Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 03:01
Static task
static1
Behavioral task
behavioral1
Sample
874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe
Resource
win7-20241010-en
General
-
Target
874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe
-
Size
93KB
-
MD5
789612a58fd4b8deaca1dcd85daa895d
-
SHA1
2c227d9ad452da6a3e763e2ab15908f9bf545031
-
SHA256
874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85
-
SHA512
888e6de09c4f9ea6e52829ddc20ef6a2530386820e4613cbe377217a004e6ca3ba3818a5b1aaac1ccbbb5f994eb32720e85d1c35cf3a9cb8da92bbede1951a79
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73t6MlYqn+jMp99zx/A0UtgK:ymb3NkkiQ3mdBjFo73tvn+Yp99zDut
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/4924-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1344-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3140-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/828-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/996-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1344 pjdjp.exe 3196 rrxrxxr.exe 4428 ttthnt.exe 4424 lrxlrxr.exe 1448 hnbttb.exe 3140 vdjjj.exe 3600 tntbnt.exe 4432 frrxlrl.exe 3184 hhttnn.exe 3144 pppdp.exe 228 rfrlfxx.exe 4252 dddjd.exe 2524 rrxxllr.exe 3704 jdvvp.exe 4040 lffxxfl.exe 1180 btnnhh.exe 2096 lfllfff.exe 2952 htnnhb.exe 828 pppjv.exe 3928 rlrxrlr.exe 1620 bnbtbb.exe 996 dpppp.exe 3768 rxxxrxr.exe 2788 thbnnh.exe 1564 jdddv.exe 3256 fxfllll.exe 1068 jjppj.exe 4020 ffxfxfl.exe 5060 bbbhnb.exe 5056 vjvvp.exe 5020 ffrlxfr.exe 1360 bbhhhh.exe 4960 vpjpp.exe 3732 xrxrrrl.exe 1612 tthnhh.exe 3680 ppddp.exe 2784 rllfxxr.exe 2144 httnbt.exe 1344 dvdvv.exe 2184 lxrrxlf.exe 3564 bhnhbt.exe 4436 frxllrr.exe 4428 bhthbn.exe 4424 pjddd.exe 4912 hbnbnb.exe 3760 nntttt.exe 1108 jjvvp.exe 4180 lxllfxx.exe 1464 hhhhnn.exe 2136 btbtnn.exe 2112 ddvdd.exe 3176 5frrrrr.exe 748 btbbbb.exe 3440 9hbbnh.exe 1952 jjddd.exe 3476 ttnhhh.exe 2344 pdvjd.exe 2876 rxxxrrf.exe 4340 lffffll.exe 3756 ddppp.exe 3344 lrrlxxl.exe 1180 hhnnhb.exe 2096 pdjjd.exe 4776 ppvvj.exe -
resource yara_rule behavioral2/memory/4924-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1344-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/828-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2788-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-213-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxlrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4924 wrote to memory of 1344 4924 874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe 83 PID 4924 wrote to memory of 1344 4924 874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe 83 PID 4924 wrote to memory of 1344 4924 874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe 83 PID 1344 wrote to memory of 3196 1344 pjdjp.exe 84 PID 1344 wrote to memory of 3196 1344 pjdjp.exe 84 PID 1344 wrote to memory of 3196 1344 pjdjp.exe 84 PID 3196 wrote to memory of 4428 3196 rrxrxxr.exe 85 PID 3196 wrote to memory of 4428 3196 rrxrxxr.exe 85 PID 3196 wrote to memory of 4428 3196 rrxrxxr.exe 85 PID 4428 wrote to memory of 4424 4428 ttthnt.exe 86 PID 4428 wrote to memory of 4424 4428 ttthnt.exe 86 PID 4428 wrote to memory of 4424 4428 ttthnt.exe 86 PID 4424 wrote to memory of 1448 4424 lrxlrxr.exe 87 PID 4424 wrote to memory of 