Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2024, 22:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
98d5593db28750142337486428ff4b71bac44e985f8eae83de578848e34ffb0b.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
98d5593db28750142337486428ff4b71bac44e985f8eae83de578848e34ffb0b.exe
-
Size
457KB
-
MD5
04c1d42c90b0d79a4e2d6b1c40bc212a
-
SHA1
36b5eb3771c7e5bc57c767cfe9fd27c2db17ace9
-
SHA256
98d5593db28750142337486428ff4b71bac44e985f8eae83de578848e34ffb0b
-
SHA512
0a50b67c6886e9b738494e0a42d15789aee8446b2d7af92aad14af9aca85232aac2c5f11e1ba93ee10036737adc5c2ca16ec0c4a8d86faad99495926b617e408
-
SSDEEP
6144:n3C9BRo7MlrWKo+lS0Le4xRSAoq78yoyfx93svqTNAuVV5H0C:n3C9yMo+S0L9xRnoq7H9QYNAuVVL
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral2/memory/3376-2-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2916-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1812-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1500-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2628-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-314-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-319-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/716-324-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-333-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-338-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/760-361-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1964-366-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-377-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2660-398-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/936-414-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 53 IoCs
resource yara_rule behavioral2/memory/3376-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4724-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3088-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4440-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/864-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1820-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1608-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1608-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4700-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1624-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4620-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3768-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/728-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4360-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1016-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1900-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1048-136-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3364-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3364-149-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3720-156-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2716-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2716-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3560-177-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2916-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4980-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4560-206-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2488-213-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4356-219-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4476-226-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2212-232-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3344-236-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1812-245-0x0000000000690000-0x000000000069C000-memory.dmp