Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 04:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe
-
Size
59KB
-
MD5
c6b0004e44a84f3897464ef81e6b0964
-
SHA1
7e91a91f43e3f6b3b4cfb3b43a93012c480f4ed8
-
SHA256
cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b
-
SHA512
90cbcae3e89b6b6e9a82033f650433e71a1770ba62f3d1589b461df0da995d13ae0d399d83c31e24989698d9c981391483870977838ba2fe911580eb4547eeb0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFYuS:ymb3NkkiQ3mdBjFIFnS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/664-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/664-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-35-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1832-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2240-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4664-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2424 rlrlffx.exe 1408 7hbthh.exe 2052 pjjjj.exe 1968 jddpj.exe 116 rlrlxxr.exe 3972 rffxrrr.exe 1832 dvppj.exe 1560 ffxfrlf.exe 1632 3ntbbb.exe 4044 pjddv.exe 232 llfffff.exe 868 nhhbbb.exe 4748 pvjjp.exe 4708 xlxrfxx.exe 3232 btbtnn.exe 396 vdjdj.exe 3512 lfrlffx.exe 2240 5httbb.exe 2644 7pvvp.exe 3520 jdjjj.exe 4568 lflrfxx.exe 368 7xxfxfx.exe 4664 bhbttt.exe 4088 pppdv.exe 5000 3djjp.exe 4876 ffllfff.exe 3488 lfllfff.exe 3036 7hnnhh.exe 2192 pjvjd.exe 3200 vpvpj.exe 1516 nnnhhh.exe 3596 ppddp.exe 3540 fxfxffr.exe 1100 xxrlrxx.exe 4924 nthhhn.exe 3004 nnnntn.exe 1564 dvpvd.exe 2828 ntbbhn.exe 3344 ppvvv.exe 4532 fffxflx.exe 2028 9hnnnt.exe 4072 dpjdv.exe 4840 9flrfxf.exe 1060 xrffrxf.exe 1140 nbnbbt.exe 2584 vvvvp.exe 3076 ddddv.exe 2156 lxffxxx.exe 432 thnnhh.exe 4184 vvddd.exe 2032 jdvdp.exe 2640 rlrrlll.exe 1368 9htnhh.exe 3988 pjjjd.exe 5004 1rxxlrx.exe 548 nnhtth.exe 1832 ddpvj.exe 3964 xrrxxrr.exe 1428 nthnnn.exe 2356 pvjdd.exe 3628 3pppj.exe 3020 lrxrlrr.exe 4496 jjpvp.exe 3372 xfxrlll.exe -
resource yara_rule behavioral2/memory/664-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2240-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 664 wrote to memory of 2424 664 cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe 83 PID 664 wrote to memory of 2424 664 cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe 83 PID 664 wrote to memory of 2424 664 cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe 83 PID 2424 wrote to memory of 1408 2424 rlrlffx.exe 84 PID 2424 wrote to memory of 1408 2424 rlrlffx.exe 84 PID 2424 wrote to memory of 1408 2424 rlrlffx.exe 84 PID 1408 wrote to memory of 2052 1408 7hbthh.exe 85 PID 1408 wrote to memory of 2052 1408 7hbthh.exe 85 PID 1408 wrote to memory of 2052 1408 7hbthh.exe 85 PID 2052 wrote to memory of 1968 2052 pjjjj.exe 86 PID 2052 wrote to memory of 1968 2052 pjjjj.exe 86 PID 2052 wrote to memory of 1968 2052 pjjjj.exe 86 PID 1968 wrote to memory of 116 1968 jddpj.exe 87 PID 1968 wrote to memory of 116 1968 jddpj.exe 87 PID 1968 wrote to memory of 116 1968 jddpj.exe 87 PID 116 wrote to memory of 3972 116 rlrlxxr.exe 88 PID 116 wrote to memory of 3972 116 rlrlxxr.exe 88 PID 116 wrote to memory of 3972 116 rlrlxxr.exe 88 PID 3972 wrote to memory of 1832 3972 rffxrrr.exe 89 PID 3972 wrote