1448 4424 lrxlrxr.exe 87 PID 4424 wrote to memory of 1448 4424 lrxlrxr.exe 87 PID 1448 wrote to memory of 3140 1448 hnbttb.exe 88 PID 1448 wrote to memory of 3140 1448 hnbttb.exe 88 PID 1448 wrote to memory of 3140 1448 hnbttb.exe 88 PID 3140 wrote to memory of 3600 3140 vdjjj.exe 89 PID 3140 wrote to memory of 3600 3140 vdjjj.exe 89 PID 3140 wrote to memory of 3600 3140 vdjjj.exe 89 PID 3600 wrote to memory of 4432 3600 tntbnt.exe 90 PID 3600 wrote to memory of 4432 3600 tntbnt.exe 90 PID 3600 wrote to memory of 4432 3600 tntbnt.exe 90 PID 4432 wrote to memory of 3184 4432 frrxlrl.exe 91 PID 4432 wrote to memory of 3184 4432 frrxlrl.exe 91 PID 4432 wrote to memory of 3184 4432 frrxlrl.exe 91 PID 3184 wrote to memory of 3144 3184 hhttnn.exe 92 PID 3184 wrote to memory of 3144 3184 hhttnn.exe 92 PID 3184 wrote to memory of 3144 3184 hhttnn.exe 92 PID 3144 wrote to memory of 228 3144 pppdp.exe 93 PID 3144 wrote to memory of 228 3144 pppdp.exe 93 PID 3144 wrote to memory of 228 3144 pppdp.exe 93 PID 228 wrote to memory of 4252 228 rfrlfxx.exe 94 PID 228 wrote to memory of 4252 228 rfrlfxx.exe 94 PID 228 wrote to memory of 4252 228 rfrlfxx.exe 94 PID 4252 wrote to memory of 2524 4252 dddjd.exe 95 PID 4252 wrote to memory of 2524 4252 dddjd.exe 95 PID 4252 wrote to memory of 2524 4252 dddjd.exe 95 PID 2524 wrote to memory of 3704 2524 rrxxllr.exe 96 PID 2524 wrote to memory of 3704 2524 rrxxllr.exe 96 PID 2524 wrote to memory of 3704 2524 rrxxllr.exe 96 PID 3704 wrote to memory of 4040 3704 jdvvp.exe 97 PID 3704 wrote to memory of 4040 3704 jdvvp.exe 97 PID 3704 wrote to memory of 4040 3704 jdvvp.exe 97 PID 4040 wrote to memory of 1180 4040 lffxxfl.exe 98 PID 4040 wrote to memory of 1180 4040 lffxxfl.exe 98 PID 4040 wrote to memory of 1180 4040 lffxxfl.exe 98 PID 1180 wrote to memory of 2096 1180 btnnhh.exe 99 PID 1180 wrote to memory of 2096 1180 btnnhh.exe 99 PID 1180 wrote to memory of 2096 1180 btnnhh.exe 99 PID 2096 wrote to memory of 2952 2096 lfllfff.exe 100 PID 2096 wrote to memory of 2952 2096 lfllfff.exe 100 PID 2096 wrote to memory of 2952 2096 lfllfff.exe 100 PID 2952 wrote to memory of 828 2952 htnnhb.exe 101 PID 2952 wrote to memory of 828 2952 htnnhb.exe 101 PID 2952 wrote to memory of 828 2952 htnnhb.exe 101 PID 828 wrote to memory of 3928 828 pppjv.exe 102 PID 828 wrote to memory of 3928 828 pppjv.exe 102 PID 828 wrote to memory of 3928 828 pppjv.exe 102 PID 3928 wrote to memory of 1620 3928 rlrxrlr.exe 103 PID 3928 wrote to memory of 1620 3928 rlrxrlr.exe 103 PID 3928 wrote to memory of 1620 3928 rlrxrlr.exe 103 PID 1620 wrote to memory of 996 1620 bnbtbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe"C:\Users\Admin\AppData\Local\Temp\874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\pjdjp.exec:\pjdjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\rrxrxxr.exec:\rrxrxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\ttthnt.exec:\ttthnt.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\lrxlrxr.exec:\lrxlrxr.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\hnbttb.exec:\hnbttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\vdjjj.exec:\vdjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\tntbnt.exec:\tntbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\frrxlrl.exec:\frrxlrl.