Analysis
-
max time kernel
101s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 18:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0bd3d99b2359de642b3c9ce8f17792e4a6b8e4f6ece0205ff104f430ebecd706.exe
Resource
win7-20231129-en
6 signatures
150 seconds
Errors
Reason
Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-19T18:34:31Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win10v2004-20240412-en/instance_15-dirty.qcow2\"}"
General
-
Target
0bd3d99b2359de642b3c9ce8f17792e4a6b8e4f6ece0205ff104f430ebecd706.exe
-
Size
140KB
-
MD5
1c841dc0ab74cdc42ddf7fc20143e77e
-
SHA1
de7e0b73392718bd530bd8aa111b5dd7fb0b1be4
-
SHA256
0bd3d99b2359de642b3c9ce8f17792e4a6b8e4f6ece0205ff104f430ebecd706
-
SHA512
0184acf36fc978af27af53704bb1cc9eea0d21f1799ebd6fb37bacb64047fa77669eaf99e38109250059e784e13ce1eada8fe5e8edab1ceaee7a95725578c33a
-
SSDEEP
3072:ymb3NkkiQ3mdBjFomR7UsyJC+n0Gsgyek1w:n3C9BRomRph+0GsgyeYw
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral2/memory/2520-2-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2092-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2160-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1100-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2300-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4376-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-321-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-339-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-347-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-350-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-360-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 50 IoCs
resource yara_rule behavioral2/memory/2520-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2092-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3192-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3192-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4320-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5064-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5064-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2160-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5080-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4352-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4324-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3900-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2668-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1668-98-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4408-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4972-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4812-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4256-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2740-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1776-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2148-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2148-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3776-156-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3024-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3024-166-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2488-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3488-178-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4232-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3228-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1100-207-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2876