Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 03:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
56296b04cf8c07fdb58053bbc0fc73f0_NEAS.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
56296b04cf8c07fdb58053bbc0fc73f0_NEAS.exe
-
Size
193KB
-
MD5
56296b04cf8c07fdb58053bbc0fc73f0
-
SHA1
99b04a5c697aed80594c0a9bcf03078f1a27f9ca
-
SHA256
96bb8fdf903fb894e8a92900b17c60b60ac3bc7837fc3544f595b670d44dc2da
-
SHA512
37eb21f9be49d7e6f73fd7cb617112e379c3bc9148b161beed672072f2a650e591c569b7a7b03f0291c74696d5788c42f4d3984a65aa1499f608a37d99c96c0a
-
SSDEEP
1536:VvQBeOGtrYSSsrc93UBIfdC67m6AJiqHlHdmAW2:VhOm2sI93UufdC67ciVAW2
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/5080-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4116-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2480-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4284-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/772-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1572-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-816-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1212-900-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-1316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-1401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5080 9hhthb.exe 1020 9jdvp.exe 4116 frllrlx.exe 2600 7vvjd.exe 3936 lrrfrlf.exe 2632 vdjdj.exe 3520 xxxrlfr.exe 2480 fxxrlfx.exe 4608 nhbtnn.exe 4676 xllfrlf.exe 3172 bnhbnh.exe 1812 jddvp.exe 3888 rrrfxlf.exe 4284 bhhbtn.exe 4604 jvddv.exe 4808 thbnht.exe 4496 httnbt.exe 2212 vdpvd.exe 2304 1nhbnb.exe 940 tbnnhb.exe 4184 vpjvd.exe 1528 lxxrlfx.exe 3184 bhhbnh.exe 1932 5jdvj.exe 2180 7rlfllx.exe 4696 7ntnhn.exe 4824 bbttbb.exe 4044 pdjvj.exe 5000 frllllr.exe 2960 dvdvd.exe 876 5rrlxfx.exe 2532 5tbbbb.exe 772 jjvjv.exe 220 rffxlfx.exe 4624 bnbhbt.exe 4408 bbhbtn.exe 2000 dvvpp.exe 320 3dvjv.exe 4104 7fxrrlf.exe 4212 lxxrllf.exe 2576 1bbthh.exe 3480 thbtnh.exe 1612 vdjvj.exe 4108 rxxlxxr.exe 4692 xfxlxlx.exe 2632 9htthb.exe 3532 jppjd.exe 3276 pdjvj.exe 4712 rlxrrff.exe 2456 3lfrlfx.exe 452 5bhtbb.exe 1620 9ppdj.exe 840 fllfxrr.exe 2428 5rrllfl.exe 2860 hntnhb.exe 980 htnbtn.exe 1692 dpvpp.exe 4684 jppdv.exe 2904 lrlxlxl.exe 1572 fxxrlfx.exe 4836 hbbnht.exe 3388 pppjd.exe 3124 vvpvj.exe 940 rlfrlfr.exe -
