Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2024 01:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
64206803c859af16df868b72eb623a2c1092bd2738ae791ea24121f0c498fde4N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
64206803c859af16df868b72eb623a2c1092bd2738ae791ea24121f0c498fde4N.exe
-
Size
70KB
-
MD5
914f08ccd73570414021b61fcdcf4e50
-
SHA1
a35c99bb16d40d96d4546d9a729ee68af3f68447
-
SHA256
64206803c859af16df868b72eb623a2c1092bd2738ae791ea24121f0c498fde4
-
SHA512
a2c6146b1f0244b5c7cc3aaa7a093a6ebf667fc8681e6c19553aef5c09b4281cf9ca8a9220c8046a583481770888cdd5e6f997402fc5539dea9600c5e452d7d8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjl:ymb3NkkiQ3mdBjFI4VV
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/2320-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/416-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-14-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/644-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/544-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2500-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/928-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/704-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 644 jpdpd.exe 1208 pjjjv.exe 416 xxxrlll.exe 3732 5fxrxxx.exe 4404 hhbtnh.exe 4276 ppjvv.exe 544 pppjj.exe 432 3ffxrrr.exe 4148 btnnhb.exe 4088 jppjv.exe 4828 1llllll.exe 3136 nnhbtb.exe 2192 vjjjv.exe 3272 rlxlxrl.exe 2876 bnhtnn.exe 3904 bhbbtt.exe 2500 vdvpj.exe 2132 fllxlfx.exe 2888 9flfxrr.exe 212 tthtnn.exe 4956 djjdv.exe 2380 flrllrl.exe 2976 bbbhhn.exe 1752 nbbthn.exe 3288 dvvvd.exe 3992 xrxlfll.exe 2028 9bbtnn.exe 928 vvjdv.exe 4680 jvddv.exe 704 thbnbt.exe 1592 9bbtnn.exe 1996 ddjjv.exe 3564 llllfff.exe 4568 9rllrxl.exe 1616 vjvjd.exe 2012 lffrlrr.exe 4716 flrrxxx.exe 4460 bntbbh.exe 1500 5jdvv.exe 4588 nbhbbt.exe 2736 nnhntb.exe 4976 ddppj.exe 3760 9xxlfll.exe 404 jppjv.exe 4280 lrxxxxx.exe 4832 htbhht.exe 4596 vjdvv.exe 3428 jvddv.exe 2516 fxxxfff.exe 728 bhhthn.exe 4420 5vjjd.exe 3604 7lrlfrl.exe 1208 ntntnn.exe 1748 dvjjj.exe 5064 bbttnb.exe 748 nhhhhh.exe 3336 7ddpd.exe 2252 rlrlrrx.exe 1036 7rlfxrl.exe 2040 3tttnh.exe 4708 nntnhh.exe 4548 pjdvd.exe 4372 rllfrrl.exe 5020 pvvvd.exe -
resource yara_rule behavioral2/memory/2320-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/416-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/644-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/544-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2500-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/928-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/704-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2320 wrote to memory of 644 