Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2024 05:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe
-
Size
105KB
-
MD5
a4c210bbb97e01caf3f428a3d44172f2
-
SHA1
fc9e2a416cb8a26622e3c668c7c0f4af265498bc
-
SHA256
eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd
-
SHA512
cf790335aa1841a2f216a00ab39d09b034d7bc005e235d324b4179f1ac743f75cea7353e7974c7d0e11614ba1a39d376b92b3b46f5920ef1c77daca9f8dff610
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHq82PC1:n3C9BRo7tvnJ99T/KZE891
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3632-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2300-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1160-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/968-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1500-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/732-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/532-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1396-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4828 vdjjv.exe 1828 nttnnt.exe 1048 thtbtn.exe 3616 vjdjp.exe 4344 bbhhhh.exe 3840 jvddd.exe 2300 7vppp.exe 2444 rxrrrrr.exe 1588 bbhhnt.exe 1160 jdvpj.exe 2824 bttbbh.exe 968 1ntnnn.exe 1500 dpvpj.exe 4228 lllfxxf.exe 732 htbbtt.exe 2044 jdddv.exe 3388 flrlxxx.exe 808 bnnhbb.exe 4140 lfxfllf.exe 1604 xrlfxxr.exe 4092 pjdvp.exe 4072 fxrllfx.exe 3888 rlllfff.exe 2936 1nnhhh.exe 532 pdppj.exe 3744 9dpjj.exe 2388 1rlfxxl.exe 1396 htnhtt.exe 2548 vpddv.exe 4888 fflllfx.exe 1932 llrrrxr.exe 1876 nhnhnn.exe 4832 5xfxrfr.exe 1352 nhhnhh.exe 3752 jdjdp.exe 3988 3rfxffx.exe 1568 3ffllll.exe 832 nhnhbh.exe 1824 vppjd.exe 2768 lrxxffr.exe 4904 rrxrllf.exe 4376 nhnhtt.exe 2332 jdjjd.exe 4716 xlxxrxf.exe 1172 rllfxxr.exe 900 tbtbth.exe 1940 jvvpp.exe 3288 frlxrrl.exe 4828 tnthbt.exe 2568 dvjdv.exe 1828 lllfxxr.exe 1048 xxrlffx.exe 3616 bhbbtb.exe 1424 hbhtbb.exe 4336 vppjp.exe 3060 xrrlfxr.exe 3704 3nnhhh.exe 1716 ddvpj.exe 2200 rflfrrl.exe 4868 hnnttb.exe 4388 dvjjj.exe 2908 jppjp.exe 3316 rrfxrrl.exe 1720 bhtnth.exe -
resource yara_rule behavioral2/memory/3632-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1828-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2300-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/968-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1500-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/532-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3632 wrote to memory of 4828 3632 eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe 83 PID 3632 wrote to memory of 4828 3632 eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe 83 PID 3632 wrote to memory of 4828 3632 eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe 83 PID 4828 wrote to memory of 1828 4828 vdjjv.exe 84 PID 4828 wrote to memory of 1828 4828 vdjjv.exe 84 PID 4828 wrote to memory of 1828 4828 vdjjv.exe 84 PID 1828 wrote to memory of 1048 1828 nttnnt.exe 85 PID 1828 wrote to memory of 1048 1828 nttnnt.exe 85 PID 1828 wrote to memory of 1048 1828 nttnnt.exe 85 PID 1048 wrote to memory of 3616 1048 thtbtn.exe 86 PID 1048 wrote to memory of 3616 1048 thtbtn.exe 86 PID 1048 wrote to memory of 3616 1048 thtbtn.exe 86 PID 3616 wrote to memory of 4344 3616 vjdjp.exe 87 PID 3616 