resource yara_rule behavioral2/memory/5080-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4116-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4284-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/772-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1572-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-483-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2200 wrote to memory of 5080 2200 56296b04cf8c07fdb58053bbc0fc73f0_NEAS.exe 86 PID 2200 wrote to memory of 5080 2200 56296b04cf8c07fdb58053bbc0fc73f0_NEAS.exe 86 PID 2200 wrote to memory of 5080 2200 56296b04cf8c07fdb58053bbc0fc73f0_NEAS.exe 86 PID 5080 wrote to memory of 1020 5080 9hhthb.exe 87 PID 5080 wrote to memory of 1020 5080 9hhthb.exe 87 PID 5080 wrote to memory of 1020 5080 9hhthb.exe 87 PID 1020 wrote to memory of 4116 1020 9jdvp.exe 88 PID 1020 wrote to memory of 4116 1020 9jdvp.exe 88 PID 1020 wrote to memory of 4116 1020 9jdvp.exe 88 PID 4116 wrote to memory of 2600 4116 frllrlx.exe 89 PID 4116 wrote to memory of 2600 4116 frllrlx.exe 89 PID 4116 wrote to memory of 2600 4116 frllrlx.exe 89 PID 2600 wrote to memory of 3936 2600 7vvjd.exe 90 PID 2600 wrote to memory of 3936 2600 7vvjd.exe 90 PID 2600 wrote to memory of 3936 2600 7vvjd.exe 90 PID 3936 wrote to memory of 2632 3936 lrrfrlf.exe 91 PID 3936 wrote to memory of 2632 3936 lrrfrlf.exe 91 PID 3936 wrote to memory of 2632 3936 lrrfrlf.exe 91 PID 2632 wrote to memory of 3520 2632 vdjdj.exe 92 PID 2632 wrote to memory of 3520 2632 vdjdj.exe 92 PID 2632 wrote to memory of 3520 2632 vdjdj.exe 92 PID 3520 wrote to memory of 2480 3520 xxxrlfr.exe 93 PID 3520 wrote to memory of 2480 3520 xxxrlfr.exe 93 PID 3520 wrote to memory of 2480 3520 xxxrlfr.exe 93 PID 2480 wrote to memory of 4608 2480 fxxrlfx.exe 95 PID 2480 wrote to memory of 4608 2480 fxxrlfx.exe 95 PID 2480 wrote to memory of 4608 2480 fxxrlfx.exe 95 PID 4608 wrote to memory of 4676 4608 nhbtnn.exe 97 PID 4608 wrote to memory of 4676 4608 nhbtnn.exe 97 PID 4608 wrote to memory of 4676 4608 nhbtnn.exe 97 PID 4676 wrote to memory of 3172 4676 xllfrlf.exe 98 PID 4676 wrote to memory of 3172 4676 xllfrlf.exe 98 PID 4676 wrote to memory of 3172 4676 xllfrlf.exe 98 PID 3172 wrote to memory of 1812 3172 bnhbnh.exe 99 PID 3172 wrote to memory of 1812 3172 bnhbnh.exe 99 PID 3172 wrote to memory of 1812 3172 bnhbnh.exe 99 PID 1812 wrote to memory of 3888 1812 jddvp.exe 100 PID 1812 wrote to memory of 3888 1812 jddvp.exe 100 PID 1812 wrote to memory of 3888 1812 jddvp.exe 100 PID 3888 wrote to memory of 4284 3888 rrrfxlf.exe 102 PID 3888 wrote to memory of 4284 3888 rrrfxlf.exe 102 PID 3888 wrote to memory of 4284 3888 rrrfxlf.exe 102 PID 4284 wrote to memory of 4604 4284 bhhbtn.exe 103 PID 4284 wrote to memory of 4604 4284 bhhbtn.exe 103 PID 4284 wrote to memory of 4604 4284 bhhbtn.exe 103 PID 4604 wrote to memory of 4808 4604 jvddv.exe 104 PID 4604 wrote to memory of 4808 4604 jvddv.exe 104 PID 4604 wrote to memory of 4808 4604 jvddv.exe 104 PID 4808 wrote to memory of 4496 4808 