2320 64206803c859af16df868b72eb623a2c1092bd2738ae791ea24121f0c498fde4N.exe 82 PID 2320 wrote to memory of 644 2320 64206803c859af16df868b72eb623a2c1092bd2738ae791ea24121f0c498fde4N.exe 82 PID 2320 wrote to memory of 644 2320 64206803c859af16df868b72eb623a2c1092bd2738ae791ea24121f0c498fde4N.exe 82 PID 644 wrote to memory of 1208 644 jpdpd.exe 83 PID 644 wrote to memory of 1208 644 jpdpd.exe 83 PID 644 wrote to memory of 1208 644 jpdpd.exe 83 PID 1208 wrote to memory of 416 1208 pjjjv.exe 84 PID 1208 wrote to memory of 416 1208 pjjjv.exe 84 PID 1208 wrote to memory of 416 1208 pjjjv.exe 84 PID 416 wrote to memory of 3732 416 xxxrlll.exe 85 PID 416 wrote to memory of 3732 416 xxxrlll.exe 85 PID 416 wrote to memory of 3732 416 xxxrlll.exe 85 PID 3732 wrote to memory of 4404 3732 5fxrxxx.exe 86 PID 3732 wrote to memory of 4404 3732 5fxrxxx.exe 86 PID 3732 wrote to memory of 4404 3732 5fxrxxx.exe 86 PID 4404 wrote to memory of 4276 4404 hhbtnh.exe 87 PID 4404 wrote to memory of 4276 4404 hhbtnh.exe 87 PID 4404 wrote to memory of 4276 4404 hhbtnh.exe 87 PID 4276 wrote to memory of 544 4276 ppjvv.exe 88 PID 4276 wrote to memory of 544 4276 ppjvv.exe 88 PID 4276 wrote to memory of 544 4276 ppjvv.exe 88 PID 544 wrote to memory of 432 544 pppjj.exe 89 PID 544 wrote to memory of 432 544 pppjj.exe 89 PID 544 wrote to memory of 432 544 pppjj.exe 89 PID 432 wrote to memory of 4148 432 3ffxrrr.exe 90 PID 432 wrote to memory of 4148 432 3ffxrrr.exe 90 PID 432 wrote to memory of 4148 432 3ffxrrr.exe 90 PID 4148 wrote to memory of 4088 4148 btnnhb.exe 91 PID 4148 wrote to memory of 4088 4148 btnnhb.exe 91 PID 4148 wrote to memory of 4088 4148 btnnhb.exe 91 PID 4088 wrote to memory of 4828 4088 jppjv.exe 92 PID 4088 wrote to memory of 4828 4088 jppjv.exe 92 PID 4088 wrote to memory of 4828 4088 jppjv.exe 92 PID 4828 wrote to memory of 3136 4828 1llllll.exe 93 PID 4828 wrote to memory of 3136 4828 1llllll.exe 93 PID 4828 wrote to memory of 3136 4828 1llllll.exe 93 PID 3136 wrote to memory of 2192 3136 nnhbtb.exe 94 PID 3136 wrote to memory of 2192 3136 nnhbtb.exe 94 PID 3136 wrote to memory of 2192 3136 nnhbtb.exe 94 PID 2192 wrote to memory of 3272 2192 vjjjv.exe 95 PID 2192 wrote to memory of 3272 2192 vjjjv.exe 95 PID 2192 wrote to memory of 3272 2192 vjjjv.exe 95 PID 3272 wrote to memory of 2876 3272 rlxlxrl.exe 96 PID 3272 wrote to memory of 2876 3272 rlxlxrl.exe 96 PID 3272 wrote to memory of 2876 3272 rlxlxrl.exe 96 PID 2876 wrote to memory of 3904 2876 bnhtnn.exe 97 PID 2876 wrote to memory of 3904 2876 bnhtnn.exe 97 PID 2876 wrote to memory of 3904 2876 bnhtnn.exe 97 PID 3904 wrote to memory of 2500 3904 bhbbtt.exe 98 PID 3904 wrote to memory of 2500 3904 