Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 00:16
Static task
static1
Behavioral task
behavioral1
Sample
a3b3c3d7a03773bbfd1e95803b2b7773114f59ef943e984303b2fcabcbe288e1.exe
Resource
win7-20240903-en
General
-
Target
a3b3c3d7a03773bbfd1e95803b2b7773114f59ef943e984303b2fcabcbe288e1.exe
-
Size
107KB
-
MD5
2ac1116405c57fc335d23409febeb856
-
SHA1
1c542ff1dc9b1818279da414930364a692381bb1
-
SHA256
a3b3c3d7a03773bbfd1e95803b2b7773114f59ef943e984303b2fcabcbe288e1
-
SHA512
a212131585377b177a92400a2f50cbd436c4a6104618b9cc6bd6bcb61fb2929cadd17318cf21c0c87f26ad49f1b63f855fce91f34ceecd3e3ed0024280394cc8
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LAIb+t7uybUvDoC5B:n3C9BRo/AI2ujc2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral2/memory/3188-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/264-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2512-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3344-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lffxrxr.exehtntbb.exevppdj.exe7dvpd.exelfrlfrl.exejvdvp.exelfxrrlx.exe3jvjd.exe1dvpp.exe5fxrlxx.exetnhhnh.exedvpvj.exellrlxrl.exevjpdv.exelrflrrf.exefrrfxrl.exettbthh.exejjjdp.exerlfxlfr.exe5hbttn.exehttnbb.exepvdvd.exerrrlrlf.exentbtnn.exepjvpv.exerrlxrlx.exe5hhnth.exevdddp.exerllfxrl.exenttnhb.exenttnbn.exejjvvd.exe1flxlfl.exelllfxrl.exenbtthh.exevjdvp.exepdpdv.exe1rrxlrr.exelxrlfxr.exe3tbthb.exevdpjd.exedddjp.exe5dvpd.exe3llfrlf.exexlrrfff.exehtttht.exevvddd.exepdvdd.exexrlxllx.exebtttbh.exenbbttt.exedvpvv.exellrlfxx.exellxrxrx.exerrxrrlf.exentnhbt.exedjjjv.exepdpjv.exe1xffxxx.exebtbnnb.exenntthn.exevdddp.exelfrrflf.exefxfffrr.exepid process 3060 lffxrxr.exe 696 htntbb.exe 264 vppdj.exe 3748 7dvpd.exe 2072 lfrlfrl.exe 2348 jvdvp.exe 4528 lfxrrlx.exe 3700 3jvjd.exe 3660 1dvpp.exe 4672 5fxrlxx.exe 3544 tnhhnh.exe 1104 dvpvj.exe 2832 llrlxrl.exe 4268 vjpdv.exe 4924 lrflrrf.exe 4056 frrfxrl.exe 1960 ttbthh.exe 3720 jjjdp.exe 544 rlfxlfr.exe 5092 5hbttn.exe 4960 httnbb.exe 2344 pvdvd.exe 740 rrrlrlf.exe 4996 ntbtnn.exe 2512 pjvpv.exe 4576 rrlxrlx.exe 2436 5hhnth.exe 3968 vdddp.exe 4164 rllfxrl.exe 3344 nttnhb.exe 3596 nttnbn.exe 3268 jjvvd.exe 3960 1flxlfl.exe 2592 lllfxrl.exe 3984 nbtthh.exe 3456 vjdvp.exe 4892 pdpdv.exe 792 1rrxlrr.exe 4392 lxrlfxr.exe 4476 3tbthb.exe 2164 vdpjd.exe 4368 dddjp.exe 3432 5dvpd.exe 2816 3llfrlf.exe 3060 xlrrfff.exe 3552 htttht.exe 3548 vvddd.exe 4484 pdvdd.exe 3940 xrlxllx.exe 4552 btttbh.exe 1280 nbbttt.exe 2348 dvpvv.exe 1076 llrlfxx.exe 3948 llxrxrx.exe 3328 rrxrrlf.exe 2940 ntnhbt.exe 732 djjjv.exe 2180 pdpjv.exe 2528 1xffxxx.exe 3044 btbnnb.exe 1484 nntthn.exe 3944 vdddp.exe 924 lfrrflf.exe 2416 fxfffrr.exe -
Processes:
