Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 11:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
39410189091fa47569a8515ed44165ad132b6556fc98dd25ce3ae5ab2bdc1a96N.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
39410189091fa47569a8515ed44165ad132b6556fc98dd25ce3ae5ab2bdc1a96N.exe
-
Size
70KB
-
MD5
7e1892dcba2692b5898bcb66d7dfafe0
-
SHA1
373dcd6800af2cf82888e953ab343ec4d8188dd8
-
SHA256
39410189091fa47569a8515ed44165ad132b6556fc98dd25ce3ae5ab2bdc1a96
-
SHA512
77a82758e8304b154a6bf945771552d9dc683a340d207752273eb475a4bcb80c89253dddcf9512300b4e50b27a857216888e684bed4589c6740d4fdce8c1366a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfUcicvM:ymb3NkkiQ3mdBjFI4V4cit
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4324-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3148-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/772-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1000-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3148 xxxffrr.exe 4844 tbbnnn.exe 4016 tnhbhn.exe 1048 vpdjd.exe 4148 nhnhnn.exe 3940 ppdvv.exe 4044 xrxrrlf.exe 2444 tnhbtt.exe 3572 pvvpp.exe 5084 ddddv.exe 2068 fffffff.exe 2368 ntnnht.exe 1764 jpppj.exe 3688 vpvpj.exe 3128 xfrlffx.exe 208 hhthnb.exe 1460 1hnhtt.exe 1756 dpvpd.exe 3924 xrxrlff.exe 2892 nbnnhh.exe 4512 tbhhnn.exe 1444 dvddp.exe 4592 vjjdv.exe 1184 bttnhh.exe 2612 bttnbb.exe 772 7pvpp.exe 1472 lfxrrrl.exe 4532 bhtnbb.exe 4204 hhnhtn.exe 2528 ppdjd.exe 1000 tnhbhh.exe 1920 nhhbnn.exe 2488 btthbb.exe 1904 dpvpd.exe 4552 7bbtnb.exe 2588 vvpjd.exe 2576 bbbtnn.exe 2748 bbhbnh.exe 4540 pppjd.exe 3052 1lxrfxx.exe 4288 hhhhbb.exe 2924 lxfxrlf.exe 656 thhhbt.exe 4456 nhhhhn.exe 3408 pvjdj.exe 4700 xrxxrxr.exe 3900 rxlffff.exe 2664 thhnnn.exe 696 pjddd.exe 1048 pjjjv.exe 1816 pdvvp.exe 4008 frffxll.exe 4764 nnttnn.exe 1844 ddjdj.exe 3240 jjpvp.exe 3016 lflfxxl.exe 3572 xxrxrrr.exe 3488 7hbtnn.exe 1868 pvpdp.exe 4452 9dvdp.exe 5116 xxrlxrx.exe 2984 bnnhbt.exe 1764 9hbthb.exe 2832 dvvpj.exe -
resource yara_rule behavioral2/memory/4324-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3148-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3148-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3148-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3148-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/772-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1000-213-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4324 wrote to memory of 3148 4324 39410189091fa47569a8515ed44165ad132b6556fc98dd25ce3ae5ab2bdc1a96N.exe 82 PID 4324 wrote to memory of 3148 4324 39410189091fa47569a8515ed44165ad132b6556fc98dd25ce3ae5ab2bdc1a96N.exe 82 PID 4324 