Analysis
-
max time kernel
120s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 06:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
835dbad3eb763155c3f8b935c58d141a70e588c1fa6986c643f8bbfd310a770fN.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
835dbad3eb763155c3f8b935c58d141a70e588c1fa6986c643f8bbfd310a770fN.exe
-
Size
64KB
-
MD5
b14b0cd2e4f803c4683e0f2387842220
-
SHA1
6bdc74f881cae50019224f0c408b1176b8cfaead
-
SHA256
835dbad3eb763155c3f8b935c58d141a70e588c1fa6986c643f8bbfd310a770f
-
SHA512
02d40ba4e745f59b933987741344253713f3207b2dd49d962d18bd06080a9eec067800c9ded3c9980b314764988a7f5200d9c7d34f9bdf18cbc121fd94ded7d9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxiP:ymb3NkkiQ3mdBjF0y7kbK
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3100-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1044-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/952-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5040 jvddd.exe 3188 dpjpv.exe 3812 fflxrxl.exe 4352 3hntnn.exe 4772 5hnnhn.exe 5108 frlfxxf.exe 2132 bbnnhb.exe 4428 pjdvj.exe 4112 xxxxfrr.exe 3496 htbtbn.exe 1044 jjvjd.exe 5032 7xrlxxx.exe 2452 1thbnn.exe 3748 5jvvp.exe 3156 fxxxxrr.exe 2664 flllffx.exe 4952 7btnnn.exe 5008 ppjjj.exe 1828 lfrrxxl.exe 2780 hhtbhh.exe 1856 9thnnb.exe 952 ppvpp.exe 2952 5lrlllf.exe 1460 hbnttb.exe 676 dvjpp.exe 1620 fffffll.exe 2124 1htthh.exe 1908 hbttnb.exe 2752 jvvdv.exe 3048 vdppp.exe 4272 lffxrxx.exe 1236 bttttb.exe 3088 jjvpv.exe 4056 pdpvv.exe 3888 7rxfrrl.exe 1112 lrrxfxl.exe 1304 5bthtb.exe 3256 ppvpp.exe 1524 flxffxl.exe 2060 fxfxxfx.exe 3548 nnnnnt.exe 2604 7thhhn.exe 3096 jjpvp.exe 3420 ppvpv.exe 2920 fffffll.exe 4924 ntbhhh.exe 4292 tnhhbb.exe 4804 vvvdv.exe 2684 xxrffff.exe 5116 pvjpp.exe 4324 bbnttb.exe 4712 pjvvd.exe 2000 1lrxxxx.exe 3032 rrxfflr.exe 3496 7hnnnn.exe 4328 3pvvd.exe 3160 ttbhbh.exe 1000 nhtbtb.exe 3668 5dppj.exe 1364 7jpvp.exe 3656 xxffxff.exe 2768 frrrrrr.exe 3688 1bbttt.exe 1476 pdjjd.exe -
resource yara_rule behavioral2/memory/3100-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1044-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1828-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1856-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/952-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlffrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3100 wrote to memory of 5040 3100 835dbad3eb763155c3f8b935c58d141a70e588c1fa6986c643f8bbfd310a770fN.exe 82 PID 3100 wrote to memory of 5040 3100 835dbad3eb763155c3f8b935c58d141a70e588c1fa6986c643f8bbfd310a770fN.exe 82 PID 3100 wrote to memory of 5040 3100 