Analysis
-
max time kernel
120s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 13:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6b78c971930d6c37b38ea559b70f049f59c2b8ec595fd899dbc32a141f6e1523N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
6b78c971930d6c37b38ea559b70f049f59c2b8ec595fd899dbc32a141f6e1523N.exe
-
Size
71KB
-
MD5
fd522946fbdd78bad609fcdd2c529210
-
SHA1
8edca771b1425160c5dfa9df432298db90bde107
-
SHA256
6b78c971930d6c37b38ea559b70f049f59c2b8ec595fd899dbc32a141f6e1523
-
SHA512
539a955d399e335b3ed1cff877f1f221e4bcbdd364bc4aeec3522963a5a08bbb2b022d4f8f10ff7db6f5622da441e3e9854bda281cf3b3782de45d8b25bee3b7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjC:ymb3NkkiQ3mdBjFI4Vy
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4840-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/556-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/732-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3000 bhbthb.exe 3668 vppjd.exe 4008 fxrrlll.exe 4044 tnnnhb.exe 2448 nbbtnn.exe 556 jpvjd.exe 524 rxllflf.exe 4408 9rrxxxx.exe 3744 9nbbbh.exe 732 5jjdv.exe 60 lxxrrll.exe 3812 thhhbb.exe 2276 9bhbbh.exe 1588 dddvd.exe 2320 lfxxlll.exe 3628 nhbbtt.exe 4812 nhbthh.exe 4252 dpdvp.exe 3620 xrffxff.exe 864 3hhbtt.exe 3636 dvddd.exe 880 7dddp.exe 2540 nnnbnh.exe 2684 bthhhh.exe 3400 vvddv.exe 4868 rflffff.exe 4880 flrxxxf.exe 4472 btttnt.exe 1040 5vdvv.exe 2488 llrlffx.exe 4912 frrrllf.exe 2080 3nnnhh.exe 644 7thbtt.exe 2060 vpjdd.exe 1388 9vdvp.exe 2408 flxxrxr.exe 1048 5xrlffx.exe 4348 thhnnn.exe 4432 9ntttt.exe 3956 pjppp.exe 2912 5vvvj.exe 1232 3lrrrlr.exe 4084 rrlrlrr.exe 4008 5bhbtt.exe 2440 hbbnhh.exe 3436 pjjdd.exe 1348 3jppj.exe 2208 lrrrfll.exe 3208 lxrlllf.exe 2472 1lrrxxf.exe 868 nbhbbb.exe 3952 nnhbtn.exe 64 7ppjv.exe 3744 pjdjd.exe 732 rllfxxx.exe 4460 frrrrrr.exe 3896 1bbbtt.exe 4400 btbtnn.exe 2276 djjdv.exe 4892 vpjdd.exe 3900 fffxrrx.exe 4256 rlxrllf.exe 3204 1hbtnn.exe 2744 1hhhth.exe -
resource yara_rule behavioral2/memory/4840-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/524-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/524-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/524-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4840 wrote to memory of 3000 4840 6b78c971930d6c37b38ea559b70f049f59c2b8ec595fd899dbc32a141f6e1523N.exe 84 PID 4840 wrote to memory of 3000 4840 6b78c971930d6c37b38ea559b70f049f59c2b8ec595fd899dbc32a141f6e1523N.exe 84 PID 4840 wrote to memory of 3000 4840 6b78c971930d6c37b38ea559b70f049f59c2b8ec595fd899dbc32a141f6e1523N.exe 84 PID 3000 wrote to memory of 3668 3000 bhbthb.exe 85 