wrote to memory of 3148 4324 39410189091fa47569a8515ed44165ad132b6556fc98dd25ce3ae5ab2bdc1a96N.exe 82 PID 3148 wrote to memory of 4844 3148 xxxffrr.exe 83 PID 3148 wrote to memory of 4844 3148 xxxffrr.exe 83 PID 3148 wrote to memory of 4844 3148 xxxffrr.exe 83 PID 4844 wrote to memory of 4016 4844 tbbnnn.exe 84 PID 4844 wrote to memory of 4016 4844 tbbnnn.exe 84 PID 4844 wrote to memory of 4016 4844 tbbnnn.exe 84 PID 4016 wrote to memory of 1048 4016 tnhbhn.exe 85 PID 4016 wrote to memory of 1048 4016 tnhbhn.exe 85 PID 4016 wrote to memory of 1048 4016 tnhbhn.exe 85 PID 1048 wrote to memory of 4148 1048 vpdjd.exe 86 PID 1048 wrote to memory of 4148 1048 vpdjd.exe 86 PID 1048 wrote to memory of 4148 1048 vpdjd.exe 86 PID 4148 wrote to memory of 3940 4148 nhnhnn.exe 87 PID 4148 wrote to memory of 3940 4148 nhnhnn.exe 87 PID 4148 wrote to memory of 3940 4148 nhnhnn.exe 87 PID 3940 wrote to memory of 4044 3940 ppdvv.exe 88 PID 3940 wrote to memory of 4044 3940 ppdvv.exe 88 PID 3940 wrote to memory of 4044 3940 ppdvv.exe 88 PID 4044 wrote to memory of 2444 4044 xrxrrlf.exe 89 PID 4044 wrote to memory of 2444 4044 xrxrrlf.exe 89 PID 4044 wrote to memory of 2444 4044 xrxrrlf.exe 89 PID 2444 wrote to memory of 3572 2444 tnhbtt.exe 90 PID 2444 wrote to memory of 3572 2444 tnhbtt.exe 90 PID 2444 wrote to memory of 3572 2444 tnhbtt.exe 90 PID 3572 wrote to memory of 5084 3572 pvvpp.exe 91 PID 3572 wrote to memory of 5084 3572 pvvpp.exe 91 PID 3572 wrote to memory of 5084 3572 pvvpp.exe 91 PID 5084 wrote to memory of 2068 5084 ddddv.exe 92 PID 5084 wrote to memory of 2068 5084 ddddv.exe 92 PID 5084 wrote to memory of 2068 5084 ddddv.exe 92 PID 2068 wrote to memory of 2368 2068 fffffff.exe 93 PID 2068 wrote to memory of 2368 2068 fffffff.exe 93 PID 2068 wrote to memory of 2368 2068 fffffff.exe 93 PID 2368 wrote to memory of 1764 2368 ntnnht.exe 94 PID 2368 wrote to memory of 1764 2368 ntnnht.exe 94 PID 2368 wrote to memory of 1764 2368 ntnnht.exe 94 PID 1764 wrote to memory of 3688 1764 jpppj.exe 95 PID 1764 wrote to memory of 3688 1764 jpppj.exe 95 PID 1764 wrote to memory of 3688 1764 jpppj.exe 95 PID 3688 wrote to memory of 3128 3688 vpvpj.exe 96 PID 3688 wrote to memory of 3128 3688 vpvpj.exe 96 PID 3688 wrote to memory of 3128 3688 vpvpj.exe 96 PID 3128 wrote to memory of 208 3128 xfrlffx.exe 97 PID 3128 wrote to memory of 208 3128 xfrlffx.exe 97 PID 3128 wrote to memory of 208 3128 xfrlffx.exe 97 PID 208 wrote to memory of 1460 208 hhthnb.exe 98 PID 208 wrote to memory of 1460 208 hhthnb.exe 98 PID 208 wrote to memory of 1460 208 hhthnb.exe 98 PID 1460 wrote to memory of 1756 1460 1hnhtt.exe 99 PID 1460 wrote to memory of 1756 