thbnht.exe 105 PID 4808 wrote to memory of 4496 4808 thbnht.exe 105 PID 4808 wrote to memory of 4496 4808 thbnht.exe 105 PID 4496 wrote to memory of 2212 4496 httnbt.exe 106 PID 4496 wrote to memory of 2212 4496 httnbt.exe 106 PID 4496 wrote to memory of 2212 4496 httnbt.exe 106 PID 2212 wrote to memory of 2304 2212 vdpvd.exe 107 PID 2212 wrote to memory of 2304 2212 vdpvd.exe 107 PID 2212 wrote to memory of 2304 2212 vdpvd.exe 107 PID 2304 wrote to memory of 940 2304 1nhbnb.exe 108 PID 2304 wrote to memory of 940 2304 1nhbnb.exe 108 PID 2304 wrote to memory of 940 2304 1nhbnb.exe 108 PID 940 wrote to memory of 4184 940 tbnnhb.exe 109 PID 940 wrote to memory of 4184 940 tbnnhb.exe 109 PID 940 wrote to memory of 4184 940 tbnnhb.exe 109 PID 4184 wrote to memory of 1528 4184 vpjvd.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\56296b04cf8c07fdb58053bbc0fc73f0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\56296b04cf8c07fdb58053bbc0fc73f0_NEAS.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\9hhthb.exec:\9hhthb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\9jdvp.exec:\9jdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\frllrlx.exec:\frllrlx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\7vvjd.exec:\7vvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\lrrfrlf.exec:\lrrfrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\vdjdj.exec:\vdjdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\xxxrlfr.exec:\xxxrlfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\nhbtnn.exec:\nhbtnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\xllfrlf.exec:\xllfrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\bnhbnh.exec:\bnhbnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\jddvp.exec:\jddvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\rrrfxlf.exec:\rrrfxlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\bhhbtn.exec:\bhhbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\jvddv.exec:\jvddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\thbnht.exec:\thbnht.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\httnbt.exec:\httnbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\vdpvd.exec:\vdpvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\1nhbnb.exec:\1nhbnb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\tbnnhb.exec:\tbnnhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\vpjvd.exec:\vpjvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe23⤵
- Executes dropped EXE
PID:1528 -
\??\c:\bhhbnh.exec:\bhhbnh.exe24⤵
- Executes dropped EXE
PID:3184 -
\??\c:\5jdvj.exec:\5jdvj.exe25⤵
- Executes dropped EXE
PID:1932 -
\??\c:\7rlfllx.exec:\7rlfllx.exe26⤵