PID 3000 wrote to memory of 3668 3000 bhbthb.exe 85 PID 3000 wrote to memory of 3668 3000 bhbthb.exe 85 PID 3668 wrote to memory of 4008 3668 vppjd.exe 86 PID 3668 wrote to memory of 4008 3668 vppjd.exe 86 PID 3668 wrote to memory of 4008 3668 vppjd.exe 86 PID 4008 wrote to memory of 4044 4008 fxrrlll.exe 87 PID 4008 wrote to memory of 4044 4008 fxrrlll.exe 87 PID 4008 wrote to memory of 4044 4008 fxrrlll.exe 87 PID 4044 wrote to memory of 2448 4044 tnnnhb.exe 88 PID 4044 wrote to memory of 2448 4044 tnnnhb.exe 88 PID 4044 wrote to memory of 2448 4044 tnnnhb.exe 88 PID 2448 wrote to memory of 556 2448 nbbtnn.exe 89 PID 2448 wrote to memory of 556 2448 nbbtnn.exe 89 PID 2448 wrote to memory of 556 2448 nbbtnn.exe 89 PID 556 wrote to memory of 524 556 jpvjd.exe 90 PID 556 wrote to memory of 524 556 jpvjd.exe 90 PID 556 wrote to memory of 524 556 jpvjd.exe 90 PID 524 wrote to memory of 4408 524 rxllflf.exe 91 PID 524 wrote to memory of 4408 524 rxllflf.exe 91 PID 524 wrote to memory of 4408 524 rxllflf.exe 91 PID 4408 wrote to memory of 3744 4408 9rrxxxx.exe 92 PID 4408 wrote to memory of 3744 4408 9rrxxxx.exe 92 PID 4408 wrote to memory of 3744 4408 9rrxxxx.exe 92 PID 3744 wrote to memory of 732 3744 9nbbbh.exe 93 PID 3744 wrote to memory of 732 3744 9nbbbh.exe 93 PID 3744 wrote to memory of 732 3744 9nbbbh.exe 93 PID 732 wrote to memory of 60 732 5jjdv.exe 94 PID 732 wrote to memory of 60 732 5jjdv.exe 94 PID 732 wrote to memory of 60 732 5jjdv.exe 94 PID 60 wrote to memory of 3812 60 lxxrrll.exe 95 PID 60 wrote to memory of 3812 60 lxxrrll.exe 95 PID 60 wrote to memory of 3812 60 lxxrrll.exe 95 PID 3812 wrote to memory of 2276 3812 thhhbb.exe 96 PID 3812 wrote to memory of 2276 3812 thhhbb.exe 96 PID 3812 wrote to memory of 2276 3812 thhhbb.exe 96 PID 2276 wrote to memory of 1588 2276 9bhbbh.exe 97 PID 2276 wrote to memory of 1588 2276 9bhbbh.exe 97 PID 2276 wrote to memory of 1588 2276 9bhbbh.exe 97 PID 1588 wrote to memory of 2320 1588 dddvd.exe 98 PID 1588 wrote to memory of 2320 1588 dddvd.exe 98 PID 1588 wrote to memory of 2320 1588 dddvd.exe 98 PID 2320 wrote to memory of 3628 2320 lfxxlll.exe 100 PID 2320 wrote to memory of 3628 2320 lfxxlll.exe 100 PID 2320 wrote to memory of 3628 2320 lfxxlll.exe 100 PID 3628 wrote to memory of 4812 3628 nhbbtt.exe 101 PID 3628 wrote to memory of 4812 3628 nhbbtt.exe 101 PID 3628 wrote to memory of 4812 3628 nhbbtt.exe 101 PID 4812 wrote to memory of 4252 4812 nhbthh.exe 102 PID 4812 wrote to memory of 4252 4812 nhbthh.exe 102 PID 4812 wrote to memory of 4252 4812 nhbthh.exe 102 PID 4252 wrote to memory of 3620 4252 