Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 01:48
Static task
static1
Behavioral task
behavioral1
Sample
c81a98664ccc133419938b9cf45b3cacfef17d1532cf2268d9781234d77795e7N.exe
Resource
win7-20240903-en
General
-
Target
c81a98664ccc133419938b9cf45b3cacfef17d1532cf2268d9781234d77795e7N.exe
-
Size
81KB
-
MD5
b6cf6aadf7676a92e6bda3f5a15aba80
-
SHA1
a328464a4187e48dad5e28121068ae690fd4c872
-
SHA256
c81a98664ccc133419938b9cf45b3cacfef17d1532cf2268d9781234d77795e7
-
SHA512
b3492d1cc071908d5af85951d90d79b775495f2542f87dcedb74abc2682a2f5ffa41a775e772a94391bad219b0fe6f172cda46fa04eebc05e2347855d13ea8d0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeqx:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu41
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/396-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1792-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vvppp.exejpvvp.exe5rxrlll.exejvjjd.exefxxrrxx.exehnnhbn.exe1pjdv.exerxfxxff.exehtbnhh.exe5djdv.exefxrllff.exe5nhnnb.exehbhbhh.exejvdjv.exexrlxrlx.exebtbnbt.exedddpj.exefxxrffr.exebthnhn.exedpvvv.exexflrrll.exebtttnn.exentnhth.exedpvpj.exexrrllxr.exettbbtb.exedpjjj.exefxxfffx.exebbbntn.exe7pvdv.exebnnhbb.exelxrlfrf.exe7jvpj.exexlrllxx.exehhhnnt.exenhtbtt.exedjvvj.exe9bntbb.exehthntb.exeddjjv.exelxrlxxx.exebbbbbb.exevjppd.exenhbbtt.exentttnb.exevvddp.exerlffrxx.exefxrfxrl.exenhnhbt.exe3jvjj.exe7jvpj.exerrrxffr.exejdjvv.exevpppj.exefxxrlrf.exelrxrlrr.exebhntht.exehbnttb.exepdjpj.exefrfxlrx.exexlrfxfl.exehbbtnh.exehbhhhh.exevjpjd.exepid Process 1792 vvppp.exe 4104 jpvvp.exe 4584 5rxrlll.exe 4972 jvjjd.exe 2448 fxxrrxx.exe 5084 hnnhbn.exe 3184 1pjdv.exe 2484 rxfxxff.exe 4908 htbnhh.exe 2148 5djdv.exe 1060 fxrllff.exe 3932 5nhnnb.exe 4568 hbhbhh.exe 5012 jvdjv.exe 464 xrlxrlx.exe 4088 btbnbt.exe 1184 dddpj.exe 1348 fxxrffr.exe 4032 bthnhn.exe 3196 dpvvv.exe 3192 xflrrll.exe 456 btttnn.exe 1616 ntnhth.exe 2296 dpvpj.exe 3388 xrrllxr.exe 4512 ttbbtb.exe 1688 dpjjj.exe 3920 fxxfffx.exe 4480 bbbntn.exe 4364 7pvdv.exe 4072 bnnhbb.exe 1576 lxrlfrf.exe 4336 7jvpj.exe 2820 xlrllxx.exe 2400 hhhnnt.exe 4220 nhtbtt.exe 1696 djvvj.exe 4716 9bntbb.exe 3500 hthntb.exe 3568 ddjjv.exe 432 lxrlxxx.exe 4408 bbbbbb.exe 232 vjppd.exe 1000 nhbbtt.exe 1124 ntttnb.exe 4672 vvddp.exe 3612 rlffrxx.exe 4960 fxrfxrl.exe 396 nhnhbt.exe 2588 3jvjj.exe 4104 7jvpj.exe 2712 rrrxffr.exe 3928 jdjvv.exe 3112 vpppj.exe 4972 fxxrlrf.exe 2300 lrxrlrr.exe 4676 bhntht.exe 5084 hbnttb.exe 1936 pdjpj.exe 2224 frfxlrx.exe 4228 xlrfxfl.exe 3004 hbbtnh.exe 2052 hbhhhh.exe 3988 vjpjd.exe -
Processes:
resource yara_rule behavioral2/memory/396-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1792-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
