Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 11:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8d414bcb7feeebe6fe26fd14d43b4e5cb4a237cd76d84065994e917ae8384029.exe
Resource
win7-20241023-en
6 signatures
120 seconds
General
-
Target
8d414bcb7feeebe6fe26fd14d43b4e5cb4a237cd76d84065994e917ae8384029.exe
-
Size
59KB
-
MD5
fe1e8f308114ebb1bccafa6b348169a3
-
SHA1
035898a02cd00797340815d2e7f45351d5e8b376
-
SHA256
8d414bcb7feeebe6fe26fd14d43b4e5cb4a237cd76d84065994e917ae8384029
-
SHA512
f3375cb04f32553350afaf8e714637bec1026ad0a5f66fb522580a48ed2908071d1f6eec7f0491489178d2dd8e35762cf2e4c8d4b3f48abf176e32d20dcf63bd
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5bx7DUQeDac7Akm:0cdpeeBSHHMHLf9Rybx7DYec7Fm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4692-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/808-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1788-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/180-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3804-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3800-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-344-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-360-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-379-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-401-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-417-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-430-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-455-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-474-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2872-478-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-485-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-489-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1712-493-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-513-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-534-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-538-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4236-542-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-612-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-616-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-698-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-709-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-763-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2492-908-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-987-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-1025-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-1751-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2588 hhhbbt.exe 2428 pdjjv.exe 4564 lllxlxr.exe 2592 hbthbt.exe 4524 bhnbtb.exe 1072 vjvpj.exe 116 vjjvp.exe 2136 9hnhtt.exe 1180 tbhbbn.exe 996 dpdvv.exe 4840 lrfffrl.exe 4396 bbbbbb.exe 4880 hhtnnn.exe 1824 dpvvp.exe 808 lrlfxxr.exe 2836 nnhhbb.exe 4132 5bhhbb.exe 1788 dpdjv.exe 3300 lfffflf.exe 2612 