resource yara_rule behavioral2/memory/3188-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/264-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2512-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3344-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1hnhhh.exe9lxxxfx.exeddvvd.exefxrrrxr.exedvvpj.exedjvvp.exejdvpv.exexfffrrf.exe7lrllll.exe7frlffx.exebbbbtb.exelfrrffr.exexrrllll.exe9djvp.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a3b3c3d7a03773bbfd1e95803b2b7773114f59ef943e984303b2fcabcbe288e1.exelffxrxr.exehtntbb.exevppdj.exe7dvpd.exelfrlfrl.exejvdvp.exelfxrrlx.exe3jvjd.exe1dvpp.exe5fxrlxx.exetnhhnh.exedvpvj.exellrlxrl.exevjpdv.exelrflrrf.exefrrfxrl.exettbthh.exejjjdp.exerlfxlfr.exe5hbttn.exehttnbb.exedescription pid process target process PID 3188 wrote to memory of 3060 3188 a3b3c3d7a03773bbfd1e95803b2b7773114f59ef943e984303b2fcabcbe288e1.exe lffxrxr.exe PID 3188 wrote to memory of 3060 3188 a3b3c3d7a03773bbfd1e95803b2b7773114f59ef943e984303b2fcabcbe288e1.exe lffxrxr.exe PID 3188 wrote to memory of 3060 3188 a3b3c3d7a03773bbfd1e95803b2b7773114f59ef943e984303b2fcabcbe288e1.exe lffxrxr.exe PID 3060 wrote to memory of 696 3060 lffxrxr.exe htntbb.exe PID 3060 wrote to memory of 696 3060 lffxrxr.exe htntbb.exe PID 3060 wrote to memory of 696 3060 lffxrxr.exe htntbb.exe PID 696 wrote to memory of 264 696 htntbb.exe vppdj.exe PID 696 wrote to memory of 264 696 htntbb.exe vppdj.exe PID 696 wrote to memory of 264 696 htntbb.exe vppdj.exe PID 264 wrote to memory of 3748 264 vppdj.exe 7dvpd.exe PID 264 wrote to memory of 3748 264 vppdj.exe 7dvpd.exe PID 264 wrote to memory of 3748 264 vppdj.exe 7dvpd.exe PID 3748 wrote to memory of 2072 3748 7dvpd.exe lfrlfrl.exe PID 3748 wrote to memory of 2072 3748 7dvpd.exe lfrlfrl.exe PID 3748 wrote to memory of 2072 3748 7dvpd.exe lfrlfrl.exe PID 2072 wrote to memory of 2348 2072 lfrlfrl.exe jvdvp.exe PID 2072 wrote to memory of 2348 2072 lfrlfrl.exe jvdvp.exe PID 2072 wrote to memory of 2348 2072 lfrlfrl.exe jvdvp.exe PID 2348 wrote to memory of 4528 2348 jvdvp.exe lfxrrlx.exe PID 2348 wrote to memory of 4528 2348 jvdvp.exe lfxrrlx.exe PID 2348 wrote to memory of 4528 2348 jvdvp.exe lfxrrlx.exe PID 4528 wrote to memory of 3700 4528 lfxrrlx.exe 3jvjd.exe PID 4528 wrote to memory of 3700 4528 lfxrrlx.exe 3jvjd.exe PID 4528 wrote to memory of 3700 4528 lfxrrlx.exe 3jvjd.exe PID 3700 wrote to memory of 3660 3700 3jvjd.exe 1dvpp.exe PID 3700 wrote to memory of 3660 3700 3jvjd.exe 1dvpp.exe PID 3700 wrote to memory of 3660 3700 3jvjd.exe 1dvpp.exe PID 3660 wrote to memory of 4672 3660 1dvpp.exe 5fxrlxx.exe PID 3660 wrote to memory of 4672 3660 1dvpp.exe 5fxrlxx.exe PID 3660 wrote to memory of 4672 3660 1dvpp.exe 5fxrlxx.exe PID 4672 wrote to memory of 3544 4672 5fxrlxx.exe tnhhnh.exe PID 4672 wrote to memory of 3544 4672 5fxrlxx.exe tnhhnh.exe PID 4672 wrote to memory of 3544 4672 5fxrlxx.exe tnhhnh.exe PID 3544 wrote to memory of 1104 3544 tnhhnh.exe dvpvj.exe PID 3544 wrote to memory of 1104 3544 tnhhnh.exe dvpvj.exe PID 3544 wrote to memory of 1104 3544 tnhhnh.exe dvpvj.exe PID 1104 wrote to memory of 2832 1104 dvpvj.exe llrlxrl.exe PID 1104 wrote to memory of 2832 1104 dvpvj.exe llrlxrl.exe PID 1104 wrote to memory of 2832 1104 dvpvj.exe llrlxrl.exe