Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 06:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d5b5b772ac88a4bc6a6b5a564e714bebd76f758e0bae2853695f5e63c219ded9N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
d5b5b772ac88a4bc6a6b5a564e714bebd76f758e0bae2853695f5e63c219ded9N.exe
-
Size
114KB
-
MD5
afa8d4eed3c6d08a7965b2c5831f8800
-
SHA1
73b7a3abe76b1b6d2331cea87c9f66f18d5b3bd2
-
SHA256
d5b5b772ac88a4bc6a6b5a564e714bebd76f758e0bae2853695f5e63c219ded9
-
SHA512
91505cd5157738cfe6150cc0579c3a0ab654c3fafd4b2b4063c3d7513af3f94685aa5592910e62831e726a1eb4f73606156cbbe7acaae67fcadd1b60c7f53328
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afowpDyJo1ZFtq:n3C9BRW0j/wtyJQq
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3276-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-44-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4812-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4336-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3788-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4104 xrxxffl.exe 1460 7bhnnh.exe 3548 dvddd.exe 5004 lrxxfxf.exe 4812 lxxxrrl.exe 4056 bbhhnt.exe 912 fxxrlfr.exe 1400 9ntnth.exe 4336 pjjdd.exe 2896 5pjdv.exe 3788 fffxfxf.exe 752 5bhhhn.exe 3064 dvdvp.exe 4876 rllfrrf.exe 1452 xflllff.exe 1084 9bhhhh.exe 1156 pddvv.exe 1128 fxrlffx.exe 3628 htbbbh.exe 1448 vvddv.exe 2224 fxxxrrr.exe 4348 hbbtnt.exe 5064 1dpjj.exe 3160 frxrllf.exe 4444 3hhbbb.exe 1704 hbbtbb.exe 352 djppj.exe 432 7vvpp.exe 3156 5flfffl.exe 4720 vjvdv.exe 2988 dvvjd.exe 1072 htbtbb.exe 3360 9bhhbb.exe 4204 jpvjd.exe 2132 xlrffff.exe 1692 bbttnb.exe 5024 jpvvd.exe 3808 xlrrffx.exe 3872 nnthbt.exe 2536 dvvdv.exe 3388 xlfffxf.exe 1592 tnttnb.exe 2228 dvjjv.exe 1736 1frfxrl.exe 3668 5ntttb.exe 4068 lxfxxxr.exe 316 bnbbbt.exe 2268 djpjj.exe 4396 vppjd.exe 2664 xxfxffl.exe 920 9hhhnb.exe 5116 nthbbb.exe 2056 jdjdj.exe 3844 rlllxxr.exe 1228 lrrrrrr.exe 3300 9bhnhn.exe 4812 pdpjj.exe 3104 dvppd.exe 1552 lrlfffx.exe 4424 tnntnn.exe 8 jdpjj.exe 1400 hbhbtn.exe 2316 tbhbtt.exe 2900 jdvjd.exe -
resource yara_rule behavioral2/memory/3276-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3548-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3788-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3276 wrote to memory of 4104 3276 d5b5b772ac88a4bc6a6b5a564e714bebd76f758e0bae2853695f5e63c219ded9N.exe 81 PID 3276 wrote to memory of 4104 3276 d5b5b772ac88a4bc6a6b5a564e714bebd76f758e0bae2853695f5e63c219ded9N.exe 81 PID 3276 wrote to memory of 4104 3276 d5b5b772ac88a4bc6a6b5a564e714bebd76f758e0bae2853695f5e63c219ded9N.exe 81 PID 4104 