Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 02:49
Static task
static1
Behavioral task
behavioral1
Sample
ea5eccc738a14b9b6e5739a4a49733abff57d7808bd3e201fb33e10e8b67fe80.exe
Resource
win7-20240903-en
General
-
Target
ea5eccc738a14b9b6e5739a4a49733abff57d7808bd3e201fb33e10e8b67fe80.exe
-
Size
366KB
-
MD5
552ba3f73a76dbb3e3e76196175c8388
-
SHA1
89c8d2d3e507dde876231f6cbf0b7b24b47e05a2
-
SHA256
ea5eccc738a14b9b6e5739a4a49733abff57d7808bd3e201fb33e10e8b67fe80
-
SHA512
723b9592b78fc8c67f683a61e72c3e396cad6329651a93a701ea6368a7608576c377be763e58a13d0889b14bafdb76e8c8174c00ed79259f271201836832bef3
-
SSDEEP
6144:n3C9BRo7tvnJ99T/KZEL3RUXownfWQkyCpxwJz9e0pQowLh3EhToK9cT085mnFhz:n3C9ytvnVXFUXoSWlnwJv90aKToFqwfV
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/2992-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2800-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3832-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1840-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2760 fxfxxxl.exe 3464 ththnn.exe 640 1pvjd.exe 2580 vpvpj.exe 2800 jvjdj.exe 1064 tnntht.exe 4692 pdddd.exe 4908 btnhhb.exe 2776 5dvvj.exe 3832 jvddv.exe 4052 ppvvp.exe 4828 tbhhhh.exe 4560 9pppj.exe 1840 rlxrllf.exe 3720 3ntbtb.exe 4472 dvdvp.exe 3656 9jvpj.exe 4892 5ntnhn.exe 1280 5pvjp.exe 5028 1thbnn.exe 8 jdppp.exe 1540 fflfxxr.exe 4640 bthhbb.exe 808 7xxrlfx.exe 1612 fflfffx.exe 2828 nbnnnn.exe 1460 dpjjj.exe 4580 xxrlflf.exe 4248 nhnhhh.exe 2916 pjjdd.exe 3100 flrfxll.exe 3808 1xfrrxx.exe 736 vdddp.exe 316 jvvvp.exe 4652 rfllffr.exe 1512 pjvpv.exe 1864 bbtnht.exe 928 vjjjv.exe 2492 fxrlffx.exe 3928 lrxrrrl.exe 2836 nhhntn.exe 1596 7bbtnt.exe 4060 dvvpd.exe 4792 rlrrrrx.exe 3424 bnhbtn.exe 1336 5ntnbb.exe 4504 1vdvj.exe 2820 ffllllr.exe 4460 hthnhh.exe 3360 nhnnbn.exe 4916 9ddvv.exe 4508 xrffffl.exe 1900 djdvp.exe 1184 rflfrrl.exe 2544 1nhhnn.exe 2580 jddvp.exe 464 jdpjd.exe 2800 rrfxxlf.exe 3064 7rrlflf.exe 384 tbhbtt.exe 1160 jjvpp.exe 2964 3xrlfxx.exe 4908 xflfllr.exe 404 nhhbtt.exe -
resource yara_rule behavioral2/memory/2992-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2800-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2800-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3832-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-192-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rfxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2992 wrote to memory of 2760 2992 ea5eccc738a14b9b6e5739a4a49733abff57d7808bd3e201fb33e10e8b67fe80.exe 82 PID 2992 wrote to memory of 2760 2992 ea5eccc738a14b9b6e5739a4a49733abff57d7808bd3e201fb33e10e8b67fe80.exe 82 PID 2992 wrote to memory of 