Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 04:44
Static task
static1
Behavioral task
behavioral1
Sample
e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe
Resource
win7-20240903-en
General
-
Target
e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe
-
Size
82KB
-
MD5
48a60f2e9b09bd24a19e7ce6dc415cf3
-
SHA1
60348bdcdf996e8dd035fdf23d459115d81e48f4
-
SHA256
e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e
-
SHA512
321db70d68349bbdeaafa4ad2bc1fa1fb37fc3281bf04256f2fb9b89167ae2926d033727661a10949e2b5c9102a57c89cbbe2bcd85d435f1e93c497c9d3e4112
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgygQwKjiawEmB5Gtb:ymb3NkkiQ3mdBjFo73thgQ/wEk0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/772-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/784-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2108-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/772-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2652-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/508-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3792-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1280-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3256 fxxrrrr.exe 784 5tnhhh.exe 2108 vpdvv.exe 1260 dddvp.exe 3536 nttnnn.exe 2652 pjjpv.exe 4816 rrrxrrr.exe 4604 tntttt.exe 5064 btnnbb.exe 3812 vvvvv.exe 768 7lxffff.exe 2040 pdppp.exe 2236 ffrxlfx.exe 4104 hhhnnt.exe 2316 ddvdd.exe 508 lflfflf.exe 4064 7thhtt.exe 1496 vvddv.exe 960 hthbtt.exe 3272 xfrxxll.exe 3792 hbtttt.exe 4868 xlxrllf.exe 3936 hbntbb.exe 704 bhtbbh.exe 4676 rrllxxx.exe 2592 lfrlfll.exe 1280 bnhhbn.exe 2580 dppvv.exe 2324 lrxxxff.exe 8 ntnbht.exe 3380 5vjpp.exe 1332 ppddd.exe 4428 xxrrflx.exe 2528 tttbbh.exe 3512 nhntbh.exe 3456 vvjdd.exe 1948 fflrxll.exe 4356 lrxffll.exe 2408 ttnttb.exe 2716 pvvpd.exe 1456 jjjjd.exe 4312 lrlrlrx.exe 4536 nhtnnt.exe 876 dvdvd.exe 3256 fxxxxff.exe 5048 rlffflr.exe 1476 bbbhht.exe 2872 nnbhnt.exe 4564 1jddj.exe 3308 lllllrx.exe 264 rlrflrr.exe 4416 1nnttb.exe 2260 jvjpv.exe 3876 pjjjj.exe 1652 ffffrxl.exe 5064 nthbbh.exe 3556 5hbbbh.exe 4824 vjdjj.exe 4636 tthhbh.exe 4880 jjjjj.exe 2948 djddd.exe 3924 rrrxxff.exe 3952 9xlrrxl.exe 232 hnhhhh.exe -
resource yara_rule behavioral2/memory/772-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/784-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/772-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2652-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/768-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/508-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3792-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhnn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 772 wrote