Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2024, 10:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b8879cb8a371fdcb99da7a54ef28eb33.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
b8879cb8a371fdcb99da7a54ef28eb33.exe
-
Size
479KB
-
MD5
b8879cb8a371fdcb99da7a54ef28eb33
-
SHA1
5e742cdbe14a869f2b7069ee4009e4543e70c8aa
-
SHA256
da7878ef20a015e47379486c9b004055ed1c6ff75aeb1f7671a41c594a97a0fc
-
SHA512
59bd4d2a87d0bcc50a5120b628e39f2a8100b218665a780a9eaf18ff6bc366af52f58a4763612ef16a15e1a5ba6a0fa45dd218fbac33f436fe62bd958bb4f7b4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwu1b26X1wjdgyPif:q7Tc2NYHUrAwqzQ7Pe
Malware Config
Signatures
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/4608-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/588-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1516-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/648-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2772-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1324-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2672-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-674-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-787-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-801-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2748-821-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-876-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-886-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-1192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5008 nhhbnh.exe 4384 vpdvj.exe 2372 nttnhh.exe 1472 7ppdp.exe 588 thnbtn.exe 2404 bnhbth.exe 3060 btnbnh.exe 3620 xlrlrlr.exe 400 dvvpj.exe 2832 xrrlfxl.exe 4588 nbhbhh.exe 4984 lxllfrf.exe 4720 jvvpp.exe 3116 3hbnhb.exe 4576 9lrffxx.exe 4404 9nnhtt.exe 1516 htnhbt.exe 3992 lfffrll.exe 2380 bnnhnn.exe 3088 lxxxlfx.exe 1860 bhhhbt.exe 3540 xxxlxrf.exe 3300 3bntht.exe 1792 9vjvp.exe 4692 nttnhb.exe 2552 llxrfxl.exe 464 thnnhh.exe 396 dppdj.exe 804 bhtnbt.exe 4876 btbtnn.exe 1796 dppjd.exe 5080 pvvjv.exe 648 rfffrff.exe 1252 frxlrfl.exe 3324 1vpjd.exe 5048 5tnthb.exe 1564 vjvjv.exe 4344 dpvjv.exe 1392 9nhtnn.exe 4196 lxxrxxr.exe 2300 lfxrlfx.exe 1844 ddjvp.exe 4872 hthbnh.exe 4112 dvvpp.exe 3320 flrlxxr.exe 3500 5bbnbb.exe 4540 1nthnt.exe 1156 bnthbt.exe 2724 pjjvv.exe 5032 lxfxlfx.exe 2772 9hhbnn.exe 3564 vppjv.exe 3676 fllxlfx.exe 2100 ntbtnt.exe 5064 3tnthb.exe 2456 dddjd.exe 4884 rxfrlrl.exe 5072 1ttthh.exe 1916 1vpdv.exe 1516 rrlxrfx.exe 5052 ddddd.exe 2380 pjpjj.exe 748 xflfxrl.exe 3516 hbtnbb.exe -