835dbad3eb763155c3f8b935c58d141a70e588c1fa6986c643f8bbfd310a770fN.exe 82 PID 5040 wrote to memory of 3188 5040 jvddd.exe 83 PID 5040 wrote to memory of 3188 5040 jvddd.exe 83 PID 5040 wrote to memory of 3188 5040 jvddd.exe 83 PID 3188 wrote to memory of 3812 3188 dpjpv.exe 84 PID 3188 wrote to memory of 3812 3188 dpjpv.exe 84 PID 3188 wrote to memory of 3812 3188 dpjpv.exe 84 PID 3812 wrote to memory of 4352 3812 fflxrxl.exe 85 PID 3812 wrote to memory of 4352 3812 fflxrxl.exe 85 PID 3812 wrote to memory of 4352 3812 fflxrxl.exe 85 PID 4352 wrote to memory of 4772 4352 3hntnn.exe 86 PID 4352 wrote to memory of 4772 4352 3hntnn.exe 86 PID 4352 wrote to memory of 4772 4352 3hntnn.exe 86 PID 4772 wrote to memory of 5108 4772 5hnnhn.exe 87 PID 4772 wrote to memory of 5108 4772 5hnnhn.exe 87 PID 4772 wrote to memory of 5108 4772 5hnnhn.exe 87 PID 5108 wrote to memory of 2132 5108 frlfxxf.exe 88 PID 5108 wrote to memory of 2132 5108 frlfxxf.exe 88 PID 5108 wrote to memory of 2132 5108 frlfxxf.exe 88 PID 2132 wrote to memory of 4428 2132 bbnnhb.exe 89 PID 2132 wrote to memory of 4428 2132 bbnnhb.exe 89 PID 2132 wrote to memory of 4428 2132 bbnnhb.exe 89 PID 4428 wrote to memory of 4112 4428 pjdvj.exe 90 PID 4428 wrote to memory of 4112 4428 pjdvj.exe 90 PID 4428 wrote to memory of 4112 4428 pjdvj.exe 90 PID 4112 wrote to memory of 3496 4112 xxxxfrr.exe 91 PID 4112 wrote to memory of 3496 4112 xxxxfrr.exe 91 PID 4112 wrote to memory of 3496 4112 xxxxfrr.exe 91 PID 3496 wrote to memory of 1044 3496 htbtbn.exe 92 PID 3496 wrote to memory of 1044 3496 htbtbn.exe 92 PID 3496 wrote to memory of 1044 3496 htbtbn.exe 92 PID 1044 wrote to memory of 5032 1044 jjvjd.exe 93 PID 1044 wrote to memory of 5032 1044 jjvjd.exe 93 PID 1044 wrote to memory of 5032 1044 jjvjd.exe 93 PID 5032 wrote to memory of 2452 5032 7xrlxxx.exe 94 PID 5032 wrote to memory of 2452 5032 7xrlxxx.exe 94 PID 5032 wrote to memory of 2452 5032 7xrlxxx.exe 94 PID 2452 wrote to memory of 3748 2452 1thbnn.exe 95 PID 2452 wrote to memory of 3748 2452 1thbnn.exe 95 PID 2452 wrote to memory of 3748 2452 1thbnn.exe 95 PID 3748 wrote to memory of 3156 3748 5jvvp.exe 96 PID 3748 wrote to memory of 3156 3748 5jvvp.exe 96 PID 3748 wrote to memory of 3156 3748 5jvvp.exe 96 PID 3156 wrote to memory of 2664 3156 fxxxxrr.exe 97 PID 3156 wrote to memory of 2664 3156 fxxxxrr.exe 97 PID 3156 wrote to memory of 2664 3156 fxxxxrr.exe 97 PID 2664 wrote to memory of 4952 2664 flllffx.exe 98 PID 2664 wrote to memory of 4952 2664 flllffx.exe 98 PID 2664 wrote to memory of 4952 2664 flllffx.exe 98 PID 4952 wrote to memory of 5008 4952 7btnnn.exe 99 PID 4952 wrote to memory of 5008 4952 7btnnn.exe 99 PID 