Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 08:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a0a4e84ad5bc28cf7d5eb146c15bca2733721a388a2ce3d6fa60b3f01ca5f602N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
a0a4e84ad5bc28cf7d5eb146c15bca2733721a388a2ce3d6fa60b3f01ca5f602N.exe
-
Size
53KB
-
MD5
d1598e9c1a4ee205709f43dbdb065360
-
SHA1
0f0ec83d7f60bfcc3bc203c0cc35d48fd6c90fc5
-
SHA256
a0a4e84ad5bc28cf7d5eb146c15bca2733721a388a2ce3d6fa60b3f01ca5f602
-
SHA512
248466e2c9f93495223e73d5164c60865b9b1e91543ca920a2c8833bcceb33ea161f75bb2eaf8f9612d6e785b1f5d3f3ad9cd4da42dc163073d99d7832ccd2a3
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlG:0cdpeeBSHHMHLf9RyI7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4016-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1164-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2600-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2128-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2512-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1844-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-334-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2508-338-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-351-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-367-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3784-377-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-390-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-394-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-404-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-418-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-439-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/828-443-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3792-456-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-460-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-464-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-471-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2020-475-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-509-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-627-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-646-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-668-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-735-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-776-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2500-852-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-1012-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2856 vpppv.exe 3376 frfxllx.exe 2752 fxllfff.exe 3080 ppvdv.exe 1164 vdppv.exe 2600 btnbnn.exe 4680 vpjdp.exe 4964 pvppv.exe 2128 rfxxxxx.exe 1820 hnhbbb.exe 2316 ppvpv.exe 3604 llrlfrl.exe 3412 hbhhtt.exe 3852 hnhtnh.exe 2200 jvvjv.exe 672 xxxrllf.exe 2928 tbbnhn.exe 4424 9jdvp.exe 2828 jdvjv.exe 1476 rfrlxxr.exe 4140 nnbbtt.exe 3268 ddvvj.exe 3236 djdpv.exe 1920 