Analysis
-
max time kernel
120s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 19:01
Static task
static1
Behavioral task
behavioral1
Sample
e0251dd1cee5b98043df04aa59eae520dad1554e443149d5c6e4c6d7ac02768c.exe
Resource
win7-20240903-en
General
-
Target
e0251dd1cee5b98043df04aa59eae520dad1554e443149d5c6e4c6d7ac02768c.exe
-
Size
81KB
-
MD5
d2f821cac4d7cb591b05b998eeb065d8
-
SHA1
c5f55765f4cb8a55895509b7eb30b78879a8e40c
-
SHA256
e0251dd1cee5b98043df04aa59eae520dad1554e443149d5c6e4c6d7ac02768c
-
SHA512
7b2217ed103eea8f69b45f7ef46887970b5209fde5306ff0b316bf00bf83ae6fef53362119c20b8fb7632cd0ff5f37f2d75a91f92703ee6e0cf2de7488584894
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qoHrnZHaY3DLELsn8:ymb3NkkiQ3mdBjFIj+qYjhaoLD8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/1264-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nttntt.exe0808822.exexrrfxxl.exe5ntttb.exe02824.exe8020044.exe0682660.exebbnbhn.exedjppp.exe3ffxlfx.exe288482.exe842228.exennbtnh.exe3vjjp.exebtthbt.exelffrrxr.exe5vvvv.exenthhbb.exethhtnn.exexfxxxxx.exefxlfrll.exenhhhhh.exe640844.exenhtbbb.exe84262.exehhtnhn.exentnhbb.exetnhnbb.exenbhbbn.exehbhbbb.exe02444.exe004466.exexffxrxx.exeo604006.exepjjdd.exefxrxrrr.exe6088248.exeffxrllf.exe206666.exetntnnn.exevdjdv.exe464888.exeu444440.exe8806666.exe020044.exe006040.exe06226.exe2064406.exe46226.exes6822.exebhhhhh.exei022608.exe440044.exe820428.exexfxrlrl.exe244666.exe0802426.exew06262.exe02020.exehbtnbb.exexrrllrr.exe86484.exew84866.exe888826.exepid process 4788 nttntt.exe 4768 0808822.exe 4464 xrrfxxl.exe 1104 5ntttb.exe 4016 02824.exe 5060 8020044.exe 4640 0682660.exe 3480 bbnbhn.exe 5100 djppp.exe 3036 3ffxlfx.exe 3628 288482.exe 5012 842228.exe 2024 nnbtnh.exe 2332 3vjjp.exe 2408 btthbt.exe 1184 lffrrxr.exe 1372 5vvvv.exe 864 nthhbb.exe 2476 thhtnn.exe 1520 xfxxxxx.exe 4780 fxlfrll.exe 4904 nhhhhh.exe 1468 640844.exe 368 nhtbbb.exe 1432 84262.exe 4672 hhtnhn.exe 4888 ntnhbb.exe 4020 tnhnbb.exe 3584 nbhbbn.exe 1064 hbhbbb.exe 4052 02444.exe 3488 004466.exe 2364 xffxrxx.exe 4916 o604006.exe 1852 pjjdd.exe 2880 fxrxrrr.exe 968 6088248.exe 1156 ffxrllf.exe 3792 206666.exe 1236 tntnnn.exe 4388 vdjdv.exe 3892 464888.exe 4168 u444440.exe 1352 8806666.exe 2892 020044.exe 3768 006040.exe 4744 06226.exe 4872 2064406.exe 1104 46226.exe 4560 s6822.exe 832 bhhhhh.exe 828 i022608.exe 3648 440044.exe 548 820428.exe 2696 xfxrlrl.exe 3252 244666.exe 3944 0802426.exe 3108 w06262.exe 3592 02020.exe 3628 hbtnbb.exe 3692 xrrllrr.exe 3184 86484.exe 3268 w84866.exe 2332 888826.exe -
Processes:
resource yara_rule behavioral2/memory/1264-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1264-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3584-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