resource yara_rule behavioral2/memory/4608-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/588-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/588-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1516-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/648-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4196-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2772-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2672-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-750-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-787-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4608 wrote to memory of 5008 4608 b8879cb8a371fdcb99da7a54ef28eb33.exe 89 PID 4608 wrote to memory of 5008 4608 b8879cb8a371fdcb99da7a54ef28eb33.exe 89 PID 4608 wrote to memory of 5008 4608 b8879cb8a371fdcb99da7a54ef28eb33.exe 89 PID 5008 wrote to memory of 4384 5008 nhhbnh.exe 90 PID 5008 wrote to memory of 4384 5008 nhhbnh.exe 90 PID 5008 wrote to memory of 4384 5008 nhhbnh.exe 90 PID 4384 wrote to memory of 2372 4384 vpdvj.exe 91 PID 4384 wrote to memory of 2372 4384 vpdvj.exe 91 PID 4384 wrote to memory of 2372 4384 vpdvj.exe 91 PID 2372 wrote to memory of 1472 2372 nttnhh.exe 92 PID 2372 wrote to memory of 1472 2372 nttnhh.exe 92 PID 2372 wrote to memory of 1472 2372 nttnhh.exe 92 PID 1472 wrote to memory of 588 1472 7ppdp.exe 93 PID 1472 wrote to memory of 588 1472 7ppdp.exe 93 PID 1472 wrote to memory of 588 1472 7ppdp.exe 93 PID 588 wrote to memory of 2404 588 thnbtn.exe 94 PID 588 wrote to memory of 2404 588 thnbtn.exe 94 PID 588 wrote to memory of 2404 588 thnbtn.exe 94 PID 2404 wrote to memory of 3060 2404 bnhbth.exe 95 PID 2404 wrote to memory of 3060 2404 bnhbth.exe 95 PID 2404 wrote to memory of 3060 2404 bnhbth.exe 95 PID 3060 wrote to memory of 3620 3060 btnbnh.exe 96 PID 3060 wrote to memory of 3620 3060 btnbnh.exe 96 PID 3060 wrote to memory of 3620 3060 btnbnh.exe 96 PID 3620 wrote to memory of 400 3620 xlrlrlr.exe 97 PID 3620 wrote to memory of 400 3620 xlrlrlr.exe 97 PID 3620 wrote to memory of 400 3620 xlrlrlr.exe 97 PID 400 wrote to memory of 2832 400 dvvpj.exe 98 PID 400 wrote to memory of 2832 400 dvvpj.exe 98 PID 400 wrote to memory of 2832 400 dvvpj.exe 98 PID 2832 wrote to memory of 4588 2832 xrrlfxl.exe 99 PID 2832 wrote to memory of 4588 2832 xrrlfxl.exe 99 PID 2832 wrote to memory of 4588 2832 xrrlfxl.exe 99 PID 4588 wrote to memory of 4984 4588 nbhbhh.exe 100 PID 4588 wrote to memory of 4984 4588 nbhbhh.exe 100 PID 4588 wrote to memory of 4984 4588 nbhbhh.exe 100 PID 4984 wrote to memory of 4720 4984 lxllfrf.exe 101 PID 4984 wrote to memory of 4720 4984 lxllfrf.exe 101 PID 4984 wrote to memory of 4720 4984 lxllfrf.exe 101 PID 4720 wrote to memory of 3116 4720 jvvpp.exe 102 PID 4720 wrote to memory of 3116 4720 jvvpp.exe 102 PID 4720 wrote to memory of 3116 4720 jvvpp.exe 102 PID 3116 wrote to memory of 4576 3116 3hbnhb.exe 103 PID 3116 wrote to memory of 4576 3116 3hbnhb.exe 103 PID 