2760 2992 ea5eccc738a14b9b6e5739a4a49733abff57d7808bd3e201fb33e10e8b67fe80.exe 82 PID 2760 wrote to memory of 3464 2760 fxfxxxl.exe 83 PID 2760 wrote to memory of 3464 2760 fxfxxxl.exe 83 PID 2760 wrote to memory of 3464 2760 fxfxxxl.exe 83 PID 3464 wrote to memory of 640 3464 ththnn.exe 84 PID 3464 wrote to memory of 640 3464 ththnn.exe 84 PID 3464 wrote to memory of 640 3464 ththnn.exe 84 PID 640 wrote to memory of 2580 640 1pvjd.exe 85 PID 640 wrote to memory of 2580 640 1pvjd.exe 85 PID 640 wrote to memory of 2580 640 1pvjd.exe 85 PID 2580 wrote to memory of 2800 2580 vpvpj.exe 86 PID 2580 wrote to memory of 2800 2580 vpvpj.exe 86 PID 2580 wrote to memory of 2800 2580 vpvpj.exe 86 PID 2800 wrote to memory of 1064 2800 jvjdj.exe 87 PID 2800 wrote to memory of 1064 2800 jvjdj.exe 87 PID 2800 wrote to memory of 1064 2800 jvjdj.exe 87 PID 1064 wrote to memory of 4692 1064 tnntht.exe 88 PID 1064 wrote to memory of 4692 1064 tnntht.exe 88 PID 1064 wrote to memory of 4692 1064 tnntht.exe 88 PID 4692 wrote to memory of 4908 4692 pdddd.exe 89 PID 4692 wrote to memory of 4908 4692 pdddd.exe 89 PID 4692 wrote to memory of 4908 4692 pdddd.exe 89 PID 4908 wrote to memory of 2776 4908 btnhhb.exe 90 PID 4908 wrote to memory of 2776 4908 btnhhb.exe 90 PID 4908 wrote to memory of 2776 4908 btnhhb.exe 90 PID 2776 wrote to memory of 3832 2776 5dvvj.exe 91 PID 2776 wrote to memory of 3832 2776 5dvvj.exe 91 PID 2776 wrote to memory of 3832 2776 5dvvj.exe 91 PID 3832 wrote to memory of 4052 3832 jvddv.exe 92 PID 3832 wrote to memory of 4052 3832 jvddv.exe 92 PID 3832 wrote to memory of 4052 3832 jvddv.exe 92 PID 4052 wrote to memory of 4828 4052 ppvvp.exe 93 PID 4052 wrote to memory of 4828 4052 ppvvp.exe 93 PID 4052 wrote to memory of 4828 4052 ppvvp.exe 93 PID 4828 wrote to memory of 4560 4828 tbhhhh.exe 94 PID 4828 wrote to memory of 4560 4828 tbhhhh.exe 94 PID 4828 wrote to memory of 4560 4828 tbhhhh.exe 94 PID 4560 wrote to memory of 1840 4560 9pppj.exe 95 PID 4560 wrote to memory of 1840 4560 9pppj.exe 95 PID 4560 wrote to memory of 1840 4560 9pppj.exe 95 PID 1840 wrote to memory of 3720 1840 rlxrllf.exe 96 PID 1840 wrote to memory of 3720 1840 rlxrllf.exe 96 PID 1840 wrote to memory of 3720 1840 rlxrllf.exe 96 PID 3720 wrote to memory of 4472 3720 3ntbtb.exe 97 PID 3720 wrote to memory of 4472 3720 3ntbtb.exe 97 PID 3720 wrote to memory of 4472 3720 3ntbtb.exe 97 PID 4472 wrote to memory of 3656 4472 dvdvp.exe 98 PID 4472 wrote to memory of 3656 4472 dvdvp.exe 98 PID 4472 wrote to memory of 3656 4472 dvdvp.exe 98 PID 3656 wrote to memory of 4892 3656 9jvpj.exe 99 PID 3656 wrote to memory of 4892 3656 9jvpj.exe 