1460 1hnhtt.exe 99 PID 1460 wrote to memory of 1756 1460 1hnhtt.exe 99 PID 1756 wrote to memory of 3924 1756 dpvpd.exe 100 PID 1756 wrote to memory of 3924 1756 dpvpd.exe 100 PID 1756 wrote to memory of 3924 1756 dpvpd.exe 100 PID 3924 wrote to memory of 2892 3924 xrxrlff.exe 101 PID 3924 wrote to memory of 2892 3924 xrxrlff.exe 101 PID 3924 wrote to memory of 2892 3924 xrxrlff.exe 101 PID 2892 wrote to memory of 4512 2892 nbnnhh.exe 102 PID 2892 wrote to memory of 4512 2892 nbnnhh.exe 102 PID 2892 wrote to memory of 4512 2892 nbnnhh.exe 102 PID 4512 wrote to memory of 1444 4512 tbhhnn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\39410189091fa47569a8515ed44165ad132b6556fc98dd25ce3ae5ab2bdc1a96N.exe"C:\Users\Admin\AppData\Local\Temp\39410189091fa47569a8515ed44165ad132b6556fc98dd25ce3ae5ab2bdc1a96N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\xxxffrr.exec:\xxxffrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\tbbnnn.exec:\tbbnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\tnhbhn.exec:\tnhbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\vpdjd.exec:\vpdjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\nhnhnn.exec:\nhnhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\ppdvv.exec:\ppdvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\xrxrrlf.exec:\xrxrrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\tnhbtt.exec:\tnhbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\pvvpp.exec:\pvvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\ddddv.exec:\ddddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\fffffff.exec:\fffffff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\ntnnht.exec:\ntnnht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\jpppj.exec:\jpppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\vpvpj.exec:\vpvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\xfrlffx.exec:\xfrlffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\hhthnb.exec:\hhthnb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\1hnhtt.exec:\1hnhtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\dpvpd.exec:\dpvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\xrxrlff.exec:\xrxrlff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\nbnnhh.exec:\nbnnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\tbhhnn.exec:\tbhhnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\dvddp.exec:\dvddp.exe23⤵
- Executes dropped EXE
PID:1444 -
\??\c:\vjjdv.exec:\vjjdv.exe24⤵
- Executes dropped EXE
PID:4592 -
\??\c:\bttnhh.exec:\bttnhh.exe25⤵
- Executes dropped EXE
PID:1184 -
\??\c:\bttnbb.exec:\bttnbb.exe26⤵
- Executes dropped EXE
PID:2612 -
\??\c:\7pvpp.exec:\7pvpp.exe27⤵