dpdvp.exe 103 PID 4252 wrote to memory of 3620 4252 dpdvp.exe 103 PID 4252 wrote to memory of 3620 4252 dpdvp.exe 103 PID 3620 wrote to memory of 864 3620 xrffxff.exe 104 PID 3620 wrote to memory of 864 3620 xrffxff.exe 104 PID 3620 wrote to memory of 864 3620 xrffxff.exe 104 PID 864 wrote to memory of 3636 864 3hhbtt.exe 105 PID 864 wrote to memory of 3636 864 3hhbtt.exe 105 PID 864 wrote to memory of 3636 864 3hhbtt.exe 105 PID 3636 wrote to memory of 880 3636 dvddd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b78c971930d6c37b38ea559b70f049f59c2b8ec595fd899dbc32a141f6e1523N.exe"C:\Users\Admin\AppData\Local\Temp\6b78c971930d6c37b38ea559b70f049f59c2b8ec595fd899dbc32a141f6e1523N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\bhbthb.exec:\bhbthb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\vppjd.exec:\vppjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\fxrrlll.exec:\fxrrlll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\tnnnhb.exec:\tnnnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\nbbtnn.exec:\nbbtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\jpvjd.exec:\jpvjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\rxllflf.exec:\rxllflf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524 -
\??\c:\9rrxxxx.exec:\9rrxxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\9nbbbh.exec:\9nbbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\5jjdv.exec:\5jjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\lxxrrll.exec:\lxxrrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\thhhbb.exec:\thhhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\9bhbbh.exec:\9bhbbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\dddvd.exec:\dddvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\lfxxlll.exec:\lfxxlll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\nhbbtt.exec:\nhbbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\nhbthh.exec:\nhbthh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\dpdvp.exec:\dpdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\xrffxff.exec:\xrffxff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\3hhbtt.exec:\3hhbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\dvddd.exec:\dvddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\7dddp.exec:\7dddp.exe23⤵
- Executes dropped EXE
PID:880 -
\??\c:\nnnbnh.exec:\nnnbnh.exe24⤵
- Executes dropped EXE
PID:2540 -
\??\c:\bthhhh.exec:\bthhhh.exe25⤵
- Executes dropped EXE
PID:2684 -
\??\c:\vvddv.exec:\vvddv.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3400 -
\??\c:\rflffff.exec:\rflffff.exe27⤵
- Executes dropped EXE
PID:4868 -
