Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-11-2024 12:56
Static task
static1
Behavioral task
behavioral1
Sample
e4665c18ab034d9b52c69c94797fc0658026db3f2a5db61221e2c536ff694bbfN.exe
Resource
win7-20240903-en
General
-
Target
e4665c18ab034d9b52c69c94797fc0658026db3f2a5db61221e2c536ff694bbfN.exe
-
Size
80KB
-
MD5
8c912c3bd66714d2a81aa750edb65be0
-
SHA1
16d4982bdc8466b2986af09f010dfef45ac762c6
-
SHA256
e4665c18ab034d9b52c69c94797fc0658026db3f2a5db61221e2c536ff694bbf
-
SHA512
5f0419cd678fb98bd2684c8517bc30b81df0d157791091d4c24b44f9a5885cf59a770e562720c1e437ce3c5f9a338ed16bf6c93ebaebdffff0036d8833a6b8e4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JxJe:ymb3NkkiQ3mdBjFIWeFGyAsJe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral1/memory/2272-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2232-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1652-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/624-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1084-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1304-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/984-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2212 tbttbt.exe 2480 1pjjv.exe 2108 5nhntb.exe 2232 9vppd.exe 2772 lfrxfxf.exe 2580 1btbht.exe 2660 9xxxlrx.exe 1708 nbtthn.exe 2692 3jvjj.exe 1488 rxfrrrl.exe 1732 7llfxrx.exe 1784 bnbbhn.exe 1652 jddjp.exe 624 pjdjv.exe 1552 nnttbt.exe 1800 btbbnh.exe 2880 jdjpd.exe 3024 fxrfxfx.exe 2220 ttnntn.exe 2392 1hhntt.exe 404 3dvpd.exe 1136 7lfrffx.exe 1348 nntntt.exe 1084 nhtbtb.exe 1940 vpdvj.exe 2176 ddjpd.exe 1304 xrxrffx.exe 2088 rxfxrfr.exe 984 ddpdj.exe 2472 xxllrrl.exe 2484 hhbhbb.exe 2100 ttthht.exe 2504 jjddd.exe 2292 rxrlfxf.exe 264 rxrrffr.exe 2764 5tthht.exe 2964 7htbbh.exe 2852 dvjjp.exe 2840 5dvpv.exe 2872 lflxfrl.exe 2796 fffrrxl.exe 2592 htntbb.exe 2164 hbhnnb.exe 2740 3dpjj.exe 2044 pjjpj.exe 1992 lxllrrf.exe 2012 rlxfllf.exe 1712 7btbhh.exe 112 bbbhnn.exe 1680 nnhnnh.exe 1436 jjjdd.exe 1516 5rffrrl.exe 2560 rfrxlrf.exe 2612 9hbnnt.exe 1600 ttntht.exe 2224 bttbhh.exe 1096 vpdjv.exe 796 rrfllrx.exe 2876 xrflxxl.exe 1520 1nhnbb.exe 1340 3hhnnt.exe 2332 9jjvv.exe 1716 jjvpv.exe 2408 7frlllx.exe -
resource yara_rule behavioral1/memory/2272-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2232-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1652-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/624-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2220-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1084-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1304-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/984-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-317-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllflxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2212 