Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 13:27
Static task
static1
Behavioral task
behavioral1
Sample
474793174870b1b8f978a1c696ccc5a1bf1edd03ffe8bcfae7dbfaca400d7ee3N.exe
Resource
win7-20240903-en
General
-
Target
474793174870b1b8f978a1c696ccc5a1bf1edd03ffe8bcfae7dbfaca400d7ee3N.exe
-
Size
75KB
-
MD5
a4c13ca5c7d71ec055b1aa0d829aea40
-
SHA1
fe6f8d20ea61877a0134b0456712aaf33906f66e
-
SHA256
474793174870b1b8f978a1c696ccc5a1bf1edd03ffe8bcfae7dbfaca400d7ee3
-
SHA512
ea94987162f17a034436b98b05f2ceb3c88e24ebe4fdc62345996292d8ba88dbf1769bbc059d19839286e6bc8cbe805f99c07be78edeb73260e32cd457dfa8c5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmsp:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHT
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/592-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2108-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2672-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/348-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2172-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4768 flxrllf.exe 2108 lfxxxfx.exe 3740 hbbtnh.exe 2672 vpddj.exe 4620 7lllrrl.exe 1416 bnhnnh.exe 1660 btnhhh.exe 1184 jddpj.exe 4912 5ttnhb.exe 2460 htnhhh.exe 1128 jvppv.exe 3764 rrxxrrl.exe 348 1frfxfx.exe 1200 htntht.exe 3328 1pjjv.exe 1992 5fxlxrx.exe 2104 ffffxxx.exe 4208 nhhhbn.exe 228 jvvpp.exe 3156 5dvpj.exe 740 flxrlll.exe 4280 nhnntt.exe 3440 bntbth.exe 3064 1vddd.exe 4760 fffxxxr.exe 2172 flxlrlr.exe 3516 hbbtbt.exe 4012 bnnhhh.exe 2448 ppppp.exe 5020 jpvvv.exe 1860 lxflffx.exe 2560 tnhntt.exe 752 vppjv.exe 1400 jdvpp.exe 592 lffxfff.exe 3088 3xflllf.exe 1668 tnnnhn.exe 760 3hhbtt.exe 820 bbbbnn.exe 4512 5vddv.exe 3828 5rxxrfx.exe 4836 fxxrrll.exe 3868 lflfllr.exe 876 1tbbbb.exe 644 3vvpj.exe 3524 5ddvv.exe 2064 xrrlfxr.exe 3212 nntnht.exe 3904 tththh.exe 784 1djpj.exe 2000 ffffxfx.exe 1932 fllfxxr.exe 1320 tnnhbb.exe 5060 pjjdp.exe 2956 lfffllr.exe 3676 llxxlll.exe 2792 hnhttn.exe 1496 9hnhhh.exe 3080 3jppj.exe 2884 pjvpp.exe 2232 1flxrrl.exe 4956 pdvjp.exe 3500 dpdvv.exe 864 rlrrrll.exe -
resource yara_rule behavioral2/memory/592-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2672-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2672-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/348-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2172-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbttt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 592 wrote to memory of 4768 592 474793174870b1b8f978a1c696ccc5a1bf1edd03ffe8bcfae7dbfaca400d7ee3N.exe 83 PID 592 wrote to memory of 4768 592 474793174870b1b8f978a1c696ccc5a1bf1edd03ffe8bcfae7dbfaca400d7ee3N.exe 