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\hhttnn.exec:\hhttnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\pppdp.exec:\pppdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\rfrlfxx.exec:\rfrlfxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\dddjd.exec:\dddjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\rrxxllr.exec:\rrxxllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\jdvvp.exec:\jdvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\lffxxfl.exec:\lffxxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\btnnhh.exec:\btnnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\lfllfff.exec:\lfllfff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\htnnhb.exec:\htnnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\pppjv.exec:\pppjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\rlrxrlr.exec:\rlrxrlr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\bnbtbb.exec:\bnbtbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\dpppp.exec:\dpppp.exe23⤵
- Executes dropped EXE
PID:996 -
\??\c:\rxxxrxr.exec:\rxxxrxr.exe24⤵
- Executes dropped EXE
PID:3768 -
\??\c:\thbnnh.exec:\thbnnh.exe25⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jdddv.exec:\jdddv.exe26⤵
- Executes dropped EXE
PID:1564 -
\??\c:\fxfllll.exec:\fxfllll.exe27⤵
- Executes dropped EXE
PID:3256 -
\??\c:\jjppj.exec:\jjppj.exe28⤵
- Executes dropped EXE
PID:1068 -
\??\c:\ffxfxfl.exec:\ffxfxfl.exe29⤵
- Executes dropped EXE
PID:4020 -
\??\c:\bbbhnb.exec:\bbbhnb.exe30⤵
- Executes dropped EXE
PID:5060 -
\??\c:\vjvvp.exec:\vjvvp.exe31⤵
- Executes dropped EXE
PID:5056 -
\??\c:\ffrlxfr.exec:\ffrlxfr.exe32⤵
- Executes dropped EXE
PID:5020 -
\??\c:\bbhhhh.exec:\bbhhhh.exe33⤵
- Executes dropped EXE
PID:1360 -
\??\c:\vpjpp.exec:\vpjpp.exe34⤵
- Executes dropped EXE
PID:4960 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe35⤵
- Executes dropped EXE
PID:3732 -
\??\c:\tthnhh.exec:\tthnhh.exe36⤵
- Executes dropped EXE
PID:1612 -
\??\c:\ppddp.exec:\ppddp.exe37⤵
- Executes dropped EXE
PID:3680 -
\??\c:\rllfxxr.exec:\rllfxxr.exe38⤵
- Executes dropped EXE
PID:2784 -
\??\c:\httnbt.exec:\httnbt.exe39⤵
- Executes dropped EXE
PID:2144 -
\??\c:\dvdvv.exec:\dvdvv.exe40⤵
- Executes dropped EXE
PID:1344 -
\??\c:\lxrrxlf.exec:\lxrrxlf.exe41⤵
- Executes dropped EXE
PID:2184 -
\??\c:\bhnhbt.exec:\bhnhbt.exe42⤵
- Executes dropped EXE
PID:3564 -
\??\c:\frxllrr.exec:\frxllrr.exe43⤵
- Executes dropped EXE
PID:4436 -
\??\c:\bhthbn.exec:\bhthbn.exe44⤵
- Executes dropped EXE
PID:4428 -
\??\c:\pjddd.exec:\pjddd.exe45⤵
- Executes dropped EXE
PID:4424 -
\??\c:\hbnbnb.exec:\hbnbnb.exe46⤵
- Executes dropped EXE
PID:4912 -
\??\c:\nntttt.exec:\nntttt.exe47⤵
- Executes dropped EXE
PID:3760 -
\??\c:\jjvvp.exec:\jjvvp.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1108 -
\??\c:\lxllfxx.exec:\lxllfxx.exe49⤵
- Executes dropped EXE
PID:4180 -
\??\c:\hhhhnn.exec:\hhhhnn.exe50⤵
- Executes dropped EXE
PID:1464 -
\??\c:\btbtnn.exec:\btbtnn.exe51⤵
- Executes dropped EXE
PID:2136 -
\??\c:\ddvdd.exec:\ddvdd.exe52⤵
- Executes dropped EXE
PID:2112 -
\??\c:\5frrrrr.exec:\5frrrrr.exe53⤵
- Executes dropped EXE
PID:3176 -
\??\c:\btbbbb.exec:\btbbbb.exe54⤵
- Executes dropped EXE
PID:748 -
\??\c:\9hbbnh.exec:\9hbbnh.exe55⤵
- Executes dropped EXE
PID:3440 -
