Overview
overview
10Static
static
10Dropper/Berbew.exe
windows7-x64
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows7-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10RAT/31.exe
windows7-x64
10RAT/31.exe
windows10-2004-x64
10RAT/XClient.exe
windows7-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/file.exe
windows7-x64
7RAT/file.exe
windows10-2004-x64
7Ransomware...-2.exe
windows7-x64
10Ransomware...-2.exe
windows10-2004-x64
10Ransomware...01.exe
windows7-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...lt.exe
windows7-x64
10Ransomware...lt.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows7-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/B...on.exe
windows7-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/Dridex.dll
windows7-x64
10Stealers/Dridex.dll
windows10-2004-x64
10Stealers/M..._2.exe
windows7-x64
10Stealers/M..._2.exe
windows10-2004-x64
10Stealers/lumma.exe
windows7-x64
1Stealers/lumma.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows7-x64
10Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows7-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Resubmissions
03-09-2024 14:02
240903-rb57sazdqf 1003-09-2024 13:51
240903-q59avszclf 1002-09-2024 19:51
240902-yk8gtsxbpd 1002-09-2024 02:27
240902-cxh7tazflg 1002-09-2024 02:26
240902-cwxc2sygll 1021-06-2024 19:37
240621-yca7cszgnd 1009-06-2024 17:07
240609-vm7rjadd73 1013-05-2024 17:36
240513-v6qblafe3y 1012-05-2024 17:17
240512-vty3zafh5s 10Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12-05-2024 17:17
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
RAT/31.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
RAT/XClient.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
RAT/XClient.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
RAT/file.exe
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
RAT/file.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Ransomware/Client-2.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Ransomware/criticalupdate01.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Ransomware/default.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
Ransomware/default.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Stealers/Azorult.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
Stealers/Azorult.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
Stealers/BlackMoon.exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
Stealers/Dridex.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Stealers/Dridex.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
Stealers/lumma.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Stealers/lumma.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Trojan/BetaBot.exe
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
Trojan/SmokeLoader.exe
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20240508-en
General
-
Target
Stealers/BlackMoon.exe
-
Size
387KB
-
MD5
336efa7460c08e3d47f29121742eb010
-
SHA1
f41c36cd83879d170309dede056563d35741b87b
-
SHA256
e6dd3fa33ad938b07c8978691f86b73e9f6fd84104b92f42566498bdb6b2930e
-
SHA512
e8d118fbe907a00d89c2514af4de475a0ea54943076bf90174234f77f2ec093a1246a0d4e78d1104a0dcda150b5441d28f4f3d1e768ecb20ae86383a99863c14