83 PID 592 wrote to memory of 4768 592 474793174870b1b8f978a1c696ccc5a1bf1edd03ffe8bcfae7dbfaca400d7ee3N.exe 83 PID 4768 wrote to memory of 2108 4768 flxrllf.exe 84 PID 4768 wrote to memory of 2108 4768 flxrllf.exe 84 PID 4768 wrote to memory of 2108 4768 flxrllf.exe 84 PID 2108 wrote to memory of 3740 2108 lfxxxfx.exe 85 PID 2108 wrote to memory of 3740 2108 lfxxxfx.exe 85 PID 2108 wrote to memory of 3740 2108 lfxxxfx.exe 85 PID 3740 wrote to memory of 2672 3740 hbbtnh.exe 86 PID 3740 wrote to memory of 2672 3740 hbbtnh.exe 86 PID 3740 wrote to memory of 2672 3740 hbbtnh.exe 86 PID 2672 wrote to memory of 4620 2672 vpddj.exe 87 PID 2672 wrote to memory of 4620 2672 vpddj.exe 87 PID 2672 wrote to memory of 4620 2672 vpddj.exe 87 PID 4620 wrote to memory of 1416 4620 7lllrrl.exe 88 PID 4620 wrote to memory of 1416 4620 7lllrrl.exe 88 PID 4620 wrote to memory of 1416 4620 7lllrrl.exe 88 PID 1416 wrote to memory of 1660 1416 bnhnnh.exe 89 PID 1416 wrote to memory of 1660 1416 bnhnnh.exe 89 PID 1416 wrote to memory of 1660 1416 bnhnnh.exe 89 PID 1660 wrote to memory of 1184 1660 btnhhh.exe 91 PID 1660 wrote to memory of 1184 1660 btnhhh.exe 91 PID 1660 wrote to memory of 1184 1660 btnhhh.exe 91 PID 1184 wrote to memory of 4912 1184 jddpj.exe 92 PID 1184 wrote to memory of 4912 1184 jddpj.exe 92 PID 1184 wrote to memory of 4912 1184 jddpj.exe 92 PID 4912 wrote to memory of 2460 4912 5ttnhb.exe 94 PID 4912 wrote to memory of 2460 4912 5ttnhb.exe 94 PID 4912 wrote to memory of 2460 4912 5ttnhb.exe 94 PID 2460 wrote to memory of 1128 2460 htnhhh.exe 95 PID 2460 wrote to memory of 1128 2460 htnhhh.exe 95 PID 2460 wrote to memory of 1128 2460 htnhhh.exe 95 PID 1128 wrote to memory of 3764 1128 jvppv.exe 96 PID 1128 wrote to memory of 3764 1128 jvppv.exe 96 PID 1128 wrote to memory of 3764 1128 jvppv.exe 96 PID 3764 wrote to memory of 348 3764 rrxxrrl.exe 97 PID 3764 wrote to memory of 348 3764 rrxxrrl.exe 97 PID 3764 wrote to memory of 348 3764 rrxxrrl.exe 97 PID 348 wrote to memory of 1200 348 1frfxfx.exe 99 PID 348 wrote to memory of 1200 348 1frfxfx.exe 99 PID 348 wrote to memory of 1200 348 1frfxfx.exe 99 PID 1200 wrote to memory of 3328 1200 htntht.exe 100 PID 1200 wrote to memory of 3328 1200 htntht.exe 100 PID 1200 wrote to memory of 3328 1200 htntht.exe 100 PID 3328 wrote to memory of 1992 3328 1pjjv.exe 101 PID 3328 wrote to memory of 1992 3328 1pjjv.exe 101 PID 3328 wrote to memory of 1992 3328 1pjjv.exe 101 PID 1992 wrote to memory of 2104 1992 5fxlxrx.exe 102 PID 1992 wrote to memory of 2104 1992 5fxlxrx.exe 102 PID 1992 wrote to memory of 2104 1992 5fxlxrx.exe 102 PID 2104 wrote to