wrote to memory of 1460 4104 xrxxffl.exe 82 PID 4104 wrote to memory of 1460 4104 xrxxffl.exe 82 PID 4104 wrote to memory of 1460 4104 xrxxffl.exe 82 PID 1460 wrote to memory of 3548 1460 7bhnnh.exe 83 PID 1460 wrote to memory of 3548 1460 7bhnnh.exe 83 PID 1460 wrote to memory of 3548 1460 7bhnnh.exe 83 PID 3548 wrote to memory of 5004 3548 dvddd.exe 84 PID 3548 wrote to memory of 5004 3548 dvddd.exe 84 PID 3548 wrote to memory of 5004 3548 dvddd.exe 84 PID 5004 wrote to memory of 4812 5004 lrxxfxf.exe 85 PID 5004 wrote to memory of 4812 5004 lrxxfxf.exe 85 PID 5004 wrote to memory of 4812 5004 lrxxfxf.exe 85 PID 4812 wrote to memory of 4056 4812 lxxxrrl.exe 86 PID 4812 wrote to memory of 4056 4812 lxxxrrl.exe 86 PID 4812 wrote to memory of 4056 4812 lxxxrrl.exe 86 PID 4056 wrote to memory of 912 4056 bbhhnt.exe 87 PID 4056 wrote to memory of 912 4056 bbhhnt.exe 87 PID 4056 wrote to memory of 912 4056 bbhhnt.exe 87 PID 912 wrote to memory of 1400 912 fxxrlfr.exe 88 PID 912 wrote to memory of 1400 912 fxxrlfr.exe 88 PID 912 wrote to memory of 1400 912 fxxrlfr.exe 88 PID 1400 wrote to memory of 4336 1400 9ntnth.exe 89 PID 1400 wrote to memory of 4336 1400 9ntnth.exe 89 PID 1400 wrote to memory of 4336 1400 9ntnth.exe 89 PID 4336 wrote to memory of 2896 4336 pjjdd.exe 90 PID 4336 wrote to memory of 2896 4336 pjjdd.exe 90 PID 4336 wrote to memory of 2896 4336 pjjdd.exe 90 PID 2896 wrote to memory of 3788 2896 5pjdv.exe 91 PID 2896 wrote to memory of 3788 2896 5pjdv.exe 91 PID 2896 wrote to memory of 3788 2896 5pjdv.exe 91 PID 3788 wrote to memory of 752 3788 fffxfxf.exe 92 PID 3788 wrote to memory of 752 3788 fffxfxf.exe 92 PID 3788 wrote to memory of 752 3788 fffxfxf.exe 92 PID 752 wrote to memory of 3064 752 5bhhhn.exe 93 PID 752 wrote to memory of 3064 752 5bhhhn.exe 93 PID 752 wrote to memory of 3064 752 5bhhhn.exe 93 PID 3064 wrote to memory of 4876 3064 dvdvp.exe 94 PID 3064 wrote to memory of 4876 3064 dvdvp.exe 94 PID 3064 wrote to memory of 4876 3064 dvdvp.exe 94 PID 4876 wrote to memory of 1452 4876 rllfrrf.exe 95 PID 4876 wrote to memory of 1452 4876 rllfrrf.exe 95 PID 4876 wrote to memory of 1452 4876 rllfrrf.exe 95 PID 1452 wrote to memory of 1084 1452 xflllff.exe 96 PID 1452 wrote to memory of 1084 1452 xflllff.exe 96 PID 1452 wrote to memory of 1084 1452 xflllff.exe 96 PID 1084 wrote to memory of 1156 1084 9bhhhh.exe 97 PID 1084 wrote to memory of 1156 1084 9bhhhh.exe 97 PID 1084 wrote to memory of 1156 1084 9bhhhh.exe 97 PID 1156 wrote to memory of 1128 1156 pddvv.exe 98 PID 1156 wrote to memory of 1128 1156 pddvv.exe 98 PID 1156 wrote to memory