Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 20:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5e587d3a9efd1e0291dc24258e1016bd7453c197b9c1d03443d48138507c5672.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
5e587d3a9efd1e0291dc24258e1016bd7453c197b9c1d03443d48138507c5672.exe
-
Size
453KB
-
MD5
f95e69e5fc628ec55c522b2128e8bafc
-
SHA1
af783c9c79fe3f85fd6e6433dbe562104cc0995f
-
SHA256
5e587d3a9efd1e0291dc24258e1016bd7453c197b9c1d03443d48138507c5672
-
SHA512
e69f440a4e123733a7b202c682a79867ae07fb772f9538999481c7147d0c1e84256f288dd88feecf60347a014d6ee9516c33079028bcbff73fcb2a7fa9e56816
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2824-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/480-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-60-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2888-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-147-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2768-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/664-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-175-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1472-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/796-346-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1740-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-362-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2800-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-536-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/328-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-683-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2288-737-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-777-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2672 ddppv.exe 2124 xxxrxrf.exe 2664 hhtnhb.exe 2540 nnhnbb.exe 3016 dvpvj.exe 480 tnbttb.exe 588 pjvpv.exe 2888 dpddd.exe 2388 hbbnbh.exe 1704 rlxfrfr.exe 2316 hhbhbn.exe 1876 3xfxffl.exe 1872 5thnbb.exe 2768 fxxlflx.exe 2028 ntthnt.exe 2164 1rflrxl.exe 2288 djvdv.exe 664 nnhnnb.exe 1720 ppjvp.exe 916 bntbhb.exe 1660 7dvvj.exe 2404 9bnhtt.exe 1284 9vpvv.exe 1472 hhbntn.exe 1956 nnbhnb.exe 1092 tnbhnt.exe 1460 5jddj.exe 2744 nhbbhh.exe 2332 jdvdv.exe 2324 btnnbb.exe 2308 5ppdd.exe 1632 9bnntb.exe 2848 vdvpv.exe 2652 flxflrf.exe 2628 hbtbnt.exe 1396 jjpvj.exe 2692 1lflrrx.exe 796 9bhbnt.exe 1740 vpvvv.exe 2440 ffxxffr.exe 1408 1fxlxfl.exe 2884 djvvv.exe 2396 ppjvp.exe 2372 frlxxrx.exe 2436 nhbhtb.exe 2588 pvpvd.exe 1564 1rfrlxf.exe 2716 fffrflr.exe 1996 3tnthn.exe 2704 vjdjp.exe 2800 lrlrfrl.exe 2376 hnhthn.exe 2024 pvpjv.exe 2280 fxrxxxf.exe 2624 xrfrxfx.exe 856 3btbnt.exe 764 djdpj.exe 236 fllrflf.exe 3052 ttttbh.exe 2248 ntnbtt.exe 1944 9vpjj.exe 952 rlxrllr.exe 744 9nbbhh.exe 1656 jdddp.exe -
