Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 03:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c94558fc9b456fb8a6f057330df2bed318c146e6f9ebbd0df3191fba2392400a.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
-
Target
c94558fc9b456fb8a6f057330df2bed318c146e6f9ebbd0df3191fba2392400a.exe
-
Size
392KB
-
MD5
e7121e435e9361c18d3dad4ba5fe2012
-
SHA1
8b938a61c2db3ba905f351c207c0ae7f238c940d
-
SHA256
c94558fc9b456fb8a6f057330df2bed318c146e6f9ebbd0df3191fba2392400a
-
SHA512
6b4a2edc78dc26cf56a168017587d08ba6d5b4f7445d5aced015eb7502cfbf2e7526f69c83aa7dc6765a1e7ff465397ea969ff1a28c0fbd06d52c270dda7bb5a
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwO1:n3C9uYA7okVqdKwaO5CV7
Malware Config
Signatures
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral2/memory/2636-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/820-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/552-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/700-318-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2708-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-334-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1808-345-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3888-349-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/848-361-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-366-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1044-383-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/648-386-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 55 IoCs
resource yara_rule behavioral2/memory/2636-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2636-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2796-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2636-9-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/820-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3028-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3416-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3416-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/552-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/552-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3836-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1436-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1680-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1680-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4124-79-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4916-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3128-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2984-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1036-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1512-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4100-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4732-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1604-167-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1112-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1948-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/408-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4644-197-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4696-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2444-211-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3180-229-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/624-234-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1904-239-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3992-251-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1548-268-