memory of 4208 2104 ffffxxx.exe 103 PID 2104 wrote to memory of 4208 2104 ffffxxx.exe 103 PID 2104 wrote to memory of 4208 2104 ffffxxx.exe 103 PID 4208 wrote to memory of 228 4208 nhhhbn.exe 104 PID 4208 wrote to memory of 228 4208 nhhhbn.exe 104 PID 4208 wrote to memory of 228 4208 nhhhbn.exe 104 PID 228 wrote to memory of 3156 228 jvvpp.exe 105 PID 228 wrote to memory of 3156 228 jvvpp.exe 105 PID 228 wrote to memory of 3156 228 jvvpp.exe 105 PID 3156 wrote to memory of 740 3156 5dvpj.exe 106 PID 3156 wrote to memory of 740 3156 5dvpj.exe 106 PID 3156 wrote to memory of 740 3156 5dvpj.exe 106 PID 740 wrote to memory of 4280 740 flxrlll.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\474793174870b1b8f978a1c696ccc5a1bf1edd03ffe8bcfae7dbfaca400d7ee3N.exe"C:\Users\Admin\AppData\Local\Temp\474793174870b1b8f978a1c696ccc5a1bf1edd03ffe8bcfae7dbfaca400d7ee3N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\flxrllf.exec:\flxrllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\lfxxxfx.exec:\lfxxxfx.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\hbbtnh.exec:\hbbtnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\vpddj.exec:\vpddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\7lllrrl.exec:\7lllrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\bnhnnh.exec:\bnhnnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\btnhhh.exec:\btnhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\jddpj.exec:\jddpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\5ttnhb.exec:\5ttnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\htnhhh.exec:\htnhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\jvppv.exec:\jvppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\rrxxrrl.exec:\rrxxrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\1frfxfx.exec:\1frfxfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\htntht.exec:\htntht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\1pjjv.exec:\1pjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\5fxlxrx.exec:\5fxlxrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\ffffxxx.exec:\ffffxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\nhhhbn.exec:\nhhhbn.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\jvvpp.exec:\jvvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\5dvpj.exec:\5dvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\flxrlll.exec:\flxrlll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\nhnntt.exec:\nhnntt.exe23⤵
- Executes dropped EXE
PID:4280 -
\??\c:\bntbth.exec:\bntbth.exe24⤵
- Executes dropped EXE
PID:3440 -
\??\c:\1vddd.exec:\1vddd.exe25⤵
- Executes dropped EXE
PID:3064 -
\??\c:\fffxxxr.exec:\fffxxxr.exe26⤵