hbbbtt.exe 3504 nbbbhh.exe 3304 xllfxfl.exe 4488 bbbttt.exe 2796 7jdjv.exe 1356 xrffxrx.exe 3912 rrllllf.exe 1736 thnnnn.exe 2280 vjvvp.exe 3556 dvppj.exe 1832 rrxlfff.exe 3276 3lrlfff.exe 1316 xllfxrl.exe 1696 tnhbbt.exe 640 jjjdd.exe 4384 ppvvj.exe 2712 llrrlxr.exe 2264 5httnn.exe 380 hbhbbb.exe 4816 vdppd.exe 3272 vdpjv.exe 3212 rfllxfl.exe 4068 nhnnbt.exe 2008 pdddp.exe 2056 djvdp.exe 4072 7xffxxr.exe 3116 bnhhhh.exe 3312 jvvpj.exe 2392 dpddd.exe 1692 lfrxrrf.exe 5072 bhbttt.exe 4460 nnnnhh.exe 4804 djdvv.exe 1056 jjvvv.exe 840 7llffll.exe 180 hhbnnn.exe 4124 nntnbb.exe 2756 dvvpj.exe 2892 fllffxx.exe 3804 9bbhhb.exe 1180 btbbtb.exe 3172 vvvpj.exe 3152 rlxrxxx.exe 5056 9lxxfxl.exe 3148 pvvvd.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flllxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4692 wrote to memory of 2588 4692 8d414bcb7feeebe6fe26fd14d43b4e5cb4a237cd76d84065994e917ae8384029.exe 83 PID 4692 wrote to memory of 2588 4692 8d414bcb7feeebe6fe26fd14d43b4e5cb4a237cd76d84065994e917ae8384029.exe 83 PID 4692 wrote to memory of 2588 4692 8d414bcb7feeebe6fe26fd14d43b4e5cb4a237cd76d84065994e917ae8384029.exe 83 PID 2588 wrote to memory of 2428 2588 hhhbbt.exe 84 PID 2588 wrote to memory of 2428 2588 hhhbbt.exe 84 PID 2588 wrote to memory of 2428 2588 hhhbbt.exe 84 PID 2428 wrote to memory of 4564 2428 pdjjv.exe 85 PID 2428 wrote to memory of 4564 2428 pdjjv.exe 85 PID 2428 wrote to memory of 4564 2428 pdjjv.exe 85 PID 4564 wrote to memory of 2592 4564 lllxlxr.exe 86 PID 4564 wrote to memory of 2592 4564 lllxlxr.exe 86 PID 4564 wrote to memory of 2592 4564 lllxlxr.exe 86 PID 2592 wrote to memory of 4524 2592 hbthbt.exe 87 PID 2592 wrote to memory of 4524 2592 hbthbt.exe 87 PID 2592 wrote to memory of 4524 2592 hbthbt.exe 87 PID 4524 wrote to memory of 1072 4524 bhnbtb.exe 88 PID 4524 wrote to memory of 1072 4524 bhnbtb.exe 88 PID 4524 wrote to memory of 1072 4524 bhnbtb.exe 88 PID 1072 wrote to memory of 116 1072 vjvpj.exe 89 PID 1072 wrote to memory of 116 1072 vjvpj.exe 89 PID 1072 wrote to memory of 116 1072 vjvpj.exe 89 PID 116 wrote to memory of 2136 116 vjjvp.exe 90 PID 116 wrote to memory of 2136 116 vjjvp.exe 90 PID 116 wrote to memory of 2136 116 vjjvp.exe 90 PID 2136 wrote to memory of 1180 2136 9hnhtt.exe 91 PID 2136 wrote to memory of 1180 2136 9hnhtt.exe 91 PID 2136 wrote to memory of 1180 2136 9hnhtt.exe 91 PID 1180 wrote to memory of 996 1180 tbhbbn.exe 92 PID 1180 wrote to memory of 996 1180 tbhbbn.exe 92 PID 1180 wrote to memory of 996 1180 tbhbbn.exe 92 PID 996 wrote to memory of 4840 996 dpdvv.exe 93 PID 996 wrote to memory of 4840 996 dpdvv.exe 93 PID 996 wrote to memory of 4840 996 dpdvv.exe 93 PID 4840 wrote to memory of 4396 4840 lrfffrl.exe 94 PID 4840 wrote to memory of 4396 4840 lrfffrl.exe 94 PID 4840 wrote to memory of 4396 4840 lrfffrl.exe 94 PID 4396 wrote to memory of 4880 4396 bbbbbb.exe 95 PID 4396 wrote