resource yara_rule behavioral1/memory/2672-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/480-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-147-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2768-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-536-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/328-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-737-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-777-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-780-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2672 2824 5e587d3a9efd1e0291dc24258e1016bd7453c197b9c1d03443d48138507c5672.exe 30 PID 2824 wrote to memory of 2672 2824 5e587d3a9efd1e0291dc24258e1016bd7453c197b9c1d03443d48138507c5672.exe 30 PID 2824 wrote to memory of 2672 2824 5e587d3a9efd1e0291dc24258e1016bd7453c197b9c1d03443d48138507c5672.exe 30 PID 2824 wrote to memory of 2672 2824 5e587d3a9efd1e0291dc24258e1016bd7453c197b9c1d03443d48138507c5672.exe 30 PID 2672 wrote to memory of 2124 2672 ddppv.exe 31 PID 2672 wrote to memory of 2124 2672 ddppv.exe 31 PID 2672 wrote to memory of 2124 2672 ddppv.exe 31 PID 2672 wrote to memory of 2124 2672 ddppv.exe 31 PID 2124 wrote to memory of 2664 2124 xxxrxrf.exe 32 PID 2124 wrote to memory of 2664 2124 xxxrxrf.exe 32 PID 2124 wrote to memory of 2664 2124 xxxrxrf.exe 32 PID 2124 wrote to memory of 2664 2124 xxxrxrf.exe 32 PID 2664 wrote to memory of 2540 2664 hhtnhb.exe 33 PID 2664 wrote to memory of 2540 2664 hhtnhb.exe 33 PID 2664 wrote to memory of 2540 2664 hhtnhb.exe 33 PID 2664 wrote to memory of 2540 2664 hhtnhb.exe 33 PID 2540 wrote to memory of 3016 2540 nnhnbb.exe 34 PID 2540 wrote to memory of 3016 2540 nnhnbb.exe 34 PID 2540 wrote to memory of 3016 2540 nnhnbb.exe 34 PID 2540 wrote to memory of 3016 2540 nnhnbb.exe 34 PID 3016 wrote to memory of 480 3016 dvpvj.exe 35 PID 3016 wrote to memory of 480 3016 dvpvj.exe 35 PID 3016 wrote to memory of 480 3016 dvpvj.exe 35 PID 3016 wrote to memory of 480 3016 dvpvj.exe 35 PID 480 wrote to memory of 588 480 tnbttb.exe 36 PID 480 wrote to memory of 588 480 tnbttb.exe 36 PID 480 wrote to memory of 588 480 tnbttb.exe 36 PID 480 wrote to memory of 588 480 tnbttb.exe 36 PID 588 wrote to memory of 2888 588 pjvpv.exe 37 PID 588 wrote to memory of 2888 588 pjvpv.exe 37 PID 588 wrote to memory of 2888 588 pjvpv.exe 37 PID 588 wrote to memory of 2888 588 pjvpv.exe 37 PID 2888 wrote to memory of 2388 2888 dpddd.exe 38 PID 2888 wrote to memory of 2388 2888 dpddd.exe 38 PID 2888 wrote to memory of 2388 2888 dpddd.exe 38 PID 2888 wrote to memory of 2388 2888 dpddd.exe 38 PID 2388 wrote to memory of 1704 2388 hbbnbh.exe 39 PID 2388 wrote to memory of 1704 2388 hbbnbh.exe 39 PID 2388 wrote to memory of 1704 2388 hbbnbh.exe 39 PID 2388 wrote to memory of 1704 2388 hbbnbh.exe 39 PID 1704 wrote to memory of 2316 1704 rlxfrfr.exe 40 PID 1704 wrote to memory of 2316 1704 rlxfrfr.exe 40 PID 1704 wrote