Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 00:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
88f6e1cf2bf227ab323195840055a023a2db50a7a06d59901204f5b6c0ab5eb5N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
88f6e1cf2bf227ab323195840055a023a2db50a7a06d59901204f5b6c0ab5eb5N.exe
-
Size
71KB
-
MD5
b18c9270be0f66c02fc778110a8a5830
-
SHA1
c4b28c4d381b7d8c424636fb830af323fd672e5f
-
SHA256
88f6e1cf2bf227ab323195840055a023a2db50a7a06d59901204f5b6c0ab5eb5
-
SHA512
5dfdcdaea0cb7d5bb8744387416f5b5e89e80d301f0941dc7c9084830b8b91c13763fc2f13b24880f0f60c7ca47e664c9580f832c9f5017466909aec08dacea4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjV:ymb3NkkiQ3mdBjFI4VF
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4944-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1200-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/312-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2156 hbbnbn.exe 1244 9pjdj.exe 2616 9vvpv.exe 5088 nbbthb.exe 4380 vjjdv.exe 2932 3djvp.exe 4356 lrlfxxl.exe 2772 nbhbbb.exe 3128 dvvpp.exe 2032 llxrrlf.exe 4020 9fffrlx.exe 3904 tbnhbt.exe 2464 7ddpd.exe 1016 7rfxfxr.exe 1200 hbhbbt.exe 2588 1bbthb.exe 1856 pvdvj.exe 3596 fxrllfr.exe 312 lllfxrf.exe 1148 btbthb.exe 4564 5pjdd.exe 3688 djpjj.exe 4316 rlfrllf.exe 2840 nthnnb.exe 2964 1jpjv.exe 3732 pjdvj.exe 2928 1ffxlfx.exe 2448 bhbnbt.exe 5080 ttthtn.exe 2812 9pvjp.exe 2200 3ffxllx.exe 2268 htnhbn.exe 4184 ntbtbt.exe 2152 vvddv.exe 1564 vdvpp.exe 2412 5xrlxfx.exe 1824 5thtnb.exe 2144 5bhtbt.exe 3148 1pjvj.exe 872 vppjd.exe 3600 pvdvv.exe 5104 xrxllff.exe 1880 7llllfx.exe 744 ntntth.exe 3252 tnbnnh.exe 916 dvpdp.exe 3480 1flfrrf.exe 1580 9xrrlxx.exe 3232 3bnhtn.exe 2120 vdjdp.exe 3744 pdjvj.exe 60 3lffrrf.exe 1948 fxfxxfr.exe 1464 5hhbbt.exe 2740 bnhbhb.exe 4556 vvpjv.exe 1996 rfxlxrf.exe 2496 lrrlfff.exe 2756 bbhhnh.exe 1344 3tnbhb.exe 3296 thhbnh.exe 4952 dpjvd.exe 1624 rxxrlfr.exe 3332 1rxllff.exe -
resource yara_rule behavioral2/memory/4944-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1200-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/312-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrlrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4944 wrote to memory of 2156 4944 88f6e1cf2bf227ab323195840055a023a2db50a7a06d59901204f5b6c0ab5eb5N.exe 84 PID 4944 wrote to memory of 2156 4944 88f6e1cf2bf227ab323195840055a023a2db50a7a06d59901204f5b6c0ab5eb5N.exe 84 PID 4944 wrote to memory of 2156 4944 88f6e1cf2bf227ab323195840055a023a2db50a7a06d59901204f5b6c0ab5eb5N.exe 84 PID 2156 wrote to memory of 1244 2156 hbbnbn.exe 85 PID 2156 wrote to memory of 1244 2156 