pdjpj.exefrlrlrr.exe9rflfll.exejjpjd.exe7tnnhb.exerrrllrr.exehbnnhh.exexxxrlll.exehbhbhb.exefrxlflx.exefrfxlrx.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rflfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxlrx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c81a98664ccc133419938b9cf45b3cacfef17d1532cf2268d9781234d77795e7N.exevvppp.exejpvvp.exe5rxrlll.exejvjjd.exefxxrrxx.exehnnhbn.exe1pjdv.exerxfxxff.exehtbnhh.exe5djdv.exefxrllff.exe5nhnnb.exehbhbhh.exejvdjv.exexrlxrlx.exebtbnbt.exedddpj.exefxxrffr.exebthnhn.exedpvvv.exexflrrll.exedescription pid Process procid_target PID 396 wrote to memory of 1792 396 c81a98664ccc133419938b9cf45b3cacfef17d1532cf2268d9781234d77795e7N.exe 82 PID 396 wrote to memory of 1792 396 c81a98664ccc133419938b9cf45b3cacfef17d1532cf2268d9781234d77795e7N.exe 82 PID 396 wrote to memory of 1792 396 c81a98664ccc133419938b9cf45b3cacfef17d1532cf2268d9781234d77795e7N.exe 82 PID 1792 wrote to memory of 4104 1792 vvppp.exe 83 PID 1792 wrote to memory of 4104 1792 vvppp.exe 83 PID 1792 wrote to memory of 4104 1792 vvppp.exe 83 PID 4104 wrote to memory of 4584 4104 jpvvp.exe 84 PID 4104 wrote to memory of 4584 4104 jpvvp.exe 84 PID 4104 wrote to memory of 4584 4104 jpvvp.exe 84 PID 4584 wrote to memory of 4972 4584 5rxrlll.exe 85 PID 4584 wrote to memory of 4972 4584 5rxrlll.exe 85 PID 4584 wrote to memory of 4972 4584 5rxrlll.exe 85 PID 4972 wrote to memory of 2448 4972 jvjjd.exe 86 PID 4972 wrote to memory of 2448 4972 jvjjd.exe 86 PID 4972 wrote to memory of 2448 4972 jvjjd.exe 86 PID 2448 wrote to memory of 5084 2448 fxxrrxx.exe 87 PID 2448 wrote to memory of 5084 2448 fxxrrxx.exe 87 PID 2448 wrote to memory of 5084 2448 fxxrrxx.exe 87 PID 5084 wrote to memory of 3184 5084 hnnhbn.exe 88 PID 5084 wrote to memory of 3184 5084 hnnhbn.exe 88 PID 5084 wrote to memory of 3184 5084 hnnhbn.exe 88 PID 3184 wrote to memory of 2484 3184 1pjdv.exe 89 PID 3184 wrote to memory of 2484 3184 1pjdv.exe 89 PID 3184 wrote to memory of 2484 3184 1pjdv.exe 89 PID 2484 wrote to memory of 4908 2484 rxfxxff.exe 90 PID 2484 wrote to memory of 4908 2484 rxfxxff.exe 90 PID 2484 wrote to memory of 4908 2484 rxfxxff.exe 90 PID 4908 wrote to memory of 2148 4908 htbnhh.exe 91 PID 4908 wrote to memory of 2148 4908 htbnhh.exe 91 PID 4908 wrote to memory of 2148 4908 htbnhh.exe 91 PID 2148 wrote to memory of 1060 2148 5djdv.exe 92 PID 2148 wrote to memory of 1060 2148 5djdv.exe 92 PID 2148 wrote to memory of 1060 2148 5djdv.exe 92 PID 1060 wrote to memory of 3932 1060 fxrllff.exe 93 PID 1060 wrote to memory of 3932 1060 fxrllff.exe 93 PID 1060 wrote to memory of 3932 1060 fxrllff.exe 93 PID 3932 wrote to memory of 4568 3932 5nhnnb.exe 94 PID 3932 wrote to memory of 4568 3932 5nhnnb.exe 94 PID 3932 wrote to memory of 4568 3932 5nhnnb.exe 94 PID 4568 wrote to memory of 5012 4568 hbhbhh.exe 95 PID 4568 wrote to memory of 5012 4568 hbhbhh.exe 95 PID 4568 wrote to memory of 5012 4568 hbhbhh.exe 95 PID 5012 wrote to memory