-213-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2300-218-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1736-232-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1736-234-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2276-240-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2372-253-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3560-257-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3560-260-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2764-266-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2620-285-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4644-287-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4376-295-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2432-300-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3156-316-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3156-321-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/972-339-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4428-347-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1332-350-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4064-354-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4552-360-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2092 rxlfxfl.exe 3192 vdpjd.exe 4320 nnhbhh.exe 4712 fxlfxxx.exe 5064 7nhhbb.exe 2160 vjvdj.exe 5080 httnhh.exe 2624 vdddv.exe 4352 xrrlfff.exe 4324 7vdjj.exe 3900 xflffxr.exe 2668 9nnhbt.exe 1668 rllfxxr.exe 4408 dvjdv.exe 4972 9xffffx.exe 4812 jjddv.exe 4256 ntnhbb.exe 2740 pjdvp.exe 1776 7frlxxx.exe 2148 1pdvp.exe 3776 hhhbnn.exe 3024 dpdvp.exe 2488 fffxrrl.exe 3488 vdpdv.exe 4232 ppvvv.exe 212 xlffxxx.exe 3228 vppjj.exe 1100 xlrlxxr.exe 2876 jjjjd.exe 2300 9hhhbb.exe 1164 frxrlll.exe 1736 9dvjp.exe 2276 xrrfffl.exe 4912 ddjdd.exe 2084 hnhhbh.exe 2372 vpjdv.exe 3560 lxxrlfx.exe 2764 hthbtb.exe 1956 5lrrxxx.exe 848 bttbtt.exe 1692 1flfxll.exe 2620 frrxrfl.exe 4644 dvppd.exe 4376 thhhhh.exe 2432 9rfrfxr.exe 528 jvddp.exe 2832 tttnhh.exe 4536 dvpjj.exe 3156 1hnhbb.exe 1512 bhhbnn.exe 3688 5fffrrr.exe 2528 hbtnnt.exe 2024 rlrlxxx.exe 972 hnbbbt.exe 4428 dpppj.exe 1332 hhtnhh.exe 4064 pdpdd.exe 4552 7nnnth.exe 5088 dvvpd.exe 4992 3nnhbh.exe 1664 vjjdv.exe 3252 bbhhtt.exe 4216 pvvpj.exe 4328 3rlfrrx.exe -
resource yara_rule behavioral2/memory/2520-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1100-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2300-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4376-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-316-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-321-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-339-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-347-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-350-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-354-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-360-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2092 2520 0bd3d99b2359de642b3c9ce8f17792e4a6b8e4f6ece0205ff104f430ebecd706.exe 85 PID 2520 wrote to memory of 2092 2520 0bd3d99b2359de642b3c9ce8f17792e4a6b8e4f6ece0205ff104f430ebecd706.exe 85 PID 2520 wrote to memory of 2092 2520 0bd3d99b2359de642b3c9ce8f17792e4a6b8e4f6ece0205ff104f430ebecd706.exe 85 PID 2092 wrote to memory of 3192 2092 rxlfxfl.exe 86 PID 2092 wrote to memory of 3192 2092 rxlfxfl.exe 86 PID 2092 wrote to memory of 3192 2092 rxlfxfl.exe 86 PID 3192 wrote to memory of 4320 