bhbbtt.exe 98 PID 3904 wrote to memory of 2500 3904 bhbbtt.exe 98 PID 2500 wrote to memory of 2132 2500 vdvpj.exe 99 PID 2500 wrote to memory of 2132 2500 vdvpj.exe 99 PID 2500 wrote to memory of 2132 2500 vdvpj.exe 99 PID 2132 wrote to memory of 2888 2132 fllxlfx.exe 100 PID 2132 wrote to memory of 2888 2132 fllxlfx.exe 100 PID 2132 wrote to memory of 2888 2132 fllxlfx.exe 100 PID 2888 wrote to memory of 212 2888 9flfxrr.exe 101 PID 2888 wrote to memory of 212 2888 9flfxrr.exe 101 PID 2888 wrote to memory of 212 2888 9flfxrr.exe 101 PID 212 wrote to memory of 4956 212 tthtnn.exe 102 PID 212 wrote to memory of 4956 212 tthtnn.exe 102 PID 212 wrote to memory of 4956 212 tthtnn.exe 102 PID 4956 wrote to memory of 2380 4956 djjdv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\64206803c859af16df868b72eb623a2c1092bd2738ae791ea24121f0c498fde4N.exe"C:\Users\Admin\AppData\Local\Temp\64206803c859af16df868b72eb623a2c1092bd2738ae791ea24121f0c498fde4N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\jpdpd.exec:\jpdpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\pjjjv.exec:\pjjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\xxxrlll.exec:\xxxrlll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
\??\c:\5fxrxxx.exec:\5fxrxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\hhbtnh.exec:\hhbtnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\ppjvv.exec:\ppjvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\pppjj.exec:\pppjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\3ffxrrr.exec:\3ffxrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\btnnhb.exec:\btnnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\jppjv.exec:\jppjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\1llllll.exec:\1llllll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\nnhbtb.exec:\nnhbtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\vjjjv.exec:\vjjjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\rlxlxrl.exec:\rlxlxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\bnhtnn.exec:\bnhtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\bhbbtt.exec:\bhbbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\vdvpj.exec:\vdvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\fllxlfx.exec:\fllxlfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\9flfxrr.exec:\9flfxrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\tthtnn.exec:\tthtnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\djjdv.exec:\djjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\flrllrl.exec:\flrllrl.exe23⤵
- Executes dropped EXE
PID:2380 -
\??\c:\bbbhhn.exec:\bbbhhn.exe24⤵
- Executes dropped EXE
PID:2976 -
\??\c:\nbbthn.exec:\nbbthn.exe25⤵