hbbnbn.exe 85 PID 2156 wrote to memory of 1244 2156 hbbnbn.exe 85 PID 1244 wrote to memory of 2616 1244 9pjdj.exe 86 PID 1244 wrote to memory of 2616 1244 9pjdj.exe 86 PID 1244 wrote to memory of 2616 1244 9pjdj.exe 86 PID 2616 wrote to memory of 5088 2616 9vvpv.exe 87 PID 2616 wrote to memory of 5088 2616 9vvpv.exe 87 PID 2616 wrote to memory of 5088 2616 9vvpv.exe 87 PID 5088 wrote to memory of 4380 5088 nbbthb.exe 88 PID 5088 wrote to memory of 4380 5088 nbbthb.exe 88 PID 5088 wrote to memory of 4380 5088 nbbthb.exe 88 PID 4380 wrote to memory of 2932 4380 vjjdv.exe 89 PID 4380 wrote to memory of 2932 4380 vjjdv.exe 89 PID 4380 wrote to memory of 2932 4380 vjjdv.exe 89 PID 2932 wrote to memory of 4356 2932 3djvp.exe 90 PID 2932 wrote to memory of 4356 2932 3djvp.exe 90 PID 2932 wrote to memory of 4356 2932 3djvp.exe 90 PID 4356 wrote to memory of 2772 4356 lrlfxxl.exe 91 PID 4356 wrote to memory of 2772 4356 lrlfxxl.exe 91 PID 4356 wrote to memory of 2772 4356 lrlfxxl.exe 91 PID 2772 wrote to memory of 3128 2772 nbhbbb.exe 92 PID 2772 wrote to memory of 3128 2772 nbhbbb.exe 92 PID 2772 wrote to memory of 3128 2772 nbhbbb.exe 92 PID 3128 wrote to memory of 2032 3128 dvvpp.exe 93 PID 3128 wrote to memory of 2032 3128 dvvpp.exe 93 PID 3128 wrote to memory of 2032 3128 dvvpp.exe 93 PID 2032 wrote to memory of 4020 2032 llxrrlf.exe 94 PID 2032 wrote to memory of 4020 2032 llxrrlf.exe 94 PID 2032 wrote to memory of 4020 2032 llxrrlf.exe 94 PID 4020 wrote to memory of 3904 4020 9fffrlx.exe 95 PID 4020 wrote to memory of 3904 4020 9fffrlx.exe 95 PID 4020 wrote to memory of 3904 4020 9fffrlx.exe 95 PID 3904 wrote to memory of 2464 3904 tbnhbt.exe 96 PID 3904 wrote to memory of 2464 3904 tbnhbt.exe 96 PID 3904 wrote to memory of 2464 3904 tbnhbt.exe 96 PID 2464 wrote to memory of 1016 2464 7ddpd.exe 97 PID 2464 wrote to memory of 1016 2464 7ddpd.exe 97 PID 2464 wrote to memory of 1016 2464 7ddpd.exe 97 PID 1016 wrote to memory of 1200 1016 7rfxfxr.exe 98 PID 1016 wrote to memory of 1200 1016 7rfxfxr.exe 98 PID 1016 wrote to memory of 1200 1016 7rfxfxr.exe 98 PID 1200 wrote to memory of 2588 1200 hbhbbt.exe 99 PID 1200 wrote to memory of 2588 1200 hbhbbt.exe 99 PID 1200 wrote to memory of 2588 1200 hbhbbt.exe 99 PID 2588 wrote to memory of 1856 2588 1bbthb.exe 100 PID 2588 wrote to memory of 1856 2588 1bbthb.exe 100 PID 2588 wrote to memory of 1856 2588 1bbthb.exe 100 PID 1856 wrote to memory of 3596 1856 pvdvj.exe 101 PID 1856 wrote to memory of 3596 1856 pvdvj.exe 101 PID 1856 wrote to memory of 3596 1856 pvdvj.exe 101 PID 3596 wrote to memory of 312 3596 fxrllfr.exe 102 PID 3596 wrote