- Executes dropped EXE
PID:4760 -
\??\c:\flxlrlr.exec:\flxlrlr.exe27⤵
- Executes dropped EXE
PID:2172 -
\??\c:\hbbtbt.exec:\hbbtbt.exe28⤵
- Executes dropped EXE
PID:3516 -
\??\c:\bnnhhh.exec:\bnnhhh.exe29⤵
- Executes dropped EXE
PID:4012 -
\??\c:\ppppp.exec:\ppppp.exe30⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jpvvv.exec:\jpvvv.exe31⤵
- Executes dropped EXE
PID:5020 -
\??\c:\lxflffx.exec:\lxflffx.exe32⤵
- Executes dropped EXE
PID:1860 -
\??\c:\tnhntt.exec:\tnhntt.exe33⤵
- Executes dropped EXE
PID:2560 -
\??\c:\vppjv.exec:\vppjv.exe34⤵
- Executes dropped EXE
PID:752 -
\??\c:\jdvpp.exec:\jdvpp.exe35⤵
- Executes dropped EXE
PID:1400 -
\??\c:\lffxfff.exec:\lffxfff.exe36⤵
- Executes dropped EXE
PID:592 -
\??\c:\3xflllf.exec:\3xflllf.exe37⤵
- Executes dropped EXE
PID:3088 -
\??\c:\tnnnhn.exec:\tnnnhn.exe38⤵
- Executes dropped EXE
PID:1668 -
\??\c:\3hhbtt.exec:\3hhbtt.exe39⤵
- Executes dropped EXE
PID:760 -
\??\c:\bbbbnn.exec:\bbbbnn.exe40⤵
- Executes dropped EXE
PID:820 -
\??\c:\5vddv.exec:\5vddv.exe41⤵
- Executes dropped EXE
PID:4512 -
\??\c:\5rxxrfx.exec:\5rxxrfx.exe42⤵
- Executes dropped EXE
PID:3828 -
\??\c:\fxxrrll.exec:\fxxrrll.exe43⤵
- Executes dropped EXE
PID:4836 -
\??\c:\lflfllr.exec:\lflfllr.exe44⤵
- Executes dropped EXE
PID:3868 -
\??\c:\1tbbbb.exec:\1tbbbb.exe45⤵
- Executes dropped EXE
PID:876 -
\??\c:\3vvpj.exec:\3vvpj.exe46⤵
- Executes dropped EXE
PID:644 -
\??\c:\5ddvv.exec:\5ddvv.exe47⤵
- Executes dropped EXE
PID:3524 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe48⤵
- Executes dropped EXE
PID:2064 -
\??\c:\nntnht.exec:\nntnht.exe49⤵
- Executes dropped EXE
PID:3212 -
\??\c:\tththh.exec:\tththh.exe50⤵
- Executes dropped EXE
PID:3904 -
\??\c:\1djpj.exec:\1djpj.exe51⤵
- Executes dropped EXE
PID:784 -
\??\c:\ffffxfx.exec:\ffffxfx.exe52⤵
- Executes dropped EXE
PID:2000 -
\??\c:\fllfxxr.exec:\fllfxxr.exe53⤵
- Executes dropped EXE
PID:1932 -
\??\c:\tnnhbb.exec:\tnnhbb.exe54⤵
- Executes dropped EXE
PID:1320 -
\??\c:\pjjdp.exec:\pjjdp.exe55⤵
- Executes dropped EXE
PID:5060 -
\??\c:\lfffllr.exec:\lfffllr.exe56⤵
- Executes dropped EXE
PID:2956 -
\??\c:\llxxlll.exec:\llxxlll.exe57⤵
- Executes dropped EXE
PID:3676 -
\??\c:\hnhttn.exec:\hnhttn.exe58⤵
- Executes dropped EXE
PID:2792 -
\??\c:\9hnhhh.exec:\9hnhhh.exe59⤵
- Executes dropped EXE
PID:1496 -
\??\c:\3jppj.exec:\3jppj.exe60⤵
- Executes dropped EXE
PID:3080 -
\??\c:\pjvpp.exec:\pjvpp.exe61⤵
- Executes dropped EXE
PID:2884 -
\??\c:\1flxrrl.exec:\1flxrrl.exe62⤵
- Executes dropped EXE
PID:2232 -
\??\c:\pdvjp.exec:\pdvjp.exe63⤵
- Executes dropped EXE
PID:4956 -
\??\c:\dpdvv.exec:\dpdvv.exe64⤵
- Executes dropped EXE
PID:3500 -