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1548-272-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3836-275-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4440-280-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4440-282-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4972-291-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4864-295-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4840-301-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1052-313-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/700-318-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2708-323-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1040-328-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1400-334-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3628-340-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1808-345-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3888-349-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/964-354-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/848-361-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1884-366-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1044-378-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1044-383-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/648-386-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2796 4888266.exe 820 88840.exe 3028 hbtnbn.exe 3416 g6266.exe 552 rrffxxx.exe 3836 dvvjd.exe 1436 u848660.exe 4108 242866.exe 1680 w64226.exe 4124 5vdvp.exe 4916 thnhbb.exe 1240 vjjjd.exe 3128 tnhtnh.exe 2984 tbhhbh.exe 1036 s0600.exe 3640 dpjvp.exe 1512 0446046.exe 4100 vdvjd.exe 1080 068080.exe 1788 vvpjp.exe 3620 pjppp.exe 4732 lfrfxll.exe 1604 btnnhn.exe 1112 djddd.exe 1948 u826004.exe 408 nnhbbn.exe 4644 24062.exe 4696 3hhbtt.exe 2444 pvpjp.exe 4172 8460488.exe 1584 i644006.exe 3180 jddvv.exe 624 lllfxxr.exe 1904 dvdvd.exe 2400 8262822.exe 1812 68660.exe 3992 pvddv.exe 4468 lxlfxrf.exe 2520 nbbbtt.exe 1616 o460048.exe 1548 tbbbtt.exe 3836 nbbttt.exe 4440 jvjjj.exe 4156 m4604.exe 4972 m4062.exe 4864 22222.exe 4840 002666.exe 2000 o848226.exe 3968 0442660.exe 1052 806464.exe 700 084406.exe 2708 8604286.exe 1040 xlrfxrf.exe 1400 u220848.exe 3628 1rrlxrf.exe 1808 m8422.exe 3888 66264.exe 964 xrxllll.exe 848 044666.exe 1884 228826.exe 3140 1vpjv.exe 2324 xrlflfx.exe 1044 frfxffx.exe 648 68822.exe -
resource yara_rule behavioral2/memory/2636-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/820-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1948-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3180-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-313-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/700-318-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2708-323-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-328-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-334-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1808-345-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-349-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-354-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/848-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1884-366-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1044-378-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1044-383-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/648-386-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2796 2636 c94558fc9b456fb8a6f057330df2bed318c146e6f9ebbd0df3191fba2392400a.exe 85 PID 2636 wrote to memory of 2796 2636 