de032985643N.exe 30 PID 2684 wrote to memory of 2896 2684 891307c88d5cabb3b64d6f865db18f9ccae09c5952a8e6389b909de032985643N.exe 30 PID 2684 wrote to memory of 2896 2684 891307c88d5cabb3b64d6f865db18f9ccae09c5952a8e6389b909de032985643N.exe 30 PID 2896 wrote to memory of 2288 2896 5ffrxrr.exe 31 PID 2896 wrote to memory of 2288 2896 5ffrxrr.exe 31 PID 2896 wrote to memory of 2288 2896 5ffrxrr.exe 31 PID 2896 wrote to memory of 2288 2896 5ffrxrr.exe 31 PID 2288 wrote to memory of 2868 2288 bntnnb.exe 32 PID 2288 wrote to memory of 2868 2288 bntnnb.exe 32 PID 2288 wrote to memory of 2868 2288 bntnnb.exe 32 PID 2288 wrote to memory of 2868 2288 bntnnb.exe 32 PID 2868 wrote to memory of 2820 2868 ntnbbt.exe 33 PID 2868 wrote to memory of 2820 2868 ntnbbt.exe 33 PID 2868 wrote to memory of 2820 2868 ntnbbt.exe 33 PID 2868 wrote to memory of 2820 2868 ntnbbt.exe 33 PID 2820 wrote to memory of 2788 2820 7vvvp.exe 34 PID 2820 wrote to memory of 2788 2820 7vvvp.exe 34 PID 2820 wrote to memory of 2788 2820 7vvvp.exe 34 PID 2820 wrote to memory of 2788 2820 7vvvp.exe 34 PID 2788 wrote to memory of 1672 2788 3rlllrx.exe 35 PID 2788 wrote to memory of 1672 2788 3rlllrx.exe 35 PID 2788 wrote to memory of 1672 2788 3rlllrx.exe 35 PID 2788 wrote to memory of 1672 2788 3rlllrx.exe 35 PID 1672 wrote to memory of 2600 1672 1vjdp.exe 36 PID 1672 wrote to memory of 2600 1672 1vjdp.exe 36 PID 1672 wrote to memory of 2600 1672 1vjdp.exe 36 PID 1672 wrote to memory of 2600 1672 1vjdp.exe 36 PID 2600 wrote to memory of 2680 2600 vvpjj.exe 37 PID 2600 wrote to memory of 2680 2600 vvpjj.exe 37 PID 2600 wrote to memory of 2680 2600 vvpjj.exe 37 PID 2600 wrote to memory of 2680 2600 vvpjj.exe 37 PID 2680 wrote to memory of 2024 2680 lllrxxf.exe 38 PID 2680 wrote to memory of 2024 2680 lllrxxf.exe 38 PID 2680 wrote to memory of 2024 2680 lllrxxf.exe 38 PID 2680 wrote to memory of 2024 2680 lllrxxf.exe 38 PID 2024 wrote to memory of 2376 2024 bbthbn.exe 39 PID 2024 wrote to memory of 2376 2024 bbthbn.exe 39 PID 2024 wrote to memory of 2376 2024 bbthbn.exe 39 PID 2024 wrote to memory of 2376 2024 bbthbn.exe 39 PID 2376 wrote to memory of 1608 2376 7ddpp.exe 40 PID 2376 wrote to memory of 1608 2376 7ddpp.exe 40 PID 2376 wrote to memory of 1608 2376 7ddpp.exe 40 PID 2376 wrote to memory of 1608 2376 7ddpp.exe 40 PID 1608 wrote to memory of 2996 1608 ppdjd.exe 41 PID 1608 wrote to memory of 2996 1608 ppdjd.exe 41 PID 1608 wrote to memory of 2996 1608 ppdjd.exe 41 PID 1608 wrote to memory of 2996 1608 ppdjd.exe 41 PID 2996 wrote to memory of 2924 2996 xrxfxrl.exe 42 PID 2996 wrote to memory of 2924 2996 xrxfxrl.exe 42 PID 2996 wrote to memory of 2924 2996 xrxfxrl.exe 42 PID 