of 1128 1156 pddvv.exe 98 PID 1128 wrote to memory of 3628 1128 fxrlffx.exe 99 PID 1128 wrote to memory of 3628 1128 fxrlffx.exe 99 PID 1128 wrote to memory of 3628 1128 fxrlffx.exe 99 PID 3628 wrote to memory of 1448 3628 htbbbh.exe 100 PID 3628 wrote to memory of 1448 3628 htbbbh.exe 100 PID 3628 wrote to memory of 1448 3628 htbbbh.exe 100 PID 1448 wrote to memory of 2224 1448 vvddv.exe 101 PID 1448 wrote to memory of 2224 1448 vvddv.exe 101 PID 1448 wrote to memory of 2224 1448 vvddv.exe 101 PID 2224 wrote to memory of 4348 2224 fxxxrrr.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5b5b772ac88a4bc6a6b5a564e714bebd76f758e0bae2853695f5e63c219ded9N.exe"C:\Users\Admin\AppData\Local\Temp\d5b5b772ac88a4bc6a6b5a564e714bebd76f758e0bae2853695f5e63c219ded9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\xrxxffl.exec:\xrxxffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\7bhnnh.exec:\7bhnnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\dvddd.exec:\dvddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\lrxxfxf.exec:\lrxxfxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\lxxxrrl.exec:\lxxxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\bbhhnt.exec:\bbhhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\fxxrlfr.exec:\fxxrlfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\9ntnth.exec:\9ntnth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\pjjdd.exec:\pjjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\5pjdv.exec:\5pjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\fffxfxf.exec:\fffxfxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\5bhhhn.exec:\5bhhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\dvdvp.exec:\dvdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\rllfrrf.exec:\rllfrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\xflllff.exec:\xflllff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\9bhhhh.exec:\9bhhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\pddvv.exec:\pddvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\fxrlffx.exec:\fxrlffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\htbbbh.exec:\htbbbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\vvddv.exec:\vvddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\hbbtnt.exec:\hbbtnt.exe23⤵
- Executes dropped EXE
PID:4348 -
\??\c:\1dpjj.exec:\1dpjj.exe24⤵
- Executes dropped EXE
PID:5064 -
\??\c:\frxrllf.exec:\frxrllf.exe25⤵
- Executes dropped EXE
PID:3160 -
\??\c:\3hhbbb.exec:\3hhbbb.exe26⤵
- Executes dropped EXE
PID:4444 -
\??\c:\hbbtbb.exec:\hbbtbb.exe27⤵
- Executes dropped EXE
PID:1704 -
