Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 01:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
61145e83182272c034fac9949e2af8f67c3855b9d823dd496417714139f89514N.exe
Resource
win7-20240729-en
7 signatures
120 seconds
General
-
Target
61145e83182272c034fac9949e2af8f67c3855b9d823dd496417714139f89514N.exe
-
Size
453KB
-
MD5
693071be407d64c6652e5d7fd4420cd0
-
SHA1
e89c78380e15b3ed0cd6a08c9b44b801d0ff5cd1
-
SHA256
61145e83182272c034fac9949e2af8f67c3855b9d823dd496417714139f89514
-
SHA512
4a9fb15caf1a462f5deed536ab8c95b12bc6b043617925dfda6de8b4c34865b2bf814ce832257e1f2619dcf96c7d6aebda897cb2b9ee49fffb9ef04cfea3a3b1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJU:q7Tc2NYHUrAwfMp3CDJU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/528-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-65-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2820-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-103-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2744-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/636-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1368-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/636-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-846-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/976-1040-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2532-1055-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/548-1135-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3024 jjvdp.exe 2000 xxrxxrr.exe 2972 hnbhnt.exe 2848 vvdjj.exe 3020 rfllrrf.exe 2728 xlxllll.exe 2820 vpdvj.exe 2768 tnnnhn.exe 2172 dvddj.exe 2744 tttnhh.exe 1520 vvddp.exe 636 ffrrrlx.exe 1332 vdjpp.exe 1936 frrrxlr.exe 2304 ntbtbh.exe 2012 9rlrrxl.exe 2372 jdpvv.exe 2556 bthhtt.exe 2988 dvddp.exe 2532 3btntb.exe 2776 djvdp.exe 2448 9xxxllx.exe 2604 nhnthh.exe 1080 7ddpj.exe 2384 hhhnnt.exe 1500 dvjpv.exe 1664 3bnhnn.exe 1368 tntnnt.exe 1552 llrrxlr.exe 1684 hhnhtt.exe 2052 9rfxfff.exe 1164 tthhhb.exe 528 3pjjv.exe 1300 fxxrrrx.exe 2332 tbhbtt.exe 2952 vpdvj.exe 2892 ffrrrrx.exe 2044 rrxfrfr.exe 2740 1bnntb.exe 3064 7jppd.exe 3000 frxfrfx.exe 2704 ntbnhb.exe 2752 bbnttt.exe 2092 pvjjp.exe 1668 rxxxxff.exe 2172 thttbh.exe 2460 bthnnh.exe 2464 7jdpd.exe 1980 flxfrxf.exe 636 hnbhhn.exe 2176 3dppv.exe 2256 vvppd.exe 1936 1rlflrx.exe 2888 7thntn.exe 760 vvdvv.exe 2196 vvjjj.exe 2372 llllxxx.exe 2088 nthnnb.exe 1040 3pdjj.exe 2544 9ffflrx.exe 2532 flrlrrx.exe 2452 bhtttt.exe 2636 ppdjj.exe 800 flrlrxf.exe -