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfN:SgdnJVU4TlnwJ6Goo
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral20/memory/2916-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1500-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2704-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4780-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2248-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3592-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/320-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/320-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2680-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2680-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2680-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2448-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1708-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/724-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/940-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/5048-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4708-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4004-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1136-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2056-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3740-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4192-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3028-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4964-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4896-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/452-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3964-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rllrrrr.exehbnhhh.exelxxrllf.exe5nnttt.exedvvvp.exetbnbtt.exevjpjd.exebntnnn.exe3xffxff.exebntttt.exeppvvd.exeflllrlx.exehttbtt.exerllllff.exejjvpv.exefrxrrrl.exennnnnn.exepjjjd.exerfrllll.exe9btttb.exetnbbtt.exe5vvpd.exevjjpj.exellxrllf.exevvvvp.exebhtthh.exejvddd.exeffllfll.exethtnhh.exedpjjj.exefxfxrlf.exevpddj.exejpjjd.exerllxlrx.exehthbbt.exehtbttt.exejpvpj.exeflrxrrr.exe9rrfxfr.exehbnntn.exepvvvp.exedvddj.exefxffxxf.exenhtttb.exebtbbtb.exejdjdd.exenbnbhn.exepppjj.exedpvpv.exellxrlrr.exehtttnt.exevjddd.exerxllrxx.exentbbnh.exevpddj.exevjddv.exefxlfxrl.exe7bnhnn.exehthbhb.exe3djdv.exelfffrxx.exebttnnn.exebbtttt.exedjjdd.exepid process 1500 rllrrrr.exe 2248 hbnhhh.exe 2704 lxxrllf.exe 4780 5nnttt.exe 3592 dvvvp.exe 4436 tbnbtt.exe 320 vjpjd.exe 2680 bntnnn.exe 2448 3xffxff.exe 1708 bntttt.exe 532 ppvvd.exe 724 flllrlx.exe 940 httbtt.exe 4932 rllllff.exe 5048 jjvpv.exe 4708 frxrrrl.exe 4004 nnnnnn.exe 1136 pjjjd.exe 2056 rfrllll.exe 3740 9btttb.exe 4192 tnbbtt.exe 3028 5vvpd.exe 4964 vjjpj.exe 1244 llxrllf.exe 4036 vvvvp.exe 4900 bhtthh.exe 4896 jvddd.exe 4152 ffllfll.exe 452 thtnhh.exe 3964 dpjjj.exe 2072 fxfxrlf.exe 1220 vpddj.exe 3748 jpjjd.exe 396 rllxlrx.exe 1076 hthbbt.exe 4360 htbttt.exe 4996 jpvpj.exe 4356 flrxrrr.exe 3856 9rrfxfr.exe 764 hbnntn.exe 564 pvvvp.exe 2684 dvddj.exe 960 fxffxxf.exe 1400 nhtttb.exe 2772 btbbtb.exe 2680 jdjdd.exe 5008 nbnbhn.exe 860 pppjj.exe 3104 dpvpv.exe 1940 llxrlrr.exe 4460 htttnt.exe 4572 vjddd.exe 3980 rxllrxx.exe 1576 ntbbnh.exe 3308 vpddj.exe 2344 vjddv.exe 4616 fxlfxrl.exe 1760 7bnhnn.exe 4004 hthbhb.exe 3276 3djdv.exe 2536 lfffrxx.exe 4548 bttnnn.exe 4752 bbtttt.exe 3640 djjdd.exe -