2272 e4665c18ab034d9b52c69c94797fc0658026db3f2a5db61221e2c536ff694bbfN.exe 30 PID 2272 wrote to memory of 2212 2272 e4665c18ab034d9b52c69c94797fc0658026db3f2a5db61221e2c536ff694bbfN.exe 30 PID 2272 wrote to memory of 2212 2272 e4665c18ab034d9b52c69c94797fc0658026db3f2a5db61221e2c536ff694bbfN.exe 30 PID 2272 wrote to memory of 2212 2272 e4665c18ab034d9b52c69c94797fc0658026db3f2a5db61221e2c536ff694bbfN.exe 30 PID 2212 wrote to memory of 2480 2212 tbttbt.exe 31 PID 2212 wrote to memory of 2480 2212 tbttbt.exe 31 PID 2212 wrote to memory of 2480 2212 tbttbt.exe 31 PID 2212 wrote to memory of 2480 2212 tbttbt.exe 31 PID 2480 wrote to memory of 2108 2480 1pjjv.exe 32 PID 2480 wrote to memory of 2108 2480 1pjjv.exe 32 PID 2480 wrote to memory of 2108 2480 1pjjv.exe 32 PID 2480 wrote to memory of 2108 2480 1pjjv.exe 32 PID 2108 wrote to memory of 2232 2108 5nhntb.exe 33 PID 2108 wrote to memory of 2232 2108 5nhntb.exe 33 PID 2108 wrote to memory of 2232 2108 5nhntb.exe 33 PID 2108 wrote to memory of 2232 2108 5nhntb.exe 33 PID 2232 wrote to memory of 2772 2232 9vppd.exe 34 PID 2232 wrote to memory of 2772 2232 9vppd.exe 34 PID 2232 wrote to memory of 2772 2232 9vppd.exe 34 PID 2232 wrote to memory of 2772 2232 9vppd.exe 34 PID 2772 wrote to memory of 2580 2772 lfrxfxf.exe 35 PID 2772 wrote to memory of 2580 2772 lfrxfxf.exe 35 PID 2772 wrote to memory of 2580 2772 lfrxfxf.exe 35 PID 2772 wrote to memory of 2580 2772 lfrxfxf.exe 35 PID 2580 wrote to memory of 2660 2580 1btbht.exe 36 PID 2580 wrote to memory of 2660 2580 1btbht.exe 36 PID 2580 wrote to memory of 2660 2580 1btbht.exe 36 PID 2580 wrote to memory of 2660 2580 1btbht.exe 36 PID 2660 wrote to memory of 1708 2660 9xxxlrx.exe 37 PID 2660 wrote to memory of 1708 2660 9xxxlrx.exe 37 PID 2660 wrote to memory of 1708 2660 9xxxlrx.exe 37 PID 2660 wrote to memory of 1708 2660 9xxxlrx.exe 37 PID 1708 wrote to memory of 2692 1708 nbtthn.exe 38 PID 1708 wrote to memory of 2692 1708 nbtthn.exe 38 PID 1708 wrote to memory of 2692 1708 nbtthn.exe 38 PID 1708 wrote to memory of 2692 1708 nbtthn.exe 38 PID 2692 wrote to memory of 1488 2692 3jvjj.exe 39 PID 2692 wrote to memory of 1488 2692 3jvjj.exe 39 PID 2692 wrote to memory of 1488 2692 3jvjj.exe 39 PID 2692 wrote to memory of 1488 2692 3jvjj.exe 39 PID 1488 wrote to memory of 1732 1488 rxfrrrl.exe 40 PID 1488 wrote to memory of 1732 1488 rxfrrrl.exe 40 PID 1488 wrote to memory of 1732 1488 rxfrrrl.exe 40 PID 1488 wrote to memory of 1732 1488 rxfrrrl.exe 40 PID 1732 wrote to memory of 1784 1732 7llfxrx.exe 41 PID 1732 wrote to memory of 1784 1732 7llfxrx.exe 41 PID 1732 wrote to memory of 1784 1732 7llfxrx.exe 