3192 vdpjd.exe 87 PID 3192 wrote to memory of 4320 3192 vdpjd.exe 87 PID 3192 wrote to memory of 4320 3192 vdpjd.exe 87 PID 4320 wrote to memory of 4712 4320 nnhbhh.exe 88 PID 4320 wrote to memory of 4712 4320 nnhbhh.exe 88 PID 4320 wrote to memory of 4712 4320 nnhbhh.exe 88 PID 4712 wrote to memory of 5064 4712 fxlfxxx.exe 89 PID 4712 wrote to memory of 5064 4712 fxlfxxx.exe 89 PID 4712 wrote to memory of 5064 4712 fxlfxxx.exe 89 PID 5064 wrote to memory of 2160 5064 7nhhbb.exe 90 PID 5064 wrote to memory of 2160 5064 7nhhbb.exe 90 PID 5064 wrote to memory of 2160 5064 7nhhbb.exe 90 PID 2160 wrote to memory of 5080 2160 vjvdj.exe 91 PID 2160 wrote to memory of 5080 2160 vjvdj.exe 91 PID 2160 wrote to memory of 5080 2160 vjvdj.exe 91 PID 5080 wrote to memory of 2624 5080 httnhh.exe 92 PID 5080 wrote to memory of 2624 5080 httnhh.exe 92 PID 5080 wrote to memory of 2624 5080 httnhh.exe 92 PID 2624 wrote to memory of 4352 2624 vdddv.exe 93 PID 2624 wrote to memory of 4352 2624 vdddv.exe 93 PID 2624 wrote to memory of 4352 2624 vdddv.exe 93 PID 4352 wrote to memory of 4324 4352 xrrlfff.exe 94 PID 4352 wrote to memory of 4324 4352 xrrlfff.exe 94 PID 4352 wrote to memory of 4324 4352 xrrlfff.exe 94 PID 4324 wrote to memory of 3900 4324 7vdjj.exe 95 PID 4324 wrote to memory of 3900 4324 7vdjj.exe 95 PID 4324 wrote to memory of 3900 4324 7vdjj.exe 95 PID 3900 wrote to memory of 2668 3900 xflffxr.exe 96 PID 3900 wrote to memory of 2668 3900 xflffxr.exe 96 PID 3900 wrote to memory of 2668 3900 xflffxr.exe 96 PID 2668 wrote to memory of 1668 2668 9nnhbt.exe 97 PID 2668 wrote to memory of 1668 2668 9nnhbt.exe 97 PID 2668 wrote to memory of 1668 2668 9nnhbt.exe 97 PID 1668 wrote to memory of 4408 1668 rllfxxr.exe 98 PID 1668 wrote to memory of 4408 1668 rllfxxr.exe 98 PID 1668 wrote to memory of 4408 1668 rllfxxr.exe 98 PID 4408 wrote to memory of 4972 4408 dvjdv.exe 99 PID 4408 wrote to memory of 4972 4408 dvjdv.exe 99 PID 4408 wrote to memory of 4972 4408 dvjdv.exe 99 PID 4972 wrote to memory of 4812 4972 9xffffx.exe 100 PID 4972 wrote to memory of 4812 4972 9xffffx.exe 100 PID 4972 wrote to memory of 4812 4972 9xffffx.exe 100 PID 4812 wrote to memory of 4256 4812 jjddv.exe 101 PID 4812 wrote to memory of 4256 4812 jjddv.exe 101 PID 4812 wrote to memory of 4256 4812 jjddv.exe 101 PID 4256 wrote to memory of 2740 4256 ntnhbb.exe 102 PID 4256 wrote to memory of 2740 4256 ntnhbb.exe 102 PID 4256 wrote to memory of 2740 4256 ntnhbb.exe 102 PID 2740 wrote to memory of 1776 2740 pjdvp.exe 103 PID 2740 wrote to memory of 1776 2740 pjdvp.exe 103 PID 2740 wrote to memory of 1776 2740 pjdvp.exe 103 PID 1776 wrote to memory of 2148 1776 7frlxxx.exe 104 PID 1776 wrote to memory of 2148 1776 7frlxxx.exe 104 PID 1776 wrote to memory of 2148 1776 7frlxxx.exe 104 PID 2148 wrote to memory of 3776 2148 1pdvp.exe 106 PID 2148 wrote to memory of 3776 2148 1pdvp.exe 106 PID 2148 wrote to memory of 3776 2148 1pdvp.exe 106 PID 3776 wrote to memory of 3024 3776 hhhbnn.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bd3d99b2359de642b3c9ce8f17792e4a6b8e4f6ece0205ff104f430ebecd706.exe"C:\Users\Admin\AppData\Local\Temp\0bd3d99b2359de642b3c9ce8f17792e4a6b8e4f6ece0205ff104f430ebecd706.