of 464 5012 jvdjv.exe 96 PID 5012 wrote to memory of 464 5012 jvdjv.exe 96 PID 5012 wrote to memory of 464 5012 jvdjv.exe 96 PID 464 wrote to memory of 4088 464 xrlxrlx.exe 97 PID 464 wrote to memory of 4088 464 xrlxrlx.exe 97 PID 464 wrote to memory of 4088 464 xrlxrlx.exe 97 PID 4088 wrote to memory of 1184 4088 btbnbt.exe 98 PID 4088 wrote to memory of 1184 4088 btbnbt.exe 98 PID 4088 wrote to memory of 1184 4088 btbnbt.exe 98 PID 1184 wrote to memory of 1348 1184 dddpj.exe 99 PID 1184 wrote to memory of 1348 1184 dddpj.exe 99 PID 1184 wrote to memory of 1348 1184 dddpj.exe 99 PID 1348 wrote to memory of 4032 1348 fxxrffr.exe 100 PID 1348 wrote to memory of 4032 1348 fxxrffr.exe 100 PID 1348 wrote to memory of 4032 1348 fxxrffr.exe 100 PID 4032 wrote to memory of 3196 4032 bthnhn.exe 101 PID 4032 wrote to memory of 3196 4032 bthnhn.exe 101 PID 4032 wrote to memory of 3196 4032 bthnhn.exe 101 PID 3196 wrote to memory of 3192 3196 dpvvv.exe 102 PID 3196 wrote to memory of 3192 3196 dpvvv.exe 102 PID 3196 wrote to memory of 3192 3196 dpvvv.exe 102 PID 3192 wrote to memory of 456 3192 xflrrll.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\c81a98664ccc133419938b9cf45b3cacfef17d1532cf2268d9781234d77795e7N.exe"C:\Users\Admin\AppData\Local\Temp\c81a98664ccc133419938b9cf45b3cacfef17d1532cf2268d9781234d77795e7N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\vvppp.exec:\vvppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\jpvvp.exec:\jpvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\5rxrlll.exec:\5rxrlll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\jvjjd.exec:\jvjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\fxxrrxx.exec:\fxxrrxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\hnnhbn.exec:\hnnhbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\1pjdv.exec:\1pjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\rxfxxff.exec:\rxfxxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\htbnhh.exec:\htbnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\5djdv.exec:\5djdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\fxrllff.exec:\fxrllff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\5nhnnb.exec:\5nhnnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\hbhbhh.exec:\hbhbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\jvdjv.exec:\jvdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\xrlxrlx.exec:\xrlxrlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\btbnbt.exec:\btbnbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\dddpj.exec:\dddpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\fxxrffr.exec:\fxxrffr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\bthnhn.exec:\bthnhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\dpvvv.exec:\dpvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\xflrrll.exec:\xflrrll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\btttnn.exec:\btttnn.exe23⤵