99 PID 3656 wrote to memory of 4892 3656 9jvpj.exe 99 PID 4892 wrote to memory of 1280 4892 5ntnhn.exe 100 PID 4892 wrote to memory of 1280 4892 5ntnhn.exe 100 PID 4892 wrote to memory of 1280 4892 5ntnhn.exe 100 PID 1280 wrote to memory of 5028 1280 5pvjp.exe 101 PID 1280 wrote to memory of 5028 1280 5pvjp.exe 101 PID 1280 wrote to memory of 5028 1280 5pvjp.exe 101 PID 5028 wrote to memory of 8 5028 1thbnn.exe 102 PID 5028 wrote to memory of 8 5028 1thbnn.exe 102 PID 5028 wrote to memory of 8 5028 1thbnn.exe 102 PID 8 wrote to memory of 1540 8 jdppp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea5eccc738a14b9b6e5739a4a49733abff57d7808bd3e201fb33e10e8b67fe80.exe"C:\Users\Admin\AppData\Local\Temp\ea5eccc738a14b9b6e5739a4a49733abff57d7808bd3e201fb33e10e8b67fe80.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\fxfxxxl.exec:\fxfxxxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\ththnn.exec:\ththnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\1pvjd.exec:\1pvjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\vpvpj.exec:\vpvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\jvjdj.exec:\jvjdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\tnntht.exec:\tnntht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\pdddd.exec:\pdddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\btnhhb.exec:\btnhhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\5dvvj.exec:\5dvvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\jvddv.exec:\jvddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\ppvvp.exec:\ppvvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\tbhhhh.exec:\tbhhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\9pppj.exec:\9pppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\rlxrllf.exec:\rlxrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\3ntbtb.exec:\3ntbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\dvdvp.exec:\dvdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\9jvpj.exec:\9jvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\5ntnhn.exec:\5ntnhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\5pvjp.exec:\5pvjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\1thbnn.exec:\1thbnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\jdppp.exec:\jdppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\fflfxxr.exec:\fflfxxr.exe23⤵
- Executes dropped EXE
PID:1540 -
\??\c:\bthhbb.exec:\bthhbb.exe24⤵
- Executes dropped EXE
PID:4640 -
\??\c:\7xxrlfx.exec:\7xxrlfx.exe25⤵
- Executes dropped EXE
PID:808 -
\??\c:\fflfffx.exec:\fflfffx.exe26⤵
- Executes dropped EXE
PID:1612 -
\??\c:\nbnnnn.exec:\nbnnnn.exe27⤵
- Executes dropped EXE
