Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28-09-2024 03:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
83638009768b9afffd2e650df3363fd1061ff700c965e4206adcbd9e2d3d92e3N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
83638009768b9afffd2e650df3363fd1061ff700c965e4206adcbd9e2d3d92e3N.exe
-
Size
230KB
-
MD5
206d60f3a0dcf6796c167b145e8561b0
-
SHA1
af7bef0f3026a8850b1531afdfd3538d73e4437a
-
SHA256
83638009768b9afffd2e650df3363fd1061ff700c965e4206adcbd9e2d3d92e3
-
SHA512
5a2f9fc274b8b049afd58e476752e99607fc07f15963d606d498d22d64c7715a57650e1ca4e589e2cac043b1fa13b1ee79dbb724d69ec036e686218e2c0c55d2
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLjBeG+4:n3C9BRo7MlrWKo+lxKf
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/3328-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1844-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2688-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1004-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1428-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3976 nbbtnn.exe 4128 vdddp.exe 4940 vpvjj.exe 4436 xxfxxrr.exe 3224 tbhnth.exe 3076 rxlffll.exe 3388 ffxffxf.exe 2428 vpjdv.exe 1844 xflllrr.exe 4396 hbhhhb.exe 468 1bbtbb.exe 3568 dpdvp.exe 1472 9vpjd.exe 2688 btbtnn.exe 1004 nbhtbt.exe 4888 vjpjp.exe 1504 rfffxxx.exe 1704 tntnhh.exe 632 rxlxlxr.exe 3828 nbhtnn.exe 1428 1nhnhn.exe 1368 3jpjd.exe 2968 vjjdp.exe 1856 rlrrlll.exe 764 lxxrlfx.exe 3084 vdpjd.exe 4044 rrrrlll.exe 4268 nntntb.exe 4900 hnttnn.exe 3100 jppjv.exe 1236 lxrxxfl.exe 3952 tntntn.exe 1312 vdppj.exe 3312 fxxrrrl.exe 896 3ffxfxf.exe 1584 bnhtnn.exe 2480 nhnhnh.exe 1488 djppp.exe 3600 lxrlfxl.exe 1336 rrxxrff.exe 4352 nhhbtn.exe 3016 tnhbtb.exe 4984 jvpjv.exe 4776 dpjdv.exe 2020 fxrlxxr.exe 4688 7ffxrrf.exe 808 ttnhbt.exe 4436 jjppp.exe 872 1djvj.exe 2012 fxfxfff.exe 2272 hhnnbb.exe 1888 httnhb.exe 4276 ddddp.exe 2428 5rxrllf.exe 5024 fxxxrrl.exe 4536 nhtnhh.exe 4892 jdddv.exe 1732 pjdvj.exe 4736 lxfxllf.exe 4472 rlxfxfx.exe 5016 thnhbn.exe 4972 9vpvp.exe 1884 vvdvp.exe 1152 fxrlxxx.exe -
resource yara_rule behavioral2/memory/3328-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1844-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1844-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1844-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2688-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1428-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-195-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlxxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3328 wrote to memory of 3976 3328 83638009768b9afffd2e650df3363fd1061ff700c965e4206adcbd9e2d3d92e3N.exe 84 PID 3328 wrote to