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\rxlfxfl.exec:\rxlfxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\vdpjd.exec:\vdpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\nnhbhh.exec:\nnhbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\fxlfxxx.exec:\fxlfxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\7nhhbb.exec:\7nhhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\vjvdj.exec:\vjvdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\httnhh.exec:\httnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\vdddv.exec:\vdddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\xrrlfff.exec:\xrrlfff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\7vdjj.exec:\7vdjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\xflffxr.exec:\xflffxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\9nnhbt.exec:\9nnhbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\rllfxxr.exec:\rllfxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\dvjdv.exec:\dvjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\9xffffx.exec:\9xffffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\jjddv.exec:\jjddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\ntnhbb.exec:\ntnhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\pjdvp.exec:\pjdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\7frlxxx.exec:\7frlxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\1pdvp.exec:\1pdvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\hhhbnn.exec:\hhhbnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\dpdvp.exec:\dpdvp.exe23⤵
- Executes dropped EXE
PID:3024 -
\??\c:\fffxrrl.exec:\fffxrrl.exe24⤵
- Executes dropped EXE
PID:2488 -
\??\c:\vdpdv.exec:\vdpdv.exe25⤵
- Executes dropped EXE
PID:3488 -
\??\c:\ppvvv.exec:\ppvvv.exe26⤵
- Executes dropped EXE
PID:4232 -
\??\c:\xlffxxx.exec:\xlffxxx.exe27⤵
- Executes dropped EXE
PID:212 -
\??\c:\vppjj.exec:\vppjj.exe28⤵
- Executes dropped EXE
PID:3228 -
\??\c:\xlrlxxr.exec:\xlrlxxr.exe29⤵
- Executes dropped EXE
PID:1100 -
\??\c:\jjjjd.exec:\jjjjd.exe30⤵
- Executes dropped EXE
PID:2876 -
\??\c:\9hhhbb.exec:\9hhhbb.exe31⤵
- Executes dropped EXE
PID:2300 -
\??\c:\jddjd.exec:\jddjd.exe32⤵PID:2688
-
\??\c:\frxrlll.exec:\frxrlll.exe33⤵
- Executes dropped EXE
PID:1164 -
\??\c:\9dvjp.exec:\9dvjp.exe34⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xrrfffl.exec:\xrrfffl.exe35⤵
- Executes dropped EXE
PID:2276 -
\??\c:\ddjdd.exec:\ddjdd.exe36⤵
- Executes dropped EXE
PID:4912 -
\??\c:\hnhhbh.exec:\hnhhbh.exe37⤵
- Executes dropped EXE
PID:2084 -
\??\c:\vpjdv.exec:\vpjdv.exe38⤵
- Executes dropped EXE
PID:2372 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe39⤵
- Executes dropped EXE
PID:3560 -
\??\c:\hthbtb.exec:\hthbtb.exe40⤵
- Executes dropped EXE
PID:2764 -
\??\c:\5lrrxxx.exec:\5lrrxxx.exe41⤵
- Executes dropped EXE
PID:1956 -
\??\c:\bttbtt.exec:\bttbtt.exe42⤵
- Executes dropped EXE
PID:848 -
\??\c:\1flfxll.exec:\1flfxll.exe43⤵
- Executes dropped EXE
PID:1692 -
\??\c:\frrxrfl.exec:\frrxrfl.exe44⤵
- Executes dropped EXE
PID:2620 -
\??\c:\dvppd.exec:\dvppd.exe45⤵
- Executes dropped EXE
PID:4644 -
\??\c:\thhhhh.exec:\thhhhh.exe46⤵
- Executes dropped EXE
PID:4376 -
\??\c:\9rfrfxr.exec:\9rfrfxr.exe47⤵
- Executes dropped EXE
PID:2432 -
\??\c:\jvddp.exec:\jvddp.exe48⤵
- Executes dropped EXE
PID:528 -
\??\c:\tttnhh.exec:\tttnhh.exe49⤵
- Executes dropped EXE
PID:2832 -
\??\c:\dvpjj.exec:\dvpjj.exe50⤵
- Executes dropped EXE
PID:4536 -
\??\c:\1hnhbb.exec:\1hnhbb.exe51⤵
- Executes dropped EXE
PID:3156 -
\??\c:\bhhbnn.exec:\bhhbnn.exe52⤵
- Executes dropped EXE
PID:1512 -
\??\c:\5fffrrr.exec:\5fffrrr.exe53⤵
- Executes dropped EXE