to memory of 4880 4396 bbbbbb.exe 95 PID 4396 wrote to memory of 4880 4396 bbbbbb.exe 95 PID 4880 wrote to memory of 1824 4880 hhtnnn.exe 96 PID 4880 wrote to memory of 1824 4880 hhtnnn.exe 96 PID 4880 wrote to memory of 1824 4880 hhtnnn.exe 96 PID 1824 wrote to memory of 808 1824 dpvvp.exe 97 PID 1824 wrote to memory of 808 1824 dpvvp.exe 97 PID 1824 wrote to memory of 808 1824 dpvvp.exe 97 PID 808 wrote to memory of 2836 808 lrlfxxr.exe 98 PID 808 wrote to memory of 2836 808 lrlfxxr.exe 98 PID 808 wrote to memory of 2836 808 lrlfxxr.exe 98 PID 2836 wrote to memory of 4132 2836 nnhhbb.exe 99 PID 2836 wrote to memory of 4132 2836 nnhhbb.exe 99 PID 2836 wrote to memory of 4132 2836 nnhhbb.exe 99 PID 4132 wrote to memory of 1788 4132 5bhhbb.exe 100 PID 4132 wrote to memory of 1788 4132 5bhhbb.exe 100 PID 4132 wrote to memory of 1788 4132 5bhhbb.exe 100 PID 1788 wrote to memory of 3300 1788 dpdjv.exe 101 PID 1788 wrote to memory of 3300 1788 dpdjv.exe 101 PID 1788 wrote to memory of 3300 1788 dpdjv.exe 101 PID 3300 wrote to memory of 2612 3300 lfffflf.exe 102 PID 3300 wrote to memory of 2612 3300 lfffflf.exe 102 PID 3300 wrote to memory of 2612 3300 lfffflf.exe 102 PID 2612 wrote to memory of 3504 2612 hbbbtt.exe 103 PID 2612 wrote to memory of 3504 2612 hbbbtt.exe 103 PID 2612 wrote to memory of 3504 2612 hbbbtt.exe 103 PID 3504 wrote to memory of 3304 3504 nbbbhh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d414bcb7feeebe6fe26fd14d43b4e5cb4a237cd76d84065994e917ae8384029.exe"C:\Users\Admin\AppData\Local\Temp\8d414bcb7feeebe6fe26fd14d43b4e5cb4a237cd76d84065994e917ae8384029.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\hhhbbt.exec:\hhhbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\pdjjv.exec:\pdjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\lllxlxr.exec:\lllxlxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\hbthbt.exec:\hbthbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\bhnbtb.exec:\bhnbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\vjvpj.exec:\vjvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\vjjvp.exec:\vjjvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\9hnhtt.exec:\9hnhtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\tbhbbn.exec:\tbhbbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\dpdvv.exec:\dpdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\lrfffrl.exec:\lrfffrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\bbbbbb.exec:\bbbbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\hhtnnn.exec:\hhtnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\dpvvp.exec:\dpvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\lrlfxxr.exec:\lrlfxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\nnhhbb.exec:\nnhhbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\5bhhbb.exec:\5bhhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\dpdjv.exec:\dpdjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\lfffflf.exec:\lfffflf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\hbbbtt.exec:\hbbbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\nbbbhh.exec:\nbbbhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\xllfxfl.exec:\xllfxfl.exe23⤵