UPX behavioral2/memory/1812-247-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2256-253-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4460-258-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4460-257-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4680-263-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1684-269-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1500-273-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2628-282-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1620-296-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2408-314-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2056-319-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/716-324-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1048-328-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1048-333-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4076-338-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/760-361-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1964-366-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4448-377-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4448-374-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2660-398-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/936-414-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4724 bbhhtb.exe 3088 lffxrrl.exe 864 rlrlflf.exe 4440 7vjdj.exe 1608 dpvvp.exe 1820 9xfxrrr.exe 4700 jdddv.exe 1624 jpdjp.exe 4620 rllfllf.exe 3768 dpvvp.exe 3864 nttnnn.exe 728 ffxrrrl.exe 4360 7nhtbh.exe 1016 bbttnn.exe 4736 fffxxrr.exe 4952 tnnnhh.exe 4100 rrrrrrl.exe 1900 pvjdv.exe 1048 hhbttt.exe 2592 xfxxxxx.exe 3364 vvjdj.exe 3720 3dppv.exe 3520 ntnbtn.exe 2716 hnhhth.exe 3560 9vdvp.exe 2916 nbhhtt.exe 3144 fllfxxr.exe 4980 jdvjp.exe 4560 hthttt.exe 2488 jdddv.exe 4356 pjvpj.exe 4476 fxfxrrl.exe 2212 vjvpd.exe 3344 nttnnh.exe 1952 7rxxrxr.exe 1812 3hhhnn.exe 2256 xfxxxxx.exe 4460 hbnnhh.exe 4680 lrxlxrl.exe 1684 pjddj.exe 1500 bhnhhb.exe 3340 9pjdv.exe 2628 bbhttt.exe 1992 rfffxrr.exe 1320 dvpvp.exe 1620 rxxllfl.exe 3976 5hhhbb.exe 4672 lrfrlll.exe 4596 9ntnhh.exe 2408 flrxlrr.exe 2056 bbhhnn.exe 716 xxrrllf.exe 1048 pddvj.exe 2412 xxlfxxx.exe 4076 7jvdv.exe 3320 tbbnht.exe 4416 xllfffx.exe 3260 thhhhb.exe 3656 5rfrllf.exe 760 btbtnh.exe 1964 9vjjp.exe 3304 9nnhhn.exe 4448 jvvdv.exe 4452 9btbht.exe -
resource yara_rule behavioral2/memory/3376-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2916-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3344-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1812-245-0x0000000000690000-0x000000000069C000-memory.dmp upx behavioral2/memory/1812-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1500-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2628-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-314-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-319-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/716-324-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-328-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-333-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/760-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1964-366-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-377-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-374-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2660-398-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/936-414-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3376 wrote to memory of 4724 3376 98d5593db28750142337486428ff4b71bac44e985f8eae83de578848e34ffb0b.exe 