41 PID 1732 wrote to memory of 1784 1732 7llfxrx.exe 41 PID 1784 wrote to memory of 1652 1784 bnbbhn.exe 42 PID 1784 wrote to memory of 1652 1784 bnbbhn.exe 42 PID 1784 wrote to memory of 1652 1784 bnbbhn.exe 42 PID 1784 wrote to memory of 1652 1784 bnbbhn.exe 42 PID 1652 wrote to memory of 624 1652 jddjp.exe 43 PID 1652 wrote to memory of 624 1652 jddjp.exe 43 PID 1652 wrote to memory of 624 1652 jddjp.exe 43 PID 1652 wrote to memory of 624 1652 jddjp.exe 43 PID 624 wrote to memory of 1552 624 pjdjv.exe 44 PID 624 wrote to memory of 1552 624 pjdjv.exe 44 PID 624 wrote to memory of 1552 624 pjdjv.exe 44 PID 624 wrote to memory of 1552 624 pjdjv.exe 44 PID 1552 wrote to memory of 1800 1552 nnttbt.exe 45 PID 1552 wrote to memory of 1800 1552 nnttbt.exe 45 PID 1552 wrote to memory of 1800 1552 nnttbt.exe 45 PID 1552 wrote to memory of 1800 1552 nnttbt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4665c18ab034d9b52c69c94797fc0658026db3f2a5db61221e2c536ff694bbfN.exe"C:\Users\Admin\AppData\Local\Temp\e4665c18ab034d9b52c69c94797fc0658026db3f2a5db61221e2c536ff694bbfN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\tbttbt.exec:\tbttbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\1pjjv.exec:\1pjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\5nhntb.exec:\5nhntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\9vppd.exec:\9vppd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\lfrxfxf.exec:\lfrxfxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\1btbht.exec:\1btbht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\9xxxlrx.exec:\9xxxlrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\nbtthn.exec:\nbtthn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\3jvjj.exec:\3jvjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\rxfrrrl.exec:\rxfrrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\7llfxrx.exec:\7llfxrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\bnbbhn.exec:\bnbbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\jddjp.exec:\jddjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\pjdjv.exec:\pjdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\nnttbt.exec:\nnttbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\btbbnh.exec:\btbbnh.exe17⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jdjpd.exec:\jdjpd.exe18⤵
- Executes dropped EXE
PID:2880 -
\??\c:\fxrfxfx.exec:\fxrfxfx.exe19⤵
- Executes dropped EXE
PID:3024 -
\??\c:\ttnntn.exec:\ttnntn.exe20⤵
- Executes dropped EXE
PID:2220 -
\??\c:\1hhntt.exec:\1hhntt.exe21⤵
- Executes dropped EXE
PID:2392 -
\??\c:\3dvpd.exec:\3dvpd.exe22⤵
- Executes dropped EXE
PID:404 -
\??\c:\7lfrffx.exec:\7lfrffx.exe23⤵
- Executes dropped EXE
PID:1136 -
\??\c:\nntntt.exec:\nntntt.exe24⤵