PID 2832 wrote to memory of 4268 2832 llrlxrl.exe vjpdv.exe PID 2832 wrote to memory of 4268 2832 llrlxrl.exe vjpdv.exe PID 2832 wrote to memory of 4268 2832 llrlxrl.exe vjpdv.exe PID 4268 wrote to memory of 4924 4268 vjpdv.exe lrflrrf.exe PID 4268 wrote to memory of 4924 4268 vjpdv.exe lrflrrf.exe PID 4268 wrote to memory of 4924 4268 vjpdv.exe lrflrrf.exe PID 4924 wrote to memory of 4056 4924 lrflrrf.exe frrfxrl.exe PID 4924 wrote to memory of 4056 4924 lrflrrf.exe frrfxrl.exe PID 4924 wrote to memory of 4056 4924 lrflrrf.exe frrfxrl.exe PID 4056 wrote to memory of 1960 4056 frrfxrl.exe ttbthh.exe PID 4056 wrote to memory of 1960 4056 frrfxrl.exe ttbthh.exe PID 4056 wrote to memory of 1960 4056 frrfxrl.exe ttbthh.exe PID 1960 wrote to memory of 3720 1960 ttbthh.exe jjjdp.exe PID 1960 wrote to memory of 3720 1960 ttbthh.exe jjjdp.exe PID 1960 wrote to memory of 3720 1960 ttbthh.exe jjjdp.exe PID 3720 wrote to memory of 544 3720 jjjdp.exe rlfxlfr.exe PID 3720 wrote to memory of 544 3720 jjjdp.exe rlfxlfr.exe PID 3720 wrote to memory of 544 3720 jjjdp.exe rlfxlfr.exe PID 544 wrote to memory of 5092 544 rlfxlfr.exe 5hbttn.exe PID 544 wrote to memory of 5092 544 rlfxlfr.exe 5hbttn.exe PID 544 wrote to memory of 5092 544 rlfxlfr.exe 5hbttn.exe PID 5092 wrote to memory of 4960 5092 5hbttn.exe httnbb.exe PID 5092 wrote to memory of 4960 5092 5hbttn.exe httnbb.exe PID 5092 wrote to memory of 4960 5092 5hbttn.exe httnbb.exe PID 4960 wrote to memory of 2344 4960 httnbb.exe pvdvd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3b3c3d7a03773bbfd1e95803b2b7773114f59ef943e984303b2fcabcbe288e1.exe"C:\Users\Admin\AppData\Local\Temp\a3b3c3d7a03773bbfd1e95803b2b7773114f59ef943e984303b2fcabcbe288e1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\lffxrxr.exec:\lffxrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\htntbb.exec:\htntbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\vppdj.exec:\vppdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\7dvpd.exec:\7dvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\lfrlfrl.exec:\lfrlfrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\jvdvp.exec:\jvdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\lfxrrlx.exec:\lfxrrlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\3jvjd.exec:\3jvjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\1dvpp.exec:\1dvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\5fxrlxx.exec:\5fxrlxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\tnhhnh.exec:\tnhhnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\dvpvj.exec:\dvpvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\llrlxrl.exec:\llrlxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\vjpdv.exec:\vjpdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\lrflrrf.exec:\lrflrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\frrfxrl.exec:\frrfxrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\ttbthh.exec:\ttbthh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\jjjdp.exec:\jjjdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\rlfxlfr.exec:\rlfxlfr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\5hbttn.exec:\5hbttn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\httnbb.exec:\httnbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\pvdvd.exec:\pvdvd.exe23⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rrrlrlf.exec:\rrrlrlf.exe24⤵
