Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 10:42
Behavioral task
behavioral1
Sample
78c9ba651a59e549d579042341f942273ebbef1942e3b00cebcbda43389a6e89.exe
Resource
win7-20240419-en
General
-
Target
78c9ba651a59e549d579042341f942273ebbef1942e3b00cebcbda43389a6e89.exe
-
Size
440KB
-
MD5
0e30696faf2af47c270f0ea2e75f3960
-
SHA1
2cdab8659ccd4679da2efb27df740ac3b33b87dc
-
SHA256
78c9ba651a59e549d579042341f942273ebbef1942e3b00cebcbda43389a6e89
-
SHA512
e5f203d4b47016b71afaa4cb115985cbf5cd77cd4b0c15fe51038738109b509970e6a554f79731578b4c7a8ab857d60e4a8109bb33a7d027276b51999513f304
-
SSDEEP
12288:w4wFHoS9KxbNnidEhjEJd1kNpeUgI95yRoZHVaoJMOxFXnRV4PiGO0hUmHt:kKxbNndhjEJd1kNpeUgI95yRoZHgoJMX
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3372-7-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2408-5-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2760-18-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4428-37-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4996-49-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/64-61-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2276-66-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2644-60-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1040-43-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4572-32-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/988-25-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4744-12-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1220-79-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5032-85-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/560-96-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/528-107-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3692-115-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2068-113-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4652-122-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3392-138-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/724-148-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4604-155-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4856-158-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3988-162-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4836-174-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/720-188-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/876-191-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3884-203-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4376-207-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1972-210-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1524-211-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2100-223-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4996-237-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1836-244-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4588-245-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1896-255-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4852-268-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2152-272-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2108-277-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/440-287-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2268-311-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3428-321-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4316-344-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1520-372-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1120-385-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2100-392-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5048-408-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2316-431-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/736-471-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/912-493-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/912-498-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1520-521-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3312-546-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4116-553-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2980-578-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1880-591-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4356-644-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2008-687-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1444-691-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3480-815-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4852-932-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1440-999-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4120-1051-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1616-1273-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\7xxxrlx.exe family_berbew \??\c:\bhthbn.exe family_berbew C:\hbtnhb.exe family_berbew C:\vjvjv.exe family_berbew \??