- Executes dropped EXE
PID:772 -
\??\c:\lfxrrrl.exec:\lfxrrrl.exe28⤵
- Executes dropped EXE
PID:1472 -
\??\c:\bhtnbb.exec:\bhtnbb.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4532 -
\??\c:\hhnhtn.exec:\hhnhtn.exe30⤵
- Executes dropped EXE
PID:4204 -
\??\c:\ppdjd.exec:\ppdjd.exe31⤵
- Executes dropped EXE
PID:2528 -
\??\c:\tnhbhh.exec:\tnhbhh.exe32⤵
- Executes dropped EXE
PID:1000 -
\??\c:\nhhbnn.exec:\nhhbnn.exe33⤵
- Executes dropped EXE
PID:1920 -
\??\c:\btthbb.exec:\btthbb.exe34⤵
- Executes dropped EXE
PID:2488 -
\??\c:\dpvpd.exec:\dpvpd.exe35⤵
- Executes dropped EXE
PID:1904 -
\??\c:\7bbtnb.exec:\7bbtnb.exe36⤵
- Executes dropped EXE
PID:4552 -
\??\c:\vvpjd.exec:\vvpjd.exe37⤵
- Executes dropped EXE
PID:2588 -
\??\c:\bbbtnn.exec:\bbbtnn.exe38⤵
- Executes dropped EXE
PID:2576 -
\??\c:\bbhbnh.exec:\bbhbnh.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pppjd.exec:\pppjd.exe40⤵
- Executes dropped EXE
PID:4540 -
\??\c:\1lxrfxx.exec:\1lxrfxx.exe41⤵
- Executes dropped EXE
PID:3052 -
\??\c:\hhhhbb.exec:\hhhhbb.exe42⤵
- Executes dropped EXE
PID:4288 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe43⤵
- Executes dropped EXE
PID:2924 -
\??\c:\thhhbt.exec:\thhhbt.exe44⤵
- Executes dropped EXE
PID:656 -
\??\c:\nhhhhn.exec:\nhhhhn.exe45⤵
- Executes dropped EXE
PID:4456 -
\??\c:\pvjdj.exec:\pvjdj.exe46⤵
- Executes dropped EXE
PID:3408 -
\??\c:\xrxxrxr.exec:\xrxxrxr.exe47⤵
- Executes dropped EXE
PID:4700 -
\??\c:\rxlffff.exec:\rxlffff.exe48⤵
- Executes dropped EXE
PID:3900 -
\??\c:\thhnnn.exec:\thhnnn.exe49⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pjddd.exec:\pjddd.exe50⤵
- Executes dropped EXE
PID:696 -
\??\c:\pjjjv.exec:\pjjjv.exe51⤵
- Executes dropped EXE
PID:1048 -
\??\c:\pdvvp.exec:\pdvvp.exe52⤵
- Executes dropped EXE
PID:1816 -
\??\c:\frffxll.exec:\frffxll.exe53⤵
- Executes dropped EXE
PID:4008 -
\??\c:\nnttnn.exec:\nnttnn.exe54⤵
- Executes dropped EXE
PID:4764 -
\??\c:\ddjdj.exec:\ddjdj.exe55⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jjpvp.exec:\jjpvp.exe56⤵
- Executes dropped EXE
PID:3240 -
\??\c:\lflfxxl.exec:\lflfxxl.exe57⤵
- Executes dropped EXE
PID:3016 -
\??\c:\xxrxrrr.exec:\xxrxrrr.exe58⤵
- Executes dropped EXE
PID:3572 -
\??\c:\7hbtnn.exec:\7hbtnn.exe59⤵
- Executes dropped EXE
PID:3488 -
\??\c:\pvpdp.exec:\pvpdp.exe60⤵
- Executes dropped EXE
PID:1868 -
\??\c:\9dvdp.exec:\9dvdp.exe61⤵
- Executes dropped EXE
PID:4452 -
\??\c:\xxrlxrx.exec:\xxrlxrx.exe62⤵
- Executes dropped EXE
PID:5116 -
\??\c:\bnnhbt.exec:\bnnhbt.exe63⤵
- Executes dropped EXE
PID:2984 -
\??\c:\9hbthb.exec:\9hbthb.exe64⤵
- Executes dropped EXE
PID:1764 -
\??\c:\dvvpj.exec:\dvvpj.exe65⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xxfrxxf.exec:\xxfrxxf.exe66⤵PID:452