- Executes dropped EXE
PID:740 -
\??\c:\ntbtnn.exec:\ntbtnn.exe25⤵
- Executes dropped EXE
PID:4996 -
\??\c:\pjvpv.exec:\pjvpv.exe26⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rrlxrlx.exec:\rrlxrlx.exe27⤵
- Executes dropped EXE
PID:4576 -
\??\c:\5hhnth.exec:\5hhnth.exe28⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vdddp.exec:\vdddp.exe29⤵
- Executes dropped EXE
PID:3968 -
\??\c:\rllfxrl.exec:\rllfxrl.exe30⤵
- Executes dropped EXE
PID:4164 -
\??\c:\nttnhb.exec:\nttnhb.exe31⤵
- Executes dropped EXE
PID:3344 -
\??\c:\nttnbn.exec:\nttnbn.exe32⤵
- Executes dropped EXE
PID:3596 -
\??\c:\jjvvd.exec:\jjvvd.exe33⤵
- Executes dropped EXE
PID:3268 -
\??\c:\1flxlfl.exec:\1flxlfl.exe34⤵
- Executes dropped EXE
PID:3960 -
\??\c:\lllfxrl.exec:\lllfxrl.exe35⤵
- Executes dropped EXE
PID:2592 -
\??\c:\nbtthh.exec:\nbtthh.exe36⤵
- Executes dropped EXE
PID:3984 -
\??\c:\vjdvp.exec:\vjdvp.exe37⤵
- Executes dropped EXE
PID:3456 -
\??\c:\pdpdv.exec:\pdpdv.exe38⤵
- Executes dropped EXE
PID:4892 -
\??\c:\1rrxlrr.exec:\1rrxlrr.exe39⤵
- Executes dropped EXE
PID:792 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe40⤵
- Executes dropped EXE
PID:4392 -
\??\c:\3tbthb.exec:\3tbthb.exe41⤵
- Executes dropped EXE
PID:4476 -
\??\c:\vdpjd.exec:\vdpjd.exe42⤵
- Executes dropped EXE
PID:2164 -
\??\c:\dddjp.exec:\dddjp.exe43⤵
- Executes dropped EXE
PID:4368 -
\??\c:\5dvpd.exec:\5dvpd.exe44⤵
- Executes dropped EXE
PID:3432 -
\??\c:\3llfrlf.exec:\3llfrlf.exe45⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xlrrfff.exec:\xlrrfff.exe46⤵
- Executes dropped EXE
PID:3060 -
\??\c:\htttht.exec:\htttht.exe47⤵
- Executes dropped EXE
PID:3552 -
\??\c:\vvddd.exec:\vvddd.exe48⤵
- Executes dropped EXE
PID:3548 -
\??\c:\pdvdd.exec:\pdvdd.exe49⤵
- Executes dropped EXE
PID:4484 -
\??\c:\xrlxllx.exec:\xrlxllx.exe50⤵
- Executes dropped EXE
PID:3940 -
\??\c:\btttbh.exec:\btttbh.exe51⤵
- Executes dropped EXE
PID:4552 -
\??\c:\nbbttt.exec:\nbbttt.exe52⤵
- Executes dropped EXE
PID:1280 -
\??\c:\dvpvv.exec:\dvpvv.exe53⤵
- Executes dropped EXE
PID:2348 -
\??\c:\llrlfxx.exec:\llrlfxx.exe54⤵
- Executes dropped EXE
PID:1076 -
\??\c:\llxrxrx.exec:\llxrxrx.exe55⤵
- Executes dropped EXE
PID:3948 -
\??\c:\rrxrrlf.exec:\rrxrrlf.exe56⤵
- Executes dropped EXE
PID:3328 -
\??\c:\ntnhbt.exec:\ntnhbt.exe57⤵
- Executes dropped EXE
PID:2940 -
\??\c:\djjjv.exec:\djjjv.exe58⤵
- Executes dropped EXE
PID:732 -
\??\c:\pdpjv.exec:\pdpjv.exe59⤵
- Executes dropped EXE
PID:2180 -
\??\c:\1xffxxx.exec:\1xffxxx.exe60⤵
- Executes dropped EXE
PID:2528 -
\??\c:\btbnnb.exec:\btbnnb.exe61⤵