ffrlxrl.exe 1632 tttbtb.exe 1772 5pvdd.exe 4176 rlxxrrr.exe 4696 rflrlrr.exe 4196 flrrffx.exe 3684 hnhnhh.exe 3016 jjvjd.exe 1532 1rlllxx.exe 2512 frflxfx.exe 2376 hnttbh.exe 4756 ppvpv.exe 3248 7ffflrr.exe 4416 tbtttb.exe 3280 ppddd.exe 2180 xllllfr.exe 1840 pjvpv.exe 392 pjvdd.exe 2524 3btttb.exe 4648 bhbbbh.exe 4460 7vddj.exe 828 3llrrrx.exe 3220 hhnbbb.exe 4036 vjvdd.exe 4156 ddjpv.exe 3228 9djjj.exe 4668 rlrllrl.exe 4028 bhtbbh.exe 2728 djvdv.exe 2100 3dppv.exe 3992 rxlflxf.exe 2072 xrrffll.exe 1816 flffffr.exe 4596 pvvjd.exe 2636 djppp.exe 1468 xrrlfll.exe 4400 lrffxff.exe 2316 ttbhhn.exe 1404 9dppj.exe 2852 ddjjj.exe 32 rxffxll.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4016 wrote to memory of 2856 4016 a0a4e84ad5bc28cf7d5eb146c15bca2733721a388a2ce3d6fa60b3f01ca5f602N.exe 82 PID 4016 wrote to memory of 2856 4016 a0a4e84ad5bc28cf7d5eb146c15bca2733721a388a2ce3d6fa60b3f01ca5f602N.exe 82 PID 4016 wrote to memory of 2856 4016 a0a4e84ad5bc28cf7d5eb146c15bca2733721a388a2ce3d6fa60b3f01ca5f602N.exe 82 PID 2856 wrote to memory of 3376 2856 vpppv.exe 83 PID 2856 wrote to memory of 3376 2856 vpppv.exe 83 PID 2856 wrote to memory of 3376 2856 vpppv.exe 83 PID 3376 wrote to memory of 2752 3376 frfxllx.exe 84 PID 3376 wrote to memory of 2752 3376 frfxllx.exe 84 PID 3376 wrote to memory of 2752 3376 frfxllx.exe 84 PID 2752 wrote to memory of 3080 2752 fxllfff.exe 85 PID 2752 wrote to memory of 3080 2752 fxllfff.exe 85 PID 2752 wrote to memory of 3080 2752 fxllfff.exe 85 PID 3080 wrote to memory of 1164 3080 ppvdv.exe 86 PID 3080 wrote to memory of 1164 3080 ppvdv.exe 86 PID 3080 wrote to memory of 1164 3080 ppvdv.exe 86 PID 1164 wrote to memory of 2600 1164 vdppv.exe 87 PID 1164 wrote to memory of 2600 1164 vdppv.exe 87 PID 1164 wrote to memory of 2600 1164 vdppv.exe 87 PID 2600 wrote to memory of 4680 2600 btnbnn.exe 88 PID 2600 wrote to memory of 4680 2600 btnbnn.exe 88 PID 2600 wrote to memory of 4680 2600 btnbnn.exe 88 PID 4680 wrote to memory of 4964 4680 vpjdp.exe 89 PID 4680 wrote to memory of 4964 4680 vpjdp.exe 89 PID 4680 wrote to memory of 4964 4680 vpjdp.exe 89 PID 4964 wrote to memory of 2128 4964 pvppv.exe 90 PID 4964 wrote to memory of 2128 4964 pvppv.exe 90 PID 4964 wrote to memory of 2128 4964 pvppv.exe 90 PID 2128 wrote to memory of 1820 2128 rfxxxxx.exe 91 PID 2128 wrote to memory of 1820 2128 rfxxxxx.exe 91 PID 2128 wrote to memory of 1820 2128 rfxxxxx.exe 91 PID 1820 wrote to memory of 2316 1820 hnhbbb.exe 92 PID 1820 wrote to memory of 2316 1820 hnhbbb.exe 92 PID 1820 wrote to memory of 2316 1820 hnhbbb.exe 92 PID 2316 wrote to memory of 3604 2316 ppvpv.exe 93 PID 2316 wrote to memory of 3604 2316 ppvpv.exe 93 PID 2316 wrote to memory of 3604 2316 ppvpv.exe 93 PID 3604 wrote to memory of 3412 3604 llrlfrl.exe 94 PID 3604 wrote to memory of 3412 3604 llrlfrl.exe 94 PID 3604 wrote to memory of 3412 