Processes:
resource yara_rule behavioral20/memory/2916-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1500-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2704-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4780-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4780-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2248-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3592-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/320-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/320-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/320-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2680-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2680-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2680-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2448-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1708-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/724-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/940-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/5048-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4708-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4004-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1136-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2056-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3740-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4192-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3028-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4964-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4896-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/452-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3964-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
BlackMoon.exerllrrrr.exehbnhhh.exelxxrllf.exe5nnttt.exedvvvp.exetbnbtt.exevjpjd.exebntnnn.exe3xffxff.exebntttt.exeppvvd.exeflllrlx.exehttbtt.exerllllff.exejjvpv.exefrxrrrl.exennnnnn.exepjjjd.exerfrllll.exe9btttb.exetnbbtt.exedescription pid process target process PID 2916 wrote to memory of 1500 2916 BlackMoon.exe rllrrrr.exe PID 2916 wrote to memory of 1500 2916 BlackMoon.exe rllrrrr.exe PID 2916 wrote to memory of 1500 2916 BlackMoon.exe rllrrrr.exe PID 1500 wrote to memory of 2248 1500 rllrrrr.exe hbnhhh.exe PID 1500 wrote to memory of 2248 1500 rllrrrr.exe hbnhhh.exe PID 1500 wrote to memory of 2248 1500 rllrrrr.exe hbnhhh.exe PID 2248 wrote to memory of 2704 2248 hbnhhh.exe lxxrllf.exe PID 2248 wrote to memory of 2704 2248 hbnhhh.exe lxxrllf.exe PID 2248 wrote to memory of 2704 2248 hbnhhh.exe lxxrllf.exe PID 2704 wrote to memory of 4780 2704 lxxrllf.exe 5nnttt.exe PID 2704 wrote to memory of 4780 2704 lxxrllf.exe 5nnttt.exe PID 2704 wrote to memory of 4780 2704 lxxrllf.exe 5nnttt.exe PID 4780 wrote to memory of 3592 4780 5nnttt.exe dvvvp.exe PID 4780 wrote to memory of 3592 4780 5nnttt.exe dvvvp.exe PID 4780 wrote to memory of 3592 4780 5nnttt.exe dvvvp.exe PID 3592 wrote to memory of 4436 3592 dvvvp.exe tbnbtt.exe PID 3592 wrote to memory of 4436 3592 dvvvp.exe tbnbtt.exe PID 3592 wrote to memory of 4436 3592 dvvvp.exe tbnbtt.exe PID 4436 wrote to memory of 320 4436 tbnbtt.exe vjpjd.exe PID 4436 wrote to