q28600.exe4806266.exexfxrlrl.exe42868.exetnbtnn.exettttnn.exec868402.exe080404.exe06226.exe640844.exetnnnhh.exe2004864.exe48264.exe44484.exethhnht.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q28600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4806266.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42868.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c868402.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 080404.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06226.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 640844.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2004864.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48264.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44484.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e0251dd1cee5b98043df04aa59eae520dad1554e443149d5c6e4c6d7ac02768c.exenttntt.exe0808822.exexrrfxxl.exe5ntttb.exe02824.exe8020044.exe0682660.exebbnbhn.exedjppp.exe3ffxlfx.exe288482.exe842228.exennbtnh.exe3vjjp.exebtthbt.exelffrrxr.exe5vvvv.exenthhbb.exethhtnn.exexfxxxxx.exefxlfrll.exedescription pid process target process PID 1264 wrote to memory of 4788 1264 e0251dd1cee5b98043df04aa59eae520dad1554e443149d5c6e4c6d7ac02768c.exe nttntt.exe PID 1264 wrote to memory of 4788 1264 e0251dd1cee5b98043df04aa59eae520dad1554e443149d5c6e4c6d7ac02768c.exe nttntt.exe PID 1264 wrote to memory of 4788 1264 e0251dd1cee5b98043df04aa59eae520dad1554e443149d5c6e4c6d7ac02768c.exe nttntt.exe PID 4788 wrote to memory of 4768 4788 nttntt.exe 0808822.exe PID 4788 wrote to memory of 4768 4788 nttntt.exe 0808822.exe PID 4788 wrote to memory of 4768 4788 nttntt.exe 0808822.exe PID 4768 wrote to memory of 4464 4768 0808822.exe xrrfxxl.exe PID 4768 wrote to memory of 4464 4768 0808822.exe xrrfxxl.exe PID 4768 wrote to memory of 4464 4768 0808822.exe xrrfxxl.exe PID 4464 wrote to memory of 1104 4464 xrrfxxl.exe 5ntttb.exe PID 4464 wrote to memory of 1104 4464 xrrfxxl.exe 5ntttb.exe PID 4464 wrote to memory of 1104 4464 xrrfxxl.exe 5ntttb.exe PID 1104 wrote to memory of 4016 1104 5ntttb.exe 02824.exe PID 1104 wrote to memory of 4016 1104 5ntttb.exe 02824.exe PID 1104 wrote to memory of 4016 1104 5ntttb.exe 02824.exe PID 4016 wrote to memory of 5060 4016 02824.exe 8020044.exe PID 4016 wrote to memory of 5060 4016 02824.exe 8020044.exe PID 4016 wrote to memory of 5060 4016 02824.exe 8020044.exe PID 5060 wrote to memory of 4640 5060 8020044.exe 0682660.exe PID 5060 wrote to memory of 4640 5060 8020044.exe 0682660.exe PID 5060 wrote to memory of 4640 5060 8020044.exe 0682660.exe PID 4640 wrote to memory of 3480 4640 0682660.exe bbnbhn.exe PID 4640 wrote to memory of 3480 4640 0682660.exe bbnbhn.exe PID 4640 wrote to memory of 3480 4640 0682660.exe bbnbhn.exe PID 3480 wrote to memory of 5100 3480 bbnbhn.exe djppp.exe PID 3480 wrote to memory of 5100 3480 bbnbhn.exe djppp.exe PID 3480 wrote to memory of 5100 3480 bbnbhn.exe djppp.exe PID 5100 wrote to memory of 3036 5100 djppp.exe 3ffxlfx.exe PID 5100 wrote to memory of 3036 5100 djppp.exe 3ffxlfx.exe PID 5100 wrote to memory of 3036 5100 djppp.exe 3ffxlfx.exe PID 3036 wrote to memory of 3628 3036 3ffxlfx.exe 288482.exe PID 3036 wrote to memory of 3628 3036 3ffxlfx.exe 288482.exe PID 3036 wrote to memory of 3628 3036 3ffxlfx.exe 288482.exe PID 3628 wrote to memory of 5012 3628 288482.exe 842228.exe PID 3628 wrote