Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 14:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
55254dbf7a19e5803a57a50af5e4d070_JaffaCakes118.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 55254dbf7a19e5803a57a50af5e4d070_JaffaCakes118.exe
- Size 191KB
- Sample240518-rl9b7afe67
- SHA256 e93816aa44950d9315279de9b049da8004ac89c71fa7ffb80a9a6384f27258c9
- MD5 55254dbf7a19e5803a57a50af5e4d070
- SHA1 9c59f35434ccc4605521625a5f364e306d9d8462
- SHA512 3396bcd1f0c3d83f8a3c76dcd194ae980c0cf9bb899d9fd23cdee11755c20a9389d0096b51784bf6ff3e3178e4ba689f78e229f8d665d057c4fbf11853609b9d
- SSDEEP 1536:EvQBeOGtrYSSsrc93UBIfdC67m6AJiqjt3ufT/FRxZOYsU58R:EhOm2sI93UufdC67ciyt3ujFf7jaR
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2540-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/992-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2916-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1236-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/684-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1340-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/684-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3288-704-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2924 lfxrxrl.exe 3580 frfxlfx.exe 3808 3tnbnh.exe 3716 xlrlfxf.exe 1800 xffrllx.exe 320 hthbtn.exe 2424 ntnbth.exe 916 5rflxrl.exe 2564 htbttn.exe 992 jdppj.exe 4108 vdvdv.exe 2084 xlrflfl.exe 2032 bbhbnn.exe 4920 7ttbnb.exe 3320 ddvpj.exe 2916 rfrfxxr.exe 3204 7ffrlfx.exe 1660 nbbthb.exe 4840 pjvvp.exe 2168 frxlfll.exe 2120 ffxrlfx.exe 1236 bnhbtn.exe 4236 vpvpd.exe 1812 pvpjv.exe 712 xxxrlfx.exe 684 7bttth.exe 4132 nnthtn.exe 1592 9ddpd.exe 2776 fxfrrrr.exe 3672 rffxrlr.exe 2760 tnnnhh.exe 5088 9vdvp.exe 4720 flfxrrf.exe 4232 fxlxrlf.exe 4188 bththb.exe 3620 1fflffx.exe 2724 tbbnhh.exe 4744 tnbtbt.exe 468 7vjvp.exe 4612 fllxrlf.exe 540 rffxlfx.exe 1800 nhbtnn.exe 212 jdjjd.exe 1164 5jvjd.exe 2648 rxrfxrf.exe 436 tnnhtt.exe 2564 pdvpj.exe 2512 ppjpd.exe 3032 lxrlfxr.exe 4424 htnhtt.exe 5012 bhbbnh.exe 4292 jpvpj.exe 3836 pjjdd.exe 3320 lfxlfxx.exe 3184 thbhbt.exe 732 hbnnht.exe 832 jjpdp.exe 2040 lllrfxl.exe 1340 xllfxrl.exe 2212 tthbbb.exe 3324 nhnhnn.exe 4840 dpdpv.exe 2308 xrrxlxl.exe 4368 7ffrlfx.exe -
resource yara_rule behavioral2/memory/2924-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/992-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1236-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1236-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/684-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1340-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-440-0x0000000000400000-0x000000000042A000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2924 