2996 wrote to memory of 2924 2996 xrxfxrl.exe 42 PID 2924 wrote to memory of 2704 2924 rlxffll.exe 43 PID 2924 wrote to memory of 2704 2924 rlxffll.exe 43 PID 2924 wrote to memory of 2704 2924 rlxffll.exe 43 PID 2924 wrote to memory of 2704 2924 rlxffll.exe 43 PID 2704 wrote to memory of 2664 2704 1bntbb.exe 44 PID 2704 wrote to memory of 2664 2704 1bntbb.exe 44 PID 2704 wrote to memory of 2664 2704 1bntbb.exe 44 PID 2704 wrote to memory of 2664 2704 1bntbb.exe 44 PID 2664 wrote to memory of 940 2664 hhnnnt.exe 45 PID 2664 wrote to memory of 940 2664 hhnnnt.exe 45 PID 2664 wrote to memory of 940 2664 hhnnnt.exe 45 PID 2664 wrote to memory of 940 2664 hhnnnt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\891307c88d5cabb3b64d6f865db18f9ccae09c5952a8e6389b909de032985643N.exe"C:\Users\Admin\AppData\Local\Temp\891307c88d5cabb3b64d6f865db18f9ccae09c5952a8e6389b909de032985643N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\5ffrxrr.exec:\5ffrxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\bntnnb.exec:\bntnnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\ntnbbt.exec:\ntnbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\7vvvp.exec:\7vvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\3rlllrx.exec:\3rlllrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\1vjdp.exec:\1vjdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\vvpjj.exec:\vvpjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\lllrxxf.exec:\lllrxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\bbthbn.exec:\bbthbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\7ddpp.exec:\7ddpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\ppdjd.exec:\ppdjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\xrxfxrl.exec:\xrxfxrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\rlxffll.exec:\rlxffll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\1bntbb.exec:\1bntbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\hhnnnt.exec:\hhnnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\jjvdj.exec:\jjvdj.exe17⤵
- Executes dropped EXE
PID:940 -
\??\c:\xrlfrlx.exec:\xrlfrlx.exe18⤵
- Executes dropped EXE
PID:496 -
\??\c:\lflflll.exec:\lflflll.exe19⤵
- Executes dropped EXE
PID:1100 -
\??\c:\tthnnn.exec:\tthnnn.exe20⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vvpdd.exec:\vvpdd.exe21⤵
- Executes dropped EXE
PID:2236 -
\??\c:\3dpjj.exec:\3dpjj.exe22⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rlxlllx.exec:\rlxlllx.exe23⤵
- Executes dropped EXE
PID:2272 -
\??\c:\7nhnbh.exec:\7nhnbh.exe24⤵
- Executes dropped EXE
PID:1912 -
\??\c:\5thhnn.exec:\5thhnn.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1636 -
\??\c:\3dvpj.exec:\3dvpj.exe26⤵