- Executes dropped EXE
PID:3044 -
\??\c:\nntthn.exec:\nntthn.exe62⤵
- Executes dropped EXE
PID:1484 -
\??\c:\vdddp.exec:\vdddp.exe63⤵
- Executes dropped EXE
PID:3944 -
\??\c:\lfrrflf.exec:\lfrrflf.exe64⤵
- Executes dropped EXE
PID:924 -
\??\c:\fxfffrr.exec:\fxfffrr.exe65⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nhthhn.exec:\nhthhn.exe66⤵PID:1164
-
\??\c:\7vddd.exec:\7vddd.exe67⤵PID:1744
-
\??\c:\7lrlfll.exec:\7lrlfll.exe68⤵PID:3988
-
\??\c:\tttthh.exec:\tttthh.exe69⤵PID:1156
-
\??\c:\jdjjd.exec:\jdjjd.exe70⤵PID:4212
-
\??\c:\3ffxxfl.exec:\3ffxxfl.exe71⤵PID:2924
-
\??\c:\xlrllff.exec:\xlrllff.exe72⤵PID:4832
-
\??\c:\tnbthh.exec:\tnbthh.exe73⤵PID:5092
-
\??\c:\9ttttt.exec:\9ttttt.exe74⤵PID:5056
-
\??\c:\jdjjj.exec:\jdjjj.exe75⤵PID:412
-
\??\c:\9fflxfr.exec:\9fflxfr.exe76⤵PID:2812
-
\??\c:\nthnnn.exec:\nthnnn.exe77⤵PID:4156
-
\??\c:\ppppj.exec:\ppppj.exe78⤵PID:4996
-
\??\c:\ppdvj.exec:\ppdvj.exe79⤵PID:1036
-
\??\c:\5xffxxr.exec:\5xffxxr.exe80⤵PID:4232
-
\??\c:\tbntnt.exec:\tbntnt.exe81⤵PID:1176
-
\??\c:\bbbttt.exec:\bbbttt.exe82⤵PID:2280
-
\??\c:\dvdjv.exec:\dvdjv.exe83⤵PID:1588
-
\??\c:\fxrfrrr.exec:\fxrfrrr.exe84⤵PID:2564
-
\??\c:\fffffff.exec:\fffffff.exe85⤵PID:3216
-
\??\c:\5hbbtb.exec:\5hbbtb.exe86⤵PID:3168
-
\??\c:\7ddvp.exec:\7ddvp.exe87⤵PID:1976
-
\??\c:\pjdjj.exec:\pjdjj.exe88⤵PID:3264
-
\??\c:\fxrlffx.exec:\fxrlffx.exe89⤵PID:2112
-
\??\c:\hhhnnn.exec:\hhhnnn.exe90⤵PID:4568
-
\??\c:\ttbhbn.exec:\ttbhbn.exe91⤵PID:2092
-
\??\c:\jjjjv.exec:\jjjjv.exe92⤵PID:1132
-
\??\c:\lllffff.exec:\lllffff.exe93⤵PID:2688
-
\??\c:\llffxxx.exec:\llffxxx.exe94⤵PID:5104
-
\??\c:\tthntb.exec:\tthntb.exe95⤵PID:468
-
\??\c:\bnnbtn.exec:\bnnbtn.exe96⤵PID:1708
-
\??\c:\dvvpp.exec:\dvvpp.exe97⤵PID:3288
-
\??\c:\5xlllll.exec:\5xlllll.exe98⤵PID:4368
-
\??\c:\3lllxfr.exec:\3lllxfr.exe99⤵PID:3432
-
\??\c:\nnttnt.exec:\nnttnt.exe100⤵PID:2032
-
\??\c:\pvvpj.exec:\pvvpj.exe101⤵PID:864
-
\??\c:\frffxff.exec:\frffxff.exe102⤵PID:3552
-
\??\c:\5rxrrxr.exec:\5rxrrxr.exe103⤵PID:3548
-
\??\c:\nhbtnn.exec:\nhbtnn.exe104⤵PID:2692
-
\??\c:\bnbbnn.exec:\bnbbnn.exe105⤵PID:3668
-
\??\c:\jvppv.exec:\jvppv.exe106⤵PID:2372
-
\??\c:\tbttnh.exec:\tbttnh.exe107⤵PID:1280
-
\??\c:\tthhnn.exec:\tthhnn.exe108⤵PID:1220
-
\??\c:\ppjvv.exec:\ppjvv.exe109⤵PID:4528
-
\??\c:\flfxrrr.exec:\flfxrrr.exe110⤵PID:1704
-
\??\c:\xxllrrx.exec:\xxllrrx.exe111⤵PID:3512
-
\??\c:\3hhbtn.exec:\3hhbtn.exe112⤵PID:2140
-
\??\c:\bnhthb.exec:\bnhthb.exe113⤵PID:4672
-
\??\c:\dvjvv.exec:\dvjvv.exe114⤵PID:3816
-
\??\c:\xxrrlrl.exec:\xxrrlrl.exe115⤵PID:1000
-
\??\c:\rxrllll.exec:\rxrllll.exe116⤵PID:1104
-
\??\c:\nttbbn.exec:\nttbbn.exe117⤵PID:3292
-
\??\c:\7jppp.exec:\7jppp.exe118⤵PID:320
-
\??\c:\pvvvv.exec:\pvvvv.exe119⤵PID:4748
-
\??\c:\llrllrr.exec:\llrllrr.exe120⤵PID:4872
-
\??\c:\xfxrfrr.exec:\xfxrfrr.exe121⤵PID:1164
-
\??\c:\1hnhhh.exec:\1hnhhh.exe122⤵
- System Location Discovery: System Language Discovery
PID:1744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-