2540 55254dbf7a19e5803a57a50af5e4d070_JaffaCakes118.exe 82 PID 2540 wrote to memory of 2924 2540 55254dbf7a19e5803a57a50af5e4d070_JaffaCakes118.exe 82 PID 2540 wrote to memory of 2924 2540 55254dbf7a19e5803a57a50af5e4d070_JaffaCakes118.exe 82 PID 2924 wrote to memory of 3580 2924 lfxrxrl.exe 83 PID 2924 wrote to memory of 3580 2924 lfxrxrl.exe 83 PID 2924 wrote to memory of 3580 2924 lfxrxrl.exe 83 PID 3580 wrote to memory of 3808 3580 frfxlfx.exe 84 PID 3580 wrote to memory of 3808 3580 frfxlfx.exe 84 PID 3580 wrote to memory of 3808 3580 frfxlfx.exe 84 PID 3808 wrote to memory of 3716 3808 3tnbnh.exe 85 PID 3808 wrote to memory of 3716 3808 3tnbnh.exe 85 PID 3808 wrote to memory of 3716 3808 3tnbnh.exe 85 PID 3716 wrote to memory of 1800 3716 xlrlfxf.exe 86 PID 3716 wrote to memory of 1800 3716 xlrlfxf.exe 86 PID 3716 wrote to memory of 1800 3716 xlrlfxf.exe 86 PID 1800 wrote to memory of 320 1800 xffrllx.exe 87 PID 1800 wrote to memory of 320 1800 xffrllx.exe 87 PID 1800 wrote to memory of 320 1800 xffrllx.exe 87 PID 320 wrote to memory of 2424 320 hthbtn.exe 88 PID 320 wrote to memory of 2424 320 hthbtn.exe 88 PID 320 wrote to memory of 2424 320 hthbtn.exe 88 PID 2424 wrote to memory of 916 2424 ntnbth.exe 89 PID 2424 wrote to memory of 916 2424 ntnbth.exe 89 PID 2424 wrote to memory of 916 2424 ntnbth.exe 89 PID 916 wrote to memory of 2564 916 5rflxrl.exe 90 PID 916 wrote to memory of 2564 916 5rflxrl.exe 90 PID 916 wrote to memory of 2564 916 5rflxrl.exe 90 PID 2564 wrote to memory of 992 2564 htbttn.exe 91 PID 2564 wrote to memory of 992 2564 htbttn.exe 91 PID 2564 wrote to memory of 992 2564 htbttn.exe 91 PID 992 wrote to memory of 4108 992 jdppj.exe 92 PID 992 wrote to memory of 4108 992 jdppj.exe 92 PID 992 wrote to memory of 4108 992 jdppj.exe 92 PID 4108 wrote to memory of 2084 4108 vdvdv.exe 93 PID 4108 wrote to memory of 2084 4108 vdvdv.exe 93 PID 4108 wrote to memory of 2084 4108 vdvdv.exe 93 PID 2084 wrote to memory of 2032 2084 xlrflfl.exe 95 PID 2084 wrote to memory of 2032 2084 xlrflfl.exe 95 PID 2084 wrote to memory of 2032 2084 xlrflfl.exe 95 PID 2032 wrote to memory of 4920 2032 bbhbnn.exe 96 PID 2032 wrote to memory of 4920 2032 bbhbnn.exe 96 PID 2032 wrote to memory of 4920 2032 bbhbnn.exe 96 PID 4920 wrote to memory of 3320 4920 7ttbnb.exe 97 PID 4920 wrote to memory of 3320 4920 7ttbnb.exe 97 PID 4920 wrote to memory of 3320 4920 7ttbnb.exe 97 PID 3320 wrote to memory of 2916 3320 ddvpj.exe 98 PID 3320 wrote to memory of 2916 3320 ddvpj.exe 98 PID 3320 wrote to memory of 2916 3320 ddvpj.exe 98 PID 2916 wrote to memory of 3204 2916 rfrfxxr.exe 100 PID 2916 wrote to memory of 3204 2916 