to memory of 2316 1704 rlxfrfr.exe 40 PID 1704 wrote to memory of 2316 1704 rlxfrfr.exe 40 PID 2316 wrote to memory of 1876 2316 hhbhbn.exe 41 PID 2316 wrote to memory of 1876 2316 hhbhbn.exe 41 PID 2316 wrote to memory of 1876 2316 hhbhbn.exe 41 PID 2316 wrote to memory of 1876 2316 hhbhbn.exe 41 PID 1876 wrote to memory of 1872 1876 3xfxffl.exe 42 PID 1876 wrote to memory of 1872 1876 3xfxffl.exe 42 PID 1876 wrote to memory of 1872 1876 3xfxffl.exe 42 PID 1876 wrote to memory of 1872 1876 3xfxffl.exe 42 PID 1872 wrote to memory of 2768 1872 5thnbb.exe 43 PID 1872 wrote to memory of 2768 1872 5thnbb.exe 43 PID 1872 wrote to memory of 2768 1872 5thnbb.exe 43 PID 1872 wrote to memory of 2768 1872 5thnbb.exe 43 PID 2768 wrote to memory of 2028 2768 fxxlflx.exe 44 PID 2768 wrote to memory of 2028 2768 fxxlflx.exe 44 PID 2768 wrote to memory of 2028 2768 fxxlflx.exe 44 PID 2768 wrote to memory of 2028 2768 fxxlflx.exe 44 PID 2028 wrote to memory of 2164 2028 ntthnt.exe 45 PID 2028 wrote to memory of 2164 2028 ntthnt.exe 45 PID 2028 wrote to memory of 2164 2028 ntthnt.exe 45 PID 2028 wrote to memory of 2164 2028 ntthnt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e587d3a9efd1e0291dc24258e1016bd7453c197b9c1d03443d48138507c5672.exe"C:\Users\Admin\AppData\Local\Temp\5e587d3a9efd1e0291dc24258e1016bd7453c197b9c1d03443d48138507c5672.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\ddppv.exec:\ddppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\xxxrxrf.exec:\xxxrxrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\hhtnhb.exec:\hhtnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\nnhnbb.exec:\nnhnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\dvpvj.exec:\dvpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\tnbttb.exec:\tnbttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
\??\c:\pjvpv.exec:\pjvpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\dpddd.exec:\dpddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\hbbnbh.exec:\hbbnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\rlxfrfr.exec:\rlxfrfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\hhbhbn.exec:\hhbhbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\3xfxffl.exec:\3xfxffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\5thnbb.exec:\5thnbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\fxxlflx.exec:\fxxlflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\ntthnt.exec:\ntthnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\1rflrxl.exec:\1rflrxl.exe17⤵
- Executes dropped EXE
PID:2164 -
\??\c:\djvdv.exec:\djvdv.exe18⤵
- Executes dropped EXE
PID:2288 -
\??\c:\nnhnnb.exec:\nnhnnb.exe19⤵
- Executes dropped EXE
PID:664 -
\??\c:\ppjvp.exec:\ppjvp.exe20⤵
- Executes dropped EXE
PID:1720 -
\??\c:\bntbhb.exec:\bntbhb.exe21⤵
- Executes dropped EXE
PID:916 -