91 PID 3376 wrote to memory of 4724 3376 98d5593db28750142337486428ff4b71bac44e985f8eae83de578848e34ffb0b.exe 91 PID 3376 wrote to memory of 4724 3376 98d5593db28750142337486428ff4b71bac44e985f8eae83de578848e34ffb0b.exe 91 PID 4724 wrote to memory of 3088 4724 bbhhtb.exe 92 PID 4724 wrote to memory of 3088 4724 bbhhtb.exe 92 PID 4724 wrote to memory of 3088 4724 bbhhtb.exe 92 PID 3088 wrote to memory of 864 3088 lffxrrl.exe 93 PID 3088 wrote to memory of 864 3088 lffxrrl.exe 93 PID 3088 wrote to memory of 864 3088 lffxrrl.exe 93 PID 864 wrote to memory of 4440 864 rlrlflf.exe 94 PID 864 wrote to memory of 4440 864 rlrlflf.exe 94 PID 864 wrote to memory of 4440 864 rlrlflf.exe 94 PID 4440 wrote to memory of 1608 4440 7vjdj.exe 95 PID 4440 wrote to memory of 1608 4440 7vjdj.exe 95 PID 4440 wrote to memory of 1608 4440 7vjdj.exe 95 PID 1608 wrote to memory of 1820 1608 dpvvp.exe 96 PID 1608 wrote to memory of 1820 1608 dpvvp.exe 96 PID 1608 wrote to memory of 1820 1608 dpvvp.exe 96 PID 1820 wrote to memory of 4700 1820 9xfxrrr.exe 97 PID 1820 wrote to memory of 4700 1820 9xfxrrr.exe 97 PID 1820 wrote to memory of 4700 1820 9xfxrrr.exe 97 PID 4700 wrote to memory of 1624 4700 jdddv.exe 98 PID 4700 wrote to memory of 1624 4700 jdddv.exe 98 PID 4700 wrote to memory of 1624 4700 jdddv.exe 98 PID 1624 wrote to memory of 4620 1624 jpdjp.exe 100 PID 1624 wrote to memory of 4620 1624 jpdjp.exe 100 PID 1624 wrote to memory of 4620 1624 jpdjp.exe 100 PID 4620 wrote to memory of 3768 4620 rllfllf.exe 101 PID 4620 wrote to memory of 3768 4620 rllfllf.exe 101 PID 4620 wrote to memory of 3768 4620 rllfllf.exe 101 PID 3768 wrote to memory of 3864 3768 dpvvp.exe 102 PID 3768 wrote to memory of 3864 3768 dpvvp.exe 102 PID 3768 wrote to memory of 3864 3768 dpvvp.exe 102 PID 3864 wrote to memory of 728 3864 nttnnn.exe 103 PID 3864 wrote to memory of 728 3864 nttnnn.exe 103 PID 3864 wrote to memory of 728 3864 nttnnn.exe 103 PID 728 wrote to memory of 4360 728 ffxrrrl.exe 104 PID 728 wrote to memory of 4360 728 ffxrrrl.exe 104 PID 728 wrote to memory of 4360 728 ffxrrrl.exe 104 PID 4360 wrote to memory of 1016 4360 7nhtbh.exe 105 PID 4360 wrote to memory of 1016 4360 7nhtbh.exe 105 PID 4360 wrote to memory of 1016 4360 7nhtbh.exe 105 PID 1016 wrote to memory of 4736 1016 bbttnn.exe 106 PID 1016 wrote to memory of 4736 1016 bbttnn.exe 106 PID 1016 wrote to memory of 4736 1016 bbttnn.exe 106 PID 4736 wrote to memory of 4952 4736 fffxxrr.exe 107 PID 4736 wrote to memory of 4952 4736 fffxxrr.exe 107 PID 4736 wrote to memory of 4952 4736 fffxxrr.exe 107 PID 4952 wrote to memory of 4100 4952 tnnnhh.exe 108 PID 4952 wrote to memory of 4100 4952 tnnnhh.exe 108 PID 4952 wrote to memory of 4100 4952 tnnnhh.exe 108 PID 4100 wrote to memory of 1900 4100 rrrrrrl.exe 109 PID 4100 wrote to memory of 1900 4100 rrrrrrl.exe 109 PID 4100 wrote to memory of 1900 4100 rrrrrrl.exe 109 PID 1900 wrote to memory of 1048 1900 pvjdv.exe 110 PID 1900 wrote to memory of 1048 1900 pvjdv.exe 110 PID 1900 wrote to memory of 1048 1900 pvjdv.exe 110 PID 1048 wrote to memory of 2592 1048 hhbttt.exe 111 PID 1048 wrote to memory of 2592 1048 hhbttt.exe 111 PID 1048 wrote to memory of 2592 1048 hhbttt.exe 111 PID 2592 wrote to memory of 3364 2592 xfxxxxx.exe 112 PID 2592 wrote to memory of 3364 2592 xfxxxxx.exe 112 PID 2592 wrote to memory of 3364 2592 xfxxxxx.exe 112 PID 3364 wrote to memory of 3720 3364 vvjdj.