4952 wrote to memory of 5008 4952 7btnnn.exe 99 PID 5008 wrote to memory of 1828 5008 ppjjj.exe 100 PID 5008 wrote to memory of 1828 5008 ppjjj.exe 100 PID 5008 wrote to memory of 1828 5008 ppjjj.exe 100 PID 1828 wrote to memory of 2780 1828 lfrrxxl.exe 101 PID 1828 wrote to memory of 2780 1828 lfrrxxl.exe 101 PID 1828 wrote to memory of 2780 1828 lfrrxxl.exe 101 PID 2780 wrote to memory of 1856 2780 hhtbhh.exe 102 PID 2780 wrote to memory of 1856 2780 hhtbhh.exe 102 PID 2780 wrote to memory of 1856 2780 hhtbhh.exe 102 PID 1856 wrote to memory of 952 1856 9thnnb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\835dbad3eb763155c3f8b935c58d141a70e588c1fa6986c643f8bbfd310a770fN.exe"C:\Users\Admin\AppData\Local\Temp\835dbad3eb763155c3f8b935c58d141a70e588c1fa6986c643f8bbfd310a770fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\jvddd.exec:\jvddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\dpjpv.exec:\dpjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\fflxrxl.exec:\fflxrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\3hntnn.exec:\3hntnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\5hnnhn.exec:\5hnnhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\frlfxxf.exec:\frlfxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\bbnnhb.exec:\bbnnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\pjdvj.exec:\pjdvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\xxxxfrr.exec:\xxxxfrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\htbtbn.exec:\htbtbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\jjvjd.exec:\jjvjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\7xrlxxx.exec:\7xrlxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\1thbnn.exec:\1thbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\5jvvp.exec:\5jvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\fxxxxrr.exec:\fxxxxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\flllffx.exec:\flllffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\7btnnn.exec:\7btnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\ppjjj.exec:\ppjjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\hhtbhh.exec:\hhtbhh.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\9thnnb.exec:\9thnnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\ppvpp.exec:\ppvpp.exe23⤵
- Executes dropped EXE
PID:952 -
\??\c:\5lrlllf.exec:\5lrlllf.exe24⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hbnttb.exec:\hbnttb.exe25⤵
- Executes dropped EXE
PID:1460 -
\??\c:\dvjpp.exec:\dvjpp.exe26⤵
- Executes dropped EXE
PID:676 -
\??\c:\fffffll.exec:\fffffll.exe27⤵
- Executes dropped EXE
PID:1620 -