c94558fc9b456fb8a6f057330df2bed318c146e6f9ebbd0df3191fba2392400a.exe 85 PID 2636 wrote to memory of 2796 2636 c94558fc9b456fb8a6f057330df2bed318c146e6f9ebbd0df3191fba2392400a.exe 85 PID 2796 wrote to memory of 820 2796 4888266.exe 86 PID 2796 wrote to memory of 820 2796 4888266.exe 86 PID 2796 wrote to memory of 820 2796 4888266.exe 86 PID 820 wrote to memory of 3028 820 88840.exe 87 PID 820 wrote to memory of 3028 820 88840.exe 87 PID 820 wrote to memory of 3028 820 88840.exe 87 PID 3028 wrote to memory of 3416 3028 hbtnbn.exe 88 PID 3028 wrote to memory of 3416 3028 hbtnbn.exe 88 PID 3028 wrote to memory of 3416 3028 hbtnbn.exe 88 PID 3416 wrote to memory of 552 3416 g6266.exe 89 PID 3416 wrote to memory of 552 3416 g6266.exe 89 PID 3416 wrote to memory of 552 3416 g6266.exe 89 PID 552 wrote to memory of 3836 552 rrffxxx.exe 90 PID 552 wrote to memory of 3836 552 rrffxxx.exe 90 PID 552 wrote to memory of 3836 552 rrffxxx.exe 90 PID 3836 wrote to memory of 1436 3836 dvvjd.exe 91 PID 3836 wrote to memory of 1436 3836 dvvjd.exe 91 PID 3836 wrote to memory of 1436 3836 dvvjd.exe 91 PID 1436 wrote to memory of 4108 1436 u848660.exe 92 PID 1436 wrote to memory of 4108 1436 u848660.exe 92 PID 1436 wrote to memory of 4108 1436 u848660.exe 92 PID 4108 wrote to memory of 1680 4108 242866.exe 93 PID 4108 wrote to memory of 1680 4108 242866.exe 93 PID 4108 wrote to memory of 1680 4108 242866.exe 93 PID 1680 wrote to memory of 4124 1680 w64226.exe 94 PID 1680 wrote to memory of 4124 1680 w64226.exe 94 PID 1680 wrote to memory of 4124 1680 w64226.exe 94 PID 4124 wrote to memory of 4916 4124 5vdvp.exe 95 PID 4124 wrote to memory of 4916 4124 5vdvp.exe 95 PID 4124 wrote to memory of 4916 4124 5vdvp.exe 95 PID 4916 wrote to memory of 1240 4916 thnhbb.exe 96 PID 4916 wrote to memory of 1240 4916 thnhbb.exe 96 PID 4916 wrote to memory of 1240 4916 thnhbb.exe 96 PID 1240 wrote to memory of 3128 1240 vjjjd.exe 97 PID 1240 wrote to memory of 3128 1240 vjjjd.exe 97 PID 1240 wrote to memory of 3128 1240 vjjjd.exe 97 PID 3128 wrote to memory of 2984 3128 tnhtnh.exe 98 PID 3128 wrote to memory of 2984 3128 tnhtnh.exe 98 PID 3128 wrote to memory of 2984 3128 tnhtnh.exe 98 PID 2984 wrote to memory of 1036 2984 tbhhbh.exe 99 PID 2984 wrote to memory of 1036 2984 tbhhbh.exe 99 PID 2984 wrote to memory of 1036 2984 tbhhbh.exe 99 PID 1036 wrote to memory of 3640 1036 s0600.exe 100 PID 1036 wrote to memory of 3640 1036 s0600.exe 100 PID 1036 wrote to memory of 3640 1036 s0600.exe 100 PID 3640 wrote to memory of 1512 3640 dpjvp.exe 101 PID 3640 wrote to memory of 1512 3640 dpjvp.exe 101 PID 3640 wrote to memory of 1512 3640 dpjvp.exe 101 PID 1512 wrote to memory of 4100 1512 0446046.exe 102 PID 1512 wrote to memory of 4100 1512 0446046.exe 102 PID 1512 wrote to memory of 4100 1512 0446046.exe 102 PID 4100 wrote to memory of 1080 4100 vdvjd.exe 103 PID 4100 wrote to memory of 1080 4100 vdvjd.exe 103 PID 4100 wrote to memory of 1080 4100 vdvjd.exe 103 PID 1080 wrote to memory of 1788 1080 068080.exe 104 PID 1080 wrote to memory of 1788 1080 068080.exe 104 PID 1080 wrote to memory of 1788 1080 068080.exe 104 PID 1788 wrote to memory of 3620 1788 vvpjp.exe 105 PID 1788 wrote to memory of 3620 1788 vvpjp.exe 105 PID 1788 wrote to memory of 3620 1788 vvpjp.exe 105 PID 3620 wrote to memory of 4732 3620 pjppp.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\c94558fc9b456fb8a6f057330df2bed318c146e6f9ebbd0df3191fba2392400a.exe"C:\Users\Admin\AppData\Local\Temp\c94558fc9b456fb8a6f057330df2bed318c146e6f9ebbd0df3191fba2392400a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\4888266.exec:\4888266.