\??\c:\djppj.exec:\djppj.exe28⤵
- Executes dropped EXE
PID:352 -
\??\c:\7vvpp.exec:\7vvpp.exe29⤵
- Executes dropped EXE
PID:432 -
\??\c:\5flfffl.exec:\5flfffl.exe30⤵
- Executes dropped EXE
PID:3156 -
\??\c:\vjvdv.exec:\vjvdv.exe31⤵
- Executes dropped EXE
PID:4720 -
\??\c:\dvvjd.exec:\dvvjd.exe32⤵
- Executes dropped EXE
PID:2988 -
\??\c:\htbtbb.exec:\htbtbb.exe33⤵
- Executes dropped EXE
PID:1072 -
\??\c:\9bhhbb.exec:\9bhhbb.exe34⤵
- Executes dropped EXE
PID:3360 -
\??\c:\jpvjd.exec:\jpvjd.exe35⤵
- Executes dropped EXE
PID:4204 -
\??\c:\xlrffff.exec:\xlrffff.exe36⤵
- Executes dropped EXE
PID:2132 -
\??\c:\bbttnb.exec:\bbttnb.exe37⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jpvvd.exec:\jpvvd.exe38⤵
- Executes dropped EXE
PID:5024 -
\??\c:\xlrrffx.exec:\xlrrffx.exe39⤵
- Executes dropped EXE
PID:3808 -
\??\c:\nnthbt.exec:\nnthbt.exe40⤵
- Executes dropped EXE
PID:3872 -
\??\c:\dvvdv.exec:\dvvdv.exe41⤵
- Executes dropped EXE
PID:2536 -
\??\c:\xlfffxf.exec:\xlfffxf.exe42⤵
- Executes dropped EXE
PID:3388 -
\??\c:\tnttnb.exec:\tnttnb.exe43⤵
- Executes dropped EXE
PID:1592 -
\??\c:\dvjjv.exec:\dvjjv.exe44⤵
- Executes dropped EXE
PID:2228 -
\??\c:\1frfxrl.exec:\1frfxrl.exe45⤵
- Executes dropped EXE
PID:1736 -
\??\c:\5ntttb.exec:\5ntttb.exe46⤵
- Executes dropped EXE
PID:3668 -
\??\c:\lxfxxxr.exec:\lxfxxxr.exe47⤵
- Executes dropped EXE
PID:4068 -
\??\c:\bnbbbt.exec:\bnbbbt.exe48⤵
- Executes dropped EXE
PID:316 -
\??\c:\djpjj.exec:\djpjj.exe49⤵
- Executes dropped EXE
PID:2268 -
\??\c:\vppjd.exec:\vppjd.exe50⤵
- Executes dropped EXE
PID:4396 -
\??\c:\xxfxffl.exec:\xxfxffl.exe51⤵
- Executes dropped EXE
PID:2664 -
\??\c:\9hhhnb.exec:\9hhhnb.exe52⤵
- Executes dropped EXE
PID:920 -
\??\c:\nthbbb.exec:\nthbbb.exe53⤵
- Executes dropped EXE
PID:5116 -
\??\c:\jdjdj.exec:\jdjdj.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2056 -
\??\c:\rlllxxr.exec:\rlllxxr.exe55⤵
- Executes dropped EXE
PID:3844 -
\??\c:\lrrrrrr.exec:\lrrrrrr.exe56⤵
- Executes dropped EXE
PID:1228 -
\??\c:\9bhnhn.exec:\9bhnhn.exe57⤵
- Executes dropped EXE
PID:3300 -
\??\c:\pdpjj.exec:\pdpjj.exe58⤵
- Executes dropped EXE
PID:4812 -
\??\c:\dvppd.exec:\dvppd.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3104 -
\??\c:\lrlfffx.exec:\lrlfffx.exe60⤵
- Executes dropped EXE
PID:1552 -
\??\c:\tnntnn.exec:\tnntnn.exe61⤵
- Executes dropped EXE
PID:4424 -
\??\c:\jdpjj.exec:\jdpjj.exe62⤵
- Executes dropped EXE
PID:8 -
\??\c:\hbhbtn.exec:\hbhbtn.exe63⤵
- Executes dropped EXE
PID:1400 -
\??\c:\tbhbtt.exec:\tbhbtt.exe64⤵
- Executes dropped EXE
PID:2316 -
\??\c:\jdvjd.exec:\jdvjd.exe65⤵
- Executes dropped EXE
PID:2900 -