3116 wrote to memory of 4576 3116 3hbnhb.exe 103 PID 4576 wrote to memory of 4404 4576 9lrffxx.exe 104 PID 4576 wrote to memory of 4404 4576 9lrffxx.exe 104 PID 4576 wrote to memory of 4404 4576 9lrffxx.exe 104 PID 4404 wrote to memory of 1516 4404 9nnhtt.exe 105 PID 4404 wrote to memory of 1516 4404 9nnhtt.exe 105 PID 4404 wrote to memory of 1516 4404 9nnhtt.exe 105 PID 1516 wrote to memory of 3992 1516 htnhbt.exe 106 PID 1516 wrote to memory of 3992 1516 htnhbt.exe 106 PID 1516 wrote to memory of 3992 1516 htnhbt.exe 106 PID 3992 wrote to memory of 2380 3992 lfffrll.exe 107 PID 3992 wrote to memory of 2380 3992 lfffrll.exe 107 PID 3992 wrote to memory of 2380 3992 lfffrll.exe 107 PID 2380 wrote to memory of 3088 2380 bnnhnn.exe 108 PID 2380 wrote to memory of 3088 2380 bnnhnn.exe 108 PID 2380 wrote to memory of 3088 2380 bnnhnn.exe 108 PID 3088 wrote to memory of 1860 3088 lxxxlfx.exe 109 PID 3088 wrote to memory of 1860 3088 lxxxlfx.exe 109 PID 3088 wrote to memory of 1860 3088 lxxxlfx.exe 109 PID 1860 wrote to memory of 3540 1860 bhhhbt.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8879cb8a371fdcb99da7a54ef28eb33.exe"C:\Users\Admin\AppData\Local\Temp\b8879cb8a371fdcb99da7a54ef28eb33.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\nhhbnh.exec:\nhhbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\vpdvj.exec:\vpdvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\nttnhh.exec:\nttnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\7ppdp.exec:\7ppdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\thnbtn.exec:\thnbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\bnhbth.exec:\bnhbth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\btnbnh.exec:\btnbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\xlrlrlr.exec:\xlrlrlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\dvvpj.exec:\dvvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\xrrlfxl.exec:\xrrlfxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\nbhbhh.exec:\nbhbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\lxllfrf.exec:\lxllfrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\jvvpp.exec:\jvvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\3hbnhb.exec:\3hbnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\9lrffxx.exec:\9lrffxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\9nnhtt.exec:\9nnhtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\htnhbt.exec:\htnhbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\lfffrll.exec:\lfffrll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\bnnhnn.exec:\bnnhnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\lxxxlfx.exec:\lxxxlfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\bhhhbt.exec:\bhhhbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\xxxlxrf.exec:\xxxlxrf.exe23⤵