- Executes dropped EXE
PID:1812 -
\??\c:\xxllrll.exec:\xxllrll.exe27⤵
- Executes dropped EXE
PID:1224 -
\??\c:\xxfxxxf.exec:\xxfxxxf.exe28⤵
- Executes dropped EXE
PID:2536 -
\??\c:\tnbhtn.exec:\tnbhtn.exe29⤵
- Executes dropped EXE
PID:2524 -
\??\c:\vdpvv.exec:\vdpvv.exe30⤵
- Executes dropped EXE
PID:1268 -
\??\c:\1xfrlll.exec:\1xfrlll.exe31⤵
- Executes dropped EXE
PID:288 -
\??\c:\5frrrrr.exec:\5frrrrr.exe32⤵
- Executes dropped EXE
PID:2684 -
\??\c:\7bhtbb.exec:\7bhtbb.exe33⤵
- Executes dropped EXE
PID:2896 -
\??\c:\tnbbbb.exec:\tnbbbb.exe34⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ddjdp.exec:\ddjdp.exe35⤵
- Executes dropped EXE
PID:2124 -
\??\c:\dvvpp.exec:\dvvpp.exe36⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xrfrrxl.exec:\xrfrrxl.exe37⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rrllffr.exec:\rrllffr.exe38⤵
- Executes dropped EXE
PID:2172 -
\??\c:\5htnnh.exec:\5htnnh.exe39⤵
- Executes dropped EXE
PID:2692 -
\??\c:\3bntnn.exec:\3bntnn.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\vppjp.exec:\vppjp.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2620 -
\??\c:\jdvpp.exec:\jdvpp.exe42⤵
- Executes dropped EXE
PID:2660 -
\??\c:\xxfrlfx.exec:\xxfrlfx.exe43⤵
- Executes dropped EXE
PID:2656 -
\??\c:\htbbhb.exec:\htbbhb.exe44⤵
- Executes dropped EXE
PID:2784 -
\??\c:\nhttbb.exec:\nhttbb.exe45⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jjppv.exec:\jjppv.exe46⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ddjjd.exec:\ddjjd.exe47⤵
- Executes dropped EXE
PID:1132 -
\??\c:\7xrxffl.exec:\7xrxffl.exe48⤵
- Executes dropped EXE
PID:2996 -
\??\c:\7fxrrlr.exec:\7fxrrlr.exe49⤵
- Executes dropped EXE
PID:2952 -
\??\c:\1nbnnt.exec:\1nbnnt.exe50⤵
- Executes dropped EXE
PID:2924 -
\??\c:\nbhbhb.exec:\nbhbhb.exe51⤵
- Executes dropped EXE
PID:2704 -
\??\c:\5djvp.exec:\5djvp.exe52⤵
- Executes dropped EXE
PID:1784 -
\??\c:\ddppv.exec:\ddppv.exe53⤵
- Executes dropped EXE
PID:2416 -
\??\c:\1lffrxl.exec:\1lffrxl.exe54⤵
- Executes dropped EXE
PID:1052 -
\??\c:\fxffrlx.exec:\fxffrlx.exe55⤵
- Executes dropped EXE
PID:2484 -
\??\c:\bbhhhn.exec:\bbhhhn.exe56⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nhbbht.exec:\nhbbht.exe57⤵
- Executes dropped EXE
PID:2072 -
\??\c:\xffflrx.exec:\xffflrx.exe58⤵
- Executes dropped EXE
PID:1120 -
\??\c:\rrfllrf.exec:\rrfllrf.exe59⤵
- Executes dropped EXE
PID:1952 -
\??\c:\tbthth.exec:\tbthth.exe60⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hnhhbh.exec:\hnhhbh.exe61⤵
- Executes dropped EXE
PID:1596 -
\??\c:\3pjpd.exec:\3pjpd.exe62⤵
- Executes dropped EXE
PID:884 -
\??\c:\jjvvd.exec:\jjvvd.exe63⤵
- Executes dropped EXE
PID:1912 -
\??\c:\rrrlrxl.exec:\rrrlrxl.exe64⤵