- Executes dropped EXE
PID:456 -
\??\c:\ntnhth.exec:\ntnhth.exe24⤵
- Executes dropped EXE
PID:1616 -
\??\c:\dpvpj.exec:\dpvpj.exe25⤵
- Executes dropped EXE
PID:2296 -
\??\c:\xrrllxr.exec:\xrrllxr.exe26⤵
- Executes dropped EXE
PID:3388 -
\??\c:\ttbbtb.exec:\ttbbtb.exe27⤵
- Executes dropped EXE
PID:4512 -
\??\c:\dpjjj.exec:\dpjjj.exe28⤵
- Executes dropped EXE
PID:1688 -
\??\c:\fxxfffx.exec:\fxxfffx.exe29⤵
- Executes dropped EXE
PID:3920 -
\??\c:\bbbntn.exec:\bbbntn.exe30⤵
- Executes dropped EXE
PID:4480 -
\??\c:\7pvdv.exec:\7pvdv.exe31⤵
- Executes dropped EXE
PID:4364 -
\??\c:\bnnhbb.exec:\bnnhbb.exe32⤵
- Executes dropped EXE
PID:4072 -
\??\c:\lxrlfrf.exec:\lxrlfrf.exe33⤵
- Executes dropped EXE
PID:1576 -
\??\c:\7jvpj.exec:\7jvpj.exe34⤵
- Executes dropped EXE
PID:4336 -
\??\c:\xlrllxx.exec:\xlrllxx.exe35⤵
- Executes dropped EXE
PID:2820 -
\??\c:\hhhnnt.exec:\hhhnnt.exe36⤵
- Executes dropped EXE
PID:2400 -
\??\c:\nhtbtt.exec:\nhtbtt.exe37⤵
- Executes dropped EXE
PID:4220 -
\??\c:\djvvj.exec:\djvvj.exe38⤵
- Executes dropped EXE
PID:1696 -
\??\c:\9bntbb.exec:\9bntbb.exe39⤵
- Executes dropped EXE
PID:4716 -
\??\c:\hthntb.exec:\hthntb.exe40⤵
- Executes dropped EXE
PID:3500 -
\??\c:\ddjjv.exec:\ddjjv.exe41⤵
- Executes dropped EXE
PID:3568 -
\??\c:\lxrlxxx.exec:\lxrlxxx.exe42⤵
- Executes dropped EXE
PID:432 -
\??\c:\bbbbbb.exec:\bbbbbb.exe43⤵
- Executes dropped EXE
PID:4408 -
\??\c:\vjppd.exec:\vjppd.exe44⤵
- Executes dropped EXE
PID:232 -
\??\c:\nhbbtt.exec:\nhbbtt.exe45⤵
- Executes dropped EXE
PID:1000 -
\??\c:\ntttnb.exec:\ntttnb.exe46⤵
- Executes dropped EXE
PID:1124 -
\??\c:\vvddp.exec:\vvddp.exe47⤵
- Executes dropped EXE
PID:4672 -
\??\c:\rlffrxx.exec:\rlffrxx.exe48⤵
- Executes dropped EXE
PID:3612 -
\??\c:\fxrfxrl.exec:\fxrfxrl.exe49⤵
- Executes dropped EXE
PID:4960 -
\??\c:\nhnhbt.exec:\nhnhbt.exe50⤵
- Executes dropped EXE
PID:396 -
\??\c:\3jvjj.exec:\3jvjj.exe51⤵
- Executes dropped EXE
PID:2588 -
\??\c:\7jvpj.exec:\7jvpj.exe52⤵
- Executes dropped EXE
PID:4104 -
\??\c:\rrrxffr.exec:\rrrxffr.exe53⤵
- Executes dropped EXE
PID:2712 -
\??\c:\jdjvv.exec:\jdjvv.exe54⤵
- Executes dropped EXE
PID:3928 -
\??\c:\vpppj.exec:\vpppj.exe55⤵
- Executes dropped EXE
PID:3112 -
\??\c:\fxxrlrf.exec:\fxxrlrf.exe56⤵
- Executes dropped EXE
PID:4972 -
\??\c:\lrxrlrr.exec:\lrxrlrr.exe57⤵
- Executes dropped EXE
PID:2300 -
\??\c:\bhntht.exec:\bhntht.exe58⤵
- Executes dropped EXE
PID:4676 -
\??\c:\hbnttb.exec:\hbnttb.exe59⤵
- Executes dropped EXE
PID:5084 -
\??\c:\pdjpj.exec:\pdjpj.exe60⤵
- Executes dropped EXE
PID:1936 -
\??\c:\frfxlrx.exec:\frfxlrx.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2224 -
\??\c:\xlrfxfl.exec:\xlrfxfl.exe62⤵
- Executes dropped EXE
PID:4228 -
\??\c:\hbbtnh.exec:\hbbtnh.exe63⤵
- Executes dropped EXE
PID:3004 -