- Executes dropped EXE
PID:3540 -
\??\c:\3bntht.exec:\3bntht.exe24⤵
- Executes dropped EXE
PID:3300 -
\??\c:\9vjvp.exec:\9vjvp.exe25⤵
- Executes dropped EXE
PID:1792 -
\??\c:\nttnhb.exec:\nttnhb.exe26⤵
- Executes dropped EXE
PID:4692 -
\??\c:\llxrfxl.exec:\llxrfxl.exe27⤵
- Executes dropped EXE
PID:2552 -
\??\c:\thnnhh.exec:\thnnhh.exe28⤵
- Executes dropped EXE
PID:464 -
\??\c:\dppdj.exec:\dppdj.exe29⤵
- Executes dropped EXE
PID:396 -
\??\c:\bhtnbt.exec:\bhtnbt.exe30⤵
- Executes dropped EXE
PID:804 -
\??\c:\btbtnn.exec:\btbtnn.exe31⤵
- Executes dropped EXE
PID:4876 -
\??\c:\dppjd.exec:\dppjd.exe32⤵
- Executes dropped EXE
PID:1796 -
\??\c:\pvvjv.exec:\pvvjv.exe33⤵
- Executes dropped EXE
PID:5080 -
\??\c:\rfffrff.exec:\rfffrff.exe34⤵
- Executes dropped EXE
PID:648 -
\??\c:\frxlrfl.exec:\frxlrfl.exe35⤵
- Executes dropped EXE
PID:1252 -
\??\c:\1vpjd.exec:\1vpjd.exe36⤵
- Executes dropped EXE
PID:3324 -
\??\c:\5tnthb.exec:\5tnthb.exe37⤵
- Executes dropped EXE
PID:5048 -
\??\c:\vjvjv.exec:\vjvjv.exe38⤵
- Executes dropped EXE
PID:1564 -
\??\c:\dpvjv.exec:\dpvjv.exe39⤵
- Executes dropped EXE
PID:4344 -
\??\c:\9nhtnn.exec:\9nhtnn.exe40⤵
- Executes dropped EXE
PID:1392 -
\??\c:\lxxrxxr.exec:\lxxrxxr.exe41⤵
- Executes dropped EXE
PID:4196 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe42⤵
- Executes dropped EXE
PID:2300 -
\??\c:\ddjvp.exec:\ddjvp.exe43⤵
- Executes dropped EXE
PID:1844 -
\??\c:\hthbnh.exec:\hthbnh.exe44⤵
- Executes dropped EXE
PID:4872 -
\??\c:\dvvpp.exec:\dvvpp.exe45⤵
- Executes dropped EXE
PID:4112 -
\??\c:\flrlxxr.exec:\flrlxxr.exe46⤵
- Executes dropped EXE
PID:3320 -
\??\c:\5bbnbb.exec:\5bbnbb.exe47⤵
- Executes dropped EXE
PID:3500 -
\??\c:\1nthnt.exec:\1nthnt.exe48⤵
- Executes dropped EXE
PID:4540 -
\??\c:\bnthbt.exec:\bnthbt.exe49⤵
- Executes dropped EXE
PID:1156 -
\??\c:\pjjvv.exec:\pjjvv.exe50⤵
- Executes dropped EXE
PID:2724 -
\??\c:\lxfxlfx.exec:\lxfxlfx.exe51⤵
- Executes dropped EXE
PID:5032 -
\??\c:\9hhbnn.exec:\9hhbnn.exe52⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vppjv.exec:\vppjv.exe53⤵
- Executes dropped EXE
PID:3564 -
\??\c:\fllxlfx.exec:\fllxlfx.exe54⤵
- Executes dropped EXE
PID:3676 -
\??\c:\ntbtnt.exec:\ntbtnt.exe55⤵
- Executes dropped EXE
PID:2100 -
\??\c:\3tnthb.exec:\3tnthb.exe56⤵
- Executes dropped EXE
PID:5064 -
\??\c:\dddjd.exec:\dddjd.exe57⤵
- Executes dropped EXE
PID:2456 -
\??\c:\rxfrlrl.exec:\rxfrlrl.exe58⤵
- Executes dropped EXE
PID:4884 -
\??\c:\1ttthh.exec:\1ttthh.exe59⤵
- Executes dropped EXE
PID:5072 -
\??\c:\1vpdv.exec:\1vpdv.exe60⤵
- Executes dropped EXE
PID:1916 -
\??\c:\rrlxrfx.exec:\rrlxrfx.exe61⤵
- Executes dropped EXE
PID:1516 -
\??\c:\ddddd.exec:\ddddd.exe62⤵
- Executes dropped EXE
PID:5052 -