rfrfxxr.exe 100 PID 2916 wrote to memory of 3204 2916 rfrfxxr.exe 100 PID 3204 wrote to memory of 1660 3204 7ffrlfx.exe 101 PID 3204 wrote to memory of 1660 3204 7ffrlfx.exe 101 PID 3204 wrote to memory of 1660 3204 7ffrlfx.exe 101 PID 1660 wrote to memory of 4840 1660 nbbthb.exe 102 PID 1660 wrote to memory of 4840 1660 nbbthb.exe 102 PID 1660 wrote to memory of 4840 1660 nbbthb.exe 102 PID 4840 wrote to memory of 2168 4840 pjvvp.exe 104 PID 4840 wrote to memory of 2168 4840 pjvvp.exe 104 PID 4840 wrote to memory of 2168 4840 pjvvp.exe 104 PID 2168 wrote to memory of 2120 2168 frxlfll.exe 105 PID 2168 wrote to memory of 2120 2168 frxlfll.exe 105 PID 2168 wrote to memory of 2120 2168 frxlfll.exe 105 PID 2120 wrote to memory of 1236 2120 ffxrlfx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\55254dbf7a19e5803a57a50af5e4d070_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\55254dbf7a19e5803a57a50af5e4d070_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\lfxrxrl.exec:\lfxrxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\frfxlfx.exec:\frfxlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\3tnbnh.exec:\3tnbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\xlrlfxf.exec:\xlrlfxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\xffrllx.exec:\xffrllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\hthbtn.exec:\hthbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\ntnbth.exec:\ntnbth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\5rflxrl.exec:\5rflxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\htbttn.exec:\htbttn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\jdppj.exec:\jdppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\vdvdv.exec:\vdvdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\xlrflfl.exec:\xlrflfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\bbhbnn.exec:\bbhbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\7ttbnb.exec:\7ttbnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\ddvpj.exec:\ddvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\rfrfxxr.exec:\rfrfxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\7ffrlfx.exec:\7ffrlfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\nbbthb.exec:\nbbthb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\pjvvp.exec:\pjvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\frxlfll.exec:\frxlfll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\ffxrlfx.exec:\ffxrlfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\bnhbtn.exec:\bnhbtn.exe23⤵
- Executes dropped EXE
PID:1236 -
\??\c:\vpvpd.exec:\vpvpd.exe24⤵
- Executes dropped EXE
PID:4236 -
\??\c:\pvpjv.exec:\pvpjv.exe25⤵
- Executes dropped EXE
PID:1812 -