resource yara_rule behavioral1/memory/528-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/636-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/636-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-886-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-919-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-987-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-1040-0x00000000003C0000-0x00000000003EA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 528 wrote to memory of 3024 528 61145e83182272c034fac9949e2af8f67c3855b9d823dd496417714139f89514N.exe 30 PID 528 wrote to memory of 3024 528 61145e83182272c034fac9949e2af8f67c3855b9d823dd496417714139f89514N.exe 30 PID 528 wrote to memory of 3024 528 61145e83182272c034fac9949e2af8f67c3855b9d823dd496417714139f89514N.exe 30 PID 528 wrote to memory of 3024 528 61145e83182272c034fac9949e2af8f67c3855b9d823dd496417714139f89514N.exe 30 PID 3024 wrote to memory of 2000 3024 jjvdp.exe 31 PID 3024 wrote to memory of 2000 3024 jjvdp.exe 31 PID 3024 wrote to memory of 2000 3024 jjvdp.exe 31 PID 3024 wrote to memory of 2000 3024 jjvdp.exe 31 PID 2000 wrote to memory of 2972 2000 xxrxxrr.exe 32 PID 2000 wrote to memory of 2972 2000 xxrxxrr.exe 32 PID 2000 wrote to memory of 2972 2000 xxrxxrr.exe 32 PID 2000 wrote to memory of 2972 2000 xxrxxrr.exe 32 PID 2972 wrote to memory of 2848 2972 hnbhnt.exe 33 PID 2972 wrote to memory of 2848 2972 hnbhnt.exe 33 PID 2972 wrote to memory of 2848 2972 hnbhnt.exe 33 PID 2972 wrote to memory of 2848 2972 hnbhnt.exe 33 PID 2848 wrote to memory of 3020 2848 vvdjj.exe 34 PID 2848 wrote to memory of 3020 2848 vvdjj.exe 34 PID 2848 wrote to memory of 3020 2848 vvdjj.exe 34 PID 2848 wrote to memory of 3020 2848 vvdjj.exe 34 PID 3020 wrote to memory of 2728 3020 rfllrrf.exe 35 PID 3020 wrote to memory of 2728 3020 rfllrrf.exe 35 PID 3020 wrote to memory of 2728 3020 rfllrrf.exe 35 PID 3020 wrote to memory of 2728 3020 rfllrrf.exe 35 PID 2728 wrote to memory of 2820 2728 xlxllll.exe 36 PID 2728 wrote to memory of 2820 2728 xlxllll.exe 36 PID 2728 wrote to memory of 2820 2728 xlxllll.exe 36 PID 2728 wrote to memory of 2820 2728 xlxllll.exe 36 PID 2820 wrote to memory of 2768 2820 vpdvj.exe 37 PID 2820 wrote to memory of 2768 2820 vpdvj.exe 37 PID 2820 wrote to memory of 2768 2820 vpdvj.exe 37 PID 2820 wrote to memory of 2768 2820 vpdvj.exe 37 PID 2768 wrote to memory of 2172 2768 tnnnhn.exe 38 PID 2768 wrote to memory of 2172 2768 tnnnhn.exe 38 PID 2768 wrote to memory of 2172 2768 tnnnhn.exe 38 PID 2768 wrote to memory of 2172 2768 tnnnhn.exe 38 PID 2172 wrote to memory of 2744 2172 dvddj.exe 39 PID 2172 wrote to memory of 2744 2172 dvddj.exe 39 PID 2172 wrote to memory of 2744 2172 dvddj.exe 39 PID 2172 wrote to memory of 2744 2172 dvddj.exe 39 PID 2744 wrote to memory of 1520 2744 tttnhh.exe 40 PID 2744 wrote to memory of 1520 2744 tttnhh.exe 40 PID 2744 wrote to memory of 1520 2744 tttnhh.exe 40 PID 2744 wrote to memory of 1520 2744 tttnhh.exe 40 PID 1520 wrote to memory of 636 1520 vvddp.exe 41 PID 1520 wrote to memory of 636 1520 vvddp.exe 