\c:\fxrfxrl.exe family_berbew \??\c:\nnhhbt.exe family_berbew C:\dddvd.exe family_berbew \??\c:\rxxrfxr.exe family_berbew \??\c:\ntbthb.exe family_berbew \??\c:\dpddd.exe family_berbew C:\dddvj.exe family_berbew \??\c:\hnnhnn.exe family_berbew \??\c:\hhntbt.exe family_berbew C:\jpjjv.exe family_berbew \??\c:\nbhhbb.exe family_berbew C:\vpvdj.exe family_berbew C:\fffxxxr.exe family_berbew C:\vvdvj.exe family_berbew C:\flllffx.exe family_berbew C:\llxrxfx.exe family_berbew C:\nthbtn.exe family_berbew C:\vvpjj.exe family_berbew C:\lxxrlff.exe family_berbew \??\c:\xxlfxlf.exe family_berbew \??\c:\1ddvj.exe family_berbew C:\ttnhtt.exe family_berbew \??\c:\vvvpd.exe family_berbew \??\c:\lrllflx.exe family_berbew C:\dvvvp.exe family_berbew C:\rfxrlfr.exe family_berbew \??\c:\nhnbtb.exe family_berbew C:\vddpp.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
7xxxrlx.exebhthbn.exehbtnhb.exevjvjv.exefxrfxrl.exennhhbt.exehnnhnn.exedddvd.exerxxrfxr.exentbthb.exedpddd.exedddvj.exehhntbt.exejpjjv.exenbhhbb.exevpvdj.exefffxxxr.exevvdvj.exeflllffx.exellxrxfx.exenthbtn.exevvpjj.exelxxrlff.exexxlfxlf.exe1ddvj.exettnhtt.exevvvpd.exelrllflx.exedvvvp.exerfxrlfr.exenhnbtb.exevddpp.exefrfxrlf.exeththtn.exevvvpd.exefllrxxf.exebbthbb.exehtnbtn.exe7pjdp.exerrxxxrl.exetnhbbt.exenttnhb.exeddpjd.exexrrlxxr.exe1rrlflf.exettbthb.exejvdvp.exerllrlff.exerxxrllf.exentnhnb.exepjddd.exelrfrlrr.exetbhhbh.exeddvvp.exe3flfxxr.exefxlffff.exe3hntnt.exedppjd.exefxlffrx.exenbhtbb.exenbtnhh.exe3vpjv.exexxfxffl.exe9rxxxxr.exepid process 3372 7xxxrlx.exe 4744 bhthbn.exe 2760 hbtnhb.exe 988 vjvjv.exe 4572 fxrfxrl.exe 4428 nnhhbt.exe 1040 hnnhnn.exe 4996 dddvd.exe 2644 rxxrfxr.exe 64 ntbthb.exe 2276 dpddd.exe 3984 dddvj.exe 1220 hhntbt.exe 5032 jpjjv.exe 3376 nbhhbb.exe 560 vpvdj.exe 528 fffxxxr.exe 3692 vvdvj.exe 2068 flllffx.exe 4652 llxrxfx.exe 2268 nthbtn.exe 736 vvpjj.exe 3392 lxxrlff.exe 724 xxlfxlf.exe 4604 1ddvj.exe 4856 ttnhtt.exe 3988 vvvpd.exe 2104 lrllflx.exe 4836 dvvvp.exe 3484 rfxrlfr.exe 720 nhnbtb.exe 876 vddpp.exe 3568 frfxrlf.exe 1512 ththtn.exe 3884 vvvpd.exe 4376 fllrxxf.exe 1972 bbthbb.exe 1524 htnbtn.exe 4656 7pjdp.exe 2760 rrxxxrl.exe 2100 tnhbbt.exe 3068 nttnhb.exe 2000 ddpjd.exe 1040 xrrlxxr.exe 3136 1rrlflf.exe 4996 ttbthb.exe 1836 jvdvp.exe 4588 rllrlff.exe 4684 rxxrllf.exe 2008 ntnhnb.exe 1896 pjddd.exe 1504 lrfrlrr.exe 1444 tbhhbh.exe 4852 ddvvp.exe 2152 3flfxxr.exe 4464 fxlffff.exe 2108 3hntnt.exe 1968 dppjd.exe 708 fxlffrx.exe 440 nbhtbb.exe 2188 nbtnhh.exe 4396 3vpjv.exe 4108 xxfxffl.exe 2056 9rxxxxr.exe -
Processes:
resource yara_rule behavioral2/memory/2408-0-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\7xxxrlx.exe upx behavioral2/memory/3372-7-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2408-5-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\bhthbn.exe upx C:\hbtnhb.exe upx behavioral2/memory/2760-18-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\vjvjv.exe upx \??\c:\fxrfxrl.exe upx \??\c:\nnhhbt.exe upx behavioral2/memory/4428-37-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\dddvd.exe upx behavioral2/memory/4996-49-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\rxxrfxr.exe upx \??\c:\ntbthb.exe upx behavioral2/memory/64-61-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2276-66-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\dpddd.exe upx behavioral2/memory/2644-60-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\dddvj.exe upx behavioral2/memory/1040-43-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\hnnhnn.exe upx behavioral2/memory/4572-32-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/988-25-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4744-12-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\hhntbt.exe upx behavioral2/memory/1220-79-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\jpjjv.exe upx \??\c:\nbhhbb.exe upx behavioral2/memory/3376-89-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\vpvdj.exe upx behavioral2/memory/5032-85-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/560-96-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\fffxxxr.exe upx C:\vvdvj.exe upx behavioral2/memory/3692-108-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/528-107-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\flllffx.exe upx behavioral2/memory/3692-115-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2068-113-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\llxrxfx.exe upx behavioral2/memory/4652-122-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\nthbtn.exe upx C:\vvpjj.exe upx C:\lxxrlff.exe upx behavioral2/memory/3392-138-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\xxlfxlf.exe upx behavioral2/memory/724-143-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/724-148-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\1ddvj.exe upx C:\ttnhtt.exe upx behavioral2/memory/4604-155-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4856-158-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\vvvpd.exe upx behavioral2/memory/3988-162-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\lrllflx.exe upx C:\dvvvp.exe upx behavioral2/memory/4836-174-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\rfxrlfr.exe upx \??\c:\nhnbtb.exe upx behavioral2/memory/720-188-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\vddpp.exe upx behavioral2/memory/876-191-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3884-203-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