- Executes dropped EXE
PID:1636 -
\??\c:\xxlxrxf.exec:\xxlxrxf.exe65⤵
- Executes dropped EXE
PID:1812 -
\??\c:\nnhbth.exec:\nnhbth.exe66⤵PID:1008
-
\??\c:\hbttbb.exec:\hbttbb.exe67⤵PID:2292
-
\??\c:\1jpdj.exec:\1jpdj.exe68⤵PID:2536
-
\??\c:\pvpdv.exec:\pvpdv.exe69⤵PID:1108
-
\??\c:\lfllffr.exec:\lfllffr.exe70⤵PID:2960
-
\??\c:\lfrxflx.exec:\lfrxflx.exe71⤵PID:1452
-
\??\c:\9bntnt.exec:\9bntnt.exe72⤵PID:288
-
\??\c:\bbntbn.exec:\bbntbn.exe73⤵PID:2956
-
\??\c:\vvdjd.exec:\vvdjd.exe74⤵PID:2752
-
\??\c:\ddvvd.exec:\ddvvd.exe75⤵PID:2760
-
\??\c:\3fxxxxf.exec:\3fxxxxf.exe76⤵PID:2064
-
\??\c:\rrlxlxf.exec:\rrlxlxf.exe77⤵PID:2124
-
\??\c:\7hthnb.exec:\7hthnb.exe78⤵PID:2768
-
\??\c:\ttntbh.exec:\ttntbh.exe79⤵PID:2968
-
\??\c:\vdvpd.exec:\vdvpd.exe80⤵PID:2892
-
\??\c:\1rxlfrf.exec:\1rxlfrf.exe81⤵PID:2692
-
\??\c:\llxrfrl.exec:\llxrfrl.exe82⤵PID:2920
-
\??\c:\hhhtht.exec:\hhhtht.exe83⤵PID:2620
-
\??\c:\1htbhn.exec:\1htbhn.exe84⤵PID:2884
-
\??\c:\9jjpv.exec:\9jjpv.exe85⤵PID:3060
-
\??\c:\pvvdd.exec:\pvvdd.exe86⤵PID:3048
-
\??\c:\jjvvp.exec:\jjvvp.exe87⤵PID:1816
-
\??\c:\llxxffr.exec:\llxxffr.exe88⤵PID:1320
-
\??\c:\llfflxr.exec:\llfflxr.exe89⤵PID:3000
-
\??\c:\hbthbn.exec:\hbthbn.exe90⤵PID:1996
-
\??\c:\tbntbb.exec:\tbntbb.exe91⤵PID:2580
-
\??\c:\jpppd.exec:\jpppd.exe92⤵PID:2164
-
\??\c:\jjjvd.exec:\jjjvd.exe93⤵PID:2924
-
\??\c:\3xrrxfl.exec:\3xrrxfl.exe94⤵PID:2084
-
\??\c:\flflxlf.exec:\flflxlf.exe95⤵PID:940
-
\??\c:\htnbtt.exec:\htnbtt.exe96⤵PID:2152
-
\??\c:\3httbb.exec:\3httbb.exe97⤵PID:2848
-
\??\c:\ppjjp.exec:\ppjjp.exe98⤵PID:1100
-
\??\c:\3dpjp.exec:\3dpjp.exe99⤵PID:1208
-
\??\c:\lrlfrxr.exec:\lrlfrxr.exe100⤵PID:1972
-
\??\c:\flflrxr.exec:\flflrxr.exe101⤵PID:2396
-
\??\c:\9hbbhn.exec:\9hbbhn.exe102⤵PID:2384
-
\??\c:\bbtthh.exec:\bbtthh.exe103⤵PID:1628
-
\??\c:\1dvdj.exec:\1dvdj.exe104⤵PID:2208
-
\??\c:\jdpdp.exec:\jdpdp.exe105⤵PID:2128
-
\??\c:\ffflxfl.exec:\ffflxfl.exe106⤵PID:768
-
\??\c:\3rfflfr.exec:\3rfflfr.exe107⤵PID:1356
-
\??\c:\1nthtb.exec:\1nthtb.exe108⤵PID:2496
-
\??\c:\7bhttb.exec:\7bhttb.exe109⤵PID:1796
-
\??\c:\btbbtb.exec:\btbbtb.exe110⤵PID:2092
-
\??\c:\pvjpp.exec:\pvjpp.exe111⤵PID:608
-
\??\c:\1vpvv.exec:\1vpvv.exe112⤵PID:352
-
\??\c:\llfxxfl.exec:\llfxxfl.exe113⤵PID:856
-
\??\c:\xxfrxxl.exec:\xxfrxxl.exe114⤵PID:1220
-
\??\c:\ntnbtt.exec:\ntnbtt.exe115⤵PID:2792
-
\??\c:\thbhbh.exec:\thbhbh.exe116⤵PID:2900
-
\??\c:\3jjpd.exec:\3jjpd.exe117⤵PID:2828
-
\??\c:\1jjvd.exec:\1jjvd.exe118⤵PID:1992
-
\??\c:\lfxfrxf.exec:\lfxfrxf.exe119⤵PID:2972
-
\??\c:\xrflrxl.exec:\xrflrxl.exe120⤵PID:2844
-
\??\c:\nnbhtt.exec:\nnbhtt.exe121⤵PID:1552
-
\??\c:\btnttn.exec:\btnttn.exe122⤵PID:2640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-