41 PID 1520 wrote to memory of 636 1520 vvddp.exe 41 PID 1520 wrote to memory of 636 1520 vvddp.exe 41 PID 636 wrote to memory of 1332 636 ffrrrlx.exe 42 PID 636 wrote to memory of 1332 636 ffrrrlx.exe 42 PID 636 wrote to memory of 1332 636 ffrrrlx.exe 42 PID 636 wrote to memory of 1332 636 ffrrrlx.exe 42 PID 1332 wrote to memory of 1936 1332 vdjpp.exe 43 PID 1332 wrote to memory of 1936 1332 vdjpp.exe 43 PID 1332 wrote to memory of 1936 1332 vdjpp.exe 43 PID 1332 wrote to memory of 1936 1332 vdjpp.exe 43 PID 1936 wrote to memory of 2304 1936 frrrxlr.exe 44 PID 1936 wrote to memory of 2304 1936 frrrxlr.exe 44 PID 1936 wrote to memory of 2304 1936 frrrxlr.exe 44 PID 1936 wrote to memory of 2304 1936 frrrxlr.exe 44 PID 2304 wrote to memory of 2012 2304 ntbtbh.exe 45 PID 2304 wrote to memory of 2012 2304 ntbtbh.exe 45 PID 2304 wrote to memory of 2012 2304 ntbtbh.exe 45 PID 2304 wrote to memory of 2012 2304 ntbtbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\61145e83182272c034fac9949e2af8f67c3855b9d823dd496417714139f89514N.exe"C:\Users\Admin\AppData\Local\Temp\61145e83182272c034fac9949e2af8f67c3855b9d823dd496417714139f89514N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\jjvdp.exec:\jjvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\xxrxxrr.exec:\xxrxxrr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\hnbhnt.exec:\hnbhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\vvdjj.exec:\vvdjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\rfllrrf.exec:\rfllrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\xlxllll.exec:\xlxllll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\vpdvj.exec:\vpdvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\tnnnhn.exec:\tnnnhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\dvddj.exec:\dvddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\tttnhh.exec:\tttnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\vvddp.exec:\vvddp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\ffrrrlx.exec:\ffrrrlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\vdjpp.exec:\vdjpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\frrrxlr.exec:\frrrxlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\ntbtbh.exec:\ntbtbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\9rlrrxl.exec:\9rlrrxl.exe17⤵
- Executes dropped EXE
PID:2012 -
\??\c:\jdpvv.exec:\jdpvv.exe18⤵
- Executes dropped EXE
PID:2372 -
\??\c:\bthhtt.exec:\bthhtt.exe19⤵
- Executes dropped EXE
PID:2556 -
\??\c:\dvddp.exec:\dvddp.exe20⤵
- Executes dropped EXE
PID:2988 -
\??\c:\3btntb.exec:\3btntb.exe21⤵
- Executes dropped EXE
PID:2532 -
\??\c:\djvdp.exec:\djvdp.exe22⤵
- Executes dropped EXE
PID:2776 -
\??\c:\9xxxllx.exec:\9xxxllx.exe23⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nhnthh.exec:\nhnthh.exe24⤵