memory of 320 4436 tbnbtt.exe vjpjd.exe PID 4436 wrote to memory of 320 4436 tbnbtt.exe vjpjd.exe PID 320 wrote to memory of 2680 320 vjpjd.exe bntnnn.exe PID 320 wrote to memory of 2680 320 vjpjd.exe bntnnn.exe PID 320 wrote to memory of 2680 320 vjpjd.exe bntnnn.exe PID 2680 wrote to memory of 2448 2680 bntnnn.exe 3xffxff.exe PID 2680 wrote to memory of 2448 2680 bntnnn.exe 3xffxff.exe PID 2680 wrote to memory of 2448 2680 bntnnn.exe 3xffxff.exe PID 2448 wrote to memory of 1708 2448 3xffxff.exe bntttt.exe PID 2448 wrote to memory of 1708 2448 3xffxff.exe bntttt.exe PID 2448 wrote to memory of 1708 2448 3xffxff.exe bntttt.exe PID 1708 wrote to memory of 532 1708 bntttt.exe ppvvd.exe PID 1708 wrote to memory of 532 1708 bntttt.exe ppvvd.exe PID 1708 wrote to memory of 532 1708 bntttt.exe ppvvd.exe PID 532 wrote to memory of 724 532 ppvvd.exe flllrlx.exe PID 532 wrote to memory of 724 532 ppvvd.exe flllrlx.exe PID 532 wrote to memory of 724 532 ppvvd.exe flllrlx.exe PID 724 wrote to memory of 940 724 flllrlx.exe httbtt.exe PID 724 wrote to memory of 940 724 flllrlx.exe httbtt.exe PID 724 wrote to memory of 940 724 flllrlx.exe httbtt.exe PID 940 wrote to memory of 4932 940 httbtt.exe rllllff.exe PID 940 wrote to memory of 4932 940 httbtt.exe rllllff.exe PID 940 wrote to memory of 4932 940 httbtt.exe rllllff.exe PID 4932 wrote to memory of 5048 4932 rllllff.exe jjvpv.exe PID 4932 wrote to memory of 5048 4932 rllllff.exe jjvpv.exe PID 4932 wrote to memory of 5048 4932 rllllff.exe jjvpv.exe PID 5048 wrote to memory of 4708 5048 jjvpv.exe frxrrrl.exe PID 5048 wrote to memory of 4708 5048 jjvpv.exe frxrrrl.exe PID 5048 wrote to memory of 4708 5048 jjvpv.exe frxrrrl.exe PID 4708 wrote to memory of 4004 4708 frxrrrl.exe nnnnnn.exe PID 4708 wrote to memory of 4004 4708 frxrrrl.exe nnnnnn.exe PID 4708 wrote to memory of 4004 4708 frxrrrl.exe nnnnnn.exe PID 4004 wrote to memory of 1136 4004 nnnnnn.exe pjjjd.exe PID 4004 wrote to memory of 1136 4004 nnnnnn.exe pjjjd.exe PID 4004 wrote to memory of 1136 4004 nnnnnn.exe pjjjd.exe PID 1136 wrote to memory of 2056 1136 pjjjd.exe rfrllll.exe PID 1136 wrote to memory of 2056 1136 pjjjd.exe rfrllll.exe PID 1136 wrote to memory of 2056 1136 pjjjd.exe rfrllll.exe PID 2056 wrote to memory of 3740 2056 rfrllll.exe 9btttb.exe PID 2056 wrote to memory of 3740 2056 rfrllll.exe 9btttb.exe PID 2056 wrote to memory of 3740 2056 rfrllll.exe 9btttb.exe PID 3740 wrote to memory of 4192 3740 9btttb.exe tnbbtt.exe PID 3740 wrote to memory of 4192 3740 9btttb.exe tnbbtt.exe PID 3740 wrote to memory of 4192 3740 9btttb.exe tnbbtt.exe PID 4192 wrote to memory of 3028 4192 tnbbtt.exe 5vvpd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\rllrrrr.exec:\rllrrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\hbnhhh.exec:\hbnhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\lxxrllf.exec:\lxxrllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\5nnttt.exec:\5nnttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\dvvvp.exec:\dvvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\tbnbtt.exec:\tbnbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\vjpjd.exec:\vjpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\bntnnn.exec:\bntnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\3xffxff.exec:\3xffxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\bntttt.exec:\bntttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\ppvvd.exec:\ppvvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\flllrlx.exec:\flllrlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