to memory of 312 3596 fxrllfr.exe 102 PID 3596 wrote to memory of 312 3596 fxrllfr.exe 102 PID 312 wrote to memory of 1148 312 lllfxrf.exe 103 PID 312 wrote to memory of 1148 312 lllfxrf.exe 103 PID 312 wrote to memory of 1148 312 lllfxrf.exe 103 PID 1148 wrote to memory of 4564 1148 btbthb.exe 104 PID 1148 wrote to memory of 4564 1148 btbthb.exe 104 PID 1148 wrote to memory of 4564 1148 btbthb.exe 104 PID 4564 wrote to memory of 3688 4564 5pjdd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\88f6e1cf2bf227ab323195840055a023a2db50a7a06d59901204f5b6c0ab5eb5N.exe"C:\Users\Admin\AppData\Local\Temp\88f6e1cf2bf227ab323195840055a023a2db50a7a06d59901204f5b6c0ab5eb5N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\hbbnbn.exec:\hbbnbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\9pjdj.exec:\9pjdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\9vvpv.exec:\9vvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\nbbthb.exec:\nbbthb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\vjjdv.exec:\vjjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\3djvp.exec:\3djvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\lrlfxxl.exec:\lrlfxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\nbhbbb.exec:\nbhbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\dvvpp.exec:\dvvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\llxrrlf.exec:\llxrrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\9fffrlx.exec:\9fffrlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\tbnhbt.exec:\tbnhbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\7ddpd.exec:\7ddpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\7rfxfxr.exec:\7rfxfxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\hbhbbt.exec:\hbhbbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\1bbthb.exec:\1bbthb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\pvdvj.exec:\pvdvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\fxrllfr.exec:\fxrllfr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\lllfxrf.exec:\lllfxrf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\btbthb.exec:\btbthb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\5pjdd.exec:\5pjdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\djpjj.exec:\djpjj.exe23⤵
- Executes dropped EXE
PID:3688 -
\??\c:\rlfrllf.exec:\rlfrllf.exe24⤵
- Executes dropped EXE
PID:4316 -
\??\c:\nthnnb.exec:\nthnnb.exe25⤵
- Executes dropped EXE
PID:2840 -
\??\c:\1jpjv.exec:\1jpjv.exe26⤵
- Executes dropped EXE
PID:2964 -
\??\c:\pjdvj.exec:\pjdvj.exe27⤵
- Executes dropped EXE
PID:3732 -
\??\c:\1ffxlfx.exec:\1ffxlfx.exe28⤵
- Executes dropped EXE