\??\c:\rlrrrll.exec:\rlrrrll.exe65⤵
- Executes dropped EXE
PID:864 -
\??\c:\nhttbn.exec:\nhttbn.exe66⤵PID:3012
-
\??\c:\hhhhth.exec:\hhhhth.exe67⤵PID:4816
-
\??\c:\vjppp.exec:\vjppp.exe68⤵PID:4680
-
\??\c:\5xfxrrl.exec:\5xfxrrl.exe69⤵PID:4760
-
\??\c:\llllflf.exec:\llllflf.exe70⤵PID:2908
-
\??\c:\tnhbhn.exec:\tnhbhn.exe71⤵PID:4360
-
\??\c:\jppjv.exec:\jppjv.exe72⤵PID:4968
-
\??\c:\pjjvj.exec:\pjjvj.exe73⤵PID:688
-
\??\c:\fxlfffr.exec:\fxlfffr.exe74⤵PID:2448
-
\??\c:\hnntbn.exec:\hnntbn.exe75⤵PID:3120
-
\??\c:\hbhhbb.exec:\hbhhbb.exe76⤵PID:756
-
\??\c:\jvppj.exec:\jvppj.exe77⤵PID:4932
-
\??\c:\xlxfxxl.exec:\xlxfxxl.exe78⤵PID:924
-
\??\c:\frrrrrl.exec:\frrrrrl.exe79⤵PID:1284
-
\??\c:\nhhhhh.exec:\nhhhhh.exe80⤵PID:4848
-
\??\c:\vdjjd.exec:\vdjjd.exe81⤵PID:4100
-
\??\c:\1hhbnn.exec:\1hhbnn.exe82⤵PID:2008
-
\??\c:\bnbntn.exec:\bnbntn.exe83⤵PID:220
-
\??\c:\vdvjp.exec:\vdvjp.exe84⤵PID:2764
-
\??\c:\lrxxlxl.exec:\lrxxlxl.exe85⤵PID:4212
-
\??\c:\ntttnh.exec:\ntttnh.exe86⤵PID:1452
-
\??\c:\3ppdv.exec:\3ppdv.exe87⤵PID:4836
-
\??\c:\5ffrffx.exec:\5ffrffx.exe88⤵PID:3868
-
\??\c:\lfxrrrl.exec:\lfxrrrl.exe89⤵PID:876
-
\??\c:\9tthbb.exec:\9tthbb.exe90⤵PID:4912
-
\??\c:\ddvpj.exec:\ddvpj.exe91⤵PID:4596
-
\??\c:\7flrxrr.exec:\7flrxrr.exe92⤵PID:5024
-
\??\c:\fffxllf.exec:\fffxllf.exe93⤵PID:1128
-
\??\c:\9nnhbb.exec:\9nnhbb.exe94⤵PID:2476
-
\??\c:\ppvdj.exec:\ppvdj.exe95⤵PID:4320
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe96⤵PID:3720
-
\??\c:\5ttnhb.exec:\5ttnhb.exe97⤵PID:4056
-
\??\c:\vppjv.exec:\vppjv.exe98⤵PID:2904
-
\??\c:\pjpjv.exec:\pjpjv.exe99⤵PID:2052
-
\??\c:\xxrlxlf.exec:\xxrlxlf.exe100⤵PID:3328
-
\??\c:\nhtntt.exec:\nhtntt.exe101⤵PID:672
-
\??\c:\btttnn.exec:\btttnn.exe102⤵PID:2800
-
\??\c:\vjjvp.exec:\vjjvp.exe103⤵PID:1028
-
\??\c:\lffxrfl.exec:\lffxrfl.exe104⤵PID:228
-
\??\c:\rxrflrr.exec:\rxrflrr.exe105⤵PID:4664
-
\??\c:\bhbnbn.exec:\bhbnbn.exe106⤵PID:3176
-
\??\c:\pjddp.exec:\pjddp.exe107⤵PID:1432
-
\??\c:\9vvpj.exec:\9vvpj.exe108⤵PID:3020
-
\??\c:\flfxxfr.exec:\flfxxfr.exe109⤵PID:4576
-
\??\c:\7ffxrrl.exec:\7ffxrrl.exe110⤵PID:2156
-
\??\c:\hbbtbn.exec:\hbbtbn.exe111⤵PID:4500
-
\??\c:\ddpdj.exec:\ddpdj.exe112⤵PID:2924
-
\??\c:\dddvv.exec:\dddvv.exe113⤵PID:3320
-
\??\c:\fllrllr.exec:\fllrllr.exe114⤵PID:4432
-
\??\c:\rrrrlfx.exec:\rrrrlfx.exe115⤵PID:3116
-
\??\c:\bhtthh.exec:\bhtthh.exe116⤵PID:848
-
\??\c:\vpvpj.exec:\vpvpj.exe117⤵PID:4204
-
\??\c:\vjjdp.exec:\vjjdp.exe118⤵PID:3452
-
\??\c:\frfxrlf.exec:\frfxrlf.exe119⤵PID:1860
-
\??\c:\hntnhh.exec:\hntnhh.exe120⤵PID:2548
-
\??\c:\hhbthh.exec:\hhbthh.exe121⤵PID:4384
-
\??\c:\7jjjv.exec:\7jjjv.exe122⤵PID:536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-