to memory of 3256 772 e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe 82 PID 772 wrote to memory of 3256 772 e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe 82 PID 772 wrote to memory of 3256 772 e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe 82 PID 3256 wrote to memory of 784 3256 fxxrrrr.exe 83 PID 3256 wrote to memory of 784 3256 fxxrrrr.exe 83 PID 3256 wrote to memory of 784 3256 fxxrrrr.exe 83 PID 784 wrote to memory of 2108 784 5tnhhh.exe 84 PID 784 wrote to memory of 2108 784 5tnhhh.exe 84 PID 784 wrote to memory of 2108 784 5tnhhh.exe 84 PID 2108 wrote to memory of 1260 2108 vpdvv.exe 85 PID 2108 wrote to memory of 1260 2108 vpdvv.exe 85 PID 2108 wrote to memory of 1260 2108 vpdvv.exe 85 PID 1260 wrote to memory of 3536 1260 dddvp.exe 86 PID 1260 wrote to memory of 3536 1260 dddvp.exe 86 PID 1260 wrote to memory of 3536 1260 dddvp.exe 86 PID 3536 wrote to memory of 2652 3536 nttnnn.exe 87 PID 3536 wrote to memory of 2652 3536 nttnnn.exe 87 PID 3536 wrote to memory of 2652 3536 nttnnn.exe 87 PID 2652 wrote to memory of 4816 2652 pjjpv.exe 88 PID 2652 wrote to memory of 4816 2652 pjjpv.exe 88 PID 2652 wrote to memory of 4816 2652 pjjpv.exe 88 PID 4816 wrote to memory of 4604 4816 rrrxrrr.exe 89 PID 4816 wrote to memory of 4604 4816 rrrxrrr.exe 89 PID 4816 wrote to memory of 4604 4816 rrrxrrr.exe 89 PID 4604 wrote to memory of 5064 4604 tntttt.exe 90 PID 4604 wrote to memory of 5064 4604 tntttt.exe 90 PID 4604 wrote to memory of 5064 4604 tntttt.exe 90 PID 5064 wrote to memory of 3812 5064 btnnbb.exe 91 PID 5064 wrote to memory of 3812 5064 btnnbb.exe 91 PID 5064 wrote to memory of 3812 5064 btnnbb.exe 91 PID 3812 wrote to memory of 768 3812 vvvvv.exe 92 PID 3812 wrote to memory of 768 3812 vvvvv.exe 92 PID 3812 wrote to memory of 768 3812 vvvvv.exe 92 PID 768 wrote to memory of 2040 768 7lxffff.exe 93 PID 768 wrote to memory of 2040 768 7lxffff.exe 93 PID 768 wrote to memory of 2040 768 7lxffff.exe 93 PID 2040 wrote to memory of 2236 2040 pdppp.exe 94 PID 2040 wrote to memory of 2236 2040 pdppp.exe 94 PID 2040 wrote to memory of 2236 2040 pdppp.exe 94 PID 2236 wrote to memory of 4104 2236 ffrxlfx.exe 95 PID 2236 wrote to memory of 4104 2236 ffrxlfx.exe 95 PID 2236 wrote to memory of 4104 2236 ffrxlfx.exe 95 PID 4104 wrote to memory of 2316 4104 hhhnnt.exe 96 PID 4104 wrote to memory of 2316 4104 hhhnnt.exe 96 PID 4104 wrote to memory of 2316 4104 hhhnnt.exe 96 PID 2316 wrote to memory of 508 2316 ddvdd.exe 97 PID 2316 wrote to memory of 508 2316 ddvdd.exe 97 PID 2316 wrote to memory of 508 2316 ddvdd.exe 97 PID 508 wrote to memory of 4064 508 lflfflf.exe 98 PID 508 wrote to memory of 4064 508 lflfflf.exe 98 PID 508 wrote to memory