\??\c:\1htthh.exec:\1htthh.exe28⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hbttnb.exec:\hbttnb.exe29⤵
- Executes dropped EXE
PID:1908 -
\??\c:\jvvdv.exec:\jvvdv.exe30⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vdppp.exec:\vdppp.exe31⤵
- Executes dropped EXE
PID:3048 -
\??\c:\lffxrxx.exec:\lffxrxx.exe32⤵
- Executes dropped EXE
PID:4272 -
\??\c:\bttttb.exec:\bttttb.exe33⤵
- Executes dropped EXE
PID:1236 -
\??\c:\jjvpv.exec:\jjvpv.exe34⤵
- Executes dropped EXE
PID:3088 -
\??\c:\pdpvv.exec:\pdpvv.exe35⤵
- Executes dropped EXE
PID:4056 -
\??\c:\7rxfrrl.exec:\7rxfrrl.exe36⤵
- Executes dropped EXE
PID:3888 -
\??\c:\lrrxfxl.exec:\lrrxfxl.exe37⤵
- Executes dropped EXE
PID:1112 -
\??\c:\5bthtb.exec:\5bthtb.exe38⤵
- Executes dropped EXE
PID:1304 -
\??\c:\ppvpp.exec:\ppvpp.exe39⤵
- Executes dropped EXE
PID:3256 -
\??\c:\flxffxl.exec:\flxffxl.exe40⤵
- Executes dropped EXE
PID:1524 -
\??\c:\fxfxxfx.exec:\fxfxxfx.exe41⤵
- Executes dropped EXE
PID:2060 -
\??\c:\nnnnnt.exec:\nnnnnt.exe42⤵
- Executes dropped EXE
PID:3548 -
\??\c:\7thhhn.exec:\7thhhn.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jjpvp.exec:\jjpvp.exe44⤵
- Executes dropped EXE
PID:3096 -
\??\c:\ppvpv.exec:\ppvpv.exe45⤵
- Executes dropped EXE
PID:3420 -
\??\c:\fffffll.exec:\fffffll.exe46⤵
- Executes dropped EXE
PID:2920 -
\??\c:\ntbhhh.exec:\ntbhhh.exe47⤵
- Executes dropped EXE
PID:4924 -
\??\c:\tnhhbb.exec:\tnhhbb.exe48⤵
- Executes dropped EXE
PID:4292 -
\??\c:\vvvdv.exec:\vvvdv.exe49⤵
- Executes dropped EXE
PID:4804 -
\??\c:\xxrffff.exec:\xxrffff.exe50⤵
- Executes dropped EXE
PID:2684 -
\??\c:\pvjpp.exec:\pvjpp.exe51⤵
- Executes dropped EXE
PID:5116 -
\??\c:\bbnttb.exec:\bbnttb.exe52⤵
- Executes dropped EXE
PID:4324 -
\??\c:\pjvvd.exec:\pjvvd.exe53⤵
- Executes dropped EXE
PID:4712 -
\??\c:\1lrxxxx.exec:\1lrxxxx.exe54⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rrxfflr.exec:\rrxfflr.exe55⤵
- Executes dropped EXE
PID:3032 -
\??\c:\7hnnnn.exec:\7hnnnn.exe56⤵
- Executes dropped EXE
PID:3496 -
\??\c:\3pvvd.exec:\3pvvd.exe57⤵
- Executes dropped EXE
PID:4328 -
\??\c:\ttbhbh.exec:\ttbhbh.exe58⤵
- Executes dropped EXE
PID:3160 -
\??\c:\nhtbtb.exec:\nhtbtb.exe59⤵
- Executes dropped EXE
PID:1000 -
\??\c:\5dppj.exec:\5dppj.exe60⤵
- Executes dropped EXE
PID:3668 -
\??\c:\7jpvp.exec:\7jpvp.exe61⤵
- Executes dropped EXE
PID:1364 -
\??\c:\xxffxff.exec:\xxffxff.exe62⤵
- Executes dropped EXE
PID:3656 -
\??\c:\frrrrrr.exec:\frrrrrr.exe63⤵
- Executes dropped EXE
PID:2768 -
\??\c:\1bbttt.exec:\1bbttt.exe64⤵
- Executes dropped EXE
PID:3688 -
\??\c:\pdjjd.exec:\pdjjd.exe65⤵
- Executes dropped EXE
PID:1476 -
\??\c:\vvvvv.exec:\vvvvv.exe66⤵PID:1428
-