\??\c:\3rfrrrr.exec:\3rfrrrr.exe66⤵PID:4932
-
\??\c:\rlllrrx.exec:\rlllrrx.exe67⤵PID:668
-
\??\c:\7bhhhn.exec:\7bhhhn.exe68⤵PID:5008
-
\??\c:\jjppj.exec:\jjppj.exe69⤵PID:5072
-
\??\c:\dpjdv.exec:\dpjdv.exe70⤵PID:4916
-
\??\c:\5rrrrxr.exec:\5rrrrxr.exe71⤵PID:4036
-
\??\c:\ttbbht.exec:\ttbbht.exe72⤵PID:1068
-
\??\c:\nhbtnn.exec:\nhbtnn.exe73⤵PID:2908
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe74⤵PID:2508
-
\??\c:\frrlfxr.exec:\frrlfxr.exe75⤵PID:1004
-
\??\c:\9nbtbb.exec:\9nbtbb.exe76⤵PID:3524
-
\??\c:\thnnnn.exec:\thnnnn.exe77⤵PID:3628
-
\??\c:\rxffffx.exec:\rxffffx.exe78⤵PID:3852
-
\??\c:\xlrlflf.exec:\xlrlflf.exe79⤵PID:2340
-
\??\c:\1btnhh.exec:\1btnhh.exe80⤵PID:4348
-
\??\c:\btbtnn.exec:\btbtnn.exe81⤵PID:3960
-
\??\c:\vvdvp.exec:\vvdvp.exe82⤵PID:3408
-
\??\c:\xlllrxr.exec:\xlllrxr.exe83⤵PID:2264
-
\??\c:\5bhhbn.exec:\5bhhbn.exe84⤵PID:4860
-
\??\c:\tnnhnt.exec:\tnnhnt.exe85⤵PID:212
-
\??\c:\jvvvv.exec:\jvvvv.exe86⤵PID:2936
-
\??\c:\llrrxxx.exec:\llrrxxx.exe87⤵PID:224
-
\??\c:\5rfxllr.exec:\5rfxllr.exe88⤵PID:432
-
\??\c:\bntbtt.exec:\bntbtt.exe89⤵PID:1784
-
\??\c:\dvvpj.exec:\dvvpj.exe90⤵PID:3028
-
\??\c:\pjjjd.exec:\pjjjd.exe91⤵PID:3184
-
\??\c:\lffxrrr.exec:\lffxrrr.exe92⤵PID:1820
-
\??\c:\nhnnnn.exec:\nhnnnn.exe93⤵PID:3092
-
\??\c:\pvvvp.exec:\pvvvp.exe94⤵PID:4164
-
\??\c:\jddvp.exec:\jddvp.exe95⤵PID:1992
-
\??\c:\lflfxff.exec:\lflfxff.exe96⤵PID:2320
-
\??\c:\7rrlrrl.exec:\7rrlrrl.exe97⤵PID:4968
-
\??\c:\nbbnht.exec:\nbbnht.exe98⤵PID:4416
-
\??\c:\djvpj.exec:\djvpj.exe99⤵PID:5028
-
\??\c:\3pvvv.exec:\3pvvv.exe100⤵PID:4288
-
\??\c:\rrxxrrl.exec:\rrxxrrl.exe101⤵PID:4868
-
\??\c:\nhttnt.exec:\nhttnt.exe102⤵PID:4872
-
\??\c:\nhhnhn.exec:\nhhnhn.exe103⤵PID:3644
-
\??\c:\9vjdd.exec:\9vjdd.exe104⤵PID:2052
-
\??\c:\thnthh.exec:\thnthh.exe105⤵PID:3652
-
\??\c:\bnnhtt.exec:\bnnhtt.exe106⤵PID:540
-
\??\c:\dvvpj.exec:\dvvpj.exe107⤵PID:1432
-
\??\c:\1vddp.exec:\1vddp.exe108⤵PID:4304
-
\??\c:\ffxlxrf.exec:\ffxlxrf.exe109⤵PID:2268
-
\??\c:\9xxfxxr.exec:\9xxfxxr.exe110⤵PID:1296
-
\??\c:\hntnnn.exec:\hntnnn.exe111⤵PID:832
-
\??\c:\jvddv.exec:\jvddv.exe112⤵PID:1212
-
\??\c:\jdddv.exec:\jdddv.exe113⤵PID:3672
-
\??\c:\fflfllr.exec:\fflfllr.exe114⤵PID:5004
-
\??\c:\7rrlfll.exec:\7rrlfll.exe115⤵PID:3300
-
\??\c:\1ttbbb.exec:\1ttbbb.exe116⤵PID:4812
-
\??\c:\tbhbbb.exec:\tbhbbb.exe117⤵PID:1304
-
\??\c:\5ppjj.exec:\5ppjj.exe118⤵PID:4084
-
\??\c:\jppjd.exec:\jppjd.exe119⤵PID:4372
-
\??\c:\lfrlxxr.exec:\lfrlxxr.exe120⤵PID:4496
-
\??\c:\5fllffx.exec:\5fllffx.exe121⤵PID:2540
-
\??\c:\1btttt.exec:\1btttt.exe122⤵PID:4840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-