\??\c:\xxxrlfx.exec:\xxxrlfx.exe26⤵
- Executes dropped EXE
PID:712 -
\??\c:\7bttth.exec:\7bttth.exe27⤵
- Executes dropped EXE
PID:684 -
\??\c:\nnthtn.exec:\nnthtn.exe28⤵
- Executes dropped EXE
PID:4132 -
\??\c:\9ddpd.exec:\9ddpd.exe29⤵
- Executes dropped EXE
PID:1592 -
\??\c:\fxfrrrr.exec:\fxfrrrr.exe30⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rffxrlr.exec:\rffxrlr.exe31⤵
- Executes dropped EXE
PID:3672 -
\??\c:\tnnnhh.exec:\tnnnhh.exe32⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9vdvp.exec:\9vdvp.exe33⤵
- Executes dropped EXE
PID:5088 -
\??\c:\flfxrrf.exec:\flfxrrf.exe34⤵
- Executes dropped EXE
PID:4720 -
\??\c:\fxlxrlf.exec:\fxlxrlf.exe35⤵
- Executes dropped EXE
PID:4232 -
\??\c:\bththb.exec:\bththb.exe36⤵
- Executes dropped EXE
PID:4188 -
\??\c:\jvvvj.exec:\jvvvj.exe37⤵PID:4468
-
\??\c:\1fflffx.exec:\1fflffx.exe38⤵
- Executes dropped EXE
PID:3620 -
\??\c:\tbbnhh.exec:\tbbnhh.exe39⤵
- Executes dropped EXE
PID:2724 -
\??\c:\tnbtbt.exec:\tnbtbt.exe40⤵
- Executes dropped EXE
PID:4744 -
\??\c:\7vjvp.exec:\7vjvp.exe41⤵
- Executes dropped EXE
PID:468 -
\??\c:\fllxrlf.exec:\fllxrlf.exe42⤵
- Executes dropped EXE
PID:4612 -
\??\c:\rffxlfx.exec:\rffxlfx.exe43⤵
- Executes dropped EXE
PID:540 -
\??\c:\nhbtnn.exec:\nhbtnn.exe44⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jdjjd.exec:\jdjjd.exe45⤵
- Executes dropped EXE
PID:212 -
\??\c:\5jvjd.exec:\5jvjd.exe46⤵
- Executes dropped EXE
PID:1164 -
\??\c:\rxrfxrf.exec:\rxrfxrf.exe47⤵
- Executes dropped EXE
PID:2648 -
\??\c:\tnnhtt.exec:\tnnhtt.exe48⤵
- Executes dropped EXE
PID:436 -
\??\c:\pdvpj.exec:\pdvpj.exe49⤵
- Executes dropped EXE
PID:2564 -
\??\c:\ppjpd.exec:\ppjpd.exe50⤵
- Executes dropped EXE
PID:2512 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe51⤵
- Executes dropped EXE
PID:3032 -
\??\c:\htnhtt.exec:\htnhtt.exe52⤵
- Executes dropped EXE
PID:4424 -
\??\c:\bhbbnh.exec:\bhbbnh.exe53⤵
- Executes dropped EXE
PID:5012 -
\??\c:\jpvpj.exec:\jpvpj.exe54⤵
- Executes dropped EXE
PID:4292 -
\??\c:\pjjdd.exec:\pjjdd.exe55⤵
- Executes dropped EXE
PID:3836 -
\??\c:\lfxlfxx.exec:\lfxlfxx.exe56⤵
- Executes dropped EXE
PID:3320 -
\??\c:\thbhbt.exec:\thbhbt.exe57⤵
- Executes dropped EXE
PID:3184 -
\??\c:\hbnnht.exec:\hbnnht.exe58⤵
- Executes dropped EXE
PID:732 -
\??\c:\jjpdp.exec:\jjpdp.exe59⤵
- Executes dropped EXE
PID:832 -
\??\c:\lllrfxl.exec:\lllrfxl.exe60⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xllfxrl.exec:\xllfxrl.exe61⤵
- Executes dropped EXE
PID:1340 -
\??\c:\tthbbb.exec:\tthbbb.exe62⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nhnhnn.exec:\nhnhnn.exe63⤵
- Executes dropped EXE
PID:3324 -
\??\c:\dpdpv.exec:\dpdpv.exe64⤵
- Executes dropped EXE