PID:3688 -
\??\c:\hbtnnt.exec:\hbtnnt.exe54⤵
- Executes dropped EXE
PID:2528 -
\??\c:\rlrlxxx.exec:\rlrlxxx.exe55⤵
- Executes dropped EXE
PID:2024 -
\??\c:\hnbbbt.exec:\hnbbbt.exe56⤵
- Executes dropped EXE
PID:972 -
\??\c:\dpppj.exec:\dpppj.exe57⤵
- Executes dropped EXE
PID:4428 -
\??\c:\hhtnhh.exec:\hhtnhh.exe58⤵
- Executes dropped EXE
PID:1332 -
\??\c:\pdpdd.exec:\pdpdd.exe59⤵
- Executes dropped EXE
PID:4064 -
\??\c:\7nnnth.exec:\7nnnth.exe60⤵
- Executes dropped EXE
PID:4552 -
\??\c:\dvvpd.exec:\dvvpd.exe61⤵
- Executes dropped EXE
PID:5088 -
\??\c:\3nnhbh.exec:\3nnhbh.exe62⤵
- Executes dropped EXE
PID:4992 -
\??\c:\vjjdv.exec:\vjjdv.exe63⤵
- Executes dropped EXE
PID:1664 -
\??\c:\bbhhtt.exec:\bbhhtt.exe64⤵
- Executes dropped EXE
PID:3252 -
\??\c:\pvvpj.exec:\pvvpj.exe65⤵
- Executes dropped EXE
PID:4216 -
\??\c:\3rlfrrx.exec:\3rlfrrx.exe66⤵
- Executes dropped EXE
PID:4328 -
\??\c:\1nnhbb.exec:\1nnhbb.exe67⤵PID:4316
-
\??\c:\7lxxrxf.exec:\7lxxrxf.exe68⤵PID:4164
-
\??\c:\7btnhh.exec:\7btnhh.exe69⤵PID:1040
-
\??\c:\rlxrllf.exec:\rlxrllf.exe70⤵PID:3264
-
\??\c:\5hbnnn.exec:\5hbnnn.exe71⤵PID:612
-
\??\c:\dvpjd.exec:\dvpjd.exe72⤵PID:2104
-
\??\c:\nhhhtt.exec:\nhhhtt.exe73⤵PID:2256
-
\??\c:\5ddvp.exec:\5ddvp.exe74⤵PID:4908
-
\??\c:\thhbnh.exec:\thhbnh.exe75⤵PID:772
-
\??\c:\dvdpj.exec:\dvdpj.exe76⤵PID:3360
-
\??\c:\nbtnbt.exec:\nbtnbt.exe77⤵PID:404
-
\??\c:\pdppp.exec:\pdppp.exe78⤵PID:4384
-
\??\c:\ttbtnn.exec:\ttbtnn.exe79⤵PID:4396
-
\??\c:\dvddv.exec:\dvddv.exe80⤵PID:4380
-
\??\c:\9fllxxx.exec:\9fllxxx.exe81⤵PID:4492
-
\??\c:\hbtnhh.exec:\hbtnhh.exe82⤵PID:1980
-
\??\c:\3vdvd.exec:\3vdvd.exe83⤵PID:1984
-
\??\c:\3nnthh.exec:\3nnthh.exe84⤵PID:4532
-
\??\c:\dddvv.exec:\dddvv.exe85⤵PID:1668
-
\??\c:\7bbbnt.exec:\7bbbnt.exe86⤵PID:5028
-
\??\c:\pjdjd.exec:\pjdjd.exe87⤵PID:2832
-
\??\c:\9rrlflf.exec:\9rrlflf.exe88⤵PID:4468
-
\??\c:\9vdvv.exec:\9vdvv.exe89⤵PID:3156
-
\??\c:\fxffflr.exec:\fxffflr.exe90⤵PID:2820
-
\??\c:\tnnhnn.exec:\tnnhnn.exe91⤵PID:5076
-
\??\c:\ffxxlrl.exec:\ffxxlrl.exe92⤵PID:2024
-
\??\c:\bntttt.exec:\bntttt.exe93⤵PID:972
-
\??\c:\3ddvp.exec:\3ddvp.exe94⤵PID:4428
-
\??\c:\5bhhbb.exec:\5bhhbb.exe95⤵PID:1332
-
\??\c:\dvpjj.exec:\dvpjj.exe96⤵PID:1304
-
\??\c:\nnnhnh.exec:\nnnhnh.exe97⤵PID:3448
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe98⤵PID:5088
-
\??\c:\vvjjv.exec:\vvjjv.exe99⤵PID:116
-
\??\c:\vpjvv.exec:\vpjvv.exe100⤵PID:1008
-
\??\c:\xfxrfff.exec:\xfxrfff.exe101⤵PID:4796
-
\??\c:\dvdvv.exec:\dvdvv.exe102⤵PID:4300
-
\??\c:\llrlfrl.exec:\llrlfrl.exe103⤵PID:4328
-
\??\c:\1dddp.exec:\1dddp.exe104⤵PID:2520
-
\??\c:\xllfxlf.exec:\xllfxlf.exe105⤵PID:4164
-
\??\c:\nbhnhn.exec:\nbhnhn.exe106⤵PID:3028
-
\??\c:\jdjpd.exec:\jdjpd.exe107⤵PID:1964
-
\??\c:\hhtttt.exec:\hhtttt.exe108⤵PID:4136
-
\??\c:\vpvvj.exec:\vpvvj.exe109⤵PID:2372
-
\??\c:\tnbbbb.exec:\tnbbbb.exe110⤵PID:1120
-
\??\c:\lfrlfxl.exec:\lfrlfxl.exe111⤵PID:2764
-
\??\c:\jvvvv.exec:\jvvvv.exe112⤵PID:3360
-
\??\c:\rfrfxrf.exec:\rfrfxrf.exe113⤵PID:404
-
\??\c:\hnhbth.exec:\hnhbth.exe114⤵PID:3244
-
\??\c:\dvdjv.exec:\dvdjv.exe115⤵PID:2716
-
\??\c:\3nnbtt.exec:\3nnbtt.exe116⤵PID:1988
-
\??\c:\pvvjd.exec:\pvvjd.exe117⤵PID:3664
-
\??\c:\hhnhtb.exec:\hhnhtb.exe118⤵PID:3960
-
\??\c:\pjpdv.exec:\pjpdv.exe119⤵PID:1344
-
\??\c:\fxfxrlx.exec:\fxfxrlx.exe120⤵PID:4348
-
\??\c:\7nbntt.exec:\7nbntt.exe121⤵PID:2440
-
\??\c:\llrrrrr.exec:\llrrrrr.exe122⤵PID:5028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-