- Executes dropped EXE
PID:3304 -
\??\c:\bbbttt.exec:\bbbttt.exe24⤵
- Executes dropped EXE
PID:4488 -
\??\c:\7jdjv.exec:\7jdjv.exe25⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xrffxrx.exec:\xrffxrx.exe26⤵
- Executes dropped EXE
PID:1356 -
\??\c:\rrllllf.exec:\rrllllf.exe27⤵
- Executes dropped EXE
PID:3912 -
\??\c:\thnnnn.exec:\thnnnn.exe28⤵
- Executes dropped EXE
PID:1736 -
\??\c:\vjvvp.exec:\vjvvp.exe29⤵
- Executes dropped EXE
PID:2280 -
\??\c:\dvppj.exec:\dvppj.exe30⤵
- Executes dropped EXE
PID:3556 -
\??\c:\rrxlfff.exec:\rrxlfff.exe31⤵
- Executes dropped EXE
PID:1832 -
\??\c:\3lrlfff.exec:\3lrlfff.exe32⤵
- Executes dropped EXE
PID:3276 -
\??\c:\xllfxrl.exec:\xllfxrl.exe33⤵
- Executes dropped EXE
PID:1316 -
\??\c:\tnhbbt.exec:\tnhbbt.exe34⤵
- Executes dropped EXE
PID:1696 -
\??\c:\jjjdd.exec:\jjjdd.exe35⤵
- Executes dropped EXE
PID:640 -
\??\c:\ppvvj.exec:\ppvvj.exe36⤵
- Executes dropped EXE
PID:4384 -
\??\c:\llrrlxr.exec:\llrrlxr.exe37⤵
- Executes dropped EXE
PID:2712 -
\??\c:\5httnn.exec:\5httnn.exe38⤵
- Executes dropped EXE
PID:2264 -
\??\c:\hbhbbb.exec:\hbhbbb.exe39⤵
- Executes dropped EXE
PID:380 -
\??\c:\vdppd.exec:\vdppd.exe40⤵
- Executes dropped EXE
PID:4816 -
\??\c:\vdpjv.exec:\vdpjv.exe41⤵
- Executes dropped EXE
PID:3272 -
\??\c:\rfllxfl.exec:\rfllxfl.exe42⤵
- Executes dropped EXE
PID:3212 -
\??\c:\nhnnbt.exec:\nhnnbt.exe43⤵
- Executes dropped EXE
PID:4068 -
\??\c:\pdddp.exec:\pdddp.exe44⤵
- Executes dropped EXE
PID:2008 -
\??\c:\djvdp.exec:\djvdp.exe45⤵
- Executes dropped EXE
PID:2056 -
\??\c:\7xffxxr.exec:\7xffxxr.exe46⤵
- Executes dropped EXE
PID:4072 -
\??\c:\bnhhhh.exec:\bnhhhh.exe47⤵
- Executes dropped EXE
PID:3116 -
\??\c:\jvvpj.exec:\jvvpj.exe48⤵
- Executes dropped EXE
PID:3312 -
\??\c:\dpddd.exec:\dpddd.exe49⤵
- Executes dropped EXE
PID:2392 -
\??\c:\lfrxrrf.exec:\lfrxrrf.exe50⤵
- Executes dropped EXE
PID:1692 -
\??\c:\bhbttt.exec:\bhbttt.exe51⤵
- Executes dropped EXE
PID:5072 -
\??\c:\nnnnhh.exec:\nnnnhh.exe52⤵
- Executes dropped EXE
PID:4460 -
\??\c:\djdvv.exec:\djdvv.exe53⤵
- Executes dropped EXE
PID:4804 -
\??\c:\jjvvv.exec:\jjvvv.exe54⤵
- Executes dropped EXE
PID:1056 -
\??\c:\7llffll.exec:\7llffll.exe55⤵
- Executes dropped EXE
PID:840 -
\??\c:\hhbnnn.exec:\hhbnnn.exe56⤵
- Executes dropped EXE
PID:180 -
\??\c:\nntnbb.exec:\nntnbb.exe57⤵
- Executes dropped EXE
PID:4124 -
\??\c:\dvvpj.exec:\dvvpj.exe58⤵
- Executes dropped EXE
PID:2756 -
\??\c:\fllffxx.exec:\fllffxx.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2892 -
\??\c:\9bbhhb.exec:\9bbhhb.exe60⤵
- Executes dropped EXE
PID:3804 -