- Executes dropped EXE
PID:1752 -
\??\c:\dvvvd.exec:\dvvvd.exe26⤵
- Executes dropped EXE
PID:3288 -
\??\c:\xrxlfll.exec:\xrxlfll.exe27⤵
- Executes dropped EXE
PID:3992 -
\??\c:\9bbtnn.exec:\9bbtnn.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2028 -
\??\c:\vvjdv.exec:\vvjdv.exe29⤵
- Executes dropped EXE
PID:928 -
\??\c:\jvddv.exec:\jvddv.exe30⤵
- Executes dropped EXE
PID:4680 -
\??\c:\thbnbt.exec:\thbnbt.exe31⤵
- Executes dropped EXE
PID:704 -
\??\c:\9bbtnn.exec:\9bbtnn.exe32⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ddjjv.exec:\ddjjv.exe33⤵
- Executes dropped EXE
PID:1996 -
\??\c:\llllfff.exec:\llllfff.exe34⤵
- Executes dropped EXE
PID:3564 -
\??\c:\9rllrxl.exec:\9rllrxl.exe35⤵
- Executes dropped EXE
PID:4568 -
\??\c:\vjvjd.exec:\vjvjd.exe36⤵
- Executes dropped EXE
PID:1616 -
\??\c:\lffrlrr.exec:\lffrlrr.exe37⤵
- Executes dropped EXE
PID:2012 -
\??\c:\flrrxxx.exec:\flrrxxx.exe38⤵
- Executes dropped EXE
PID:4716 -
\??\c:\bntbbh.exec:\bntbbh.exe39⤵
- Executes dropped EXE
PID:4460 -
\??\c:\5jdvv.exec:\5jdvv.exe40⤵
- Executes dropped EXE
PID:1500 -
\??\c:\nbhbbt.exec:\nbhbbt.exe41⤵
- Executes dropped EXE
PID:4588 -
\??\c:\nnhntb.exec:\nnhntb.exe42⤵
- Executes dropped EXE
PID:2736 -
\??\c:\ddppj.exec:\ddppj.exe43⤵
- Executes dropped EXE
PID:4976 -
\??\c:\9xxlfll.exec:\9xxlfll.exe44⤵
- Executes dropped EXE
PID:3760 -
\??\c:\jppjv.exec:\jppjv.exe45⤵
- Executes dropped EXE
PID:404 -
\??\c:\lrxxxxx.exec:\lrxxxxx.exe46⤵
- Executes dropped EXE
PID:4280 -
\??\c:\htbhht.exec:\htbhht.exe47⤵
- Executes dropped EXE
PID:4832 -
\??\c:\vjdvv.exec:\vjdvv.exe48⤵
- Executes dropped EXE
PID:4596 -
\??\c:\jvddv.exec:\jvddv.exe49⤵
- Executes dropped EXE
PID:3428 -
\??\c:\fxxxfff.exec:\fxxxfff.exe50⤵
- Executes dropped EXE
PID:2516 -
\??\c:\bhhthn.exec:\bhhthn.exe51⤵
- Executes dropped EXE
PID:728 -
\??\c:\5vjjd.exec:\5vjjd.exe52⤵
- Executes dropped EXE
PID:4420 -
\??\c:\7lrlfrl.exec:\7lrlfrl.exe53⤵
- Executes dropped EXE
PID:3604 -
\??\c:\ntntnn.exec:\ntntnn.exe54⤵
- Executes dropped EXE
PID:1208 -
\??\c:\dvjjj.exec:\dvjjj.exe55⤵
- Executes dropped EXE
PID:1748 -
\??\c:\bbttnb.exec:\bbttnb.exe56⤵
- Executes dropped EXE
PID:5064 -
\??\c:\nhhhhh.exec:\nhhhhh.exe57⤵
- Executes dropped EXE
PID:748 -
\??\c:\7ddpd.exec:\7ddpd.exe58⤵
- Executes dropped EXE
PID:3336 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe59⤵
- Executes dropped EXE
PID:2252 -
\??\c:\7rlfxrl.exec:\7rlfxrl.exe60⤵
- Executes dropped EXE
PID:1036 -
\??\c:\3tttnh.exec:\3tttnh.exe61⤵
- Executes dropped EXE
PID:2040 -
\??\c:\nntnhh.exec:\nntnhh.exe62⤵
- Executes dropped EXE
PID:4708 -
\??\c:\pjdvd.exec:\pjdvd.exe63⤵
- Executes dropped EXE
PID:4548 -
\??\c:\rllfrrl.exec:\rllfrrl.exe64⤵