of 4064 508 lflfflf.exe 98 PID 4064 wrote to memory of 1496 4064 7thhtt.exe 99 PID 4064 wrote to memory of 1496 4064 7thhtt.exe 99 PID 4064 wrote to memory of 1496 4064 7thhtt.exe 99 PID 1496 wrote to memory of 960 1496 vvddv.exe 100 PID 1496 wrote to memory of 960 1496 vvddv.exe 100 PID 1496 wrote to memory of 960 1496 vvddv.exe 100 PID 960 wrote to memory of 3272 960 hthbtt.exe 101 PID 960 wrote to memory of 3272 960 hthbtt.exe 101 PID 960 wrote to memory of 3272 960 hthbtt.exe 101 PID 3272 wrote to memory of 3792 3272 xfrxxll.exe 102 PID 3272 wrote to memory of 3792 3272 xfrxxll.exe 102 PID 3272 wrote to memory of 3792 3272 xfrxxll.exe 102 PID 3792 wrote to memory of 4868 3792 hbtttt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe"C:\Users\Admin\AppData\Local\Temp\e712aef52d5c0ba5da286e5144cd053bf32c7cc324c0a1097490447674f67c5e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\fxxrrrr.exec:\fxxrrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\5tnhhh.exec:\5tnhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\vpdvv.exec:\vpdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\dddvp.exec:\dddvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\nttnnn.exec:\nttnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\pjjpv.exec:\pjjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\rrrxrrr.exec:\rrrxrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\tntttt.exec:\tntttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\btnnbb.exec:\btnnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\vvvvv.exec:\vvvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\7lxffff.exec:\7lxffff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\pdppp.exec:\pdppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\ffrxlfx.exec:\ffrxlfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\hhhnnt.exec:\hhhnnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\ddvdd.exec:\ddvdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\lflfflf.exec:\lflfflf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
\??\c:\7thhtt.exec:\7thhtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\vvddv.exec:\vvddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\hthbtt.exec:\hthbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\xfrxxll.exec:\xfrxxll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\hbtttt.exec:\hbtttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\xlxrllf.exec:\xlxrllf.exe23⤵
- Executes dropped EXE
PID:4868 -
\??\c:\hbntbb.exec:\hbntbb.exe24⤵
- Executes dropped EXE
PID:3936 -
\??\c:\bhtbbh.exec:\bhtbbh.exe25⤵
- Executes dropped EXE
PID:704 -
\??\c:\rrllxxx.exec:\rrllxxx.exe26⤵
- Executes dropped EXE
PID:4676 -