- Executes dropped EXE
PID:1348 -
\??\c:\nhtbtb.exec:\nhtbtb.exe25⤵
- Executes dropped EXE
PID:1084 -
\??\c:\vpdvj.exec:\vpdvj.exe26⤵
- Executes dropped EXE
PID:1940 -
\??\c:\ddjpd.exec:\ddjpd.exe27⤵
- Executes dropped EXE
PID:2176 -
\??\c:\xrxrffx.exec:\xrxrffx.exe28⤵
- Executes dropped EXE
PID:1304 -
\??\c:\rxfxrfr.exec:\rxfxrfr.exe29⤵
- Executes dropped EXE
PID:2088 -
\??\c:\ddpdj.exec:\ddpdj.exe30⤵
- Executes dropped EXE
PID:984 -
\??\c:\xxllrrl.exec:\xxllrrl.exe31⤵
- Executes dropped EXE
PID:2472 -
\??\c:\hhbhbb.exec:\hhbhbb.exe32⤵
- Executes dropped EXE
PID:2484 -
\??\c:\ttthht.exec:\ttthht.exe33⤵
- Executes dropped EXE
PID:2100 -
\??\c:\jjddd.exec:\jjddd.exe34⤵
- Executes dropped EXE
PID:2504 -
\??\c:\rxrlfxf.exec:\rxrlfxf.exe35⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rxrrffr.exec:\rxrrffr.exe36⤵
- Executes dropped EXE
PID:264 -
\??\c:\5tthht.exec:\5tthht.exe37⤵
- Executes dropped EXE
PID:2764 -
\??\c:\7htbbh.exec:\7htbbh.exe38⤵
- Executes dropped EXE
PID:2964 -
\??\c:\dvjjp.exec:\dvjjp.exe39⤵
- Executes dropped EXE
PID:2852 -
\??\c:\5dvpv.exec:\5dvpv.exe40⤵
- Executes dropped EXE
PID:2840 -
\??\c:\lflxfrl.exec:\lflxfrl.exe41⤵
- Executes dropped EXE
PID:2872 -
\??\c:\fffrrxl.exec:\fffrrxl.exe42⤵
- Executes dropped EXE
PID:2796 -
\??\c:\htntbb.exec:\htntbb.exe43⤵
- Executes dropped EXE
PID:2592 -
\??\c:\hbhnnb.exec:\hbhnnb.exe44⤵
- Executes dropped EXE
PID:2164 -
\??\c:\3dpjj.exec:\3dpjj.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\pjjpj.exec:\pjjpj.exe46⤵
- Executes dropped EXE
PID:2044 -
\??\c:\lxllrrf.exec:\lxllrrf.exe47⤵
- Executes dropped EXE
PID:1992 -
\??\c:\rlxfllf.exec:\rlxfllf.exe48⤵
- Executes dropped EXE
PID:2012 -
\??\c:\7btbhh.exec:\7btbhh.exe49⤵
- Executes dropped EXE
PID:1712 -
\??\c:\bbbhnn.exec:\bbbhnn.exe50⤵
- Executes dropped EXE
PID:112 -
\??\c:\nnhnnh.exec:\nnhnnh.exe51⤵
- Executes dropped EXE
PID:1680 -
\??\c:\jjjdd.exec:\jjjdd.exe52⤵
- Executes dropped EXE
PID:1436 -
\??\c:\5rffrrl.exec:\5rffrrl.exe53⤵
- Executes dropped EXE
PID:1516 -
\??\c:\rfrxlrf.exec:\rfrxlrf.exe54⤵
- Executes dropped EXE
PID:2560 -
\??\c:\9hbnnt.exec:\9hbnnt.exe55⤵
- Executes dropped EXE
PID:2612 -
\??\c:\ttntht.exec:\ttntht.exe56⤵
- Executes dropped EXE
PID:1600 -
\??\c:\bttbhh.exec:\bttbhh.exe57⤵
- Executes dropped EXE
PID:2224 -
\??\c:\vpdjv.exec:\vpdjv.exe58⤵
- Executes dropped EXE
PID:1096 -
\??\c:\rrfllrx.exec:\rrfllrx.exe59⤵
- Executes dropped EXE
PID:796 -
\??\c:\xrflxxl.exec:\xrflxxl.exe60⤵
- Executes dropped EXE
PID:2876 -
\??\c:\1nhnbb.exec:\1nhnbb.exe61⤵
- Executes dropped EXE
PID:1520 -
\??\c:\3hhnnt.exec:\3hhnnt.exe62⤵
- Executes dropped EXE
PID:1340 -
\??\c:\9jjvv.exec:\9jjvv.exe63⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jjvpv.exec:\jjvpv.exe64⤵