PID:2928 -
\??\c:\bhbnbt.exec:\bhbnbt.exe29⤵
- Executes dropped EXE
PID:2448 -
\??\c:\ttthtn.exec:\ttthtn.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5080 -
\??\c:\9pvjp.exec:\9pvjp.exe31⤵
- Executes dropped EXE
PID:2812 -
\??\c:\3ffxllx.exec:\3ffxllx.exe32⤵
- Executes dropped EXE
PID:2200 -
\??\c:\htnhbn.exec:\htnhbn.exe33⤵
- Executes dropped EXE
PID:2268 -
\??\c:\ntbtbt.exec:\ntbtbt.exe34⤵
- Executes dropped EXE
PID:4184 -
\??\c:\vvddv.exec:\vvddv.exe35⤵
- Executes dropped EXE
PID:2152 -
\??\c:\vdvpp.exec:\vdvpp.exe36⤵
- Executes dropped EXE
PID:1564 -
\??\c:\5xrlxfx.exec:\5xrlxfx.exe37⤵
- Executes dropped EXE
PID:2412 -
\??\c:\5thtnb.exec:\5thtnb.exe38⤵
- Executes dropped EXE
PID:1824 -
\??\c:\5bhtbt.exec:\5bhtbt.exe39⤵
- Executes dropped EXE
PID:2144 -
\??\c:\1pjvj.exec:\1pjvj.exe40⤵
- Executes dropped EXE
PID:3148 -
\??\c:\vppjd.exec:\vppjd.exe41⤵
- Executes dropped EXE
PID:872 -
\??\c:\pvdvv.exec:\pvdvv.exe42⤵
- Executes dropped EXE
PID:3600 -
\??\c:\xrxllff.exec:\xrxllff.exe43⤵
- Executes dropped EXE
PID:5104 -
\??\c:\7llllfx.exec:\7llllfx.exe44⤵
- Executes dropped EXE
PID:1880 -
\??\c:\ntntth.exec:\ntntth.exe45⤵
- Executes dropped EXE
PID:744 -
\??\c:\tnbnnh.exec:\tnbnnh.exe46⤵
- Executes dropped EXE
PID:3252 -
\??\c:\dvpdp.exec:\dvpdp.exe47⤵
- Executes dropped EXE
PID:916 -
\??\c:\1flfrrf.exec:\1flfrrf.exe48⤵
- Executes dropped EXE
PID:3480 -
\??\c:\9xrrlxx.exec:\9xrrlxx.exe49⤵
- Executes dropped EXE
PID:1580 -
\??\c:\3bnhtn.exec:\3bnhtn.exe50⤵
- Executes dropped EXE
PID:3232 -
\??\c:\vdjdp.exec:\vdjdp.exe51⤵
- Executes dropped EXE
PID:2120 -
\??\c:\pdjvj.exec:\pdjvj.exe52⤵
- Executes dropped EXE
PID:3744 -
\??\c:\3lffrrf.exec:\3lffrrf.exe53⤵
- Executes dropped EXE
PID:60 -
\??\c:\fxfxxfr.exec:\fxfxxfr.exe54⤵
- Executes dropped EXE
PID:1948 -
\??\c:\5hhbbt.exec:\5hhbbt.exe55⤵
- Executes dropped EXE
PID:1464 -
\??\c:\bnhbhb.exec:\bnhbhb.exe56⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vvpjv.exec:\vvpjv.exe57⤵
- Executes dropped EXE
PID:4556 -
\??\c:\rfxlxrf.exec:\rfxlxrf.exe58⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lrrlfff.exec:\lrrlfff.exe59⤵
- Executes dropped EXE
PID:2496 -
\??\c:\bbhhnh.exec:\bbhhnh.exe60⤵
- Executes dropped EXE
PID:2756 -
\??\c:\3tnbhb.exec:\3tnbhb.exe61⤵
- Executes dropped EXE
PID:1344 -
\??\c:\thhbnh.exec:\thhbnh.exe62⤵
- Executes dropped EXE
PID:3296 -
\??\c:\dpjvd.exec:\dpjvd.exe63⤵
- Executes dropped EXE
PID:4952 -
\??\c:\rxxrlfr.exec:\rxxrlfr.exe64⤵
- Executes dropped EXE
PID:1624 -
\??\c:\1rxllff.exec:\1rxllff.exe65⤵
- Executes dropped EXE
PID:3332 -
\??\c:\nttnbb.exec:\nttnbb.exe66⤵PID:3780
-