-
\??\c:\frllfxl.exec:\frllfxl.exe67⤵PID:3600
-
\??\c:\btnhbb.exec:\btnhbb.exe68⤵PID:212
-
\??\c:\nbbtnh.exec:\nbbtnh.exe69⤵PID:2948
-
\??\c:\pvvvv.exec:\pvvvv.exe70⤵PID:3508
-
\??\c:\rxffxxx.exec:\rxffxxx.exe71⤵PID:4504
-
\??\c:\1lxrlxr.exec:\1lxrlxr.exe72⤵PID:1056
-
\??\c:\nhhhbb.exec:\nhhhbb.exe73⤵PID:3060
-
\??\c:\bbbbth.exec:\bbbbth.exe74⤵PID:4748
-
\??\c:\jddvp.exec:\jddvp.exe75⤵PID:3020
-
\??\c:\xrlrlll.exec:\xrlrlll.exe76⤵PID:5012
-
\??\c:\7hhbtt.exec:\7hhbtt.exe77⤵PID:2264
-
\??\c:\nbbnbt.exec:\nbbnbt.exe78⤵PID:708
-
\??\c:\7btnbb.exec:\7btnbb.exe79⤵PID:3256
-
\??\c:\jvdpv.exec:\jvdpv.exe80⤵PID:2772
-
\??\c:\fxxxffx.exec:\fxxxffx.exe81⤵PID:2988
-
\??\c:\lflfrlx.exec:\lflfrlx.exe82⤵PID:4152
-
\??\c:\hbnnnn.exec:\hbnnnn.exe83⤵PID:780
-
\??\c:\nnhbth.exec:\nnhbth.exe84⤵PID:424
-
\??\c:\pvvpd.exec:\pvvpd.exe85⤵PID:3564
-
\??\c:\rrxlrlx.exec:\rrxlrlx.exe86⤵PID:2592
-
\??\c:\fxfxxlf.exec:\fxfxxlf.exe87⤵PID:4584
-
\??\c:\nhttnh.exec:\nhttnh.exe88⤵PID:4372
-
\??\c:\htnhtn.exec:\htnhtn.exe89⤵PID:4348
-
\??\c:\vvvpd.exec:\vvvpd.exe90⤵PID:4756
-
\??\c:\jpjdv.exec:\jpjdv.exe91⤵PID:1404
-
\??\c:\7xfxllf.exec:\7xfxllf.exe92⤵PID:1044
-
\??\c:\nbnbhb.exec:\nbnbhb.exe93⤵PID:2576
-
\??\c:\ddjdv.exec:\ddjdv.exe94⤵PID:2748
-
\??\c:\rlllxff.exec:\rlllxff.exe95⤵PID:4540
-
\??\c:\tbhnnb.exec:\tbhnnb.exe96⤵PID:1588
-
\??\c:\httnnn.exec:\httnnn.exe97⤵PID:4384
-
\??\c:\vpdvv.exec:\vpdvv.exe98⤵PID:2924
-
\??\c:\dvvvp.exec:\dvvvp.exe99⤵PID:4852
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe100⤵PID:3148
-
\??\c:\lfrrrrl.exec:\lfrrrrl.exe101⤵PID:4996
-
\??\c:\hbtnhh.exec:\hbtnhh.exe102⤵PID:444
-
\??\c:\tttthn.exec:\tttthn.exe103⤵PID:3900
-
\??\c:\jjvvv.exec:\jjvvv.exe104⤵PID:1168
-
\??\c:\dpddp.exec:\dpddp.exe105⤵PID:696
-
\??\c:\fxxrxxf.exec:\fxxrxxf.exe106⤵PID:4896
-
\??\c:\lxxxrrx.exec:\lxxxrrx.exe107⤵PID:3940
-
\??\c:\nbnhhh.exec:\nbnhhh.exe108⤵
- System Location Discovery: System Language Discovery
PID:2076 -
\??\c:\tttnhh.exec:\tttnhh.exe109⤵PID:4764
-
\??\c:\ddvvv.exec:\ddvvv.exe110⤵PID:1844
-
\??\c:\fflllfr.exec:\fflllfr.exe111⤵PID:3616
-
\??\c:\5xxxrrr.exec:\5xxxrrr.exe112⤵PID:2364
-
\??\c:\tnhhtt.exec:\tnhhtt.exe113⤵PID:5044
-
\??\c:\5hbhbn.exec:\5hbhbn.exe114⤵PID:2872
-
\??\c:\pjvdd.exec:\pjvdd.exe115⤵PID:3436
-
\??\c:\dvddv.exec:\dvddv.exe116⤵PID:4660
-
\??\c:\rrlfxlf.exec:\rrlfxlf.exe117⤵PID:4564
-
\??\c:\rlfxxxx.exec:\rlfxxxx.exe118⤵PID:3152
-
\??\c:\nhbttt.exec:\nhbttt.exe119⤵PID:1968
-
\??\c:\pdddj.exec:\pdddj.exe120⤵PID:3128
-
\??\c:\vjpjd.exec:\vjpjd.exe121⤵PID:1916
-
\??\c:\flrrlrl.exec:\flrrlrl.exe122⤵PID:1052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-