- Executes dropped EXE
PID:2180 -
\??\c:\7ntnhn.exec:\7ntnhn.exe27⤵
- Executes dropped EXE
PID:4696 -
\??\c:\bbttbb.exec:\bbttbb.exe28⤵
- Executes dropped EXE
PID:4824 -
\??\c:\pdjvj.exec:\pdjvj.exe29⤵
- Executes dropped EXE
PID:4044 -
\??\c:\frllllr.exec:\frllllr.exe30⤵
- Executes dropped EXE
PID:5000 -
\??\c:\dvdvd.exec:\dvdvd.exe31⤵
- Executes dropped EXE
PID:2960 -
\??\c:\5rrlxfx.exec:\5rrlxfx.exe32⤵
- Executes dropped EXE
PID:876 -
\??\c:\5tbbbb.exec:\5tbbbb.exe33⤵
- Executes dropped EXE
PID:2532 -
\??\c:\jjvjv.exec:\jjvjv.exe34⤵
- Executes dropped EXE
PID:772 -
\??\c:\rffxlfx.exec:\rffxlfx.exe35⤵
- Executes dropped EXE
PID:220 -
\??\c:\bnbhbt.exec:\bnbhbt.exe36⤵
- Executes dropped EXE
PID:4624 -
\??\c:\bbhbtn.exec:\bbhbtn.exe37⤵
- Executes dropped EXE
PID:4408 -
\??\c:\dvvpp.exec:\dvvpp.exe38⤵
- Executes dropped EXE
PID:2000 -
\??\c:\3dvjv.exec:\3dvjv.exe39⤵
- Executes dropped EXE
PID:320 -
\??\c:\7fxrrlf.exec:\7fxrrlf.exe40⤵
- Executes dropped EXE
PID:4104 -
\??\c:\lxxrllf.exec:\lxxrllf.exe41⤵
- Executes dropped EXE
PID:4212 -
\??\c:\1bbthh.exec:\1bbthh.exe42⤵
- Executes dropped EXE
PID:2576 -
\??\c:\thbtnh.exec:\thbtnh.exe43⤵
- Executes dropped EXE
PID:3480 -
\??\c:\vdjvj.exec:\vdjvj.exe44⤵
- Executes dropped EXE
PID:1612 -
\??\c:\rxxlxxr.exec:\rxxlxxr.exe45⤵
- Executes dropped EXE
PID:4108 -
\??\c:\xfxlxlx.exec:\xfxlxlx.exe46⤵
- Executes dropped EXE
PID:4692 -
\??\c:\9htthb.exec:\9htthb.exe47⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jppjd.exec:\jppjd.exe48⤵
- Executes dropped EXE
PID:3532 -
\??\c:\pdjvj.exec:\pdjvj.exe49⤵
- Executes dropped EXE
PID:3276 -
\??\c:\rlxrrff.exec:\rlxrrff.exe50⤵
- Executes dropped EXE
PID:4712 -
\??\c:\3lfrlfx.exec:\3lfrlfx.exe51⤵
- Executes dropped EXE
PID:2456 -
\??\c:\5bhtbb.exec:\5bhtbb.exe52⤵
- Executes dropped EXE
PID:452 -
\??\c:\9ppdj.exec:\9ppdj.exe53⤵
- Executes dropped EXE
PID:1620 -
\??\c:\fllfxrr.exec:\fllfxrr.exe54⤵
- Executes dropped EXE
PID:840 -
\??\c:\5rrllfl.exec:\5rrllfl.exe55⤵
- Executes dropped EXE
PID:2428 -
\??\c:\hntnhb.exec:\hntnhb.exe56⤵
- Executes dropped EXE
PID:2860 -
\??\c:\htnbtn.exec:\htnbtn.exe57⤵
- Executes dropped EXE
PID:980 -
\??\c:\dpvpp.exec:\dpvpp.exe58⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jppdv.exec:\jppdv.exe59⤵
- Executes dropped EXE
PID:4684 -
\??\c:\lrlxlxl.exec:\lrlxlxl.exe60⤵
- Executes dropped EXE
PID:2904 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe61⤵
- Executes dropped EXE
PID:1572 -
\??\c:\hbbnht.exec:\hbbnht.exe62⤵
- Executes dropped EXE
PID:4836 -
\??\c:\pppjd.exec:\pppjd.exe63⤵
- Executes dropped EXE
PID:3388 -
\??\c:\vvpvj.exec:\vvpvj.exe64⤵
- Executes dropped EXE