\??\c:\hbhhhh.exec:\hbhhhh.exe64⤵
- Executes dropped EXE
PID:2052 -
\??\c:\vjpjd.exec:\vjpjd.exe65⤵
- Executes dropped EXE
PID:3988 -
\??\c:\1llfxxx.exec:\1llfxxx.exe66⤵PID:5064
-
\??\c:\hhhhhb.exec:\hhhhhb.exe67⤵PID:4700
-
\??\c:\5vjjj.exec:\5vjjj.exe68⤵PID:3056
-
\??\c:\jjpjd.exec:\jjpjd.exe69⤵
- System Location Discovery: System Language Discovery
PID:4216 -
\??\c:\rrlrrrf.exec:\rrlrrrf.exe70⤵PID:4712
-
\??\c:\bnnnnb.exec:\bnnnnb.exe71⤵PID:540
-
\??\c:\1nbtnt.exec:\1nbtnt.exe72⤵PID:4052
-
\??\c:\djddj.exec:\djddj.exe73⤵PID:448
-
\??\c:\vpvvj.exec:\vpvvj.exe74⤵PID:2480
-
\??\c:\rfllxfx.exec:\rfllxfx.exe75⤵PID:1904
-
\??\c:\9xfffll.exec:\9xfffll.exe76⤵PID:3708
-
\??\c:\3vvpd.exec:\3vvpd.exe77⤵PID:2532
-
\??\c:\ppppj.exec:\ppppj.exe78⤵PID:3008
-
\??\c:\fxxlfrr.exec:\fxxlfrr.exe79⤵PID:456
-
\??\c:\hbtntb.exec:\hbtntb.exe80⤵PID:3624
-
\??\c:\nhhbhn.exec:\nhhbhn.exe81⤵PID:5056
-
\??\c:\vdvjd.exec:\vdvjd.exe82⤵PID:1612
-
\??\c:\xlrlflx.exec:\xlrlflx.exe83⤵PID:4392
-
\??\c:\5bbttt.exec:\5bbttt.exe84⤵PID:4824
-
\??\c:\3dpjd.exec:\3dpjd.exe85⤵PID:764
-
\??\c:\pppjj.exec:\pppjj.exe86⤵PID:3920
-
\??\c:\9lflfxf.exec:\9lflfxf.exe87⤵PID:1152
-
\??\c:\btnhhb.exec:\btnhhb.exe88⤵PID:748
-
\??\c:\ttbbnn.exec:\ttbbnn.exe89⤵PID:3208
-
\??\c:\djpjd.exec:\djpjd.exe90⤵PID:3548
-
\??\c:\rfrlflf.exec:\rfrlflf.exe91⤵PID:1660
-
\??\c:\7rxxrrr.exec:\7rxxrrr.exe92⤵PID:3888
-
\??\c:\tnhhtt.exec:\tnhhtt.exe93⤵PID:760
-
\??\c:\ppvpp.exec:\ppvpp.exe94⤵PID:2948
-
\??\c:\1flffff.exec:\1flffff.exe95⤵PID:4208
-
\??\c:\rffxxxx.exec:\rffxxxx.exe96⤵PID:2508
-
\??\c:\xffflxr.exec:\xffflxr.exe97⤵PID:3476
-
\??\c:\1rxrllf.exec:\1rxrllf.exe98⤵PID:2952
-
\??\c:\9dpjj.exec:\9dpjj.exe99⤵PID:4352
-
\??\c:\djdvd.exec:\djdvd.exe100⤵PID:3728
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe101⤵PID:1448
-
\??\c:\lrrrllf.exec:\lrrrllf.exe102⤵PID:1032
-
\??\c:\hhthhh.exec:\hhthhh.exe103⤵PID:1000
-
\??\c:\5pppj.exec:\5pppj.exe104⤵PID:1016
-
\??\c:\5lxxrxx.exec:\5lxxrxx.exe105⤵PID:3536
-
\??\c:\3rrxrll.exec:\3rrxrll.exe106⤵PID:1820
-
\??\c:\ntbthh.exec:\ntbthh.exe107⤵PID:2964
-
\??\c:\pjjpd.exec:\pjjpd.exe108⤵PID:3868
-
\??\c:\xlllfxx.exec:\xlllfxx.exe109⤵PID:1256
-
\??\c:\rrxfxfx.exec:\rrxfxfx.exe110⤵PID:4852
-
\??\c:\7nnnnt.exec:\7nnnnt.exe111⤵PID:3884
-
\??\c:\3btntn.exec:\3btntn.exe112⤵PID:3956
-
\??\c:\pjpjd.exec:\pjpjd.exe113⤵PID:5084
-
\??\c:\1vvjd.exec:\1vvjd.exe114⤵PID:2484
-
\??\c:\xffxxrr.exec:\xffxxrr.exe115⤵PID:2224
-
\??\c:\7tnnhb.exec:\7tnnhb.exe116⤵
- System Location Discovery: System Language Discovery
PID:4544 -
\??\c:\hbthbt.exec:\hbthbt.exe117⤵PID:3852
-
\??\c:\rfxffrf.exec:\rfxffrf.exe118⤵PID:3064
-
\??\c:\9lfffff.exec:\9lfffff.exe119⤵PID:2308
-
\??\c:\5pdvv.exec:\5pdvv.exe120⤵PID:3584
-
\??\c:\jdjdd.exec:\jdjdd.exe121⤵PID:2696
-
\??\c:\frfrxll.exec:\frfrxll.exe122⤵PID:3776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-