- Executes dropped EXE
PID:2604 -
\??\c:\7ddpj.exec:\7ddpj.exe25⤵
- Executes dropped EXE
PID:1080 -
\??\c:\hhhnnt.exec:\hhhnnt.exe26⤵
- Executes dropped EXE
PID:2384 -
\??\c:\dvjpv.exec:\dvjpv.exe27⤵
- Executes dropped EXE
PID:1500 -
\??\c:\3bnhnn.exec:\3bnhnn.exe28⤵
- Executes dropped EXE
PID:1664 -
\??\c:\tntnnt.exec:\tntnnt.exe29⤵
- Executes dropped EXE
PID:1368 -
\??\c:\llrrxlr.exec:\llrrxlr.exe30⤵
- Executes dropped EXE
PID:1552 -
\??\c:\hhnhtt.exec:\hhnhtt.exe31⤵
- Executes dropped EXE
PID:1684 -
\??\c:\9rfxfff.exec:\9rfxfff.exe32⤵
- Executes dropped EXE
PID:2052 -
\??\c:\tthhhb.exec:\tthhhb.exe33⤵
- Executes dropped EXE
PID:1164 -
\??\c:\3pjjv.exec:\3pjjv.exe34⤵
- Executes dropped EXE
PID:528 -
\??\c:\fxxrrrx.exec:\fxxrrrx.exe35⤵
- Executes dropped EXE
PID:1300 -
\??\c:\tbhbtt.exec:\tbhbtt.exe36⤵
- Executes dropped EXE
PID:2332 -
\??\c:\vpdvj.exec:\vpdvj.exe37⤵
- Executes dropped EXE
PID:2952 -
\??\c:\ffrrrrx.exec:\ffrrrrx.exe38⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rrxfrfr.exec:\rrxfrfr.exe39⤵
- Executes dropped EXE
PID:2044 -
\??\c:\1bnntb.exec:\1bnntb.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\7jppd.exec:\7jppd.exe41⤵
- Executes dropped EXE
PID:3064 -
\??\c:\frxfrfx.exec:\frxfrfx.exe42⤵
- Executes dropped EXE
PID:3000 -
\??\c:\ntbnhb.exec:\ntbnhb.exe43⤵
- Executes dropped EXE
PID:2704 -
\??\c:\bbnttt.exec:\bbnttt.exe44⤵
- Executes dropped EXE
PID:2752 -
\??\c:\pvjjp.exec:\pvjjp.exe45⤵
- Executes dropped EXE
PID:2092 -
\??\c:\rxxxxff.exec:\rxxxxff.exe46⤵
- Executes dropped EXE
PID:1668 -
\??\c:\thttbh.exec:\thttbh.exe47⤵
- Executes dropped EXE
PID:2172 -
\??\c:\bthnnh.exec:\bthnnh.exe48⤵
- Executes dropped EXE
PID:2460 -
\??\c:\7jdpd.exec:\7jdpd.exe49⤵
- Executes dropped EXE
PID:2464 -
\??\c:\flxfrxf.exec:\flxfrxf.exe50⤵
- Executes dropped EXE
PID:1980 -
\??\c:\hnbhhn.exec:\hnbhhn.exe51⤵
- Executes dropped EXE
PID:636 -
\??\c:\3dppv.exec:\3dppv.exe52⤵
- Executes dropped EXE
PID:2176 -
\??\c:\vvppd.exec:\vvppd.exe53⤵
- Executes dropped EXE
PID:2256 -
\??\c:\1rlflrx.exec:\1rlflrx.exe54⤵
- Executes dropped EXE
PID:1936 -
\??\c:\7thntn.exec:\7thntn.exe55⤵
- Executes dropped EXE
PID:2888 -
\??\c:\vvdvv.exec:\vvdvv.exe56⤵
- Executes dropped EXE
PID:760 -
\??\c:\vvjjj.exec:\vvjjj.exe57⤵
- Executes dropped EXE
PID:2196 -
\??\c:\llllxxx.exec:\llllxxx.exe58⤵
- Executes dropped EXE
PID:2372 -
\??\c:\nthnnb.exec:\nthnnb.exe59⤵
- Executes dropped EXE
PID:2088 -
\??\c:\3pdjj.exec:\3pdjj.exe60⤵
- Executes dropped EXE
PID:1040 -
\??\c:\9ffflrx.exec:\9ffflrx.exe61⤵
- Executes dropped EXE
PID:2544 -
\??\c:\flrlrrx.exec:\flrlrrx.exe62⤵
- Executes dropped EXE
PID:2532 -
\??\c:\bhtttt.exec:\bhtttt.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2452 -
\??\c:\ppdjj.exec:\ppdjj.exe64⤵
- Executes dropped EXE