\??\c:\httbtt.exec:\httbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\rllllff.exec:\rllllff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\jjvpv.exec:\jjvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\frxrrrl.exec:\frxrrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\nnnnnn.exec:\nnnnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\pjjjd.exec:\pjjjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\rfrllll.exec:\rfrllll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\9btttb.exec:\9btttb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\tnbbtt.exec:\tnbbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\5vvpd.exec:\5vvpd.exe23⤵
- Executes dropped EXE
PID:3028 -
\??\c:\vjjpj.exec:\vjjpj.exe24⤵
- Executes dropped EXE
PID:4964 -
\??\c:\llxrllf.exec:\llxrllf.exe25⤵
- Executes dropped EXE
PID:1244 -
\??\c:\vvvvp.exec:\vvvvp.exe26⤵
- Executes dropped EXE
PID:4036 -
\??\c:\bhtthh.exec:\bhtthh.exe27⤵
- Executes dropped EXE
PID:4900 -
\??\c:\jvddd.exec:\jvddd.exe28⤵
- Executes dropped EXE
PID:4896 -
\??\c:\ffllfll.exec:\ffllfll.exe29⤵
- Executes dropped EXE
PID:4152 -
\??\c:\thtnhh.exec:\thtnhh.exe30⤵
- Executes dropped EXE
PID:452 -
\??\c:\dpjjj.exec:\dpjjj.exe31⤵
- Executes dropped EXE
PID:3964 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe32⤵
- Executes dropped EXE
PID:2072 -
\??\c:\vpddj.exec:\vpddj.exe33⤵
- Executes dropped EXE
PID:1220 -
\??\c:\jpjjd.exec:\jpjjd.exe34⤵
- Executes dropped EXE
PID:3748 -
\??\c:\rllxlrx.exec:\rllxlrx.exe35⤵
- Executes dropped EXE
PID:396 -
\??\c:\hthbbt.exec:\hthbbt.exe36⤵
- Executes dropped EXE
PID:1076 -
\??\c:\htbttt.exec:\htbttt.exe37⤵
- Executes dropped EXE
PID:4360 -
\??\c:\jpvpj.exec:\jpvpj.exe38⤵
- Executes dropped EXE
PID:4996 -
\??\c:\flrxrrr.exec:\flrxrrr.exe39⤵
- Executes dropped EXE
PID:4356 -
\??\c:\9rrfxfr.exec:\9rrfxfr.exe40⤵
- Executes dropped EXE
PID:3856 -
\??\c:\hbnntn.exec:\hbnntn.exe41⤵
- Executes dropped EXE
PID:764 -
\??\c:\pvvvp.exec:\pvvvp.exe42⤵
- Executes dropped EXE
PID:564 -
\??\c:\dvddj.exec:\dvddj.exe43⤵
- Executes dropped EXE
PID:2684 -
\??\c:\fxffxxf.exec:\fxffxxf.exe44⤵
- Executes dropped EXE
PID:960 -
\??\c:\nhtttb.exec:\nhtttb.exe45⤵
- Executes dropped EXE
PID:1400 -
\??\c:\btbbtb.exec:\btbbtb.exe46⤵
- Executes dropped EXE
PID:2772 -
\??\c:\jdjdd.exec:\jdjdd.exe47⤵
- Executes dropped EXE
PID:2680 -
\??\c:\nbnbhn.exec:\nbnbhn.exe48⤵
- Executes dropped EXE
PID:5008 -
\??\c:\pppjj.exec:\pppjj.exe49⤵
- Executes dropped EXE
PID:860 -
\??\c:\dpvpv.exec:\dpvpv.exe50⤵
- Executes dropped EXE
PID:3104 -
\??\c:\llxrlrr.exec:\llxrlrr.exe51⤵
- Executes dropped EXE
PID:1940 -
\??\c:\htttnt.exec:\htttnt.exe52⤵
- Executes dropped EXE
PID:4460 -
\??\c:\vjddd.exec:\vjddd.exe53⤵
- Executes dropped EXE
PID:4572 -
\??\c:\rxllrxx.exec:\rxllrxx.exe54⤵
- Executes dropped EXE
PID:3980 -
\??\c:\ntbbnh.exec:\ntbbnh.exe55⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vpddj.exec:\vpddj.exe56⤵