PID:3124 -
\??\c:\rlfrlfr.exec:\rlfrlfr.exe65⤵
- Executes dropped EXE
PID:940 -
\??\c:\nbnhnh.exec:\nbnhnh.exe66⤵PID:4884
-
\??\c:\9jvvj.exec:\9jvvj.exe67⤵PID:4536
-
\??\c:\djjvj.exec:\djjvj.exe68⤵PID:5060
-
\??\c:\lxrlxlr.exec:\lxrlxlr.exe69⤵PID:2340
-
\??\c:\xfflfxr.exec:\xfflfxr.exe70⤵PID:4148
-
\??\c:\1ttnhh.exec:\1ttnhh.exe71⤵PID:1252
-
\??\c:\hbhbtt.exec:\hbhbtt.exe72⤵PID:1724
-
\??\c:\vjdvj.exec:\vjdvj.exe73⤵PID:2984
-
\??\c:\jpppd.exec:\jpppd.exe74⤵PID:4824
-
\??\c:\xrrxxrr.exec:\xrrxxrr.exe75⤵PID:2440
-
\??\c:\nhhbtn.exec:\nhhbtn.exe76⤵PID:5112
-
\??\c:\bnthbb.exec:\bnthbb.exe77⤵PID:2768
-
\??\c:\vppdd.exec:\vppdd.exe78⤵PID:924
-
\??\c:\pjpjj.exec:\pjpjj.exe79⤵PID:668
-
\??\c:\flrfxrl.exec:\flrfxrl.exe80⤵PID:4644
-
\??\c:\3xfxllr.exec:\3xfxllr.exe81⤵PID:3252
-
\??\c:\hbtbtn.exec:\hbtbtn.exe82⤵PID:3552
-
\??\c:\bbnntt.exec:\bbnntt.exe83⤵PID:5028
-
\??\c:\nhtntb.exec:\nhtntb.exe84⤵PID:4400
-
\??\c:\vvvvv.exec:\vvvvv.exe85⤵PID:1696
-
\??\c:\7xxxrrl.exec:\7xxxrrl.exe86⤵PID:3440
-
\??\c:\lffxrrf.exec:\lffxrrf.exe87⤵PID:3128
-
\??\c:\bnbbhh.exec:\bnbbhh.exe88⤵PID:1632
-
\??\c:\hthbth.exec:\hthbth.exe89⤵PID:1956
-
\??\c:\1jvvp.exec:\1jvvp.exe90⤵PID:4116
-
\??\c:\ppjdv.exec:\ppjdv.exe91⤵PID:3480
-
\??\c:\lxxrffx.exec:\lxxrffx.exe92⤵PID:1268
-
\??\c:\htttnh.exec:\htttnh.exe93⤵PID:4108
-
\??\c:\jppdp.exec:\jppdp.exe94⤵PID:4692
-
\??\c:\dpppd.exec:\dpppd.exe95⤵PID:3912
-
\??\c:\rxxrfrl.exec:\rxxrfrl.exe96⤵PID:5004
-
\??\c:\lfrfrrf.exec:\lfrfrrf.exe97⤵PID:4260
-
\??\c:\nbnbhb.exec:\nbnbhb.exe98⤵PID:5096
-
\??\c:\9bbtbt.exec:\9bbtbt.exe99⤵PID:4972
-
\??\c:\dpdpj.exec:\dpdpj.exe100⤵PID:452
-
\??\c:\lllxlff.exec:\lllxlff.exe101⤵PID:1620
-
\??\c:\xxfxrrf.exec:\xxfxrrf.exe102⤵PID:840
-
\??\c:\3nbbnn.exec:\3nbbnn.exe103⤵PID:4112
-
\??\c:\nntbnn.exec:\nntbnn.exe104⤵PID:3180
-
\??\c:\vdpdp.exec:\vdpdp.exe105⤵PID:2468
-
\??\c:\xlxrxrx.exec:\xlxrxrx.exe106⤵PID:3088
-
\??\c:\lxllfff.exec:\lxllfff.exe107⤵PID:3240
-
\??\c:\7flxxlx.exec:\7flxxlx.exe108⤵PID:3224
-
\??\c:\hhnbtt.exec:\hhnbtt.exe109⤵PID:3256
-
\??\c:\jvjdp.exec:\jvjdp.exe110⤵PID:4988
-
\??\c:\9vpdp.exec:\9vpdp.exe111⤵PID:3288
-
\??\c:\lxxlrlf.exec:\lxxlrlf.exe112⤵PID:3812
-
\??\c:\ththbb.exec:\ththbb.exe113⤵PID:3204
-
\??\c:\thbtbb.exec:\thbtbb.exe114⤵PID:940
-
\??\c:\jvvpj.exec:\jvvpj.exe115⤵PID:2352
-
\??\c:\jvvjj.exec:\jvvjj.exe116⤵PID:4976
-
\??\c:\xlrlllf.exec:\xlrlllf.exe117⤵PID:1060
-
\??\c:\5xxxrrl.exec:\5xxxrrl.exe118⤵PID:2340
-
\??\c:\nntnhb.exec:\nntnhb.exe119⤵PID:4148
-
\??\c:\dddvp.exec:\dddvp.exe120⤵PID:4412
-
\??\c:\lllffxx.exec:\lllffxx.exe121⤵PID:1492
-
\??\c:\nnbnhb.exec:\nnbnhb.exe122⤵PID:2984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-