\??\c:\btbbtb.exec:\btbbtb.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1180 -
\??\c:\vvvpj.exec:\vvvpj.exe62⤵
- Executes dropped EXE
PID:3172 -
\??\c:\rlxrxxx.exec:\rlxrxxx.exe63⤵
- Executes dropped EXE
PID:3152 -
\??\c:\9lxxfxl.exec:\9lxxfxl.exe64⤵
- Executes dropped EXE
PID:5056 -
\??\c:\pvvvd.exec:\pvvvd.exe65⤵
- Executes dropped EXE
PID:3148 -
\??\c:\jjppp.exec:\jjppp.exe66⤵PID:3268
-
\??\c:\llfrrrx.exec:\llfrrrx.exe67⤵PID:1688
-
\??\c:\htbbbb.exec:\htbbbb.exe68⤵PID:3800
-
\??\c:\vpvvv.exec:\vpvvv.exe69⤵PID:2044
-
\??\c:\frfxrrr.exec:\frfxrrr.exe70⤵PID:3812
-
\??\c:\tnnhbb.exec:\tnnhbb.exe71⤵PID:2124
-
\??\c:\htnnbb.exec:\htnnbb.exe72⤵PID:5116
-
\??\c:\rlxrrxf.exec:\rlxrrxf.exe73⤵PID:4468
-
\??\c:\1lrrfll.exec:\1lrrfll.exe74⤵PID:1296
-
\??\c:\nbttnn.exec:\nbttnn.exe75⤵PID:4876
-
\??\c:\tttnbb.exec:\tttnbb.exe76⤵PID:3300
-
\??\c:\dddvp.exec:\dddvp.exe77⤵PID:4968
-
\??\c:\rlfffff.exec:\rlfffff.exe78⤵PID:1096
-
\??\c:\lxlfflr.exec:\lxlfflr.exe79⤵PID:4500
-
\??\c:\7bhbhh.exec:\7bhbhh.exe80⤵PID:4508
-
\??\c:\3thbhn.exec:\3thbhn.exe81⤵PID:644
-
\??\c:\jjvpv.exec:\jjvpv.exe82⤵PID:1684
-
\??\c:\5frlfff.exec:\5frlfff.exe83⤵PID:4276
-
\??\c:\9htttt.exec:\9htttt.exe84⤵PID:2076
-
\??\c:\btnhbb.exec:\btnhbb.exe85⤵PID:916
-
\??\c:\dddvp.exec:\dddvp.exe86⤵PID:396
-
\??\c:\5rflxfx.exec:\5rflxfx.exe87⤵PID:216
-
\??\c:\lfrrrxr.exec:\lfrrrxr.exe88⤵PID:3004
-
\??\c:\nntnhh.exec:\nntnhh.exe89⤵PID:4812
-
\??\c:\vvdvp.exec:\vvdvp.exe90⤵PID:3232
-
\??\c:\xxrlfff.exec:\xxrlfff.exe91⤵PID:1616
-
\??\c:\rflffll.exec:\rflffll.exe92⤵PID:1848
-
\??\c:\ththtb.exec:\ththtb.exe93⤵PID:392
-
\??\c:\vppjd.exec:\vppjd.exe94⤵PID:2700
-
\??\c:\vjvdv.exec:\vjvdv.exe95⤵PID:2164
-
\??\c:\hnhbnt.exec:\hnhbnt.exe96⤵PID:5052
-
\??\c:\vvvvp.exec:\vvvvp.exe97⤵PID:2192
-
\??\c:\fffxrrl.exec:\fffxrrl.exe98⤵PID:2712
-
\??\c:\hnhbhn.exec:\hnhbhn.exe99⤵PID:2832
-
\??\c:\thbbbh.exec:\thbbbh.exe100⤵PID:1064
-
\??\c:\vvvpj.exec:\vvvpj.exe101⤵PID:4720
-
\??\c:\llrrrrr.exec:\llrrrrr.exe102⤵PID:3272
-
\??\c:\7rxrlll.exec:\7rxrlll.exe103⤵PID:3212
-
\??\c:\nbhbnh.exec:\nbhbnh.exe104⤵PID:4068
-
\??\c:\jjppv.exec:\jjppv.exe105⤵PID:2828
-
\??\c:\xfxrlll.exec:\xfxrlll.exe106⤵PID:1080
-
\??\c:\rflllff.exec:\rflllff.exe107⤵PID:740
-
\??\c:\hntttb.exec:\hntttb.exe108⤵PID:4404
-
\??\c:\dvpjd.exec:\dvpjd.exe109⤵PID:940
-
\??\c:\jdjvv.exec:\jdjvv.exe110⤵PID:864
-
\??\c:\frxrllf.exec:\frxrllf.exe111⤵PID:4800
-
\??\c:\ntnnnn.exec:\ntnnnn.exe112⤵PID:4696
-
\??\c:\bthbbb.exec:\bthbbb.exe113⤵PID:2760
-
\??\c:\vvddp.exec:\vvddp.exe114⤵PID:2592
-
\??\c:\vvvpj.exec:\vvvpj.exe115⤵PID:32
-
\??\c:\1flxlfx.exec:\1flxlfx.exe116⤵PID:3740
-
\??\c:\7htnnh.exec:\7htnnh.exe117⤵PID:1072
-
\??\c:\vjvdd.exec:\vjvdd.exe118⤵PID:1328
-
\??\c:\vdjpd.exec:\vdjpd.exe119⤵PID:2040
-
\??\c:\xrlfrrx.exec:\xrlfrrx.exe120⤵PID:2316
-
\??\c:\bnttnn.exec:\bnttnn.exe121⤵PID:5064
-
\??\c:\bbhhhn.exec:\bbhhhn.exe122⤵PID:4160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-