- Executes dropped EXE
PID:1716 -
\??\c:\7frlllx.exec:\7frlllx.exe65⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nbhnhh.exec:\nbhnhh.exe66⤵PID:1636
-
\??\c:\nnbnhn.exec:\nnbnhn.exe67⤵PID:3008
-
\??\c:\jpvjv.exec:\jpvjv.exe68⤵PID:2400
-
\??\c:\3jjvv.exec:\3jjvv.exe69⤵PID:1324
-
\??\c:\fxlxfrf.exec:\fxlxfrf.exe70⤵PID:2060
-
\??\c:\hhhhnh.exec:\hhhhnh.exe71⤵PID:1976
-
\??\c:\ttnbbn.exec:\ttnbbn.exe72⤵PID:2004
-
\??\c:\7dppp.exec:\7dppp.exe73⤵PID:844
-
\??\c:\ddpvj.exec:\ddpvj.exe74⤵PID:2328
-
\??\c:\llxfrrl.exec:\llxfrrl.exe75⤵PID:2108
-
\??\c:\9rxrfll.exec:\9rxrfll.exe76⤵PID:2712
-
\??\c:\bnbhnb.exec:\bnbhnb.exe77⤵PID:2812
-
\??\c:\hhbtth.exec:\hhbtth.exe78⤵PID:2956
-
\??\c:\vppdp.exec:\vppdp.exe79⤵PID:2608
-
\??\c:\jvpjj.exec:\jvpjj.exe80⤵PID:2792
-
\??\c:\rllllrr.exec:\rllllrr.exe81⤵PID:2620
-
\??\c:\llrfrxf.exec:\llrfrxf.exe82⤵PID:2660
-
\??\c:\ttthbh.exec:\ttthbh.exe83⤵PID:2364
-
\??\c:\vpvdd.exec:\vpvdd.exe84⤵PID:2616
-
\??\c:\7vjdv.exec:\7vjdv.exe85⤵PID:1424
-
\??\c:\frlrlfx.exec:\frlrlfx.exe86⤵PID:1488
-
\??\c:\9rffllr.exec:\9rffllr.exe87⤵PID:2380
-
\??\c:\btttnn.exec:\btttnn.exe88⤵PID:2316
-
\??\c:\nhthbb.exec:\nhthbb.exe89⤵PID:236
-
\??\c:\vpjpj.exec:\vpjpj.exe90⤵PID:1608
-
\??\c:\pvjjp.exec:\pvjjp.exe91⤵PID:1780
-
\??\c:\rlxlllx.exec:\rlxlllx.exe92⤵PID:1552
-
\??\c:\fxlfllx.exec:\fxlfllx.exe93⤵PID:1792
-
\??\c:\btthtt.exec:\btthtt.exe94⤵PID:1516
-
\??\c:\bhnttb.exec:\bhnttb.exe95⤵PID:2668
-
\??\c:\7vpvd.exec:\7vpvd.exe96⤵PID:3024
-
\??\c:\vpjpp.exec:\vpjpp.exe97⤵PID:1308
-
\??\c:\ffxxllr.exec:\ffxxllr.exe98⤵PID:1140
-
\??\c:\ttntht.exec:\ttntht.exe99⤵PID:2104
-
\??\c:\bntttb.exec:\bntttb.exe100⤵PID:824
-
\??\c:\jdvdp.exec:\jdvdp.exe101⤵PID:2540
-
\??\c:\djjvp.exec:\djjvp.exe102⤵PID:2544
-
\??\c:\fxlrrlr.exec:\fxlrrlr.exe103⤵PID:1084
-
\??\c:\lrfllxr.exec:\lrfllxr.exe104⤵PID:848
-
\??\c:\3htntb.exec:\3htntb.exe105⤵PID:564
-
\??\c:\bbbhhn.exec:\bbbhhn.exe106⤵PID:1304
-
\??\c:\dddjv.exec:\dddjv.exe107⤵PID:952
-
\??\c:\dpjpp.exec:\dpjpp.exe108⤵PID:2088
-
\??\c:\xrrrxlr.exec:\xrrrxlr.exe109⤵PID:2300
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe110⤵PID:1584
-
\??\c:\nhthnt.exec:\nhthnt.exe111⤵PID:1700
-
\??\c:\vvdvp.exec:\vvdvp.exe112⤵PID:2280
-
\??\c:\jvvjd.exec:\jvvjd.exe113⤵PID:2508
-
\??\c:\flrxffx.exec:\flrxffx.exe114⤵PID:2492
-
\??\c:\lfllxxf.exec:\lfllxxf.exe115⤵PID:2244
-
\??\c:\bnbhnn.exec:\bnbhnn.exe116⤵PID:2664
-
\??\c:\pjddp.exec:\pjddp.exe117⤵PID:2772
-
\??\c:\9ppvj.exec:\9ppvj.exe118⤵PID:2728
-
\??\c:\lxffflx.exec:\lxffflx.exe119⤵PID:2152
-
\??\c:\xrrfrrx.exec:\xrrfrrx.exe120⤵PID:2744
-
\??\c:\nhbbhn.exec:\nhbbhn.exe121⤵PID:2576
-
\??\c:\bbttbn.exec:\bbttbn.exe122⤵PID:1708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-