\??\c:\jjddd.exec:\jjddd.exe56⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ttnhhh.exec:\ttnhhh.exe57⤵
- Executes dropped EXE
PID:3476 -
\??\c:\pdvjd.exec:\pdvjd.exe58⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rxxxrrf.exec:\rxxxrrf.exe59⤵
- Executes dropped EXE
PID:2876 -
\??\c:\lffffll.exec:\lffffll.exe60⤵
- Executes dropped EXE
PID:4340 -
\??\c:\ddppp.exec:\ddppp.exe61⤵
- Executes dropped EXE
PID:3756 -
\??\c:\lrrlxxl.exec:\lrrlxxl.exe62⤵
- Executes dropped EXE
PID:3344 -
\??\c:\hhnnhb.exec:\hhnnhb.exe63⤵
- Executes dropped EXE
PID:1180 -
\??\c:\pdjjd.exec:\pdjjd.exe64⤵
- Executes dropped EXE
PID:2096 -
\??\c:\ppvvj.exec:\ppvvj.exe65⤵
- Executes dropped EXE
PID:4776 -
\??\c:\3lrlfff.exec:\3lrlfff.exe66⤵PID:4708
-
\??\c:\ntbtth.exec:\ntbtth.exe67⤵PID:1440
-
\??\c:\jdddv.exec:\jdddv.exe68⤵PID:4788
-
\??\c:\vdjjd.exec:\vdjjd.exe69⤵PID:5080
-
\??\c:\9rrrrrf.exec:\9rrrrrf.exe70⤵PID:2528
-
\??\c:\bttttb.exec:\bttttb.exe71⤵PID:2648
-
\??\c:\jjppv.exec:\jjppv.exe72⤵PID:3200
-
\??\c:\7lxrffl.exec:\7lxrffl.exe73⤵PID:932
-
\??\c:\hbtnnn.exec:\hbtnnn.exe74⤵PID:4504
-
\??\c:\btbbnn.exec:\btbbnn.exe75⤵PID:5064
-
\??\c:\ddpdv.exec:\ddpdv.exe76⤵PID:2460
-
\??\c:\ffrrxxr.exec:\ffrrxxr.exe77⤵PID:4036
-
\??\c:\btbbbh.exec:\btbbbh.exe78⤵PID:2880
-
\??\c:\lfrxlrr.exec:\lfrxlrr.exe79⤵PID:4928
-
\??\c:\rrfffll.exec:\rrfffll.exe80⤵PID:4916
-
\??\c:\ntbbhn.exec:\ntbbhn.exe81⤵PID:2496
-
\??\c:\pppdd.exec:\pppdd.exe82⤵PID:2608
-
\??\c:\llxflrf.exec:\llxflrf.exe83⤵PID:4532
-
\??\c:\lrrllll.exec:\lrrllll.exe84⤵PID:4136
-
\??\c:\ttbhhh.exec:\ttbhhh.exe85⤵PID:4028
-
\??\c:\djjjj.exec:\djjjj.exe86⤵PID:4460
-
\??\c:\frxrrll.exec:\frxrrll.exe87⤵PID:676
-
\??\c:\hbhbhh.exec:\hbhbhh.exe88⤵PID:2360
-
\??\c:\bnbbhh.exec:\bnbbhh.exe89⤵PID:4924
-
\??\c:\jvddd.exec:\jvddd.exe90⤵PID:3588
-
\??\c:\9pjjd.exec:\9pjjd.exe91⤵PID:3000
-
\??\c:\rlrrfrr.exec:\rlrrfrr.exe92⤵PID:4760
-
\??\c:\nbtbtb.exec:\nbtbtb.exe93⤵PID:3080
-
\??\c:\nnnhbb.exec:\nnnhbb.exe94⤵PID:4900
-
\??\c:\vjppj.exec:\vjppj.exe95⤵PID:3480
-
\??\c:\xfrrxfl.exec:\xfrrxfl.exe96⤵PID:5088
-
\??\c:\lrrxxxx.exec:\lrrxxxx.exe97⤵PID:3140
-
\??\c:\nhhhbb.exec:\nhhhbb.exe98⤵PID:3416
-
\??\c:\pvddv.exec:\pvddv.exe99⤵PID:5016
-
\??\c:\1xxxxxx.exec:\1xxxxxx.exe100⤵PID:2580
-
\??\c:\lfrrlrl.exec:\lfrrlrl.exe101⤵PID:2028
-
\??\c:\nnhhbb.exec:\nnhhbb.exe102⤵PID:3572
-
\??\c:\jpvdv.exec:\jpvdv.exe103⤵PID:744
-
\??\c:\rffxfff.exec:\rffxfff.exe104⤵PID:4656
-
\??\c:\rlxxxll.exec:\rlxxxll.exe105⤵PID:2324
-
\??\c:\hbhbbn.exec:\hbhbbn.exe106⤵PID:228
-
\??\c:\tttttt.exec:\tttttt.exe107⤵PID:912
-
\??\c:\pdjjp.exec:\pdjjp.exe108⤵PID:4832
-
\??\c:\1xllfll.exec:\1xllfll.exe109⤵PID:3464
-
\??\c:\btbbhh.exec:\btbbhh.exe110⤵PID:2824
-
\??\c:\dddvv.exec:\dddvv.exe111⤵PID:2884
-
\??\c:\dpjpd.exec:\dpjpd.exe112⤵PID:1348
-
\??\c:\llfxrxx.exec:\llfxrxx.exe113⤵PID:3292
-
\??\c:\bhttnb.exec:\bhttnb.exe114⤵PID:2240
-
\??\c:\dpdvd.exec:\dpdvd.exe115⤵PID:2980
-
\??\c:\dvjjj.exec:\dvjjj.exe116⤵PID:1180
-
\??\c:\lflffff.exec:\lflffff.exe117⤵PID:2096
-
\??\c:\hhhbhb.exec:\hhhbhb.exe118⤵PID:1072
-
\??\c:\dvjdd.exec:\dvjdd.exe119⤵PID:3500
-
\??\c:\llrllrl.exec:\llrllrl.exe120⤵PID:640
-
\??\c:\rxlfxxx.exec:\rxlfxxx.exe121⤵PID:4444
-
\??\c:\hhhntb.exec:\hhhntb.exe122⤵PID:368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-