to memory of 1832 3972 rffxrrr.exe 89 PID 3972 wrote to memory of 1832 3972 rffxrrr.exe 89 PID 1832 wrote to memory of 1560 1832 dvppj.exe 90 PID 1832 wrote to memory of 1560 1832 dvppj.exe 90 PID 1832 wrote to memory of 1560 1832 dvppj.exe 90 PID 1560 wrote to memory of 1632 1560 ffxfrlf.exe 91 PID 1560 wrote to memory of 1632 1560 ffxfrlf.exe 91 PID 1560 wrote to memory of 1632 1560 ffxfrlf.exe 91 PID 1632 wrote to memory of 4044 1632 3ntbbb.exe 92 PID 1632 wrote to memory of 4044 1632 3ntbbb.exe 92 PID 1632 wrote to memory of 4044 1632 3ntbbb.exe 92 PID 4044 wrote to memory of 232 4044 pjddv.exe 93 PID 4044 wrote to memory of 232 4044 pjddv.exe 93 PID 4044 wrote to memory of 232 4044 pjddv.exe 93 PID 232 wrote to memory of 868 232 llfffff.exe 94 PID 232 wrote to memory of 868 232 llfffff.exe 94 PID 232 wrote to memory of 868 232 llfffff.exe 94 PID 868 wrote to memory of 4748 868 nhhbbb.exe 95 PID 868 wrote to memory of 4748 868 nhhbbb.exe 95 PID 868 wrote to memory of 4748 868 nhhbbb.exe 95 PID 4748 wrote to memory of 4708 4748 pvjjp.exe 96 PID 4748 wrote to memory of 4708 4748 pvjjp.exe 96 PID 4748 wrote to memory of 4708 4748 pvjjp.exe 96 PID 4708 wrote to memory of 3232 4708 xlxrfxx.exe 97 PID 4708 wrote to memory of 3232 4708 xlxrfxx.exe 97 PID 4708 wrote to memory of 3232 4708 xlxrfxx.exe 97 PID 3232 wrote to memory of 396 3232 btbtnn.exe 98 PID 3232 wrote to memory of 396 3232 btbtnn.exe 98 PID 3232 wrote to memory of 396 3232 btbtnn.exe 98 PID 396 wrote to memory of 3512 396 vdjdj.exe 99 PID 396 wrote to memory of 3512 396 vdjdj.exe 99 PID 396 wrote to memory of 3512 396 vdjdj.exe 99 PID 3512 wrote to memory of 2240 3512 lfrlffx.exe 100 PID 3512 wrote to memory of 2240 3512 lfrlffx.exe 100 PID 3512 wrote to memory of 2240 3512 lfrlffx.exe 100 PID 2240 wrote to memory of 2644 2240 5httbb.exe 101 PID 2240 wrote to memory of 2644 2240 5httbb.exe 101 PID 2240 wrote to memory of 2644 2240 5httbb.exe 101 PID 2644 wrote to memory of 3520 2644 7pvvp.exe 102 PID 2644 wrote to memory of 3520 2644 7pvvp.exe 102 PID 2644 wrote to memory of 3520 2644 7pvvp.exe 102 PID 3520 wrote to memory of 4568 3520 jdjjj.exe 103 PID 3520 wrote to memory of 4568 3520 jdjjj.exe 103 PID 3520 wrote to memory of 4568 3520 jdjjj.exe 103 PID 4568 wrote to memory of 368 4568 lflrfxx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe"C:\Users\Admin\AppData\Local\Temp\cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\rlrlffx.exec:\rlrlffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\7hbthh.exec:\7hbthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\pjjjj.exec:\pjjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\jddpj.exec:\jddpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\rlrlxxr.exec:\rlrlxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\rffxrrr.exec:\rffxrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\dvppj.exec:\dvppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\ffxfrlf.exec:\ffxfrlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\3ntbbb.exec:\3ntbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\pjddv.exec:\pjddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\llfffff.exec:\llfffff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\nhhbbb.exec:\nhhbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\pvjjp.exec:\pvjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\xlxrfxx.exec:\xlxrfxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\btbtnn.exec:\btbtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\vdjdj.exec:\vdjdj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\lfrlffx.exec:\lfrlffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\5httbb.exec:\5httbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\7pvvp.exec:\7pvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\jdjjj.exec:\jdjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\lflrfxx.exec:\lflrfxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\7xxfxfx.exec:\7xxfxfx.exe23⤵
- Executes dropped EXE
PID:368 -
\??\c:\bhbttt.exec:\bhbttt.exe24⤵
- Executes dropped EXE
PID:4664 -
\??\c:\pppdv.exec:\pppdv.exe25⤵
- Executes dropped EXE
PID:4088 -
\??\c:\3djjp.exec:\3djjp.exe26⤵
- Executes dropped EXE
PID:5000 -
\??\c:\ffllfff.exec:\ffllfff.exe27⤵
- Executes dropped EXE
PID:4876 -
\??\c:\lfllfff.exec:\lfllfff.exe28⤵
- Executes dropped EXE
PID:3488 -
\??\c:\7hnnhh.exec:\7hnnhh.exe29⤵
- Executes dropped EXE
PID:3036 -
\??\c:\pjvjd.exec:\pjvjd.exe30⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vpvpj.exec:\vpvpj.exe31⤵
- Executes dropped EXE
PID:3200 -
\??\c:\nnnhhh.exec:\nnnhhh.exe32⤵
- Executes dropped EXE
PID:1516 -
\??\c:\ppddp.exec:\ppddp.exe33⤵
- Executes dropped EXE
PID:3596 -
\??\c:\fxfxffr.exec:\fxfxffr.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3540 -
\??\c:\xxrlrxx.exec:\xxrlrxx.exe35⤵
- Executes dropped EXE
PID:1100 -
\??\c:\nthhhn.exec:\nthhhn.exe36⤵
- Executes dropped EXE
PID:4924 -
\??\c:\nnnntn.exec:\nnnntn.exe37⤵
- Executes dropped EXE
PID:3004 -
\??\c:\dvpvd.exec:\dvpvd.exe38⤵
- Executes dropped EXE
PID:1564 -
\??\c:\ntbbhn.exec:\ntbbhn.exe39⤵
- Executes dropped EXE
PID:2828 -
\??\c:\ppvvv.exec:\ppvvv.exe40⤵
- Executes dropped EXE
PID:3344 -
\??\c:\fffxflx.exec:\fffxflx.exe41⤵
- Executes dropped EXE
PID:4532 -
\??\c:\9hnnnt.exec:\9hnnnt.exe42⤵
- Executes dropped EXE
PID:2028 -
\??\c:\dpjdv.exec:\dpjdv.exe43⤵
- Executes dropped EXE
PID:4072 -
\??\c:\9flrfxf.exec:\9flrfxf.exe44⤵
- Executes dropped EXE
PID:4840 -
\??\c:\xrffrxf.exec:\xrffrxf.exe45⤵
- Executes dropped EXE
PID:1060 -
\??\c:\nbnbbt.exec:\nbnbbt.exe46⤵
- Executes dropped EXE
PID:1140 -
\??\c:\vvvvp.exec:\vvvvp.exe47⤵
- Executes dropped EXE
PID:2584 -
\??\c:\ddddv.exec:\ddddv.exe48⤵
- Executes dropped EXE
PID:3076 -
\??\c:\lxffxxx.exec:\lxffxxx.exe49⤵
- Executes dropped EXE
PID:2156 -
\??\c:\thnnhh.exec:\thnnhh.exe50⤵
- Executes dropped EXE
PID:432 -
\??\c:\vvddd.exec:\vvddd.exe51⤵
- Executes dropped EXE
PID:4184 -
\??\c:\jdvdp.exec:\jdvdp.exe52⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rlrrlll.exec:\rlrrlll.exe53⤵
- Executes dropped EXE
PID:2640 -
\??\c:\9htnhh.exec:\9htnhh.exe54⤵
- Executes dropped EXE
PID:1368 -
\??\c:\pjjjd.exec:\pjjjd.exe55⤵
- Executes dropped EXE
PID:3988 -
\??\c:\1rxxlrx.exec:\1rxxlrx.exe56⤵
- Executes dropped EXE
PID:5004 -
\??\c:\nnhtth.exec:\nnhtth.exe57⤵
- Executes dropped EXE
PID:548 -