to memory of 5012 3628 288482.exe 842228.exe PID 3628 wrote to memory of 5012 3628 288482.exe 842228.exe PID 5012 wrote to memory of 2024 5012 842228.exe nnbtnh.exe PID 5012 wrote to memory of 2024 5012 842228.exe nnbtnh.exe PID 5012 wrote to memory of 2024 5012 842228.exe nnbtnh.exe PID 2024 wrote to memory of 2332 2024 nnbtnh.exe 3vjjp.exe PID 2024 wrote to memory of 2332 2024 nnbtnh.exe 3vjjp.exe PID 2024 wrote to memory of 2332 2024 nnbtnh.exe 3vjjp.exe PID 2332 wrote to memory of 2408 2332 3vjjp.exe btthbt.exe PID 2332 wrote to memory of 2408 2332 3vjjp.exe btthbt.exe PID 2332 wrote to memory of 2408 2332 3vjjp.exe btthbt.exe PID 2408 wrote to memory of 1184 2408 btthbt.exe lffrrxr.exe PID 2408 wrote to memory of 1184 2408 btthbt.exe lffrrxr.exe PID 2408 wrote to memory of 1184 2408 btthbt.exe lffrrxr.exe PID 1184 wrote to memory of 1372 1184 lffrrxr.exe 5vvvv.exe PID 1184 wrote to memory of 1372 1184 lffrrxr.exe 5vvvv.exe PID 1184 wrote to memory of 1372 1184 lffrrxr.exe 5vvvv.exe PID 1372 wrote to memory of 864 1372 5vvvv.exe nthhbb.exe PID 1372 wrote to memory of 864 1372 5vvvv.exe nthhbb.exe PID 1372 wrote to memory of 864 1372 5vvvv.exe nthhbb.exe PID 864 wrote to memory of 2476 864 nthhbb.exe thhtnn.exe PID 864 wrote to memory of 2476 864 nthhbb.exe thhtnn.exe PID 864 wrote to memory of 2476 864 nthhbb.exe thhtnn.exe PID 2476 wrote to memory of 1520 2476 thhtnn.exe xfxxxxx.exe PID 2476 wrote to memory of 1520 2476 thhtnn.exe xfxxxxx.exe PID 2476 wrote to memory of 1520 2476 thhtnn.exe xfxxxxx.exe PID 1520 wrote to memory of 4780 1520 xfxxxxx.exe fxlfrll.exe PID 1520 wrote to memory of 4780 1520 xfxxxxx.exe fxlfrll.exe PID 1520 wrote to memory of 4780 1520 xfxxxxx.exe fxlfrll.exe PID 4780 wrote to memory of 4904 4780 fxlfrll.exe nhhhhh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0251dd1cee5b98043df04aa59eae520dad1554e443149d5c6e4c6d7ac02768c.exe"C:\Users\Admin\AppData\Local\Temp\e0251dd1cee5b98043df04aa59eae520dad1554e443149d5c6e4c6d7ac02768c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\nttntt.exec:\nttntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\0808822.exec:\0808822.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\xrrfxxl.exec:\xrrfxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\5ntttb.exec:\5ntttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\02824.exec:\02824.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\8020044.exec:\8020044.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\0682660.exec:\0682660.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\bbnbhn.exec:\bbnbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\djppp.exec:\djppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\3ffxlfx.exec:\3ffxlfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\288482.exec:\288482.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\842228.exec:\842228.