memory of 3976 3328 83638009768b9afffd2e650df3363fd1061ff700c965e4206adcbd9e2d3d92e3N.exe 84 PID 3328 wrote to memory of 3976 3328 83638009768b9afffd2e650df3363fd1061ff700c965e4206adcbd9e2d3d92e3N.exe 84 PID 3976 wrote to memory of 4128 3976 nbbtnn.exe 85 PID 3976 wrote to memory of 4128 3976 nbbtnn.exe 85 PID 3976 wrote to memory of 4128 3976 nbbtnn.exe 85 PID 4128 wrote to memory of 4940 4128 vdddp.exe 86 PID 4128 wrote to memory of 4940 4128 vdddp.exe 86 PID 4128 wrote to memory of 4940 4128 vdddp.exe 86 PID 4940 wrote to memory of 4436 4940 vpvjj.exe 87 PID 4940 wrote to memory of 4436 4940 vpvjj.exe 87 PID 4940 wrote to memory of 4436 4940 vpvjj.exe 87 PID 4436 wrote to memory of 3224 4436 xxfxxrr.exe 88 PID 4436 wrote to memory of 3224 4436 xxfxxrr.exe 88 PID 4436 wrote to memory of 3224 4436 xxfxxrr.exe 88 PID 3224 wrote to memory of 3076 3224 tbhnth.exe 89 PID 3224 wrote to memory of 3076 3224 tbhnth.exe 89 PID 3224 wrote to memory of 3076 3224 tbhnth.exe 89 PID 3076 wrote to memory of 3388 3076 rxlffll.exe 90 PID 3076 wrote to memory of 3388 3076 rxlffll.exe 90 PID 3076 wrote to memory of 3388 3076 rxlffll.exe 90 PID 3388 wrote to memory of 2428 3388 ffxffxf.exe 91 PID 3388 wrote to memory of 2428 3388 ffxffxf.exe 91 PID 3388 wrote to memory of 2428 3388 ffxffxf.exe 91 PID 2428 wrote to memory of 1844 2428 vpjdv.exe 92 PID 2428 wrote to memory of 1844 2428 vpjdv.exe 92 PID 2428 wrote to memory of 1844 2428 vpjdv.exe 92 PID 1844 wrote to memory of 4396 1844 xflllrr.exe 93 PID 1844 wrote to memory of 4396 1844 xflllrr.exe 93 PID 1844 wrote to memory of 4396 1844 xflllrr.exe 93 PID 4396 wrote to memory of 468 4396 hbhhhb.exe 94 PID 4396 wrote to memory of 468 4396 hbhhhb.exe 94 PID 4396 wrote to memory of 468 4396 hbhhhb.exe 94 PID 468 wrote to memory of 3568 468 1bbtbb.exe 95 PID 468 wrote to memory of 3568 468 1bbtbb.exe 95 PID 468 wrote to memory of 3568 468 1bbtbb.exe 95 PID 3568 wrote to memory of 1472 3568 dpdvp.exe 96 PID 3568 wrote to memory of 1472 3568 dpdvp.exe 96 PID 3568 wrote to memory of 1472 3568 dpdvp.exe 96 PID 1472 wrote to memory of 2688 1472 9vpjd.exe 97 PID 1472 wrote to memory of 2688 1472 9vpjd.exe 97 PID 1472 wrote to memory of 2688 1472 9vpjd.exe 97 PID 2688 wrote to memory of 1004 2688 btbtnn.exe 98 PID 2688 wrote to memory of 1004 2688 btbtnn.exe 98 PID 2688 wrote to memory of 1004 2688 btbtnn.exe 98 PID 1004 wrote to memory of 4888 1004 nbhtbt.exe 99 PID 1004 wrote to memory of 4888 1004 nbhtbt.exe 99 PID 1004 wrote to memory of 4888 1004 nbhtbt.exe 99 PID 4888 wrote to memory of 1504 4888 vjpjp.exe 100 PID 4888 wrote to memory of 1504 4888 vjpjp.exe 100 PID 4888 wrote to memory of 1504 4888 vjpjp.exe 100 PID 1504 