3604 llrlfrl.exe 94 PID 3412 wrote to memory of 3852 3412 hbhhtt.exe 95 PID 3412 wrote to memory of 3852 3412 hbhhtt.exe 95 PID 3412 wrote to memory of 3852 3412 hbhhtt.exe 95 PID 3852 wrote to memory of 2200 3852 hnhtnh.exe 96 PID 3852 wrote to memory of 2200 3852 hnhtnh.exe 96 PID 3852 wrote to memory of 2200 3852 hnhtnh.exe 96 PID 2200 wrote to memory of 672 2200 jvvjv.exe 97 PID 2200 wrote to memory of 672 2200 jvvjv.exe 97 PID 2200 wrote to memory of 672 2200 jvvjv.exe 97 PID 672 wrote to memory of 2928 672 xxxrllf.exe 98 PID 672 wrote to memory of 2928 672 xxxrllf.exe 98 PID 672 wrote to memory of 2928 672 xxxrllf.exe 98 PID 2928 wrote to memory of 4424 2928 tbbnhn.exe 99 PID 2928 wrote to memory of 4424 2928 tbbnhn.exe 99 PID 2928 wrote to memory of 4424 2928 tbbnhn.exe 99 PID 4424 wrote to memory of 2828 4424 9jdvp.exe 100 PID 4424 wrote to memory of 2828 4424 9jdvp.exe 100 PID 4424 wrote to memory of 2828 4424 9jdvp.exe 100 PID 2828 wrote to memory of 1476 2828 jdvjv.exe 101 PID 2828 wrote to memory of 1476 2828 jdvjv.exe 101 PID 2828 wrote to memory of 1476 2828 jdvjv.exe 101 PID 1476 wrote to memory of 4140 1476 rfrlxxr.exe 102 PID 1476 wrote to memory of 4140 1476 rfrlxxr.exe 102 PID 1476 wrote to memory of 4140 1476 rfrlxxr.exe 102 PID 4140 wrote to memory of 3268 4140 nnbbtt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0a4e84ad5bc28cf7d5eb146c15bca2733721a388a2ce3d6fa60b3f01ca5f602N.exe"C:\Users\Admin\AppData\Local\Temp\a0a4e84ad5bc28cf7d5eb146c15bca2733721a388a2ce3d6fa60b3f01ca5f602N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\vpppv.exec:\vpppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\frfxllx.exec:\frfxllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\fxllfff.exec:\fxllfff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\ppvdv.exec:\ppvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\vdppv.exec:\vdppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\btnbnn.exec:\btnbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\vpjdp.exec:\vpjdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\pvppv.exec:\pvppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\rfxxxxx.exec:\rfxxxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\hnhbbb.exec:\hnhbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\ppvpv.exec:\ppvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\llrlfrl.exec:\llrlfrl.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\hbhhtt.exec:\hbhhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\hnhtnh.exec:\hnhtnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\jvvjv.exec:\jvvjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\xxxrllf.exec:\xxxrllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\tbbnhn.exec:\tbbnhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\9jdvp.exec:\9jdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\jdvjv.exec:\jdvjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\rfrlxxr.exec:\rfrlxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\nnbbtt.exec:\nnbbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\ddvvj.exec:\ddvvj.exe23⤵