\??\c:\lfrlfll.exec:\lfrlfll.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2592 -
\??\c:\bnhhbn.exec:\bnhhbn.exe28⤵
- Executes dropped EXE
PID:1280 -
\??\c:\dppvv.exec:\dppvv.exe29⤵
- Executes dropped EXE
PID:2580 -
\??\c:\lrxxxff.exec:\lrxxxff.exe30⤵
- Executes dropped EXE
PID:2324 -
\??\c:\ntnbht.exec:\ntnbht.exe31⤵
- Executes dropped EXE
PID:8 -
\??\c:\5vjpp.exec:\5vjpp.exe32⤵
- Executes dropped EXE
PID:3380 -
\??\c:\ppddd.exec:\ppddd.exe33⤵
- Executes dropped EXE
PID:1332 -
\??\c:\xxrrflx.exec:\xxrrflx.exe34⤵
- Executes dropped EXE
PID:4428 -
\??\c:\tttbbh.exec:\tttbbh.exe35⤵
- Executes dropped EXE
PID:2528 -
\??\c:\nhntbh.exec:\nhntbh.exe36⤵
- Executes dropped EXE
PID:3512 -
\??\c:\vvjdd.exec:\vvjdd.exe37⤵
- Executes dropped EXE
PID:3456 -
\??\c:\fflrxll.exec:\fflrxll.exe38⤵
- Executes dropped EXE
PID:1948 -
\??\c:\lrxffll.exec:\lrxffll.exe39⤵
- Executes dropped EXE
PID:4356 -
\??\c:\ttnttb.exec:\ttnttb.exe40⤵
- Executes dropped EXE
PID:2408 -
\??\c:\pvvpd.exec:\pvvpd.exe41⤵
- Executes dropped EXE
PID:2716 -
\??\c:\jjjjd.exec:\jjjjd.exe42⤵
- Executes dropped EXE
PID:1456 -
\??\c:\lrlrlrx.exec:\lrlrlrx.exe43⤵
- Executes dropped EXE
PID:4312 -
\??\c:\nhtnnt.exec:\nhtnnt.exe44⤵
- Executes dropped EXE
PID:4536 -
\??\c:\tbhnhn.exec:\tbhnhn.exe45⤵PID:3904
-
\??\c:\dvdvd.exec:\dvdvd.exe46⤵
- Executes dropped EXE
PID:876 -
\??\c:\fxxxxff.exec:\fxxxxff.exe47⤵
- Executes dropped EXE
PID:3256 -
\??\c:\rlffflr.exec:\rlffflr.exe48⤵
- Executes dropped EXE
PID:5048 -
\??\c:\bbbhht.exec:\bbbhht.exe49⤵
- Executes dropped EXE
PID:1476 -
\??\c:\nnbhnt.exec:\nnbhnt.exe50⤵
- Executes dropped EXE
PID:2872 -
\??\c:\1jddj.exec:\1jddj.exe51⤵
- Executes dropped EXE
PID:4564 -
\??\c:\lllllrx.exec:\lllllrx.exe52⤵
- Executes dropped EXE
PID:3308 -
\??\c:\rlrflrr.exec:\rlrflrr.exe53⤵
- Executes dropped EXE
PID:264 -
\??\c:\1nnttb.exec:\1nnttb.exe54⤵
- Executes dropped EXE
PID:4416 -
\??\c:\jvjpv.exec:\jvjpv.exe55⤵
- Executes dropped EXE
PID:2260 -
\??\c:\pjjjj.exec:\pjjjj.exe56⤵
- Executes dropped EXE
PID:3876 -
\??\c:\ffffrxl.exec:\ffffrxl.exe57⤵
- Executes dropped EXE
PID:1652 -
\??\c:\nthbbh.exec:\nthbbh.exe58⤵
- Executes dropped EXE
PID:5064 -
\??\c:\5hbbbh.exec:\5hbbbh.exe59⤵
- Executes dropped EXE
PID:3556 -
\??\c:\vjdjj.exec:\vjdjj.exe60⤵
- Executes dropped EXE
PID:4824 -
\??\c:\tthhbh.exec:\tthhbh.exe61⤵
- Executes dropped EXE
PID:4636 -
\??\c:\jjjjj.exec:\jjjjj.exe62⤵
- Executes dropped EXE
PID:4880 -
\??\c:\djddd.exec:\djddd.exe63⤵
- Executes dropped EXE
PID:2948 -
\??\c:\rrrxxff.exec:\rrrxxff.exe64⤵
- Executes dropped EXE
PID:3924 -
\??\c:\9xlrrxl.exec:\9xlrrxl.exe65⤵
- Executes dropped EXE
PID:3952 -
\??\c:\hnhhhh.exec:\hnhhhh.exe66⤵
- Executes dropped EXE
PID:232 -
\??\c:\djdjj.exec:\djdjj.exe67⤵PID:3360