\??\c:\pjpjj.exec:\pjpjj.exe63⤵
- Executes dropped EXE
PID:2380 -
\??\c:\xflfxrl.exec:\xflfxrl.exe64⤵
- Executes dropped EXE
PID:748 -
\??\c:\hbtnbb.exec:\hbtnbb.exe65⤵
- Executes dropped EXE
PID:3516 -
\??\c:\pvvjp.exec:\pvvjp.exe66⤵PID:1228
-
\??\c:\xrlrfxx.exec:\xrlrfxx.exe67⤵PID:1348
-
\??\c:\9bhbhh.exec:\9bhbhh.exe68⤵PID:3700
-
\??\c:\nbbnhb.exec:\nbbnhb.exe69⤵PID:1636
-
\??\c:\pvdpj.exec:\pvdpj.exe70⤵PID:768
-
\??\c:\3xrlfxr.exec:\3xrlfxr.exe71⤵PID:3884
-
\??\c:\tnnhtn.exec:\tnnhtn.exe72⤵PID:1920
-
\??\c:\jpdpj.exec:\jpdpj.exe73⤵PID:448
-
\??\c:\dpvjv.exec:\dpvjv.exe74⤵PID:3524
-
\??\c:\xxrlffx.exec:\xxrlffx.exe75⤵PID:4572
-
\??\c:\pdvjv.exec:\pdvjv.exe76⤵PID:1324
-
\??\c:\jpvpj.exec:\jpvpj.exe77⤵PID:628
-
\??\c:\hnnbbt.exec:\hnnbbt.exe78⤵PID:3340
-
\??\c:\vpdvj.exec:\vpdvj.exe79⤵PID:2752
-
\??\c:\xxxffff.exec:\xxxffff.exe80⤵PID:3104
-
\??\c:\3btnbb.exec:\3btnbb.exe81⤵PID:2720
-
\??\c:\thnhth.exec:\thnhth.exe82⤵PID:2976
-
\??\c:\rllxxrr.exec:\rllxxrr.exe83⤵PID:3324
-
\??\c:\9xxlxrf.exec:\9xxlxrf.exe84⤵PID:4444
-
\??\c:\1bbnbb.exec:\1bbnbb.exe85⤵PID:4352
-
\??\c:\pjpdp.exec:\pjpdp.exe86⤵PID:4348
-
\??\c:\rrxrffr.exec:\rrxrffr.exe87⤵PID:4904
-
\??\c:\tnnhhb.exec:\tnnhhb.exe88⤵PID:2672
-
\??\c:\5ddpj.exec:\5ddpj.exe89⤵PID:2372
-
\??\c:\frrfxlf.exec:\frrfxlf.exe90⤵PID:1472
-
\??\c:\thbthb.exec:\thbthb.exe91⤵PID:1844
-
\??\c:\jdpvj.exec:\jdpvj.exe92⤵PID:2880
-
\??\c:\frxlfxl.exec:\frxlfxl.exe93⤵PID:4112
-
\??\c:\thnbbn.exec:\thnbbn.exe94⤵PID:4312
-
\??\c:\rlrllxx.exec:\rlrllxx.exe95⤵PID:3904
-
\??\c:\nttnbb.exec:\nttnbb.exe96⤵PID:3060
-
\??\c:\1vpdp.exec:\1vpdp.exe97⤵PID:2232
-
\??\c:\rfrfxrf.exec:\rfrfxrf.exe98⤵PID:2724
-
\??\c:\3xxllfr.exec:\3xxllfr.exe99⤵PID:2832
-
\??\c:\vppjp.exec:\vppjp.exe100⤵PID:3544
-
\??\c:\vvdpd.exec:\vvdpd.exe101⤵PID:992
-
\??\c:\5ffrfxl.exec:\5ffrfxl.exe102⤵PID:1892
-
\??\c:\1nnhth.exec:\1nnhth.exe103⤵PID:3116
-
\??\c:\1nbnhb.exec:\1nbnhb.exe104⤵PID:2100
-
\??\c:\1dvvj.exec:\1dvvj.exe105⤵PID:1400
-
\??\c:\lllxlff.exec:\lllxlff.exe106⤵PID:4404
-
\??\c:\vjjvp.exec:\vjjvp.exe107⤵PID:2360
-
\??\c:\frrffxl.exec:\frrffxl.exe108⤵PID:2500
-
\??\c:\7nhhbh.exec:\7nhhbh.exe109⤵PID:1248
-
\??\c:\nbtntn.exec:\nbtntn.exe110⤵PID:2512
-
\??\c:\9vpjj.exec:\9vpjj.exe111⤵PID:2612
-
\??\c:\xlllfxf.exec:\xlllfxf.exe112⤵PID:1752
-
\??\c:\bnnhtn.exec:\bnnhtn.exe113⤵PID:2060
-
\??\c:\hhhnbn.exec:\hhhnbn.exe114⤵PID:4392
-
\??\c:\dvdjv.exec:\dvdjv.exe115⤵PID:932
-
\??\c:\9lfxlfr.exec:\9lfxlfr.exe116⤵PID:2860
-
\??\c:\hthtbn.exec:\hthtbn.exe117⤵PID:3024
-
\??\c:\pdpdd.exec:\pdpdd.exe118⤵PID:464
-
\??\c:\3ppdp.exec:\3ppdp.exe119⤵PID:3884
-
\??\c:\xffllff.exec:\xffllff.exe120⤵PID:516
-
\??\c:\3flfffl.exec:\3flfffl.exe121⤵PID:1456
-
\??\c:\9tbttt.exec:\9tbttt.exe122⤵PID:412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-