PID:4840 -
\??\c:\xrrxlxl.exec:\xrrxlxl.exe65⤵
- Executes dropped EXE
PID:2308 -
\??\c:\7ffrlfx.exec:\7ffrlfx.exe66⤵
- Executes dropped EXE
PID:4368 -
\??\c:\bbbnhb.exec:\bbbnhb.exe67⤵PID:4312
-
\??\c:\ntnnbt.exec:\ntnnbt.exe68⤵PID:1216
-
\??\c:\jvvpv.exec:\jvvpv.exe69⤵PID:4644
-
\??\c:\pppjd.exec:\pppjd.exe70⤵PID:1632
-
\??\c:\3rxrllx.exec:\3rxrllx.exe71⤵PID:4712
-
\??\c:\7nhbnh.exec:\7nhbnh.exe72⤵PID:2472
-
\??\c:\tnbhtn.exec:\tnbhtn.exe73⤵PID:1436
-
\??\c:\pjjjd.exec:\pjjjd.exe74⤵PID:3100
-
\??\c:\5llxlfx.exec:\5llxlfx.exe75⤵PID:4456
-
\??\c:\flfxlfx.exec:\flfxlfx.exe76⤵PID:3244
-
\??\c:\bnnhnn.exec:\bnnhnn.exe77⤵PID:2776
-
\??\c:\ntbntt.exec:\ntbntt.exe78⤵PID:3672
-
\??\c:\djjvj.exec:\djjvj.exe79⤵PID:3876
-
\??\c:\rlllxxx.exec:\rlllxxx.exe80⤵PID:4476
-
\??\c:\xxxrlrr.exec:\xxxrlrr.exe81⤵PID:1040
-
\??\c:\hbnhbb.exec:\hbnhbb.exe82⤵PID:4432
-
\??\c:\dvpdv.exec:\dvpdv.exe83⤵PID:4440
-
\??\c:\lflxfxx.exec:\lflxfxx.exe84⤵PID:4188
-
\??\c:\bnbbbt.exec:\bnbbbt.exe85⤵PID:4420
-
\??\c:\3jpdp.exec:\3jpdp.exe86⤵PID:2732
-
\??\c:\frfrfrl.exec:\frfrfrl.exe87⤵PID:4408
-
\??\c:\3lxlffx.exec:\3lxlffx.exe88⤵PID:3400
-
\??\c:\nhbthb.exec:\nhbthb.exe89⤵PID:4984
-
\??\c:\pjdvv.exec:\pjdvv.exe90⤵PID:3392
-
\??\c:\rlrllll.exec:\rlrllll.exe91⤵PID:4664
-
\??\c:\rrrfxlf.exec:\rrrfxlf.exe92⤵PID:2424
-
\??\c:\btthth.exec:\btthth.exe93⤵PID:1996
-
\??\c:\9djpp.exec:\9djpp.exe94⤵PID:2088
-
\??\c:\lfxrxrl.exec:\lfxrxrl.exe95⤵PID:756
-
\??\c:\hbthbt.exec:\hbthbt.exe96⤵PID:4492
-
\??\c:\hbbnbb.exec:\hbbnbb.exe97⤵PID:3196
-
\??\c:\vjjdj.exec:\vjjdj.exe98⤵PID:4580
-
\??\c:\djvjd.exec:\djvjd.exe99⤵PID:3112
-
\??\c:\rrrlfff.exec:\rrrlfff.exe100⤵PID:972
-
\??\c:\frfxxrf.exec:\frfxxrf.exe101⤵PID:2264
-
\??\c:\1bnhbt.exec:\1bnhbt.exe102⤵PID:4920
-
\??\c:\pjjvj.exec:\pjjvj.exe103⤵PID:5092
-
\??\c:\frlfrfx.exec:\frlfrfx.exe104⤵PID:3060
-
\??\c:\rfxlxrf.exec:\rfxlxrf.exe105⤵PID:876
-
\??\c:\tnhtbt.exec:\tnhtbt.exe106⤵PID:364
-
\??\c:\pdpjd.exec:\pdpjd.exe107⤵PID:1572
-
\??\c:\1xxxfxx.exec:\1xxxfxx.exe108⤵PID:2148
-
\??\c:\xxxrfrl.exec:\xxxrfrl.exe109⤵PID:3324
-
\??\c:\3nnhbt.exec:\3nnhbt.exe110⤵PID:4840
-
\??\c:\dvpjp.exec:\dvpjp.exe111⤵PID:636
-
\??\c:\jdvvj.exec:\jdvvj.exe112⤵PID:4368
-
\??\c:\lxxlxrf.exec:\lxxlxrf.exe113⤵PID:1684
-
\??\c:\ntnbhb.exec:\ntnbhb.exe114⤵PID:4624
-
\??\c:\tbnhtn.exec:\tbnhtn.exe115⤵PID:4892
-
\??\c:\djdvp.exec:\djdvp.exe116⤵PID:1812
-
\??\c:\ppjdp.exec:\ppjdp.exe117⤵PID:684
-
\??\c:\lflrrxx.exec:\lflrrxx.exe118⤵PID:4956
-
\??\c:\3nnhtn.exec:\3nnhtn.exe119⤵PID:2720
-
\??\c:\vdpvj.exec:\vdpvj.exe120⤵PID:3264
-
\??\c:\lfrlffl.exec:\lfrlffl.exe121⤵PID:4076
-
\??\c:\thttbb.exec:\thttbb.exe122⤵PID:3228
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-