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\98d5593db28750142337486428ff4b71bac44e985f8eae83de578848e34ffb0b.exe"C:\Users\Admin\AppData\Local\Temp\98d5593db28750142337486428ff4b71bac44e985f8eae83de578848e34ffb0b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\bbhhtb.exec:\bbhhtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\lffxrrl.exec:\lffxrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\rlrlflf.exec:\rlrlflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\7vjdj.exec:\7vjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\dpvvp.exec:\dpvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\9xfxrrr.exec:\9xfxrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\jdddv.exec:\jdddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\jpdjp.exec:\jpdjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\rllfllf.exec:\rllfllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\dpvvp.exec:\dpvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\nttnnn.exec:\nttnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\ffxrrrl.exec:\ffxrrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\7nhtbh.exec:\7nhtbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\bbttnn.exec:\bbttnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\fffxxrr.exec:\fffxxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\tnnnhh.exec:\tnnnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\rrrrrrl.exec:\rrrrrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\pvjdv.exec:\pvjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\hhbttt.exec:\hhbttt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\xfxxxxx.exec:\xfxxxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\vvjdj.exec:\vvjdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\3dppv.exec:\3dppv.exe23⤵
- Executes dropped EXE
PID:3720 -
\??\c:\ntnbtn.exec:\ntnbtn.exe24⤵
- Executes dropped EXE
PID:3520 -
\??\c:\hnhhth.exec:\hnhhth.exe25⤵
- Executes dropped EXE
PID:2716 -
\??\c:\9vdvp.exec:\9vdvp.exe26⤵
- Executes dropped EXE
PID:3560 -
\??\c:\nbhhtt.exec:\nbhhtt.exe27⤵
- Executes dropped EXE
PID:2916 -
\??\c:\fllfxxr.exec:\fllfxxr.exe28⤵
- Executes dropped EXE
PID:3144 -
\??\c:\jdvjp.exec:\jdvjp.exe29⤵
- Executes dropped EXE
PID:4980 -
\??\c:\hthttt.exec:\hthttt.exe30⤵
- Executes dropped EXE
PID:4560 -
\??\c:\jdddv.exec:\jdddv.exe31⤵
- Executes dropped EXE
PID:2488 -
\??\c:\pjvpj.exec:\pjvpj.exe32⤵
- Executes dropped EXE
PID:4356 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe33⤵
- Executes dropped EXE
PID:4476 -
\??\c:\vjvpd.exec:\vjvpd.exe34⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nttnnh.exec:\nttnnh.exe35⤵
- Executes dropped EXE
PID:3344 -
\??\c:\7rxxrxr.exec:\7rxxrxr.exe36⤵
- Executes dropped EXE
PID:1952 -
\??\c:\3hhhnn.exec:\3hhhnn.exe37⤵
- Executes dropped EXE
PID:1812 -
\??\c:\xfxxxxx.exec:\xfxxxxx.exe38⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hbnnhh.exec:\hbnnhh.exe39⤵
- Executes dropped EXE
PID:4460 -
\??\c:\lrxlxrl.exec:\lrxlxrl.exe40⤵
- Executes dropped EXE
PID:4680 -
\??\c:\pjddj.exec:\pjddj.exe41⤵
- Executes dropped EXE
PID:1684 -
\??\c:\bhnhhb.exec:\bhnhhb.exe42⤵
- Executes dropped EXE
PID:1500 -
\??\c:\9pjdv.exec:\9pjdv.exe43⤵
- Executes dropped EXE
PID:3340 -
\??\c:\bbhttt.exec:\bbhttt.exe44⤵
- Executes dropped EXE
PID:2628 -
\??\c:\rfffxrr.exec:\rfffxrr.exe45⤵
- Executes dropped EXE
PID:1992 -
\??\c:\dvpvp.exec:\dvpvp.exe46⤵
- Executes dropped EXE
PID:1320 -
\??\c:\rxxllfl.exec:\rxxllfl.exe47⤵
- Executes dropped EXE
PID:1620 -
\??\c:\5hhhbb.exec:\5hhhbb.exe48⤵
- Executes dropped EXE
PID:3976 -
\??\c:\lrfrlll.exec:\lrfrlll.exe49⤵
- Executes dropped EXE
PID:4672 -
\??\c:\9ntnhh.exec:\9ntnhh.exe50⤵
- Executes dropped EXE
PID:4596 -
\??\c:\flrxlrr.exec:\flrxlrr.exe51⤵
- Executes dropped EXE