- Executes dropped EXE
PID:4372 -
\??\c:\pvvvd.exec:\pvvvd.exe65⤵
- Executes dropped EXE
PID:5020 -
\??\c:\djjjd.exec:\djjjd.exe66⤵PID:5016
-
\??\c:\lfrrllr.exec:\lfrrllr.exe67⤵PID:216
-
\??\c:\hbhhnn.exec:\hbhhnn.exe68⤵PID:4840
-
\??\c:\nhhnhb.exec:\nhhnhb.exe69⤵PID:3064
-
\??\c:\dppvj.exec:\dppvj.exe70⤵PID:2936
-
\??\c:\7fxrlff.exec:\7fxrlff.exe71⤵PID:2660
-
\??\c:\lxxrrlf.exec:\lxxrrlf.exe72⤵PID:4692
-
\??\c:\7thbbt.exec:\7thbbt.exe73⤵PID:3312
-
\??\c:\hbbbnn.exec:\hbbbnn.exe74⤵PID:2792
-
\??\c:\djjjv.exec:\djjjv.exe75⤵PID:2504
-
\??\c:\1frfxxr.exec:\1frfxxr.exe76⤵PID:980
-
\??\c:\fxrlffx.exec:\fxrlffx.exe77⤵PID:460
-
\??\c:\3xrrfrl.exec:\3xrrfrl.exe78⤵PID:2524
-
\??\c:\tnnnhb.exec:\tnnnhb.exe79⤵PID:1876
-
\??\c:\djvvp.exec:\djvvp.exe80⤵PID:4980
-
\??\c:\jjpvj.exec:\jjpvj.exe81⤵PID:3004
-
\??\c:\xxrlffx.exec:\xxrlffx.exe82⤵PID:5092
-
\??\c:\hbbhnt.exec:\hbbhnt.exe83⤵PID:3484
-
\??\c:\tnnntn.exec:\tnnntn.exe84⤵PID:3752
-
\??\c:\vjdvd.exec:\vjdvd.exe85⤵PID:3672
-
\??\c:\xxlffrr.exec:\xxlffrr.exe86⤵PID:772
-
\??\c:\xxrrllr.exec:\xxrrllr.exe87⤵PID:3992
-
\??\c:\httnhh.exec:\httnhh.exe88⤵PID:3188
-
\??\c:\thnnhh.exec:\thnnhh.exe89⤵PID:3964
-
\??\c:\jvvpj.exec:\jvvpj.exe90⤵PID:848
-
\??\c:\dppjv.exec:\dppjv.exe91⤵PID:2212
-
\??\c:\5lrrxlf.exec:\5lrrxlf.exe92⤵PID:2228
-
\??\c:\5llllff.exec:\5llllff.exe93⤵PID:5088
-
\??\c:\5nttnn.exec:\5nttnn.exe94⤵PID:3580
-
\??\c:\hnnhhb.exec:\hnnhhb.exe95⤵PID:336
-
\??\c:\dpppj.exec:\dpppj.exe96⤵PID:4568
-
\??\c:\djjjd.exec:\djjjd.exe97⤵PID:1616
-
\??\c:\rflxrrl.exec:\rflxrrl.exe98⤵PID:2012
-
\??\c:\7xrrllf.exec:\7xrrllf.exe99⤵PID:1324
-
\??\c:\hhhbtb.exec:\hhhbtb.exe100⤵PID:1236
-
\??\c:\jdvvv.exec:\jdvvv.exe101⤵PID:2336
-
\??\c:\pdjjj.exec:\pdjjj.exe102⤵PID:4492
-
\??\c:\frffxff.exec:\frffxff.exe103⤵PID:4588
-
\??\c:\ffrxrxx.exec:\ffrxrxx.exe104⤵PID:2036
-
\??\c:\nhnhhn.exec:\nhnhhn.exe105⤵PID:540
-
\??\c:\nnhhhn.exec:\nnhhhn.exe106⤵PID:3760
-
\??\c:\vpdjd.exec:\vpdjd.exe107⤵PID:4340
-
\??\c:\lrlrxlx.exec:\lrlrxlx.exe108⤵PID:4608
-
\??\c:\rrxrrrx.exec:\rrxrrrx.exe109⤵PID:4844
-
\??\c:\httbbn.exec:\httbbn.exe110⤵PID:4596
-
\??\c:\htbhbh.exec:\htbhbh.exe111⤵PID:1048
-
\??\c:\ppvpd.exec:\ppvpd.exe112⤵PID:2516
-
\??\c:\fflllrr.exec:\fflllrr.exe113⤵PID:1080
-
\??\c:\pvppp.exec:\pvppp.exe114⤵PID:2352
-
\??\c:\jjvjd.exec:\jjvjd.exe115⤵PID:4108
-
\??\c:\5frrrrx.exec:\5frrrrx.exe116⤵PID:2588
-
\??\c:\nhnttb.exec:\nhnttb.exe117⤵PID:1096
-
\??\c:\bbnnnt.exec:\bbnnnt.exe118⤵PID:2732
-
\??\c:\pjjdd.exec:\pjjdd.exe119⤵PID:3240
-
\??\c:\rrlrrll.exec:\rrlrrll.exe120⤵PID:3492
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe121⤵PID:2712
-
\??\c:\hhbnnb.exec:\hhbnnb.exe122⤵PID:2724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-