wrote to memory of 4344 3616 vjdjp.exe 87 PID 3616 wrote to memory of 4344 3616 vjdjp.exe 87 PID 4344 wrote to memory of 3840 4344 bbhhhh.exe 88 PID 4344 wrote to memory of 3840 4344 bbhhhh.exe 88 PID 4344 wrote to memory of 3840 4344 bbhhhh.exe 88 PID 3840 wrote to memory of 2300 3840 jvddd.exe 89 PID 3840 wrote to memory of 2300 3840 jvddd.exe 89 PID 3840 wrote to memory of 2300 3840 jvddd.exe 89 PID 2300 wrote to memory of 2444 2300 7vppp.exe 90 PID 2300 wrote to memory of 2444 2300 7vppp.exe 90 PID 2300 wrote to memory of 2444 2300 7vppp.exe 90 PID 2444 wrote to memory of 1588 2444 rxrrrrr.exe 91 PID 2444 wrote to memory of 1588 2444 rxrrrrr.exe 91 PID 2444 wrote to memory of 1588 2444 rxrrrrr.exe 91 PID 1588 wrote to memory of 1160 1588 bbhhnt.exe 92 PID 1588 wrote to memory of 1160 1588 bbhhnt.exe 92 PID 1588 wrote to memory of 1160 1588 bbhhnt.exe 92 PID 1160 wrote to memory of 2824 1160 jdvpj.exe 93 PID 1160 wrote to memory of 2824 1160 jdvpj.exe 93 PID 1160 wrote to memory of 2824 1160 jdvpj.exe 93 PID 2824 wrote to memory of 968 2824 bttbbh.exe 94 PID 2824 wrote to memory of 968 2824 bttbbh.exe 94 PID 2824 wrote to memory of 968 2824 bttbbh.exe 94 PID 968 wrote to memory of 1500 968 1ntnnn.exe 95 PID 968 wrote to memory of 1500 968 1ntnnn.exe 95 PID 968 wrote to memory of 1500 968 1ntnnn.exe 95 PID 1500 wrote to memory of 4228 1500 dpvpj.exe 96 PID 1500 wrote to memory of 4228 1500 dpvpj.exe 96 PID 1500 wrote to memory of 4228 1500 dpvpj.exe 96 PID 4228 wrote to memory of 732 4228 lllfxxf.exe 97 PID 4228 wrote to memory of 732 4228 lllfxxf.exe 97 PID 4228 wrote to memory of 732 4228 lllfxxf.exe 97 PID 732 wrote to memory of 2044 732 htbbtt.exe 98 PID 732 wrote to memory of 2044 732 htbbtt.exe 98 PID 732 wrote to memory of 2044 732 htbbtt.exe 98 PID 2044 wrote to memory of 3388 2044 jdddv.exe 99 PID 2044 wrote to memory of 3388 2044 jdddv.exe 99 PID 2044 wrote to memory of 3388 2044 jdddv.exe 99 PID 3388 wrote to memory of 808 3388 flrlxxx.exe 100 PID 3388 wrote to memory of 808 3388 flrlxxx.exe 100 PID 3388 wrote to memory of 808 3388 flrlxxx.exe 100 PID 808 wrote to memory of 4140 808 bnnhbb.exe 101 PID 808 wrote to memory of 4140 808 bnnhbb.exe 101 PID 808 wrote to memory of 4140 808 bnnhbb.exe 101 PID 4140 wrote to memory of 1604 4140 lfxfllf.exe 102 PID 4140 wrote to memory of 1604 4140 lfxfllf.exe 102 PID 4140 wrote to memory of 1604 4140 lfxfllf.exe 102 PID 1604 wrote to memory of 4092 1604 xrlfxxr.exe 103 PID 1604 wrote to memory of 4092 1604 xrlfxxr.exe 103 PID 1604 wrote to memory of 4092 1604 xrlfxxr.exe 103 PID 4092 wrote to memory of 4072 4092 pjdvp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe"C:\Users\Admin\AppData\Local\Temp\eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\vdjjv.exec:\vdjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\nttnnt.exec:\nttnnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\thtbtn.exec:\thtbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\vjdjp.exec:\vjdjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\bbhhhh.exec:\bbhhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\jvddd.exec:\jvddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\7vppp.exec:\7vppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