PID:2828 -
\??\c:\dpjjj.exec:\dpjjj.exe28⤵
- Executes dropped EXE
PID:1460 -
\??\c:\xxrlflf.exec:\xxrlflf.exe29⤵
- Executes dropped EXE
PID:4580 -
\??\c:\nhnhhh.exec:\nhnhhh.exe30⤵
- Executes dropped EXE
PID:4248 -
\??\c:\pjjdd.exec:\pjjdd.exe31⤵
- Executes dropped EXE
PID:2916 -
\??\c:\flrfxll.exec:\flrfxll.exe32⤵
- Executes dropped EXE
PID:3100 -
\??\c:\1xfrrxx.exec:\1xfrrxx.exe33⤵
- Executes dropped EXE
PID:3808 -
\??\c:\vdddp.exec:\vdddp.exe34⤵
- Executes dropped EXE
PID:736 -
\??\c:\jvvvp.exec:\jvvvp.exe35⤵
- Executes dropped EXE
PID:316 -
\??\c:\rfllffr.exec:\rfllffr.exe36⤵
- Executes dropped EXE
PID:4652 -
\??\c:\pjvpv.exec:\pjvpv.exe37⤵
- Executes dropped EXE
PID:1512 -
\??\c:\bbtnht.exec:\bbtnht.exe38⤵
- Executes dropped EXE
PID:1864 -
\??\c:\vjjjv.exec:\vjjjv.exe39⤵
- Executes dropped EXE
PID:928 -
\??\c:\fxrlffx.exec:\fxrlffx.exe40⤵
- Executes dropped EXE
PID:2492 -
\??\c:\lrxrrrl.exec:\lrxrrrl.exe41⤵
- Executes dropped EXE
PID:3928 -
\??\c:\nhhntn.exec:\nhhntn.exe42⤵
- Executes dropped EXE
PID:2836 -
\??\c:\7bbtnt.exec:\7bbtnt.exe43⤵
- Executes dropped EXE
PID:1596 -
\??\c:\dvvpd.exec:\dvvpd.exe44⤵
- Executes dropped EXE
PID:4060 -
\??\c:\rlrrrrx.exec:\rlrrrrx.exe45⤵
- Executes dropped EXE
PID:4792 -
\??\c:\bnhbtn.exec:\bnhbtn.exe46⤵
- Executes dropped EXE
PID:3424 -
\??\c:\5ntnbb.exec:\5ntnbb.exe47⤵
- Executes dropped EXE
PID:1336 -
\??\c:\1vdvj.exec:\1vdvj.exe48⤵
- Executes dropped EXE
PID:4504 -
\??\c:\ffllllr.exec:\ffllllr.exe49⤵
- Executes dropped EXE
PID:2820 -
\??\c:\hthnhh.exec:\hthnhh.exe50⤵
- Executes dropped EXE
PID:4460 -
\??\c:\nhnnbn.exec:\nhnnbn.exe51⤵
- Executes dropped EXE
PID:3360 -
\??\c:\9ddvv.exec:\9ddvv.exe52⤵
- Executes dropped EXE
PID:4916 -
\??\c:\xrffffl.exec:\xrffffl.exe53⤵
- Executes dropped EXE
PID:4508 -
\??\c:\djdvp.exec:\djdvp.exe54⤵
- Executes dropped EXE
PID:1900 -
\??\c:\rflfrrl.exec:\rflfrrl.exe55⤵
- Executes dropped EXE
PID:1184 -
\??\c:\1nhhnn.exec:\1nhhnn.exe56⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jddvp.exec:\jddvp.exe57⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jdpjd.exec:\jdpjd.exe58⤵
- Executes dropped EXE
PID:464 -
\??\c:\rrfxxlf.exec:\rrfxxlf.exe59⤵
- Executes dropped EXE
PID:2800 -
\??\c:\7rrlflf.exec:\7rrlflf.exe60⤵
- Executes dropped EXE
PID:3064 -
\??\c:\tbhbtt.exec:\tbhbtt.exe61⤵
- Executes dropped EXE
PID:384 -
\??\c:\jjvpp.exec:\jjvpp.exe62⤵
- Executes dropped EXE
PID:1160 -
\??\c:\3xrlfxx.exec:\3xrlfxx.exe63⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xflfllr.exec:\xflfllr.exe64⤵
- Executes dropped EXE
PID:4908 -
\??\c:\nhhbtt.exec:\nhhbtt.exe65⤵
- Executes dropped EXE
PID:404 -
\??\c:\3jvpv.exec:\3jvpv.exe66⤵PID:396