PID:2636 -
\??\c:\flrlrxf.exec:\flrlrxf.exe65⤵
- Executes dropped EXE
PID:800 -
\??\c:\nnthhb.exec:\nnthhb.exe66⤵PID:340
-
\??\c:\thbnht.exec:\thbnht.exe67⤵PID:1080
-
\??\c:\ddjjp.exec:\ddjjp.exe68⤵PID:1160
-
\??\c:\ppvdj.exec:\ppvdj.exe69⤵PID:1676
-
\??\c:\rrfxffl.exec:\rrfxffl.exe70⤵PID:2488
-
\??\c:\9hnbhn.exec:\9hnbhn.exe71⤵PID:2352
-
\??\c:\dvjjp.exec:\dvjjp.exe72⤵PID:1748
-
\??\c:\lrllxff.exec:\lrllxff.exe73⤵PID:376
-
\??\c:\9htntt.exec:\9htntt.exe74⤵PID:1720
-
\??\c:\7nhnbt.exec:\7nhnbt.exe75⤵PID:1240
-
\??\c:\vjddv.exec:\vjddv.exe76⤵PID:676
-
\??\c:\9fxxfll.exec:\9fxxfll.exe77⤵PID:2436
-
\??\c:\nttttt.exec:\nttttt.exe78⤵PID:1580
-
\??\c:\1nbhhh.exec:\1nbhhh.exe79⤵PID:576
-
\??\c:\vdppd.exec:\vdppd.exe80⤵PID:2816
-
\??\c:\rlrxxfl.exec:\rlrxxfl.exe81⤵PID:2240
-
\??\c:\xfrrrrx.exec:\xfrrrrx.exe82⤵PID:2220
-
\??\c:\tntbtn.exec:\tntbtn.exe83⤵PID:2864
-
\??\c:\djvdd.exec:\djvdd.exe84⤵PID:2044
-
\??\c:\jvjjp.exec:\jvjjp.exe85⤵PID:2740
-
\??\c:\rrfxfxf.exec:\rrfxfxf.exe86⤵PID:2896
-
\??\c:\bbntbb.exec:\bbntbb.exe87⤵PID:2728
-
\??\c:\jppvv.exec:\jppvv.exe88⤵PID:2736
-
\??\c:\xfxxlrf.exec:\xfxxlrf.exe89⤵PID:2996
-
\??\c:\fxflrrx.exec:\fxflrrx.exe90⤵PID:1352
-
\??\c:\nhbbbh.exec:\nhbbbh.exe91⤵PID:2268
-
\??\c:\djppp.exec:\djppp.exe92⤵PID:2468
-
\??\c:\rrffllx.exec:\rrffllx.exe93⤵PID:1032
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe94⤵PID:2288
-
\??\c:\bbtnbh.exec:\bbtnbh.exe95⤵PID:2688
-
\??\c:\9pddd.exec:\9pddd.exe96⤵PID:2204
-
\??\c:\rrxrffr.exec:\rrxrffr.exe97⤵PID:2280
-
\??\c:\ffrllff.exec:\ffrllff.exe98⤵PID:1960
-
\??\c:\1bnnnn.exec:\1bnnnn.exe99⤵
- System Location Discovery: System Language Discovery
PID:1656 -
\??\c:\pvdvv.exec:\pvdvv.exe100⤵PID:532
-
\??\c:\9vjpp.exec:\9vjpp.exe101⤵PID:844
-
\??\c:\5frrlll.exec:\5frrlll.exe102⤵PID:2168
-
\??\c:\tbbttn.exec:\tbbttn.exe103⤵PID:2300
-
\??\c:\dvjjp.exec:\dvjjp.exe104⤵PID:2556
-
\??\c:\dddjv.exec:\dddjv.exe105⤵PID:2336
-
\??\c:\3rflrrx.exec:\3rflrrx.exe106⤵PID:2108
-
\??\c:\3hnnnn.exec:\3hnnnn.exe107⤵PID:1480
-
\??\c:\7hthtb.exec:\7hthtb.exe108⤵PID:696
-
\??\c:\jjvvd.exec:\jjvvd.exe109⤵PID:2448
-
\??\c:\lrffffl.exec:\lrffffl.exe110⤵PID:1076
-
\??\c:\3xlffxx.exec:\3xlffxx.exe111⤵PID:1852
-
\??\c:\hnbhbb.exec:\hnbhbb.exe112⤵PID:2572
-
\??\c:\jdppd.exec:\jdppd.exe113⤵PID:2100
-
\??\c:\djjjj.exec:\djjjj.exe114⤵
- System Location Discovery: System Language Discovery
PID:1704 -
\??\c:\9xlllll.exec:\9xlllll.exe115⤵PID:1864
-
\??\c:\bbnnnh.exec:\bbnnnh.exe116⤵PID:1712
-
\??\c:\hnhntb.exec:\hnhntb.exe117⤵PID:2500
-
\??\c:\jdjjj.exec:\jdjjj.exe118⤵PID:1072
-
\??\c:\llrlxrr.exec:\llrlxrr.exe119⤵PID:1724
-
\??\c:\bthhnn.exec:\bthhnn.exe120⤵PID:336
-
\??\c:\vdpvd.exec:\vdpvd.exe121⤵PID:1172
-
\??\c:\fxffrxx.exec:\fxffrxx.exe122⤵PID:1680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-