\rxrrrrr.exec:\rxrrrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\bbhhnt.exec:\bbhhnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\jdvpj.exec:\jdvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\bttbbh.exec:\bttbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\1ntnnn.exec:\1ntnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\dpvpj.exec:\dpvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\lllfxxf.exec:\lllfxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\htbbtt.exec:\htbbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\jdddv.exec:\jdddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\flrlxxx.exec:\flrlxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\bnnhbb.exec:\bnnhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\lfxfllf.exec:\lfxfllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\pjdvp.exec:\pjdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\fxrllfx.exec:\fxrllfx.exe23⤵
- Executes dropped EXE
PID:4072 -
\??\c:\rlllfff.exec:\rlllfff.exe24⤵
- Executes dropped EXE
PID:3888 -
\??\c:\1nnhhh.exec:\1nnhhh.exe25⤵
- Executes dropped EXE
PID:2936 -
\??\c:\pdppj.exec:\pdppj.exe26⤵
- Executes dropped EXE
PID:532 -
\??\c:\9dpjj.exec:\9dpjj.exe27⤵
- Executes dropped EXE
PID:3744 -
\??\c:\1rlfxxl.exec:\1rlfxxl.exe28⤵
- Executes dropped EXE
PID:2388 -
\??\c:\htnhtt.exec:\htnhtt.exe29⤵
- Executes dropped EXE
PID:1396 -
\??\c:\vpddv.exec:\vpddv.exe30⤵
- Executes dropped EXE
PID:2548 -
\??\c:\fflllfx.exec:\fflllfx.exe31⤵
- Executes dropped EXE
PID:4888 -
\??\c:\llrrrxr.exec:\llrrrxr.exe32⤵
- Executes dropped EXE
PID:1932 -
\??\c:\nhnhnn.exec:\nhnhnn.exe33⤵
- Executes dropped EXE
PID:1876 -
\??\c:\5xfxrfr.exec:\5xfxrfr.exe34⤵
- Executes dropped EXE
PID:4832 -
\??\c:\nhhnhh.exec:\nhhnhh.exe35⤵
- Executes dropped EXE
PID:1352 -
\??\c:\jdjdp.exec:\jdjdp.exe36⤵
- Executes dropped EXE
PID:3752 -
\??\c:\3rfxffx.exec:\3rfxffx.exe37⤵
- Executes dropped EXE
PID:3988 -
\??\c:\3ffllll.exec:\3ffllll.exe38⤵
- Executes dropped EXE
PID:1568 -
\??\c:\nhnhbh.exec:\nhnhbh.exe39⤵
- Executes dropped EXE
PID:832 -
\??\c:\vppjd.exec:\vppjd.exe40⤵
- Executes dropped EXE
PID:1824 -
\??\c:\lrxxffr.exec:\lrxxffr.exe41⤵
- Executes dropped EXE
PID:2768 -
\??\c:\rrxrllf.exec:\rrxrllf.exe42⤵
- Executes dropped EXE
PID:4904 -
\??\c:\nhnhtt.exec:\nhnhtt.exe43⤵
- Executes dropped EXE
PID:4376 -
\??\c:\jdjjd.exec:\jdjjd.exe44⤵
- Executes dropped EXE
PID:2332 -
\??\c:\xlxxrxf.exec:\xlxxrxf.exe45⤵
- Executes dropped EXE
PID:4716 -
\??\c:\rllfxxr.exec:\rllfxxr.exe46⤵
- Executes dropped EXE
PID:1172 -
\??\c:\tbtbth.exec:\tbtbth.exe47⤵
- Executes dropped EXE
PID:900 -
\??\c:\jvvpp.exec:\jvvpp.exe48⤵
- Executes dropped EXE
PID:1940 -
\??\c:\frlxrrl.exec:\frlxrrl.exe49⤵
- Executes dropped EXE
PID:3288 -
\??\c:\tnthbt.exec:\tnthbt.exe50⤵
- Executes dropped EXE
PID:4828 -
\??\c:\dvjdv.exec:\dvjdv.exe51⤵
- Executes dropped EXE
PID:2568 -
\??\c:\lllfxxr.exec:\lllfxxr.exe52⤵
- Executes dropped EXE
PID:1828 -
\??\c:\xxrlffx.exec:\xxrlffx.exe53⤵
- Executes dropped EXE
PID:1048 -
\??\c:\bhbbtb.exec:\bhbbtb.exe54⤵
- Executes dropped EXE
PID:3616 -
\??\c:\hbhtbb.exec:\hbhtbb.exe55⤵
- Executes dropped EXE
PID:1424 -
\??\c:\vppjp.exec:\vppjp.exe56⤵
- Executes dropped EXE