- Executes dropped EXE
PID:3308 -
\??\c:\vjddv.exec:\vjddv.exe57⤵
- Executes dropped EXE
PID:2344 -
\??\c:\fxlfxrl.exec:\fxlfxrl.exe58⤵
- Executes dropped EXE
PID:4616 -
\??\c:\7bnhnn.exec:\7bnhnn.exe59⤵
- Executes dropped EXE
PID:1760 -
\??\c:\hthbhb.exec:\hthbhb.exe60⤵
- Executes dropped EXE
PID:4004 -
\??\c:\3djdv.exec:\3djdv.exe61⤵
- Executes dropped EXE
PID:3276 -
\??\c:\lfffrxx.exec:\lfffrxx.exe62⤵
- Executes dropped EXE
PID:2536 -
\??\c:\bttnnn.exec:\bttnnn.exe63⤵
- Executes dropped EXE
PID:4548 -
\??\c:\bbtttt.exec:\bbtttt.exe64⤵
- Executes dropped EXE
PID:4752 -
\??\c:\djjdd.exec:\djjdd.exe65⤵
- Executes dropped EXE
PID:3640 -
\??\c:\djjjd.exec:\djjjd.exe66⤵PID:3244
-
\??\c:\7lfffff.exec:\7lfffff.exe67⤵PID:3304
-
\??\c:\hnhttb.exec:\hnhttb.exe68⤵PID:4524
-
\??\c:\bttttt.exec:\bttttt.exe69⤵PID:2376
-
\??\c:\jvjdd.exec:\jvjdd.exe70⤵PID:4288
-
\??\c:\rflrxfr.exec:\rflrxfr.exe71⤵PID:756
-
\??\c:\tbtbnb.exec:\tbtbnb.exe72⤵PID:440
-
\??\c:\nnhhbh.exec:\nnhhbh.exe73⤵PID:2116
-
\??\c:\ppvjp.exec:\ppvjp.exe74⤵PID:1408
-
\??\c:\3ffxxxl.exec:\3ffxxxl.exe75⤵PID:1628
-
\??\c:\tnbnnn.exec:\tnbnnn.exe76⤵PID:4764
-
\??\c:\hbhbbb.exec:\hbhbbb.exe77⤵PID:3496
-
\??\c:\dpppv.exec:\dpppv.exe78⤵PID:4300
-
\??\c:\xlxxflx.exec:\xlxxflx.exe79⤵PID:2472
-
\??\c:\llxrrrr.exec:\llxrrrr.exe80⤵PID:2180
-
\??\c:\nhthhn.exec:\nhthhn.exe81⤵PID:2248
-
\??\c:\5jjdd.exec:\5jjdd.exe82⤵PID:556
-
\??\c:\xrxrrfx.exec:\xrxrrfx.exe83⤵PID:3712
-
\??\c:\btntnh.exec:\btntnh.exe84⤵PID:1120
-
\??\c:\pjppv.exec:\pjppv.exe85⤵PID:3336
-
\??\c:\5jjpp.exec:\5jjpp.exe86⤵PID:564
-
\??\c:\7lrrllf.exec:\7lrrllf.exe87⤵PID:2168
-
\??\c:\7htnbt.exec:\7htnbt.exe88⤵PID:3692
-
\??\c:\pjjdv.exec:\pjjdv.exe89⤵PID:5024
-
\??\c:\lflllxx.exec:\lflllxx.exe90⤵PID:4084
-
\??\c:\hhbnhn.exec:\hhbnhn.exe91⤵PID:1732
-
\??\c:\5jpjj.exec:\5jpjj.exe92⤵PID:4712
-
\??\c:\rrxrxxf.exec:\rrxrxxf.exe93⤵PID:3760
-
\??\c:\rflfxrl.exec:\rflfxrl.exe94⤵PID:4240
-
\??\c:\bhtbnh.exec:\bhtbnh.exe95⤵PID:940
-
\??\c:\ppvdd.exec:\ppvdd.exe96⤵PID:3360
-
\??\c:\3fxfflr.exec:\3fxfflr.exe97⤵PID:4708
-
\??\c:\xlrfxrl.exec:\xlrfxrl.exe98⤵PID:3300
-
\??\c:\bbnbbh.exec:\bbnbbh.exe99⤵PID:2464
-
\??\c:\pddvd.exec:\pddvd.exe100⤵PID:4568
-
\??\c:\dpdvp.exec:\dpdvp.exe101⤵PID:2156
-
\??\c:\xrxfflr.exec:\xrxfflr.exe102⤵PID:3136
-
\??\c:\pvjjp.exec:\pvjjp.exe103⤵PID:1464
-
\??\c:\lrrxxff.exec:\lrrxxff.exe104⤵PID:3744
-
\??\c:\bnbtnb.exec:\bnbtnb.exe105⤵PID:2584
-
\??\c:\3vddd.exec:\3vddd.exe106⤵PID:5112
-
\??\c:\jdpvv.exec:\jdpvv.exe107⤵PID:2580
-
\??\c:\xxrrlfx.exec:\xxrrlfx.exe108⤵PID:5076
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe109⤵PID:3752
-
\??\c:\7bbbtb.exec:\7bbbtb.exe110⤵PID:4416
-
\??\c:\7ppjv.exec:\7ppjv.exe111⤵PID:1312
-
\??\c:\9dpjp.exec:\9dpjp.exe112⤵PID:2072
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe113⤵PID:4388
-
\??\c:\ffffflf.exec:\ffffflf.exe114⤵PID:3180
-
\??\c:\3bhbtb.exec:\3bhbtb.exe115⤵PID:2716
-
\??\c:\jpvpj.exec:\jpvpj.exe116⤵PID:2232
-
\??\c:\jjppv.exec:\jjppv.exe117⤵PID:3408
-
\??\c:\7xfxrfx.exec:\7xfxrfx.exe118⤵PID:2704
-
\??\c:\rllfxrr.exec:\rllfxrr.exe119⤵PID:1032
-
\??\c:\1hnnhh.exec:\1hnnhh.exe120⤵PID:3856
-
\??\c:\pppjj.exec:\pppjj.exe121⤵PID:1820
-
\??\c:\pddpd.exec:\pddpd.exe122⤵PID:3336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-