\??\c:\xxlrrxf.exec:\xxlrrxf.exe67⤵PID:2052
-
\??\c:\flfrlff.exec:\flfrlff.exe68⤵PID:2596
-
\??\c:\jjvvj.exec:\jjvvj.exe69⤵PID:4956
-
\??\c:\rfrrlrr.exec:\rfrrlrr.exe70⤵PID:1704
-
\??\c:\rflrfff.exec:\rflrfff.exe71⤵PID:1116
-
\??\c:\tnbhhn.exec:\tnbhhn.exe72⤵PID:936
-
\??\c:\tnbbtb.exec:\tnbbtb.exe73⤵PID:3052
-
\??\c:\dpddp.exec:\dpddp.exe74⤵PID:4508
-
\??\c:\lfrlflr.exec:\lfrlflr.exe75⤵PID:3128
-
\??\c:\lllllrr.exec:\lllllrr.exe76⤵PID:1804
-
\??\c:\bbhbbb.exec:\bbhbbb.exe77⤵PID:1940
-
\??\c:\bbnnhn.exec:\bbnnhn.exe78⤵PID:1548
-
\??\c:\1pjjj.exec:\1pjjj.exe79⤵PID:3768
-
\??\c:\7rflfrr.exec:\7rflfrr.exe80⤵PID:1908
-
\??\c:\5lrxxff.exec:\5lrxxff.exe81⤵PID:2144
-
\??\c:\thnbhn.exec:\thnbhn.exe82⤵PID:876
-
\??\c:\vpppj.exec:\vpppj.exe83⤵PID:2292
-
\??\c:\9flllrr.exec:\9flllrr.exe84⤵PID:3576
-
\??\c:\5xxffff.exec:\5xxffff.exe85⤵PID:5072
-
\??\c:\btbhnb.exec:\btbhnb.exe86⤵PID:4392
-
\??\c:\nbhntt.exec:\nbhntt.exe87⤵PID:3396
-
\??\c:\ppppj.exec:\ppppj.exe88⤵PID:3680
-
\??\c:\jjjjd.exec:\jjjjd.exe89⤵PID:3404
-
\??\c:\xfllrrf.exec:\xfllrrf.exe90⤵PID:4400
-
\??\c:\llllllr.exec:\llllllr.exe91⤵PID:4452
-
\??\c:\ttbbhn.exec:\ttbbhn.exe92⤵PID:3828
-
\??\c:\bhhtnb.exec:\bhhtnb.exe93⤵PID:5040
-
\??\c:\7ppvv.exec:\7ppvv.exe94⤵PID:3964
-
\??\c:\xxffxfx.exec:\xxffxfx.exe95⤵PID:5028
-
\??\c:\rxrxrxf.exec:\rxrxrxf.exe96⤵PID:4736
-
\??\c:\nhnnnn.exec:\nhnnnn.exe97⤵PID:3004
-
\??\c:\1djjv.exec:\1djjv.exe98⤵PID:3796
-
\??\c:\vvjjj.exec:\vvjjj.exe99⤵PID:4748
-
\??\c:\xfllfll.exec:\xfllfll.exe100⤵PID:4292
-
\??\c:\rrllllx.exec:\rrllllx.exe101⤵PID:4436
-
\??\c:\btbbbb.exec:\btbbbb.exe102⤵PID:2132
-
\??\c:\ddddp.exec:\ddddp.exe103⤵PID:3948
-
\??\c:\vjjjd.exec:\vjjjd.exe104⤵PID:1552
-
\??\c:\lrrfrlx.exec:\lrrfrlx.exe105⤵PID:3044
-
\??\c:\hhttnt.exec:\hhttnt.exe106⤵PID:4852
-
\??\c:\1hnnhn.exec:\1hnnhn.exe107⤵PID:1500
-
\??\c:\pdvpp.exec:\pdvpp.exe108⤵PID:224
-
\??\c:\pjppj.exec:\pjppj.exe109⤵PID:2996
-
\??\c:\llrrlxx.exec:\llrrlxx.exe110⤵PID:1044
-
\??\c:\nhbtbh.exec:\nhbtbh.exe111⤵PID:2464
-
\??\c:\9nbbnt.exec:\9nbbnt.exe112⤵PID:3780
-
\??\c:\hbnhhh.exec:\hbnhhh.exe113⤵PID:4580
-
\??\c:\ppjjd.exec:\ppjjd.exe114⤵PID:672
-
\??\c:\rxxxflf.exec:\rxxxflf.exe115⤵
- System Location Discovery: System Language Discovery
PID:1364 -
\??\c:\xfrlxxl.exec:\xfrlxxl.exe116⤵PID:3656
-
\??\c:\nhhhnt.exec:\nhhhnt.exe117⤵PID:2348
-
\??\c:\pdjjj.exec:\pdjjj.exe118⤵PID:5104
-
\??\c:\rrxrllf.exec:\rrxrllf.exe119⤵PID:4620
-
\??\c:\llrrrrr.exec:\llrrrrr.exe120⤵
- System Location Discovery: System Language Discovery
PID:1828 -
\??\c:\nttnnn.exec:\nttnnn.exe121⤵PID:3460
-
\??\c:\ppvvp.exec:\ppvvp.exe122⤵PID:2596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-