\??\c:\ddpvj.exec:\ddpvj.exe58⤵
- Executes dropped EXE
PID:1832 -
\??\c:\xrrxxrr.exec:\xrrxxrr.exe59⤵
- Executes dropped EXE
PID:3964 -
\??\c:\nthnnn.exec:\nthnnn.exe60⤵
- Executes dropped EXE
PID:1428 -
\??\c:\pvjdd.exec:\pvjdd.exe61⤵
- Executes dropped EXE
PID:2356 -
\??\c:\3pppj.exec:\3pppj.exe62⤵
- Executes dropped EXE
PID:3628 -
\??\c:\lrxrlrr.exec:\lrxrlrr.exe63⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jjpvp.exec:\jjpvp.exe64⤵
- Executes dropped EXE
PID:4496 -
\??\c:\xfxrlll.exec:\xfxrlll.exe65⤵
- Executes dropped EXE
PID:3372 -
\??\c:\9rxxxxx.exec:\9rxxxxx.exe66⤵PID:2652
-
\??\c:\5nttnn.exec:\5nttnn.exe67⤵PID:3464
-
\??\c:\dpddv.exec:\dpddv.exe68⤵PID:3696
-
\??\c:\jvjdd.exec:\jvjdd.exe69⤵PID:3600
-
\??\c:\xxllrrl.exec:\xxllrrl.exe70⤵PID:5048
-
\??\c:\hbhbbh.exec:\hbhbbh.exe71⤵PID:4068
-
\??\c:\ntnbtt.exec:\ntnbtt.exe72⤵PID:3900
-
\??\c:\vdvvj.exec:\vdvvj.exe73⤵PID:3052
-
\??\c:\rxrlrll.exec:\rxrlrll.exe74⤵PID:2240
-
\??\c:\tbhhnh.exec:\tbhhnh.exe75⤵PID:2036
-
\??\c:\tnbthh.exec:\tnbthh.exe76⤵PID:4176
-
\??\c:\jddvj.exec:\jddvj.exe77⤵PID:1928
-
\??\c:\7pjpd.exec:\7pjpd.exe78⤵PID:3640
-
\??\c:\lxrxlrr.exec:\lxrxlrr.exe79⤵PID:5032
-
\??\c:\tnntnn.exec:\tnntnn.exe80⤵PID:1588
-
\??\c:\hbtttn.exec:\hbtttn.exe81⤵PID:4680
-
\??\c:\jpddd.exec:\jpddd.exe82⤵PID:2380
-
\??\c:\jjjjj.exec:\jjjjj.exe83⤵PID:4704
-
\??\c:\7lffxxr.exec:\7lffxxr.exe84⤵PID:2632
-
\??\c:\nttthn.exec:\nttthn.exe85⤵PID:2596
-
\??\c:\jpjjp.exec:\jpjjp.exe86⤵PID:4716
-
\??\c:\vjpjd.exec:\vjpjd.exe87⤵PID:3588
-
\??\c:\1llrfll.exec:\1llrfll.exe88⤵PID:3200
-
\??\c:\3llllll.exec:\3llllll.exe89⤵PID:2040
-
\??\c:\ppjvv.exec:\ppjvv.exe90⤵PID:1696
-
\??\c:\lfllllx.exec:\lfllllx.exe91⤵PID:2020
-
\??\c:\thnhbb.exec:\thnhbb.exe92⤵PID:4628
-
\??\c:\tntnhb.exec:\tntnhb.exe93⤵PID:3352
-
\??\c:\jvvvv.exec:\jvvvv.exe94⤵PID:3672
-
\??\c:\hbhbtt.exec:\hbhbtt.exe95⤵PID:4656
-
\??\c:\nnnhbn.exec:\nnnhbn.exe96⤵PID:3664
-
\??\c:\vjvpp.exec:\vjvpp.exe97⤵PID:2184
-
\??\c:\xlfrfff.exec:\xlfrfff.exe98⤵PID:3296
-
\??\c:\nhhtht.exec:\nhhtht.exe99⤵PID:2668
-
\??\c:\ntbttn.exec:\ntbttn.exe100⤵PID:2088
-
\??\c:\7jvvj.exec:\7jvvj.exe101⤵
- System Location Discovery: System Language Discovery
PID:4516 -
\??\c:\lrxrlrl.exec:\lrxrlrl.exe102⤵PID:1060
-
\??\c:\fxrlfff.exec:\fxrlfff.exe103⤵PID:2456
-
\??\c:\nnbtnn.exec:\nnbtnn.exe104⤵PID:2148
-
\??\c:\djvpj.exec:\djvpj.exe105⤵PID:3076
-
\??\c:\rlrlflr.exec:\rlrlflr.exe106⤵PID:3872
-
\??\c:\ntthnn.exec:\ntthnn.exe107⤵PID:2092
-
\??\c:\jdddv.exec:\jdddv.exe108⤵PID:1892
-
\??\c:\5fffxxx.exec:\5fffxxx.exe109⤵PID:4236
-
\??\c:\ffxrffx.exec:\ffxrffx.exe110⤵PID:4956
-
\??\c:\5bttnn.exec:\5bttnn.exe111⤵PID:3144
-
\??\c:\bhhbbb.exec:\bhhbbb.exe112⤵PID:3948
-
\??\c:\vpddp.exec:\vpddp.exe113⤵PID:2096
-
\??\c:\vdjdp.exec:\vdjdp.exe114⤵PID:1832
-
\??\c:\fxffrrx.exec:\fxffrrx.exe115⤵PID:3852
-
\??\c:\5bnhnn.exec:\5bnhnn.exe116⤵PID:2356
-
\??\c:\bhbntb.exec:\bhbntb.exe117⤵PID:3432
-
\??\c:\djjvp.exec:\djjvp.exe118⤵PID:2124
-
\??\c:\pjpjj.exec:\pjpjj.exe119⤵PID:5040
-
\??\c:\flrlfff.exec:\flrlfff.exe120⤵PID:3600
-
\??\c:\bhthtt.exec:\bhthtt.exe121⤵PID:1692
-
\??\c:\bhhhnn.exec:\bhhhnn.exe122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-