wrote to memory of 1704 1504 rfffxxx.exe 101 PID 1504 wrote to memory of 1704 1504 rfffxxx.exe 101 PID 1504 wrote to memory of 1704 1504 rfffxxx.exe 101 PID 1704 wrote to memory of 632 1704 tntnhh.exe 102 PID 1704 wrote to memory of 632 1704 tntnhh.exe 102 PID 1704 wrote to memory of 632 1704 tntnhh.exe 102 PID 632 wrote to memory of 3828 632 rxlxlxr.exe 103 PID 632 wrote to memory of 3828 632 rxlxlxr.exe 103 PID 632 wrote to memory of 3828 632 rxlxlxr.exe 103 PID 3828 wrote to memory of 1428 3828 nbhtnn.exe 104 PID 3828 wrote to memory of 1428 3828 nbhtnn.exe 104 PID 3828 wrote to memory of 1428 3828 nbhtnn.exe 104 PID 1428 wrote to memory of 1368 1428 1nhnhn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\83638009768b9afffd2e650df3363fd1061ff700c965e4206adcbd9e2d3d92e3N.exe"C:\Users\Admin\AppData\Local\Temp\83638009768b9afffd2e650df3363fd1061ff700c965e4206adcbd9e2d3d92e3N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\nbbtnn.exec:\nbbtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\vdddp.exec:\vdddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\vpvjj.exec:\vpvjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\xxfxxrr.exec:\xxfxxrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\tbhnth.exec:\tbhnth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\rxlffll.exec:\rxlffll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\ffxffxf.exec:\ffxffxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\vpjdv.exec:\vpjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\xflllrr.exec:\xflllrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\hbhhhb.exec:\hbhhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\1bbtbb.exec:\1bbtbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\dpdvp.exec:\dpdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\9vpjd.exec:\9vpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\btbtnn.exec:\btbtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\nbhtbt.exec:\nbhtbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\vjpjp.exec:\vjpjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\rfffxxx.exec:\rfffxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\tntnhh.exec:\tntnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\rxlxlxr.exec:\rxlxlxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\nbhtnn.exec:\nbhtnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\1nhnhn.exec:\1nhnhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\3jpjd.exec:\3jpjd.exe23⤵
- Executes dropped EXE
PID:1368 -
\??\c:\vjjdp.exec:\vjjdp.exe24⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rlrrlll.exec:\rlrrlll.exe25⤵
- Executes dropped EXE
PID:1856 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe26⤵