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\nnbtnh.exec:\nnbtnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\3vjjp.exec:\3vjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\btthbt.exec:\btthbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\lffrrxr.exec:\lffrrxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\5vvvv.exec:\5vvvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\nthhbb.exec:\nthhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\thhtnn.exec:\thhtnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\xfxxxxx.exec:\xfxxxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\fxlfrll.exec:\fxlfrll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\nhhhhh.exec:\nhhhhh.exe23⤵
- Executes dropped EXE
PID:4904 -
\??\c:\640844.exec:\640844.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1468 -
\??\c:\nhtbbb.exec:\nhtbbb.exe25⤵
- Executes dropped EXE
PID:368 -
\??\c:\84262.exec:\84262.exe26⤵
- Executes dropped EXE
PID:1432 -
\??\c:\hhtnhn.exec:\hhtnhn.exe27⤵
- Executes dropped EXE
PID:4672 -
\??\c:\ntnhbb.exec:\ntnhbb.exe28⤵
- Executes dropped EXE
PID:4888 -
\??\c:\tnhnbb.exec:\tnhnbb.exe29⤵
- Executes dropped EXE
PID:4020 -
\??\c:\nbhbbn.exec:\nbhbbn.exe30⤵
- Executes dropped EXE
PID:3584 -
\??\c:\hbhbbb.exec:\hbhbbb.exe31⤵
- Executes dropped EXE
PID:1064 -
\??\c:\02444.exec:\02444.exe32⤵
- Executes dropped EXE
PID:4052 -
\??\c:\004466.exec:\004466.exe33⤵
- Executes dropped EXE
PID:3488 -
\??\c:\xffxrxx.exec:\xffxrxx.exe34⤵
- Executes dropped EXE
PID:2364 -
\??\c:\o604006.exec:\o604006.exe35⤵
- Executes dropped EXE
PID:4916 -
\??\c:\pjjdd.exec:\pjjdd.exe36⤵
- Executes dropped EXE
PID:1852 -
\??\c:\fxrxrrr.exec:\fxrxrrr.exe37⤵
- Executes dropped EXE
PID:2880 -
\??\c:\6088248.exec:\6088248.exe38⤵
- Executes dropped EXE
PID:968 -
\??\c:\ffxrllf.exec:\ffxrllf.exe39⤵
- Executes dropped EXE
PID:1156 -
\??\c:\206666.exec:\206666.exe40⤵
- Executes dropped EXE
PID:3792 -
\??\c:\tntnnn.exec:\tntnnn.exe41⤵
- Executes dropped EXE
PID:1236 -
\??\c:\vdjdv.exec:\vdjdv.exe42⤵
- Executes dropped EXE
PID:4388 -
\??\c:\464888.exec:\464888.exe43⤵
- Executes dropped EXE
PID:3892 -
\??\c:\u444440.exec:\u444440.exe44⤵
- Executes dropped EXE
PID:4168 -
\??\c:\8806666.exec:\8806666.exe45⤵
- Executes dropped EXE
PID:1352 -
\??\c:\020044.exec:\020044.exe46⤵
- Executes dropped EXE
PID:2892 -
\??\c:\006040.exec:\006040.exe47⤵
- Executes dropped EXE
PID:3768 -
\??\c:\06226.exec:\06226.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4744 -
\??\c:\2064406.exec:\2064406.exe49⤵
- Executes dropped EXE
PID:4872 -
\??\c:\46226.exec:\46226.exe50⤵
- Executes dropped EXE
PID:1104 -
\??\c:\s6822.exec:\s6822.exe51⤵
- Executes dropped EXE
PID:4560 -
\??\c:\bhhhhh.exec:\bhhhhh.exe52⤵
- Executes dropped EXE
PID:832 -
\??\c:\i022608.exec:\i022608.exe53⤵
- Executes dropped EXE
PID:828 -
\??\c:\440044.exec:\440044.exe54⤵
- Executes dropped EXE
PID:3648 -
\??\c:\820428.exec:\820428.exe55⤵
- Executes dropped EXE
PID:548 -
\??\c:\xfxrlrl.exec:\xfxrlrl.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2696 -
\??\c:\244666.exec:\244666.exe57⤵
- Executes dropped EXE
PID:3252 -
\??\c:\0802426.exec:\0802426.exe58⤵
- Executes dropped EXE
PID:3944 -
\??\c:\w06262.exec:\w06262.exe59⤵
- Executes dropped EXE