\??\c:\7dvvj.exec:\7dvvj.exe22⤵
- Executes dropped EXE
PID:1660 -
\??\c:\9bnhtt.exec:\9bnhtt.exe23⤵
- Executes dropped EXE
PID:2404 -
\??\c:\9vpvv.exec:\9vpvv.exe24⤵
- Executes dropped EXE
PID:1284 -
\??\c:\hhbntn.exec:\hhbntn.exe25⤵
- Executes dropped EXE
PID:1472 -
\??\c:\nnbhnb.exec:\nnbhnb.exe26⤵
- Executes dropped EXE
PID:1956 -
\??\c:\tnbhnt.exec:\tnbhnt.exe27⤵
- Executes dropped EXE
PID:1092 -
\??\c:\5jddj.exec:\5jddj.exe28⤵
- Executes dropped EXE
PID:1460 -
\??\c:\nhbbhh.exec:\nhbbhh.exe29⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jdvdv.exec:\jdvdv.exe30⤵
- Executes dropped EXE
PID:2332 -
\??\c:\btnnbb.exec:\btnnbb.exe31⤵
- Executes dropped EXE
PID:2324 -
\??\c:\5ppdd.exec:\5ppdd.exe32⤵
- Executes dropped EXE
PID:2308 -
\??\c:\9bnntb.exec:\9bnntb.exe33⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vdvpv.exec:\vdvpv.exe34⤵
- Executes dropped EXE
PID:2848 -
\??\c:\flxflrf.exec:\flxflrf.exe35⤵
- Executes dropped EXE
PID:2652 -
\??\c:\hbtbnt.exec:\hbtbnt.exe36⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jjpvj.exec:\jjpvj.exe37⤵
- Executes dropped EXE
PID:1396 -
\??\c:\1lflrrx.exec:\1lflrrx.exe38⤵
- Executes dropped EXE
PID:2692 -
\??\c:\9bhbnt.exec:\9bhbnt.exe39⤵
- Executes dropped EXE
PID:796 -
\??\c:\vpvvv.exec:\vpvvv.exe40⤵
- Executes dropped EXE
PID:1740 -
\??\c:\ffxxffr.exec:\ffxxffr.exe41⤵
- Executes dropped EXE
PID:2440 -
\??\c:\1fxlxfl.exec:\1fxlxfl.exe42⤵
- Executes dropped EXE
PID:1408 -
\??\c:\djvvv.exec:\djvvv.exe43⤵
- Executes dropped EXE
PID:2884 -
\??\c:\ppjvp.exec:\ppjvp.exe44⤵
- Executes dropped EXE
PID:2396 -
\??\c:\frlxxrx.exec:\frlxxrx.exe45⤵
- Executes dropped EXE
PID:2372 -
\??\c:\nhbhtb.exec:\nhbhtb.exe46⤵
- Executes dropped EXE
PID:2436 -
\??\c:\pvpvd.exec:\pvpvd.exe47⤵
- Executes dropped EXE
PID:2588 -
\??\c:\1rfrlxf.exec:\1rfrlxf.exe48⤵
- Executes dropped EXE
PID:1564 -
\??\c:\fffrflr.exec:\fffrflr.exe49⤵
- Executes dropped EXE
PID:2716 -
\??\c:\3tnthn.exec:\3tnthn.exe50⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vjdjp.exec:\vjdjp.exe51⤵
- Executes dropped EXE
PID:2704 -
\??\c:\lrlrfrl.exec:\lrlrfrl.exe52⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hnhthn.exec:\hnhthn.exe53⤵
- Executes dropped EXE
PID:2376 -
\??\c:\pvpjv.exec:\pvpjv.exe54⤵
- Executes dropped EXE
PID:2024 -
\??\c:\fxrxxxf.exec:\fxrxxxf.exe55⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xrfrxfx.exec:\xrfrxfx.exe56⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3btbnt.exec:\3btbnt.exe57⤵
- Executes dropped EXE
PID:856 -
\??\c:\djdpj.exec:\djdpj.exe58⤵
- Executes dropped EXE
PID:764 -
\??\c:\fllrflf.exec:\fllrflf.exe59⤵
- Executes dropped EXE
PID:236 -
\??\c:\ttttbh.exec:\ttttbh.exe60⤵
- Executes dropped EXE
PID:3052 -
\??\c:\ntnbtt.exec:\ntnbtt.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2248 -
\??\c:\9vpjj.exec:\9vpjj.exe62⤵