\??\c:\nhtbtb.exec:\nhtbtb.exe67⤵PID:2768
-
\??\c:\3ppdj.exec:\3ppdj.exe68⤵PID:440
-
\??\c:\xfrfxrl.exec:\xfrfxrl.exe69⤵PID:5024
-
\??\c:\lflfrlf.exec:\lflfrlf.exe70⤵PID:2916
-
\??\c:\nhtnhn.exec:\nhtnhn.exe71⤵PID:2416
-
\??\c:\hbnbnh.exec:\hbnbnh.exe72⤵PID:4732
-
\??\c:\ppjvj.exec:\ppjvj.exe73⤵
- System Location Discovery: System Language Discovery
PID:4396 -
\??\c:\lxrfrlf.exec:\lxrfrlf.exe74⤵PID:3572
-
\??\c:\xllfrlf.exec:\xllfrlf.exe75⤵PID:2204
-
\??\c:\hbhbtt.exec:\hbhbtt.exe76⤵PID:3100
-
\??\c:\bnhnnh.exec:\bnhnnh.exe77⤵PID:4872
-
\??\c:\vddvd.exec:\vddvd.exe78⤵PID:2188
-
\??\c:\jdppv.exec:\jdppv.exe79⤵PID:1144
-
\??\c:\lxfxllf.exec:\lxfxllf.exe80⤵PID:4004
-
\??\c:\frlfrrf.exec:\frlfrrf.exe81⤵PID:888
-
\??\c:\tnbnbt.exec:\tnbnbt.exe82⤵PID:3280
-
\??\c:\nnnnnn.exec:\nnnnnn.exe83⤵PID:4960
-
\??\c:\flrlxxr.exec:\flrlxxr.exe84⤵PID:2840
-
\??\c:\hntnhh.exec:\hntnhh.exe85⤵PID:1140
-
\??\c:\tbnhbt.exec:\tbnhbt.exe86⤵PID:4320
-
\??\c:\vvjdp.exec:\vvjdp.exe87⤵PID:2304
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe88⤵PID:3692
-
\??\c:\9llxrll.exec:\9llxrll.exe89⤵PID:4244
-
\??\c:\nhnhbt.exec:\nhnhbt.exe90⤵PID:5080
-
\??\c:\dvppj.exec:\dvppj.exe91⤵PID:4120
-
\??\c:\vpvvp.exec:\vpvvp.exe92⤵PID:5112
-
\??\c:\1vdjv.exec:\1vdjv.exe93⤵PID:2516
-
\??\c:\ffllrrr.exec:\ffllrrr.exe94⤵PID:2884
-
\??\c:\fxrlfff.exec:\fxrlfff.exe95⤵PID:3840
-
\??\c:\7nhnnt.exec:\7nhnnt.exe96⤵PID:2148
-
\??\c:\7hnnhn.exec:\7hnnhn.exe97⤵PID:3776
-
\??\c:\pjjjv.exec:\pjjjv.exe98⤵PID:4040
-
\??\c:\jjjvd.exec:\jjjvd.exe99⤵PID:2180
-
\??\c:\frrllfr.exec:\frrllfr.exe100⤵PID:4052
-
\??\c:\5frffll.exec:\5frffll.exe101⤵PID:1776
-
\??\c:\thtthb.exec:\thtthb.exe102⤵PID:3192
-
\??\c:\ddvpv.exec:\ddvpv.exe103⤵PID:4656
-
\??\c:\jjjvj.exec:\jjjvj.exe104⤵PID:5056
-
\??\c:\5fxrflf.exec:\5fxrflf.exe105⤵PID:1032
-
\??\c:\xlrlrrx.exec:\xlrlrrx.exe106⤵PID:4536
-
\??\c:\5thhnn.exec:\5thhnn.exe107⤵PID:4860
-
\??\c:\tttnbt.exec:\tttnbt.exe108⤵PID:4944
-
\??\c:\vvpjj.exec:\vvpjj.exe109⤵PID:2156
-
\??\c:\lxxrffx.exec:\lxxrffx.exe110⤵PID:3424
-
\??\c:\lffxxxr.exec:\lffxxxr.exe111⤵PID:2428
-
\??\c:\bnhbhn.exec:\bnhbhn.exe112⤵PID:4764
-
\??\c:\ttbtbb.exec:\ttbtbb.exe113⤵PID:2616
-
\??\c:\9jjjj.exec:\9jjjj.exe114⤵PID:2348
-
\??\c:\xffxfxr.exec:\xffxfxr.exe115⤵PID:3676
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe116⤵PID:536
-
\??\c:\1nhhhb.exec:\1nhhhb.exe117⤵PID:4268
-
\??\c:\thhbhb.exec:\thhbhb.exe118⤵PID:2076
-
\??\c:\pvdjd.exec:\pvdjd.exe119⤵PID:1056
-
\??\c:\jvdjj.exec:\jvdjj.exe120⤵PID:376
-
\??\c:\lfrlrxr.exec:\lfrlrxr.exe121⤵PID:1588
-
\??\c:\tbhbnh.exec:\tbhbnh.exe122⤵PID:964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-