PID:3108 -
\??\c:\02020.exec:\02020.exe60⤵
- Executes dropped EXE
PID:3592 -
\??\c:\hbtnbb.exec:\hbtnbb.exe61⤵
- Executes dropped EXE
PID:3628 -
\??\c:\xrrllrr.exec:\xrrllrr.exe62⤵
- Executes dropped EXE
PID:3692 -
\??\c:\86484.exec:\86484.exe63⤵
- Executes dropped EXE
PID:3184 -
\??\c:\w84866.exec:\w84866.exe64⤵
- Executes dropped EXE
PID:3268 -
\??\c:\888826.exec:\888826.exe65⤵
- Executes dropped EXE
PID:2332 -
\??\c:\062648.exec:\062648.exe66⤵PID:4308
-
\??\c:\thbhnn.exec:\thbhnn.exe67⤵PID:4272
-
\??\c:\s2488.exec:\s2488.exe68⤵PID:2700
-
\??\c:\nnnnbb.exec:\nnnnbb.exe69⤵PID:4584
-
\??\c:\ppjdv.exec:\ppjdv.exe70⤵PID:2288
-
\??\c:\pjddp.exec:\pjddp.exe71⤵PID:3532
-
\??\c:\dvvvd.exec:\dvvvd.exe72⤵PID:1520
-
\??\c:\u622662.exec:\u622662.exe73⤵PID:2716
-
\??\c:\tnbtbb.exec:\tnbtbb.exe74⤵PID:4400
-
\??\c:\8060000.exec:\8060000.exe75⤵PID:3396
-
\??\c:\4026048.exec:\4026048.exe76⤵PID:1884
-
\??\c:\ddvvv.exec:\ddvvv.exe77⤵PID:5068
-
\??\c:\80044.exec:\80044.exe78⤵PID:720
-
\??\c:\202002.exec:\202002.exe79⤵PID:1196
-
\??\c:\rllxrrl.exec:\rllxrrl.exe80⤵PID:4964
-
\??\c:\8208080.exec:\8208080.exe81⤵PID:2348
-
\??\c:\e00422.exec:\e00422.exe82⤵PID:4080
-
\??\c:\k66082.exec:\k66082.exe83⤵PID:2828
-
\??\c:\5fxrfff.exec:\5fxrfff.exe84⤵PID:3940
-
\??\c:\42826.exec:\42826.exe85⤵PID:5040
-
\??\c:\lrxrllf.exec:\lrxrllf.exe86⤵PID:2460
-
\??\c:\2604826.exec:\2604826.exe87⤵PID:4404
-
\??\c:\484460.exec:\484460.exe88⤵PID:400
-
\??\c:\664866.exec:\664866.exe89⤵PID:4484
-
\??\c:\5vdpd.exec:\5vdpd.exe90⤵PID:2096
-
\??\c:\5frlxrr.exec:\5frlxrr.exe91⤵PID:5032
-
\??\c:\2460448.exec:\2460448.exe92⤵PID:4820
-
\??\c:\7vvpj.exec:\7vvpj.exe93⤵PID:1812
-
\??\c:\jppjv.exec:\jppjv.exe94⤵PID:2088
-
\??\c:\046044.exec:\046044.exe95⤵PID:4356
-
\??\c:\8844848.exec:\8844848.exe96⤵PID:4380
-
\??\c:\3pvpj.exec:\3pvpj.exe97⤵PID:3976
-
\??\c:\vdvjj.exec:\vdvjj.exe98⤵PID:1736
-
\??\c:\xlrrlxf.exec:\xlrrlxf.exe99⤵PID:2380
-
\??\c:\bthbbb.exec:\bthbbb.exe100⤵PID:3956
-
\??\c:\nnhbtn.exec:\nnhbtn.exe101⤵PID:4452
-
\??\c:\rrflxlr.exec:\rrflxlr.exe102⤵PID:2640
-
\??\c:\llrlxfx.exec:\llrlxfx.exe103⤵PID:4744
-
\??\c:\bhbnhb.exec:\bhbnhb.exe104⤵PID:4872
-
\??\c:\062204.exec:\062204.exe105⤵PID:3876
-
\??\c:\2642262.exec:\2642262.exe106⤵PID:4560
-
\??\c:\04682.exec:\04682.exe107⤵PID:924
-
\??\c:\ddddd.exec:\ddddd.exe108⤵PID:1116
-
\??\c:\086048.exec:\086048.exe109⤵PID:3424
-
\??\c:\w88200.exec:\w88200.exe110⤵PID:2012
-
\??\c:\rllrfxr.exec:\rllrfxr.exe111⤵PID:4696
-
\??\c:\68882.exec:\68882.exe112⤵PID:972
-
\??\c:\44400.exec:\44400.exe113⤵PID:1848
-
\??\c:\64086.exec:\64086.exe114⤵PID:3108
-
\??\c:\2642262.exec:\2642262.exe115⤵PID:3592
-
\??\c:\nhhbtt.exec:\nhhbtt.exe116⤵PID:3628
-
\??\c:\u406444.exec:\u406444.exe117⤵PID:3208
-
\??\c:\224620.exec:\224620.exe118⤵PID:2188
-
\??\c:\lrrxrrl.exec:\lrrxrrl.exe119⤵PID:3224
-
\??\c:\4204600.exec:\4204600.exe120⤵PID:2336
-
\??\c:\hhhhhh.exec:\hhhhhh.exe121⤵PID:4512
-
\??\c:\tnbtnn.exec:\tnbtnn.exe122⤵
- System Location Discovery: System Language Discovery
PID:3484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-