- Executes dropped EXE
PID:1944 -
\??\c:\rlxrllr.exec:\rlxrllr.exe63⤵
- Executes dropped EXE
PID:952 -
\??\c:\9nbbhh.exec:\9nbbhh.exe64⤵
- Executes dropped EXE
PID:744 -
\??\c:\jdddp.exec:\jdddp.exe65⤵
- Executes dropped EXE
PID:1656 -
\??\c:\rrllxxx.exec:\rrllxxx.exe66⤵PID:1648
-
\??\c:\hhnthn.exec:\hhnthn.exe67⤵PID:1652
-
\??\c:\ttbbnt.exec:\ttbbnt.exe68⤵PID:2384
-
\??\c:\jppvj.exec:\jppvj.exe69⤵PID:328
-
\??\c:\5xxxllx.exec:\5xxxllx.exe70⤵PID:1912
-
\??\c:\1hbbhn.exec:\1hbbhn.exe71⤵PID:600
-
\??\c:\ppdpv.exec:\ppdpv.exe72⤵PID:1920
-
\??\c:\ffxflrf.exec:\ffxflrf.exe73⤵PID:2912
-
\??\c:\bhhthh.exec:\bhhthh.exe74⤵PID:996
-
\??\c:\jddjd.exec:\jddjd.exe75⤵PID:1528
-
\??\c:\vvpvj.exec:\vvpvj.exe76⤵PID:2824
-
\??\c:\fxxxlll.exec:\fxxxlll.exe77⤵PID:2844
-
\??\c:\hhbtht.exec:\hhbtht.exe78⤵PID:1260
-
\??\c:\dddjj.exec:\dddjj.exe79⤵PID:2808
-
\??\c:\rrlxflf.exec:\rrlxflf.exe80⤵PID:2584
-
\??\c:\7hbbnt.exec:\7hbbnt.exe81⤵PID:2984
-
\??\c:\9ddjd.exec:\9ddjd.exe82⤵PID:3000
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe83⤵PID:1984
-
\??\c:\xrrfxff.exec:\xrrfxff.exe84⤵PID:1012
-
\??\c:\vddjv.exec:\vddjv.exe85⤵PID:2616
-
\??\c:\vjdjp.exec:\vjdjp.exe86⤵PID:2568
-
\??\c:\fxxxfxl.exec:\fxxxfxl.exe87⤵PID:2180
-
\??\c:\hbnthh.exec:\hbnthh.exe88⤵PID:644
-
\??\c:\djdjv.exec:\djdjv.exe89⤵PID:1828
-
\??\c:\djdjp.exec:\djdjp.exe90⤵PID:1232
-
\??\c:\flfxrxr.exec:\flfxrxr.exe91⤵PID:2316
-
\??\c:\bbtbnh.exec:\bbtbnh.exe92⤵PID:2012
-
\??\c:\jdppv.exec:\jdppv.exe93⤵PID:2596
-
\??\c:\rlffrrl.exec:\rlffrrl.exe94⤵PID:2760
-
\??\c:\btthtn.exec:\btthtn.exe95⤵PID:1612
-
\??\c:\ttthtb.exec:\ttthtb.exe96⤵PID:1948
-
\??\c:\pjvdj.exec:\pjvdj.exe97⤵PID:1352
-
\??\c:\nhbhnt.exec:\nhbhnt.exe98⤵PID:2224
-
\??\c:\fxrrxrf.exec:\fxrrxrf.exe99⤵PID:2288
-
\??\c:\llrflrl.exec:\llrflrl.exe100⤵PID:1100
-
\??\c:\hnhnbn.exec:\hnhnbn.exe101⤵PID:836
-
\??\c:\7pdjj.exec:\7pdjj.exe102⤵PID:236
-
\??\c:\lxxlrxl.exec:\lxxlrxl.exe103⤵PID:2448
-
\??\c:\nhbhbb.exec:\nhbhbb.exe104⤵PID:2248
-
\??\c:\nnhnnt.exec:\nnhnnt.exe105⤵PID:1076
-
\??\c:\dvpdp.exec:\dvpdp.exe106⤵PID:1776
-
\??\c:\7xrrfxl.exec:\7xrrfxl.exe107⤵PID:2612
-
\??\c:\tnnbhh.exec:\tnnbhh.exe108⤵PID:884
-
\??\c:\jjdjp.exec:\jjdjp.exe109⤵PID:2972
-
\??\c:\dvvvv.exec:\dvvvv.exe110⤵PID:1584
-
\??\c:\flxfxxf.exec:\flxfxxf.exe111⤵PID:3008
-
\??\c:\nbnnth.exec:\nbnnth.exe112⤵PID:988
-
\??\c:\pjddd.exec:\pjddd.exe113⤵PID:2236
-
\??\c:\7rfrlxr.exec:\7rfrlxr.exe114⤵PID:2956
-
\??\c:\5lfrxfl.exec:\5lfrxfl.exe115⤵PID:2104
-
\??\c:\tnhnbh.exec:\tnhnbh.exe116⤵PID:2196
-
\??\c:\7dvjd.exec:\7dvjd.exe117⤵PID:2660
-
\??\c:\xfflxxr.exec:\xfflxxr.exe118⤵PID:2644
-
\??\c:\9tbtnn.exec:\9tbtnn.exe119⤵PID:2672
-
\??\c:\9ttbbb.exec:\9ttbbb.exe120⤵PID:1640
-
\??\c:\1vjdj.exec:\1vjdj.exe121⤵PID:2560
-
\??\c:\ffxflrx.exec:\ffxflrx.exe122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-