PID:4336 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe57⤵
- Executes dropped EXE
PID:3060 -
\??\c:\3nnhhh.exec:\3nnhhh.exe58⤵
- Executes dropped EXE
PID:3704 -
\??\c:\ddvpj.exec:\ddvpj.exe59⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rflfrrl.exec:\rflfrrl.exe60⤵
- Executes dropped EXE
PID:2200 -
\??\c:\hnnttb.exec:\hnnttb.exe61⤵
- Executes dropped EXE
PID:4868 -
\??\c:\dvjjj.exec:\dvjjj.exe62⤵
- Executes dropped EXE
PID:4388 -
\??\c:\jppjp.exec:\jppjp.exe63⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe64⤵
- Executes dropped EXE
PID:3316 -
\??\c:\bhtnth.exec:\bhtnth.exe65⤵
- Executes dropped EXE
PID:1720 -
\??\c:\9pvvd.exec:\9pvvd.exe66⤵PID:4476
-
\??\c:\9xlfrrr.exec:\9xlfrrr.exe67⤵PID:592
-
\??\c:\nnhhbb.exec:\nnhhbb.exe68⤵PID:4768
-
\??\c:\9jjdv.exec:\9jjdv.exe69⤵PID:732
-
\??\c:\jjvpv.exec:\jjvpv.exe70⤵PID:3444
-
\??\c:\xfffrrl.exec:\xfffrrl.exe71⤵PID:184
-
\??\c:\bnnnhh.exec:\bnnnhh.exe72⤵PID:1000
-
\??\c:\9dvvp.exec:\9dvvp.exe73⤵PID:3580
-
\??\c:\rrrfxxx.exec:\rrrfxxx.exe74⤵PID:4480
-
\??\c:\nnbttb.exec:\nnbttb.exe75⤵PID:4748
-
\??\c:\tnthtn.exec:\tnthtn.exe76⤵PID:3992
-
\??\c:\vvpjj.exec:\vvpjj.exe77⤵PID:2852
-
\??\c:\rxxrfff.exec:\rxxrfff.exe78⤵PID:4500
-
\??\c:\1rxrxxx.exec:\1rxrxxx.exe79⤵PID:4136
-
\??\c:\7hhhtt.exec:\7hhhtt.exe80⤵PID:2820
-
\??\c:\pjpjp.exec:\pjpjp.exe81⤵PID:2664
-
\??\c:\flxlflf.exec:\flxlflf.exe82⤵PID:2856
-
\??\c:\rlrlffx.exec:\rlrlffx.exe83⤵PID:2836
-
\??\c:\nbtnhb.exec:\nbtnhb.exe84⤵PID:4392
-
\??\c:\5ntnnn.exec:\5ntnnn.exe85⤵PID:4952
-
\??\c:\pddvj.exec:\pddvj.exe86⤵PID:3260
-
\??\c:\rlfxllf.exec:\rlfxllf.exe87⤵PID:4704
-
\??\c:\5xfffrr.exec:\5xfffrr.exe88⤵PID:1620
-
\??\c:\bbbnnn.exec:\bbbnnn.exe89⤵PID:3180
-
\??\c:\nhtnhb.exec:\nhtnhb.exe90⤵PID:3112
-
\??\c:\ppdvj.exec:\ppdvj.exe91⤵PID:3096
-
\??\c:\7flffff.exec:\7flffff.exe92⤵PID:2012
-
\??\c:\rflfxfl.exec:\rflfxfl.exe93⤵PID:4552
-
\??\c:\ththnb.exec:\ththnb.exe94⤵PID:2508
-
\??\c:\5nnnhb.exec:\5nnnhb.exe95⤵PID:4248
-
\??\c:\7vvdv.exec:\7vvdv.exe96⤵PID:5092
-
\??\c:\tbhbnn.exec:\tbhbnn.exe97⤵PID:3960
-
\??\c:\bbttnt.exec:\bbttnt.exe98⤵PID:2808
-
\??\c:\jdjjv.exec:\jdjjv.exe99⤵PID:3676
-
\??\c:\1vvpd.exec:\1vvpd.exe100⤵PID:3700
-
\??\c:\fxrxxll.exec:\fxrxxll.exe101⤵PID:1640
-
\??\c:\btbbhh.exec:\btbbhh.exe102⤵PID:2940
-
\??\c:\vvjjj.exec:\vvjjj.exe103⤵PID:4628
-
\??\c:\vpdvj.exec:\vpdvj.exe104⤵PID:3844
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe105⤵PID:1236
-
\??\c:\rrrfxrf.exec:\rrrfxrf.exe106⤵PID:4496
-
\??\c:\9tttnt.exec:\9tttnt.exe107⤵PID:2216
-
\??\c:\dvdvv.exec:\dvdvv.exe108⤵PID:4844
-
\??\c:\lffxrrl.exec:\lffxrrl.exe109⤵PID:2128
-
\??\c:\xrxxrfl.exec:\xrxxrfl.exe110⤵PID:1260
-
\??\c:\7hhhbb.exec:\7hhhbb.exe111⤵PID:668
-
\??\c:\vdpjv.exec:\vdpjv.exe112⤵PID:536
-
\??\c:\5llfrlf.exec:\5llfrlf.exe113⤵PID:3840
-
\??\c:\frfxxxr.exec:\frfxxxr.exe114⤵PID:3996
-
\??\c:\tnnbhh.exec:\tnnbhh.exe115⤵PID:3664
-
\??\c:\9djvp.exec:\9djvp.exe116⤵PID:1864
-
\??\c:\lfxrfrl.exec:\lfxrfrl.exe117⤵PID:4644
-
\??\c:\rffxrrl.exec:\rffxrrl.exe118⤵PID:1160
-
\??\c:\httttb.exec:\httttb.exe119⤵PID:4712
-
\??\c:\jjdvj.exec:\jjdvj.exe120⤵PID:4980
-
\??\c:\xlrlfll.exec:\xlrlfll.exe121⤵PID:3100
-
\??\c:\rfrlxxr.exec:\rfrlxxr.exe122⤵PID:1328
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-