-
\??\c:\5ddvj.exec:\5ddvj.exe67⤵PID:960
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe68⤵PID:1708
-
\??\c:\9nhhhh.exec:\9nhhhh.exe69⤵PID:1772
-
\??\c:\vvpjv.exec:\vvpjv.exe70⤵PID:1320
-
\??\c:\rflfxxr.exec:\rflfxxr.exe71⤵PID:116
-
\??\c:\tbhbtt.exec:\tbhbtt.exe72⤵PID:3636
-
\??\c:\1bbtnn.exec:\1bbtnn.exe73⤵PID:4896
-
\??\c:\ppjdp.exec:\ppjdp.exe74⤵PID:2608
-
\??\c:\lfllrrx.exec:\lfllrrx.exe75⤵PID:796
-
\??\c:\xflfffx.exec:\xflfffx.exe76⤵PID:4656
-
\??\c:\bhttnn.exec:\bhttnn.exe77⤵PID:3092
-
\??\c:\pdjdp.exec:\pdjdp.exe78⤵PID:5036
-
\??\c:\vpvpd.exec:\vpvpd.exe79⤵PID:2032
-
\??\c:\fxrrlfr.exec:\fxrrlfr.exe80⤵PID:5028
-
\??\c:\ntbbtt.exec:\ntbbtt.exe81⤵PID:2244
-
\??\c:\nbnnbn.exec:\nbnnbn.exe82⤵PID:1504
-
\??\c:\jjjdv.exec:\jjjdv.exe83⤵PID:4164
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe84⤵PID:5064
-
\??\c:\3tbtnb.exec:\3tbtnb.exe85⤵PID:4668
-
\??\c:\nthhtt.exec:\nthhtt.exe86⤵PID:4972
-
\??\c:\pjvpp.exec:\pjvpp.exe87⤵PID:1408
-
\??\c:\1rxllff.exec:\1rxllff.exe88⤵PID:4784
-
\??\c:\nhhhtb.exec:\nhhhtb.exe89⤵PID:1800
-
\??\c:\7nhbnn.exec:\7nhbnn.exe90⤵PID:3292
-
\??\c:\vpvpj.exec:\vpvpj.exe91⤵PID:3640
-
\??\c:\rflfrrr.exec:\rflfrrr.exe92⤵PID:1456
-
\??\c:\btbtth.exec:\btbtth.exe93⤵PID:3032
-
\??\c:\vpjvj.exec:\vpjvj.exe94⤵PID:2980
-
\??\c:\3xxxlxl.exec:\3xxxlxl.exe95⤵PID:2512
-
\??\c:\9llxlfr.exec:\9llxlfr.exe96⤵PID:3888
-
\??\c:\5hthtn.exec:\5hthtn.exe97⤵PID:1324
-
\??\c:\5jjdd.exec:\5jjdd.exe98⤵PID:316
-
\??\c:\rrxrfxl.exec:\rrxrfxl.exe99⤵PID:4652
-
\??\c:\frlxrxf.exec:\frlxrxf.exe100⤵PID:4468
-
\??\c:\9hhnbt.exec:\9hhnbt.exe101⤵PID:4252
-
\??\c:\5pjdv.exec:\5pjdv.exe102⤵PID:928
-
\??\c:\9ffrfxl.exec:\9ffrfxl.exe103⤵PID:4712
-
\??\c:\rxffflf.exec:\rxffflf.exe104⤵PID:2748
-
\??\c:\nhbhbh.exec:\nhbhbh.exe105⤵PID:2156
-
\??\c:\djjdv.exec:\djjdv.exe106⤵PID:1032
-
\??\c:\3rlrrlf.exec:\3rlrrlf.exe107⤵PID:3080
-
\??\c:\5rrlxxr.exec:\5rrlxxr.exe108⤵PID:4444
-
\??\c:\3hbhtn.exec:\3hbhtn.exe109⤵PID:3528
-
\??\c:\vpjdv.exec:\vpjdv.exe110⤵PID:1768
-
\??\c:\vvdvj.exec:\vvdvj.exe111⤵PID:4364
-
\??\c:\9lrlrlr.exec:\9lrlrlr.exe112⤵PID:5080
-
\??\c:\nbbtnh.exec:\nbbtnh.exe113⤵PID:1988
-
\??\c:\pdjdp.exec:\pdjdp.exe114⤵PID:3360
-
\??\c:\dvpdp.exec:\dvpdp.exe115⤵PID:1216
-
\??\c:\9rfxxxr.exec:\9rfxxxr.exe116⤵
- System Location Discovery: System Language Discovery
PID:4716 -
\??\c:\thnhtn.exec:\thnhtn.exe117⤵PID:1900
-
\??\c:\3vdpv.exec:\3vdpv.exe118⤵PID:1648
-
\??\c:\9vpdp.exec:\9vpdp.exe119⤵PID:724
-
\??\c:\3rxrlfl.exec:\3rxrlfl.exe120⤵PID:1592
-
\??\c:\hnbbtt.exec:\hnbbtt.exe121⤵PID:4092
-
\??\c:\1vdpd.exec:\1vdpd.exe122⤵PID:4868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-