- Executes dropped EXE
PID:3268 -
\??\c:\djdpv.exec:\djdpv.exe24⤵
- Executes dropped EXE
PID:3236 -
\??\c:\ffrlxrl.exec:\ffrlxrl.exe25⤵
- Executes dropped EXE
PID:1920 -
\??\c:\tttbtb.exec:\tttbtb.exe26⤵
- Executes dropped EXE
PID:1632 -
\??\c:\5pvdd.exec:\5pvdd.exe27⤵
- Executes dropped EXE
PID:1772 -
\??\c:\rlxxrrr.exec:\rlxxrrr.exe28⤵
- Executes dropped EXE
PID:4176 -
\??\c:\rflrlrr.exec:\rflrlrr.exe29⤵
- Executes dropped EXE
PID:4696 -
\??\c:\flrrffx.exec:\flrrffx.exe30⤵
- Executes dropped EXE
PID:4196 -
\??\c:\hnhnhh.exec:\hnhnhh.exe31⤵
- Executes dropped EXE
PID:3684 -
\??\c:\jjvjd.exec:\jjvjd.exe32⤵
- Executes dropped EXE
PID:3016 -
\??\c:\1rlllxx.exec:\1rlllxx.exe33⤵
- Executes dropped EXE
PID:1532 -
\??\c:\frflxfx.exec:\frflxfx.exe34⤵
- Executes dropped EXE
PID:2512 -
\??\c:\hnttbh.exec:\hnttbh.exe35⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ppvpv.exec:\ppvpv.exe36⤵
- Executes dropped EXE
PID:4756 -
\??\c:\7ffflrr.exec:\7ffflrr.exe37⤵
- Executes dropped EXE
PID:3248 -
\??\c:\tbtttb.exec:\tbtttb.exe38⤵
- Executes dropped EXE
PID:4416 -
\??\c:\ppddd.exec:\ppddd.exe39⤵
- Executes dropped EXE
PID:3280 -
\??\c:\xllllfr.exec:\xllllfr.exe40⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pjvpv.exec:\pjvpv.exe41⤵
- Executes dropped EXE
PID:1840 -
\??\c:\pjvdd.exec:\pjvdd.exe42⤵
- Executes dropped EXE
PID:392 -
\??\c:\3btttb.exec:\3btttb.exe43⤵
- Executes dropped EXE
PID:2524 -
\??\c:\bhbbbh.exec:\bhbbbh.exe44⤵
- Executes dropped EXE
PID:4648 -
\??\c:\7vddj.exec:\7vddj.exe45⤵
- Executes dropped EXE
PID:4460 -
\??\c:\3llrrrx.exec:\3llrrrx.exe46⤵
- Executes dropped EXE
PID:828 -
\??\c:\hhnbbb.exec:\hhnbbb.exe47⤵
- Executes dropped EXE
PID:3220 -
\??\c:\vjvdd.exec:\vjvdd.exe48⤵
- Executes dropped EXE
PID:4036 -
\??\c:\ddjpv.exec:\ddjpv.exe49⤵
- Executes dropped EXE
PID:4156 -
\??\c:\9djjj.exec:\9djjj.exe50⤵
- Executes dropped EXE
PID:3228 -
\??\c:\rlrllrl.exec:\rlrllrl.exe51⤵
- Executes dropped EXE
PID:4668 -
\??\c:\bhtbbh.exec:\bhtbbh.exe52⤵
- Executes dropped EXE
PID:4028 -
\??\c:\djvdv.exec:\djvdv.exe53⤵
- Executes dropped EXE
PID:2728 -
\??\c:\3dppv.exec:\3dppv.exe54⤵
- Executes dropped EXE
PID:2100 -
\??\c:\rxlflxf.exec:\rxlflxf.exe55⤵
- Executes dropped EXE
PID:3992 -
\??\c:\xrrffll.exec:\xrrffll.exe56⤵
- Executes dropped EXE
PID:2072 -
\??\c:\flffffr.exec:\flffffr.exe57⤵
- Executes dropped EXE
PID:1816 -
\??\c:\pvvjd.exec:\pvvjd.exe58⤵
- Executes dropped EXE
PID:4596 -
\??\c:\djppp.exec:\djppp.exe59⤵
- Executes dropped EXE
PID:2636 -
\??\c:\xrrlfll.exec:\xrrlfll.exe60⤵
- Executes dropped EXE
PID:1468 -
\??\c:\lrffxff.exec:\lrffxff.exe61⤵
- Executes dropped EXE