- Executes dropped EXE
PID:764 -
\??\c:\vdpjd.exec:\vdpjd.exe27⤵
- Executes dropped EXE
PID:3084 -
\??\c:\rrrrlll.exec:\rrrrlll.exe28⤵
- Executes dropped EXE
PID:4044 -
\??\c:\nntntb.exec:\nntntb.exe29⤵
- Executes dropped EXE
PID:4268 -
\??\c:\hnttnn.exec:\hnttnn.exe30⤵
- Executes dropped EXE
PID:4900 -
\??\c:\jppjv.exec:\jppjv.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3100 -
\??\c:\lxrxxfl.exec:\lxrxxfl.exe32⤵
- Executes dropped EXE
PID:1236 -
\??\c:\tntntn.exec:\tntntn.exe33⤵
- Executes dropped EXE
PID:3952 -
\??\c:\vdppj.exec:\vdppj.exe34⤵
- Executes dropped EXE
PID:1312 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe35⤵
- Executes dropped EXE
PID:3312 -
\??\c:\3ffxfxf.exec:\3ffxfxf.exe36⤵
- Executes dropped EXE
PID:896 -
\??\c:\bnhtnn.exec:\bnhtnn.exe37⤵
- Executes dropped EXE
PID:1584 -
\??\c:\nhnhnh.exec:\nhnhnh.exe38⤵
- Executes dropped EXE
PID:2480 -
\??\c:\djppp.exec:\djppp.exe39⤵
- Executes dropped EXE
PID:1488 -
\??\c:\lxrlfxl.exec:\lxrlfxl.exe40⤵
- Executes dropped EXE
PID:3600 -
\??\c:\rrxxrff.exec:\rrxxrff.exe41⤵
- Executes dropped EXE
PID:1336 -
\??\c:\nhhbtn.exec:\nhhbtn.exe42⤵
- Executes dropped EXE
PID:4352 -
\??\c:\tnhbtb.exec:\tnhbtb.exe43⤵
- Executes dropped EXE
PID:3016 -
\??\c:\jvpjv.exec:\jvpjv.exe44⤵
- Executes dropped EXE
PID:4984 -
\??\c:\dpjdv.exec:\dpjdv.exe45⤵
- Executes dropped EXE
PID:4776 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe46⤵
- Executes dropped EXE
PID:2020 -
\??\c:\7ffxrrf.exec:\7ffxrrf.exe47⤵
- Executes dropped EXE
PID:4688 -
\??\c:\ttnhbt.exec:\ttnhbt.exe48⤵
- Executes dropped EXE
PID:808 -
\??\c:\jjppp.exec:\jjppp.exe49⤵
- Executes dropped EXE
PID:4436 -
\??\c:\1djvj.exec:\1djvj.exe50⤵
- Executes dropped EXE
PID:872 -
\??\c:\fxfxfff.exec:\fxfxfff.exe51⤵
- Executes dropped EXE
PID:2012 -
\??\c:\hhnnbb.exec:\hhnnbb.exe52⤵
- Executes dropped EXE
PID:2272 -
\??\c:\httnhb.exec:\httnhb.exe53⤵
- Executes dropped EXE
PID:1888 -
\??\c:\ddddp.exec:\ddddp.exe54⤵
- Executes dropped EXE
PID:4276 -
\??\c:\5rxrllf.exec:\5rxrllf.exe55⤵
- Executes dropped EXE
PID:2428 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe56⤵
- Executes dropped EXE
PID:5024 -
\??\c:\nhtnhh.exec:\nhtnhh.exe57⤵
- Executes dropped EXE
PID:4536 -
\??\c:\jdddv.exec:\jdddv.exe58⤵
- Executes dropped EXE
PID:4892 -
\??\c:\pjdvj.exec:\pjdvj.exe59⤵
- Executes dropped EXE
PID:1732 -
\??\c:\lxfxllf.exec:\lxfxllf.exe60⤵
- Executes dropped EXE
PID:4736 -
\??\c:\rlxfxfx.exec:\rlxfxfx.exe61⤵
- Executes dropped EXE
PID:4472 -
\??\c:\thnhbn.exec:\thnhbn.exe62⤵
- Executes dropped EXE
PID:5016 -
\??\c:\9vpvp.exec:\9vpvp.exe63⤵
- Executes dropped EXE
PID:4972 -
\??\c:\vvdvp.exec:\vvdvp.exe64⤵
- Executes dropped EXE