-
\??\c:\rfxxlrr.exec:\rfxxlrr.exe68⤵PID:3612
-
\??\c:\frxxflf.exec:\frxxflf.exe69⤵PID:1616
-
\??\c:\9tnnnt.exec:\9tnnnt.exe70⤵PID:1776
-
\??\c:\pjdpj.exec:\pjdpj.exe71⤵PID:2088
-
\??\c:\dvjjv.exec:\dvjjv.exe72⤵PID:1128
-
\??\c:\5lrxrxr.exec:\5lrxrxr.exe73⤵PID:960
-
\??\c:\xfrffrr.exec:\xfrffrr.exe74⤵PID:1256
-
\??\c:\htbhnt.exec:\htbhnt.exe75⤵PID:3156
-
\??\c:\ppppp.exec:\ppppp.exe76⤵PID:2464
-
\??\c:\dvjjd.exec:\dvjjd.exe77⤵PID:4964
-
\??\c:\frfffll.exec:\frfffll.exe78⤵
- System Location Discovery: System Language Discovery
PID:3936 -
\??\c:\bbhhnt.exec:\bbhhnt.exe79⤵PID:2704
-
\??\c:\7bhhhn.exec:\7bhhhn.exe80⤵PID:4616
-
\??\c:\ppdvd.exec:\ppdvd.exe81⤵PID:4444
-
\??\c:\xxxxlrf.exec:\xxxxlrf.exe82⤵PID:888
-
\??\c:\lfxrrlr.exec:\lfxrrlr.exe83⤵PID:1280
-
\??\c:\9httnt.exec:\9httnt.exe84⤵PID:5080
-
\??\c:\5jppv.exec:\5jppv.exe85⤵PID:940
-
\??\c:\jdddj.exec:\jdddj.exe86⤵PID:2912
-
\??\c:\1flrrff.exec:\1flrrff.exe87⤵PID:2028
-
\??\c:\hthhbb.exec:\hthhbb.exe88⤵PID:1480
-
\??\c:\1bnnht.exec:\1bnnht.exe89⤵PID:1784
-
\??\c:\vjvpj.exec:\vjvpj.exe90⤵PID:4840
-
\??\c:\vjvdd.exec:\vjvdd.exe91⤵PID:3428
-
\??\c:\frlfxrr.exec:\frlfxrr.exe92⤵PID:3512
-
\??\c:\tbntbt.exec:\tbntbt.exe93⤵PID:3980
-
\??\c:\hnhnhn.exec:\hnhnhn.exe94⤵PID:396
-
\??\c:\dvpjj.exec:\dvpjj.exe95⤵PID:1796
-
\??\c:\jjjdd.exec:\jjjdd.exe96⤵PID:2408
-
\??\c:\lrfrlfr.exec:\lrfrlfr.exe97⤵PID:2716
-
\??\c:\nnthnb.exec:\nnthnb.exe98⤵PID:4328
-
\??\c:\thbnbh.exec:\thbnbh.exe99⤵PID:2944
-
\??\c:\7jjpp.exec:\7jjpp.exe100⤵PID:2524
-
\??\c:\vjdvj.exec:\vjdvj.exe101⤵PID:3880
-
\??\c:\llxlrfr.exec:\llxlrfr.exe102⤵PID:1804
-
\??\c:\nbnnhn.exec:\nbnnhn.exe103⤵PID:2108
-
\??\c:\jjjpj.exec:\jjjpj.exe104⤵PID:4656
-
\??\c:\pvvpd.exec:\pvvpd.exe105⤵PID:1260
-
\??\c:\1xxxrff.exec:\1xxxrff.exe106⤵
- System Location Discovery: System Language Discovery
PID:4588 -
\??\c:\xxflxfl.exec:\xxflxfl.exe107⤵
- System Location Discovery: System Language Discovery
PID:2328 -
\??\c:\bnhhhh.exec:\bnhhhh.exe108⤵PID:460
-
\??\c:\vpddj.exec:\vpddj.exe109⤵PID:4812
-
\??\c:\vpvpj.exec:\vpvpj.exe110⤵PID:1500
-
\??\c:\lfflfxx.exec:\lfflfxx.exe111⤵PID:4516
-
\??\c:\hthhnh.exec:\hthhnh.exe112⤵PID:4844
-
\??\c:\dpvpj.exec:\dpvpj.exe113⤵PID:2320
-
\??\c:\ppjpd.exec:\ppjpd.exe114⤵PID:1104
-
\??\c:\1rfflrf.exec:\1rfflrf.exe115⤵PID:3372
-
\??\c:\5lxlllx.exec:\5lxlllx.exe116⤵PID:5012
-
\??\c:\bhhthn.exec:\bhhthn.exe117⤵PID:4500
-
\??\c:\jdvvv.exec:\jdvvv.exe118⤵PID:3944
-
\??\c:\rrxrllr.exec:\rrxrllr.exe119⤵
- System Location Discovery: System Language Discovery
PID:3956 -
\??\c:\5fllrrr.exec:\5fllrrr.exe120⤵PID:220
-
\??\c:\3bhhtn.exec:\3bhhtn.exe121⤵PID:388
-
\??\c:\btnnnt.exec:\btnnnt.exe122⤵PID:700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-