PID:4400 -
\??\c:\ttbhhn.exec:\ttbhhn.exe62⤵
- Executes dropped EXE
PID:2316 -
\??\c:\9dppj.exec:\9dppj.exe63⤵
- Executes dropped EXE
PID:1404 -
\??\c:\ddjjj.exec:\ddjjj.exe64⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rxffxll.exec:\rxffxll.exe65⤵
- Executes dropped EXE
PID:32 -
\??\c:\7ntbnt.exec:\7ntbnt.exe66⤵PID:2144
-
\??\c:\tttnbt.exec:\tttnbt.exe67⤵PID:3668
-
\??\c:\ppjdv.exec:\ppjdv.exe68⤵PID:4516
-
\??\c:\rrfxxxf.exec:\rrfxxxf.exe69⤵PID:3060
-
\??\c:\tttnhh.exec:\tttnhh.exe70⤵PID:2780
-
\??\c:\hbhhtt.exec:\hbhhtt.exe71⤵PID:1844
-
\??\c:\vvvpd.exec:\vvvpd.exe72⤵PID:1132
-
\??\c:\vdjvp.exec:\vdjvp.exe73⤵PID:3704
-
\??\c:\xrlxlrl.exec:\xrlxlrl.exe74⤵PID:2828
-
\??\c:\rxfffll.exec:\rxfffll.exe75⤵PID:224
-
\??\c:\nnbhtt.exec:\nnbhtt.exe76⤵PID:1916
-
\??\c:\ppvdd.exec:\ppvdd.exe77⤵PID:3728
-
\??\c:\vdjpv.exec:\vdjpv.exe78⤵PID:2508
-
\??\c:\rxxfffr.exec:\rxxfffr.exe79⤵PID:2956
-
\??\c:\tbtttb.exec:\tbtttb.exe80⤵PID:3236
-
\??\c:\bhnhhh.exec:\bhnhhh.exe81⤵PID:2648
-
\??\c:\pddjv.exec:\pddjv.exe82⤵PID:1316
-
\??\c:\ppddd.exec:\ppddd.exe83⤵PID:4944
-
\??\c:\ffffrfx.exec:\ffffrfx.exe84⤵PID:2904
-
\??\c:\ttntnt.exec:\ttntnt.exe85⤵PID:3064
-
\??\c:\3hnhhh.exec:\3hnhhh.exe86⤵PID:4340
-
\??\c:\pvdjj.exec:\pvdjj.exe87⤵PID:4072
-
\??\c:\7xrrrrr.exec:\7xrrrrr.exe88⤵PID:1304
-
\??\c:\hhbhbn.exec:\hhbhbn.exe89⤵PID:4696
-
\??\c:\ntbbbh.exec:\ntbbbh.exe90⤵PID:3784
-
\??\c:\vdvdd.exec:\vdvdd.exe91⤵PID:448
-
\??\c:\djpvv.exec:\djpvv.exe92⤵PID:4492
-
\??\c:\rxlllxf.exec:\rxlllxf.exe93⤵PID:3168
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe94⤵PID:3368
-
\??\c:\hbhhhn.exec:\hbhhhn.exe95⤵PID:3680
-
\??\c:\ddpjj.exec:\ddpjj.exe96⤵PID:2356
-
\??\c:\xxxxrxx.exec:\xxxxrxx.exe97⤵PID:3912
-
\??\c:\fxlllrr.exec:\fxlllrr.exe98⤵PID:4756
-
\??\c:\bbnttb.exec:\bbnttb.exe99⤵PID:3204
-
\??\c:\dvddv.exec:\dvddv.exe100⤵PID:3312
-
\??\c:\pjpvp.exec:\pjpvp.exe101⤵PID:4840
-
\??\c:\lfrxxfl.exec:\lfrxxfl.exe102⤵PID:2036
-
\??\c:\3rxffll.exec:\3rxffll.exe103⤵PID:2180
-
\??\c:\hhthhh.exec:\hhthhh.exe104⤵PID:3476
-
\??\c:\pdjjj.exec:\pdjjj.exe105⤵PID:392
-
\??\c:\vvjjd.exec:\vvjjd.exe106⤵PID:2524
-
\??\c:\rxxrrxf.exec:\rxxrrxf.exe107⤵PID:3780
-
\??\c:\flxllxx.exec:\flxllxx.exe108⤵PID:4016
-
\??\c:\3ttbbh.exec:\3ttbbh.exe109⤵PID:4460
-
\??\c:\bbnbbh.exec:\bbnbbh.exe110⤵PID:828
-
\??\c:\ddppd.exec:\ddppd.exe111⤵PID:3376
-
\??\c:\jvvvp.exec:\jvvvp.exe112⤵PID:1176
-
\??\c:\hbttnt.exec:\hbttnt.exe113⤵PID:824
-
\??\c:\1jppp.exec:\1jppp.exe114⤵PID:3792
-
\??\c:\dpddv.exec:\dpddv.exe115⤵PID:3080
-
\??\c:\rrlrrrx.exec:\rrlrrrx.exe116⤵PID:4536
-
\??\c:\hhhnhb.exec:\hhhnhb.exe117⤵PID:2728
-
\??\c:\djvdj.exec:\djvdj.exe118⤵PID:2644
-
\??\c:\5pppj.exec:\5pppj.exe119⤵PID:2020
-
\??\c:\dppjj.exec:\dppjj.exe120⤵PID:1564
-
\??\c:\lllfxrr.exec:\lllfxrr.exe121⤵PID:1640
-
\??\c:\htbhbn.exec:\htbhbn.exe122⤵PID:4436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-