PID:1884 -
\??\c:\fxrlxxx.exec:\fxrlxxx.exe65⤵
- Executes dropped EXE
PID:1152 -
\??\c:\tnhbbt.exec:\tnhbbt.exe66⤵PID:4780
-
\??\c:\tthnnb.exec:\tthnnb.exe67⤵PID:3160
-
\??\c:\dvvvj.exec:\dvvvj.exe68⤵PID:3492
-
\??\c:\dvdvv.exec:\dvdvv.exe69⤵PID:1504
-
\??\c:\9rrlxxx.exec:\9rrlxxx.exe70⤵PID:4968
-
\??\c:\thbtnh.exec:\thbtnh.exe71⤵PID:3920
-
\??\c:\vdjvj.exec:\vdjvj.exe72⤵PID:1520
-
\??\c:\pvjvp.exec:\pvjvp.exe73⤵PID:3692
-
\??\c:\rrxrlfr.exec:\rrxrlfr.exe74⤵PID:3644
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe75⤵PID:4456
-
\??\c:\tbhbnn.exec:\tbhbnn.exe76⤵PID:3760
-
\??\c:\vppjv.exec:\vppjv.exe77⤵PID:908
-
\??\c:\vvdpj.exec:\vvdpj.exe78⤵PID:3420
-
\??\c:\fxlxfxf.exec:\fxlxfxf.exe79⤵PID:764
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe80⤵PID:3448
-
\??\c:\thnnhb.exec:\thnnhb.exe81⤵PID:3504
-
\??\c:\vvdvv.exec:\vvdvv.exe82⤵PID:3652
-
\??\c:\jpvpj.exec:\jpvpj.exe83⤵PID:3164
-
\??\c:\rllfllr.exec:\rllfllr.exe84⤵PID:4668
-
\??\c:\rxfffxx.exec:\rxfffxx.exe85⤵PID:3020
-
\??\c:\tnnbbb.exec:\tnnbbb.exe86⤵PID:3928
-
\??\c:\jvddv.exec:\jvddv.exe87⤵PID:1964
-
\??\c:\lffxllf.exec:\lffxllf.exe88⤵PID:4912
-
\??\c:\rflfxrr.exec:\rflfxrr.exe89⤵PID:3944
-
\??\c:\htnhbt.exec:\htnhbt.exe90⤵PID:2056
-
\??\c:\jddpj.exec:\jddpj.exe91⤵PID:352
-
\??\c:\pjjdd.exec:\pjjdd.exe92⤵PID:3484
-
\??\c:\rlfxlll.exec:\rlfxlll.exe93⤵PID:1676
-
\??\c:\tthbtn.exec:\tthbtn.exe94⤵PID:1948
-
\??\c:\1ttnhb.exec:\1ttnhb.exe95⤵PID:4344
-
\??\c:\jppdp.exec:\jppdp.exe96⤵PID:2904
-
\??\c:\3lrlffx.exec:\3lrlffx.exe97⤵PID:1408
-
\??\c:\hhhhbb.exec:\hhhhbb.exe98⤵PID:2308
-
\??\c:\bnnbnn.exec:\bnnbnn.exe99⤵PID:2796
-
\??\c:\vvdjv.exec:\vvdjv.exe100⤵PID:4080
-
\??\c:\rffxxxr.exec:\rffxxxr.exe101⤵PID:2628
-
\??\c:\9fxlxrf.exec:\9fxlxrf.exe102⤵PID:2700
-
\??\c:\tntntn.exec:\tntntn.exe103⤵PID:2496
-
\??\c:\9nthtt.exec:\9nthtt.exe104⤵PID:4568
-
\??\c:\vvdvv.exec:\vvdvv.exe105⤵PID:2092
-
\??\c:\dvddj.exec:\dvddj.exe106⤵PID:5008
-
\??\c:\llfrfxl.exec:\llfrfxl.exe107⤵PID:684
-
\??\c:\5tthbt.exec:\5tthbt.exe108⤵PID:4372
-
\??\c:\dppdp.exec:\dppdp.exe109⤵PID:3360
-
\??\c:\5pdpd.exec:\5pdpd.exe110⤵PID:5060
-
\??\c:\xrxlxrf.exec:\xrxlxrf.exe111⤵PID:2256
-
\??\c:\1bhbnh.exec:\1bhbnh.exe112⤵PID:3120
-
\??\c:\1btthb.exec:\1btthb.exe113⤵PID:3568
-
\??\c:\pdpjv.exec:\pdpjv.exe114⤵PID:4988
-
\??\c:\lxlxrrl.exec:\lxlxrrl.exe115⤵PID:4620
-
\??\c:\1flxfxx.exec:\1flxfxx.exe116⤵PID:948
-
\??\c:\thnbbn.exec:\thnbbn.exe117⤵PID:3124
-
\??\c:\pppdp.exec:\pppdp.exe118⤵PID:5116
-
\??\c:\fxlllfl.exec:\fxlllfl.exe119⤵PID:2680
-
\??\c:\rffxrfr.exec:\rffxrfr.exe120⤵PID:4888
-
\??\c:\hbtbhn.exec:\hbtbhn.exe121⤵PID:1200
-
\??\c:\ppvjv.exec:\ppvjv.exe122⤵PID:5092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-