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\88840.exec:\88840.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\hbtnbn.exec:\hbtnbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\g6266.exec:\g6266.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\rrffxxx.exec:\rrffxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\dvvjd.exec:\dvvjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\u848660.exec:\u848660.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\242866.exec:\242866.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\w64226.exec:\w64226.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\5vdvp.exec:\5vdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\thnhbb.exec:\thnhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\vjjjd.exec:\vjjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\tnhtnh.exec:\tnhtnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\tbhhbh.exec:\tbhhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\s0600.exec:\s0600.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\dpjvp.exec:\dpjvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\0446046.exec:\0446046.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\vdvjd.exec:\vdvjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\068080.exec:\068080.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\vvpjp.exec:\vvpjp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\pjppp.exec:\pjppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\lfrfxll.exec:\lfrfxll.exe23⤵
- Executes dropped EXE
PID:4732 -
\??\c:\btnnhn.exec:\btnnhn.exe24⤵
- Executes dropped EXE
PID:1604 -
\??\c:\djddd.exec:\djddd.exe25⤵
- Executes dropped EXE
PID:1112 -
\??\c:\u826004.exec:\u826004.exe26⤵
- Executes dropped EXE
PID:1948 -
\??\c:\nnhbbn.exec:\nnhbbn.exe27⤵
- Executes dropped EXE
PID:408 -
\??\c:\24062.exec:\24062.exe28⤵
- Executes dropped EXE
PID:4644 -
\??\c:\3hhbtt.exec:\3hhbtt.exe29⤵
- Executes dropped EXE
PID:4696 -
\??\c:\pvpjp.exec:\pvpjp.exe30⤵
- Executes dropped EXE
PID:2444 -
\??\c:\8460488.exec:\8460488.exe31⤵
- Executes dropped EXE
PID:4172 -
\??\c:\i644006.exec:\i644006.exe32⤵
- Executes dropped EXE
PID:1584 -
\??\c:\jddvv.exec:\jddvv.exe33⤵
- Executes dropped EXE
PID:3180 -
\??\c:\lllfxxr.exec:\lllfxxr.exe34⤵
- Executes dropped EXE
PID:624 -
\??\c:\dvdvd.exec:\dvdvd.exe35⤵
- Executes dropped EXE
PID:1904 -
\??\c:\8262822.exec:\8262822.exe36⤵
- Executes dropped EXE
PID:2400 -
\??\c:\68660.exec:\68660.exe37⤵
- Executes dropped EXE
PID:1812 -
\??\c:\pvddv.exec:\pvddv.exe38⤵
- Executes dropped EXE
PID:3992 -
\??\c:\lxlfxrf.exec:\lxlfxrf.exe39⤵
- Executes dropped EXE
PID:4468 -
\??\c:\nbbbtt.exec:\nbbbtt.exe40⤵
- Executes dropped EXE
PID:2520 -
\??\c:\o460048.exec:\o460048.exe41⤵
- Executes dropped EXE
PID:1616 -
\??\c:\tbbbtt.exec:\tbbbtt.exe42⤵
- Executes dropped EXE
PID:1548 -
\??\c:\nbbttt.exec:\nbbttt.exe43⤵
- Executes dropped EXE
PID:3836 -
\??\c:\jvjjj.exec:\jvjjj.exe44⤵
- Executes dropped EXE
PID:4440 -
\??\c:\m4604.exec:\m4604.exe45⤵
- Executes dropped EXE
PID:4156 -
\??\c:\m4062.exec:\m4062.exe46⤵
- Executes dropped EXE
PID:4972 -
\??\c:\22222.exec:\22222.exe47⤵
- Executes dropped EXE
PID:4864 -
\??\c:\002666.exec:\002666.exe48⤵
- Executes dropped EXE
PID:4840 -
\??\c:\o848226.exec:\o848226.exe49⤵
- Executes dropped EXE
PID:2000 -
\??\c:\0442660.exec:\0442660.exe50⤵
- Executes dropped EXE
PID:3968 -
\??\c:\806464.exec:\806464.exe51⤵
- Executes dropped EXE
PID:1052 -
\??\c:\084406.exec:\084406.exe52⤵