\??\c:\flrxxxf.exec:\flrxxxf.exe28⤵
- Executes dropped EXE
PID:4880 -
\??\c:\btttnt.exec:\btttnt.exe29⤵
- Executes dropped EXE
PID:4472 -
\??\c:\5vdvv.exec:\5vdvv.exe30⤵
- Executes dropped EXE
PID:1040 -
\??\c:\llrlffx.exec:\llrlffx.exe31⤵
- Executes dropped EXE
PID:2488 -
\??\c:\frrrllf.exec:\frrrllf.exe32⤵
- Executes dropped EXE
PID:4912 -
\??\c:\3nnnhh.exec:\3nnnhh.exe33⤵
- Executes dropped EXE
PID:2080 -
\??\c:\7thbtt.exec:\7thbtt.exe34⤵
- Executes dropped EXE
PID:644 -
\??\c:\vpjdd.exec:\vpjdd.exe35⤵
- Executes dropped EXE
PID:2060 -
\??\c:\9vdvp.exec:\9vdvp.exe36⤵
- Executes dropped EXE
PID:1388 -
\??\c:\flxxrxr.exec:\flxxrxr.exe37⤵
- Executes dropped EXE
PID:2408 -
\??\c:\5xrlffx.exec:\5xrlffx.exe38⤵
- Executes dropped EXE
PID:1048 -
\??\c:\thhnnn.exec:\thhnnn.exe39⤵
- Executes dropped EXE
PID:4348 -
\??\c:\9ntttt.exec:\9ntttt.exe40⤵
- Executes dropped EXE
PID:4432 -
\??\c:\pjppp.exec:\pjppp.exe41⤵
- Executes dropped EXE
PID:3956 -
\??\c:\5vvvj.exec:\5vvvj.exe42⤵
- Executes dropped EXE
PID:2912 -
\??\c:\3lrrrlr.exec:\3lrrrlr.exe43⤵
- Executes dropped EXE
PID:1232 -
\??\c:\rrlrlrr.exec:\rrlrlrr.exe44⤵
- Executes dropped EXE
PID:4084 -
\??\c:\5bhbtt.exec:\5bhbtt.exe45⤵
- Executes dropped EXE
PID:4008 -
\??\c:\hbbnhh.exec:\hbbnhh.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2440 -
\??\c:\pjjdd.exec:\pjjdd.exe47⤵
- Executes dropped EXE
PID:3436 -
\??\c:\3jppj.exec:\3jppj.exe48⤵
- Executes dropped EXE
PID:1348 -
\??\c:\lrrrfll.exec:\lrrrfll.exe49⤵
- Executes dropped EXE
PID:2208 -
\??\c:\lxrlllf.exec:\lxrlllf.exe50⤵
- Executes dropped EXE
PID:3208 -
\??\c:\1lrrxxf.exec:\1lrrxxf.exe51⤵
- Executes dropped EXE
PID:2472 -
\??\c:\nbhbbb.exec:\nbhbbb.exe52⤵
- Executes dropped EXE
PID:868 -
\??\c:\nnhbtn.exec:\nnhbtn.exe53⤵
- Executes dropped EXE
PID:3952 -
\??\c:\7ppjv.exec:\7ppjv.exe54⤵
- Executes dropped EXE
PID:64 -
\??\c:\pjdjd.exec:\pjdjd.exe55⤵
- Executes dropped EXE
PID:3744 -
\??\c:\rllfxxx.exec:\rllfxxx.exe56⤵
- Executes dropped EXE
PID:732 -
\??\c:\frrrrrr.exec:\frrrrrr.exe57⤵
- Executes dropped EXE
PID:4460 -
\??\c:\1bbbtt.exec:\1bbbtt.exe58⤵
- Executes dropped EXE
PID:3896 -
\??\c:\btbtnn.exec:\btbtnn.exe59⤵
- Executes dropped EXE
PID:4400 -
\??\c:\djjdv.exec:\djjdv.exe60⤵
- Executes dropped EXE
PID:2276 -
\??\c:\vpjdd.exec:\vpjdd.exe61⤵
- Executes dropped EXE
PID:4892 -
\??\c:\fffxrrx.exec:\fffxrrx.exe62⤵
- Executes dropped EXE
PID:3900 -
\??\c:\rlxrllf.exec:\rlxrllf.exe63⤵
- Executes dropped EXE
PID:4256 -
\??\c:\1hbtnn.exec:\1hbtnn.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3204 -
\??\c:\1hhhth.exec:\1hhhth.exe65⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jjvpj.exec:\jjvpj.exe66⤵PID:4560
-
\??\c:\lrxrfff.exec:\lrxrfff.exe67⤵PID:3908
-
\??\c:\fxrllrr.exec:\fxrllrr.exe68⤵PID:2156
-
\??\c:\9bhbtn.exec:\9bhbtn.exe69⤵PID:3044
-
\??\c:\ntttnn.exec:\ntttnn.exe70⤵PID:4996
-
\??\c:\9pdvd.exec:\9pdvd.exe71⤵PID:3212
-
\??\c:\jjjjd.exec:\jjjjd.exe72⤵PID:32
-
\??\c:\9rrlxxr.exec:\9rrlxxr.exe73⤵PID:1836
-
\??\c:\lrxxrrr.exec:\lrxxrrr.exe74⤵PID:3316
-
\??\c:\ttbthh.exec:\ttbthh.exe75⤵PID:4108
-
\??\c:\vddjv.exec:\vddjv.exe76⤵PID:1364
-
\??\c:\5xlfxxr.exec:\5xlfxxr.exe77⤵PID:4796
-
\??\c:\5flfllr.exec:\5flfllr.exe78⤵PID:4012
-
\??\c:\bthhbb.exec:\bthhbb.exe79⤵PID:3808
-
\??\c:\hbtntt.exec:\hbtntt.exe80⤵PID:3576
-
\??\c:\dppjd.exec:\dppjd.exe81⤵PID:3740
-
\??\c:\pjdvp.exec:\pjdvp.exe82⤵PID:4648
-
\??\c:\3vvpd.exec:\3vvpd.exe83⤵PID:1872
-
\??\c:\lfrrxxx.exec:\lfrrxxx.exe84⤵PID:3444
-
\??\c:\nhhbtn.exec:\nhhbtn.exe85⤵PID:3692
-
\??\c:\hhbtnn.exec:\hhbtnn.exe86⤵PID:2500
-
\??\c:\jddjv.exec:\jddjv.exe87⤵PID:4928
-
\??\c:\xxrrlrr.exec:\xxrrlrr.exe88⤵PID:5028
-
\??\c:\fxxfflf.exec:\fxxfflf.exe89⤵PID:1048
-
\??\c:\btbhbn.exec:\btbhbn.exe90⤵PID:4348
-
\??\c:\bbnntt.exec:\bbnntt.exe91⤵PID:4432
-
\??\c:\ppdvv.exec:\ppdvv.exe92⤵PID:3956
-
\??\c:\dpjvp.exec:\dpjvp.exe93⤵PID:4064
-
\??\c:\lrfrllf.exec:\lrfrllf.exe94⤵PID:3676
-
\??\c:\xrrrlff.exec:\xrrrlff.exe95⤵PID:4084
-
\??\c:\htnhbt.exec:\htnhbt.exe96⤵PID:4008
-
\??\c:\vjdvv.exec:\vjdvv.exe97⤵PID:2440
-
\??\c:\pvjvv.exec:\pvjvv.exe98⤵PID:4872
-
\??\c:\dvvpj.exec:\dvvpj.exe99⤵PID:4576
-
\??\c:\fflxrrl.exec:\fflxrrl.exe100⤵PID:2208
-
\??\c:\rlffxxr.exec:\rlffxxr.exe101⤵PID:3736
-
\??\c:\nbbtbn.exec:\nbbtbn.exe102⤵PID:1876
-
\??\c:\dpvpp.exec:\dpvpp.exe103⤵PID:3340
-
\??\c:\jddvj.exec:\jddvj.exe104⤵PID:3556
-
\??\c:\fllfxxx.exec:\fllfxxx.exe105⤵PID:2608
-
\??\c:\rlfxffl.exec:\rlfxffl.exe106⤵PID:1536
-
\??\c:\hhnntb.exec:\hhnntb.exe107⤵PID:2364
-
\??\c:\tbbbnn.exec:\tbbbnn.exe108⤵PID:2040
-
\??\c:\ddvpp.exec:\ddvpp.exe109⤵PID:3772
-
\??\c:\vddvj.exec:\vddvj.exe110⤵PID:3684
-
\??\c:\ppvpp.exec:\ppvpp.exe111⤵PID:4308
-
\??\c:\fxlffxf.exec:\fxlffxf.exe112⤵PID:4608
-
\??\c:\rxllrxf.exec:\rxllrxf.exe113⤵PID:4512
-
\??\c:\9nnbbh.exec:\9nnbbh.exe114⤵PID:4508
-
\??\c:\9hbthh.exec:\9hbthh.exe115⤵PID:3344
-
\??\c:\ppdvp.exec:\ppdvp.exe116⤵PID:3180
-
\??\c:\dpvjd.exec:\dpvjd.exe117⤵PID:780
-
\??\c:\rrrlffx.exec:\rrrlffx.exe118⤵PID:1932
-
\??\c:\lxxrlff.exec:\lxxrlff.exe119⤵PID:952
-
\??\c:\xllffxx.exec:\xllffxx.exe120⤵PID:3784
-
\??\c:\3hnnnn.exec:\3hnnnn.exe121⤵PID:1648
-
\??\c:\thnnhh.exec:\thnnhh.exe122⤵PID:2308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-