PID:2408 -
\??\c:\bbhhnn.exec:\bbhhnn.exe52⤵
- Executes dropped EXE
PID:2056 -
\??\c:\xxrrllf.exec:\xxrrllf.exe53⤵
- Executes dropped EXE
PID:716 -
\??\c:\pddvj.exec:\pddvj.exe54⤵
- Executes dropped EXE
PID:1048 -
\??\c:\xxlfxxx.exec:\xxlfxxx.exe55⤵
- Executes dropped EXE
PID:2412 -
\??\c:\7jvdv.exec:\7jvdv.exe56⤵
- Executes dropped EXE
PID:4076 -
\??\c:\tbbnht.exec:\tbbnht.exe57⤵
- Executes dropped EXE
PID:3320 -
\??\c:\xllfffx.exec:\xllfffx.exe58⤵
- Executes dropped EXE
PID:4416 -
\??\c:\thhhhb.exec:\thhhhb.exe59⤵
- Executes dropped EXE
PID:3260 -
\??\c:\5rfrllf.exec:\5rfrllf.exe60⤵
- Executes dropped EXE
PID:3656 -
\??\c:\btbtnh.exec:\btbtnh.exe61⤵
- Executes dropped EXE
PID:760 -
\??\c:\9vjjp.exec:\9vjjp.exe62⤵
- Executes dropped EXE
PID:1964 -
\??\c:\9nnhhn.exec:\9nnhhn.exe63⤵
- Executes dropped EXE
PID:3304 -
\??\c:\jvvdv.exec:\jvvdv.exe64⤵
- Executes dropped EXE
PID:4448 -
\??\c:\9btbht.exec:\9btbht.exe65⤵
- Executes dropped EXE
PID:4452 -
\??\c:\fxfllrf.exec:\fxfllrf.exe66⤵PID:4560
-
\??\c:\5bhhbt.exec:\5bhhbt.exe67⤵PID:2488
-
\??\c:\vpddv.exec:\vpddv.exe68⤵PID:3844
-
\??\c:\9hhbbn.exec:\9hhbbn.exe69⤵PID:2660
-
\??\c:\lxxffff.exec:\lxxffff.exe70⤵PID:4164
-
\??\c:\thtnnn.exec:\thtnnn.exe71⤵PID:1952
-
\??\c:\xrlffxx.exec:\xrlffxx.exe72⤵PID:1812
-
\??\c:\xfxxlll.exec:\xfxxlll.exe73⤵PID:936
-
\??\c:\jdppp.exec:\jdppp.exe74⤵PID:4468
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe75⤵PID:1080
-
\??\c:\ttbbnn.exec:\ttbbnn.exe76⤵PID:1624
-
\??\c:\vpddv.exec:\vpddv.exe77⤵PID:4660
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe78⤵PID:1684
-
\??\c:\vvjvv.exec:\vvjvv.exe79⤵PID:3864
-
\??\c:\5hhhtb.exec:\5hhhtb.exe80⤵PID:3192
-
\??\c:\vjpjd.exec:\vjpjd.exe81⤵PID:728
-
\??\c:\nhhbhb.exec:\nhhbhb.exe82⤵PID:1992
-
\??\c:\pvpjd.exec:\pvpjd.exe83⤵PID:4936
-
\??\c:\bhttbh.exec:\bhttbh.exe84⤵PID:3248
-
\??\c:\jvdvv.exec:\jvdvv.exe85⤵PID:1456
-
\??\c:\llxfxxr.exec:\llxfxxr.exe86⤵PID:3060
-
\??\c:\hhhbbb.exec:\hhhbbb.exe87⤵PID:3084
-
\??\c:\llfxflf.exec:\llfxflf.exe88⤵PID:4828
-
\??\c:\htttnn.exec:\htttnn.exe89⤵PID:4552
-
\??\c:\frffxxr.exec:\frffxxr.exe90⤵PID:1588
-
\??\c:\hhbttt.exec:\hhbttt.exe91⤵PID:3240
-
\??\c:\pvdvv.exec:\pvdvv.exe92⤵PID:3260
-
\??\c:\9bbnhn.exec:\9bbnhn.exe93⤵PID:1876
-
\??\c:\jvddp.exec:\jvddp.exe94⤵PID:3644
-
\??\c:\bnbbbh.exec:\bnbbbh.exe95⤵PID:4968
-
\??\c:\dvppd.exec:\dvppd.exe96⤵PID:180
-
\??\c:\nhnhbt.exec:\nhnhbt.exe97⤵PID:3176
-
\??\c:\pdjdp.exec:\pdjdp.exe98⤵PID:3360
-
\??\c:\hbbbhh.exec:\hbbbhh.exe99⤵PID:2488
-
\??\c:\3rxrrrl.exec:\3rxrrrl.exe100⤵PID:1664
-
\??\c:\tnbbnn.exec:\tnbbnn.exe101⤵PID:3080
-
\??\c:\jdddj.exec:\jdddj.exe102⤵PID:2016
-
\??\c:\nhtntt.exec:\nhtntt.exe103⤵PID:4628
-
\??\c:\3frrxxl.exec:\3frrxxl.exe104⤵PID:1288
-
\??\c:\nntbtt.exec:\nntbtt.exe105⤵PID:1932
-
\??\c:\rllfffx.exec:\rllfffx.exe106⤵PID:8
-
\??\c:\bbhhhh.exec:\bbhhhh.exe107⤵PID:4620
-
\??\c:\jddjd.exec:\jddjd.exe108⤵PID:664
-
\??\c:\5hnnhb.exec:\5hnnhb.exe109⤵PID:4576
-
\??\c:\jdvjd.exec:\jdvjd.exe110⤵PID:396
-
\??\c:\xrrllll.exec:\xrrllll.exe111⤵PID:2628
-
\??\c:\nntnhn.exec:\nntnhn.exe112⤵PID:5044
-
\??\c:\rrlxrll.exec:\rrlxrll.exe113⤵PID:5084
-
\??\c:\llrlrrx.exec:\llrlrrx.exe114⤵PID:1184
-
\??\c:\jjjjd.exec:\jjjjd.exe115⤵PID:1008
-
\??\c:\5xlfllf.exec:\5xlfllf.exe116⤵PID:1736
-
\??\c:\nnhtnh.exec:\nnhtnh.exe117⤵PID:2056
-
\??\c:\rlllfxl.exec:\rlllfxl.exe118⤵PID:3364
-
\??\c:\rfrfxff.exec:\rfrfxff.exe119⤵PID:2592
-
\??\c:\vvvvp.exec:\vvvvp.exe120⤵PID:2716
-
\??\c:\rlrrlll.exec:\rlrrlll.exe121⤵PID:2772
-
\??\c:\vjjpv.exec:\vjjpv.exe122⤵PID:3032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-