- Executes dropped EXE
PID:700 -
\??\c:\8604286.exec:\8604286.exe53⤵
- Executes dropped EXE
PID:2708 -
\??\c:\xlrfxrf.exec:\xlrfxrf.exe54⤵
- Executes dropped EXE
PID:1040 -
\??\c:\u220848.exec:\u220848.exe55⤵
- Executes dropped EXE
PID:1400 -
\??\c:\1rrlxrf.exec:\1rrlxrf.exe56⤵
- Executes dropped EXE
PID:3628 -
\??\c:\m8422.exec:\m8422.exe57⤵
- Executes dropped EXE
PID:1808 -
\??\c:\66264.exec:\66264.exe58⤵
- Executes dropped EXE
PID:3888 -
\??\c:\xrxllll.exec:\xrxllll.exe59⤵
- Executes dropped EXE
PID:964 -
\??\c:\044666.exec:\044666.exe60⤵
- Executes dropped EXE
PID:848 -
\??\c:\228826.exec:\228826.exe61⤵
- Executes dropped EXE
PID:1884 -
\??\c:\1vpjv.exec:\1vpjv.exe62⤵
- Executes dropped EXE
PID:3140 -
\??\c:\xrlflfx.exec:\xrlflfx.exe63⤵
- Executes dropped EXE
PID:2324 -
\??\c:\frfxffx.exec:\frfxffx.exe64⤵
- Executes dropped EXE
PID:1044 -
\??\c:\68822.exec:\68822.exe65⤵
- Executes dropped EXE
PID:648 -
\??\c:\44486.exec:\44486.exe66⤵PID:3148
-
\??\c:\8426420.exec:\8426420.exe67⤵PID:556
-
\??\c:\bhhthb.exec:\bhhthb.exe68⤵PID:1456
-
\??\c:\bttnnh.exec:\bttnnh.exe69⤵PID:2948
-
\??\c:\tbbthh.exec:\tbbthh.exe70⤵PID:3740
-
\??\c:\pddpj.exec:\pddpj.exe71⤵PID:1172
-
\??\c:\frfrlfr.exec:\frfrlfr.exe72⤵PID:3964
-
\??\c:\0844808.exec:\0844808.exe73⤵PID:3028
-
\??\c:\0626486.exec:\0626486.exe74⤵PID:3812
-
\??\c:\202048.exec:\202048.exe75⤵PID:3400
-
\??\c:\5rrfxrr.exec:\5rrfxrr.exe76⤵PID:2428
-
\??\c:\jjjdv.exec:\jjjdv.exe77⤵PID:4888
-
\??\c:\fxrxlrr.exec:\fxrxlrr.exe78⤵PID:1340
-
\??\c:\xrfxxrf.exec:\xrfxxrf.exe79⤵PID:4156
-
\??\c:\jdddd.exec:\jdddd.exe80⤵PID:1012
-
\??\c:\4242004.exec:\4242004.exe81⤵PID:4004
-
\??\c:\6008260.exec:\6008260.exe82⤵PID:2116
-
\??\c:\xflxrrx.exec:\xflxrrx.exe83⤵PID:1928
-
\??\c:\hbhbnb.exec:\hbhbnb.exe84⤵PID:3968
-
\??\c:\6684824.exec:\6684824.exe85⤵PID:4744
-
\??\c:\088204.exec:\088204.exe86⤵PID:2720
-
\??\c:\u800206.exec:\u800206.exe87⤵PID:4544
-
\??\c:\q06088.exec:\q06088.exe88⤵PID:884
-
\??\c:\3btthn.exec:\3btthn.exe89⤵PID:3036
-
\??\c:\288204.exec:\288204.exe90⤵PID:2056
-
\??\c:\c808602.exec:\c808602.exe91⤵PID:3404
-
\??\c:\jjvjd.exec:\jjvjd.exe92⤵PID:2856
-
\??\c:\k88266.exec:\k88266.exe93⤵PID:3648
-
\??\c:\2444226.exec:\2444226.exe94⤵PID:2076
-
\??\c:\0688222.exec:\0688222.exe95⤵PID:1604
-
\??\c:\9ntntn.exec:\9ntntn.exe96⤵PID:2440
-
\??\c:\q88422.exec:\q88422.exe97⤵PID:1948
-
\??\c:\24086.exec:\24086.exe98⤵PID:3052
-
\??\c:\nhtnnh.exec:\nhtnnh.exe99⤵PID:4696
-
\??\c:\3hnntb.exec:\3hnntb.exe100⤵PID:3912
-
\??\c:\8444600.exec:\8444600.exe101⤵PID:1068
-
\??\c:\nbbthh.exec:\nbbthh.exe102⤵PID:1584
-
\??\c:\dpdvd.exec:\dpdvd.exe103⤵PID:2872
-
\??\c:\pjvpd.exec:\pjvpd.exe104⤵PID:1456
-
\??\c:\2624620.exec:\2624620.exe105⤵PID:536
-
\??\c:\a0404.exec:\a0404.exe106⤵PID:3740
-
\??\c:\vvdpp.exec:\vvdpp.exe107⤵PID:1520
-
\??\c:\dvvjv.exec:\dvvjv.exe108⤵PID:3964
-
\??\c:\xrrrxxf.exec:\xrrrxxf.exe109⤵PID:3028
-
\??\c:\llrxflr.exec:\llrxflr.exe110⤵PID:2792
-
\??\c:\s8644.exec:\s8644.exe111⤵PID:3572
-
\??\c:\e22606.exec:\e22606.exe112⤵PID:4888
-
\??\c:\lrrlxrl.exec:\lrrlxrl.exe113⤵PID:3440
-
\??\c:\2242604.exec:\2242604.exe114⤵PID:1804
-
\??\c:\i226600.exec:\i226600.exe115⤵PID:2916
-
\??\c:\o822828.exec:\o822828.exe116⤵PID:1232
-
\??\c:\rrlrlxr.exec:\rrlrlxr.exe117⤵PID:2024
-
\??\c:\vjvvv.exec:\vjvvv.exe118⤵PID:3968
-
\??\c:\tbhhbh.exec:\tbhhbh.exe119⤵PID:4744
-
\??\c:\nhnhbb.exec:\nhnhbb.exe120⤵PID:4860
-
\??\c:\4882222.exec:\4882222.exe121⤵PID:4544
-
\??\c:\0084888.exec:\0084888.exe122⤵PID:884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-