78c9ba651a59e549d579042341f942273ebbef1942e3b00cebcbda43389a6e89.exe7xxxrlx.exebhthbn.exehbtnhb.exevjvjv.exefxrfxrl.exennhhbt.exehnnhnn.exedddvd.exerxxrfxr.exentbthb.exedpddd.exedddvj.exehhntbt.exejpjjv.exenbhhbb.exevpvdj.exefffxxxr.exevvdvj.exeflllffx.exellxrxfx.exenthbtn.exedescription pid process target process PID 2408 wrote to memory of 3372 2408 78c9ba651a59e549d579042341f942273ebbef1942e3b00cebcbda43389a6e89.exe 7xxxrlx.exe PID 2408 wrote to memory of 3372 2408 78c9ba651a59e549d579042341f942273ebbef1942e3b00cebcbda43389a6e89.exe 7xxxrlx.exe PID 2408 wrote to memory of 3372 2408 78c9ba651a59e549d579042341f942273ebbef1942e3b00cebcbda43389a6e89.exe 7xxxrlx.exe PID 3372 wrote to memory of 4744 3372 7xxxrlx.exe bhthbn.exe PID 3372 wrote to memory of 4744 3372 7xxxrlx.exe bhthbn.exe PID 3372 wrote to memory of 4744 3372 7xxxrlx.exe bhthbn.exe PID 4744 wrote to memory of 2760 4744 bhthbn.exe hbtnhb.exe PID 4744 wrote to memory of 2760 4744 bhthbn.exe hbtnhb.exe PID 4744 wrote to memory of 2760 4744 bhthbn.exe hbtnhb.exe PID 2760 wrote to memory of 988 2760 hbtnhb.exe vjvjv.exe PID 2760 wrote to memory of 988 2760 hbtnhb.exe vjvjv.exe PID 2760 wrote to memory of 988 2760 hbtnhb.exe vjvjv.exe PID 988 wrote to memory of 4572 988 vjvjv.exe fxrfxrl.exe PID 988 wrote to memory of 4572 988 vjvjv.exe fxrfxrl.exe PID 988 wrote to memory of 4572 988 vjvjv.exe fxrfxrl.exe PID 4572 wrote to memory of 4428 4572 fxrfxrl.exe nnhhbt.exe PID 4572 wrote to memory of 4428 4572 fxrfxrl.exe nnhhbt.exe PID 4572 wrote to memory of 4428 4572 fxrfxrl.exe nnhhbt.exe PID 4428 wrote to memory of 1040 4428 nnhhbt.exe hnnhnn.exe PID 4428 wrote to memory of 1040 4428 nnhhbt.exe hnnhnn.exe PID 4428 wrote to memory of 1040 4428 nnhhbt.exe hnnhnn.exe PID 1040 wrote to memory of 4996 1040 hnnhnn.exe dddvd.exe PID 1040 wrote to memory of 4996 1040 hnnhnn.exe dddvd.exe PID 1040 wrote to memory of 4996 1040 hnnhnn.exe dddvd.exe PID 4996 wrote to memory of 2644 4996 dddvd.exe rxxrfxr.exe PID 4996 wrote to memory of 2644 4996 dddvd.exe rxxrfxr.exe PID 4996 wrote to memory of 2644 4996 dddvd.exe rxxrfxr.exe PID 2644 wrote to memory of 64 2644 rxxrfxr.exe ntbthb.exe PID 2644 wrote to memory of 64 2644 rxxrfxr.exe ntbthb.exe PID 2644 wrote to memory of 64 2644 rxxrfxr.exe ntbthb.exe PID 64 wrote to memory of 2276 64 ntbthb.exe dpddd.exe PID 64 wrote to memory of 2276 64 ntbthb.exe dpddd.exe PID 64 wrote to memory of 2276 64 ntbthb.exe dpddd.exe PID 2276 wrote to memory of 3984 2276 dpddd.exe dddvj.exe PID 2276 wrote to memory of 3984 2276 dpddd.exe dddvj.exe PID 2276 wrote to memory of 3984 2276 dpddd.exe dddvj.exe PID 3984 wrote to memory of 1220 3984 dddvj.exe hhntbt.exe PID 3984 wrote to memory of 1220 3984 dddvj.exe hhntbt.exe PID 3984 wrote to memory of 1220 3984 dddvj.exe hhntbt.exe PID 1220 wrote to memory of 5032 1220 hhntbt.exe jpjjv.exe PID 1220 wrote to memory of 5032 1220 hhntbt.exe jpjjv.exe PID 1220 wrote to memory of 5032 1220 hhntbt.exe jpjjv.exe PID 5032 wrote to memory of 3376 5032 jpjjv.exe nbhhbb.exe PID 5032 wrote to memory of 3376 5032 jpjjv.exe nbhhbb.exe PID 5032 wrote to memory of 3376 5032 jpjjv.exe nbhhbb.exe PID 3376 wrote to memory of 560 3376 nbhhbb.exe vpvdj.exe PID 3376 wrote to memory of 560 3376 nbhhbb.exe vpvdj.exe PID 3376 wrote to memory of 560 3376 nbhhbb.exe vpvdj.exe PID 560 wrote to memory of 528 560 vpvdj.exe fffxxxr.exe PID 560 wrote to memory of 528 560 vpvdj.exe fffxxxr.exe PID 560 wrote to memory of 528 560 vpvdj.exe fffxxxr.exe PID 528 wrote to memory of 3692 528 fffxxxr.exe vvdvj.exe PID 528 wrote to memory of 3692 528 fffxxxr.exe vvdvj.exe PID 528 wrote to memory of 3692 528 fffxxxr.exe vvdvj.exe PID 3692 wrote to memory of 2068 3692 vvdvj.exe flllffx.exe PID 3692 wrote to memory of 2068 3692 vvdvj.exe flllffx.exe PID 3692 wrote to memory of 2068 3692 vvdvj.exe flllffx.exe PID 2068 wrote to memory of 4652 2068 flllffx.exe llxrxfx.exe PID 2068 wrote to memory of 4652 2068 flllffx.exe llxrxfx.exe PID 2068 wrote to memory of 4652 2068 flllffx.exe llxrxfx.exe PID 4652 wrote to memory of 2268 4652 llxrxfx.exe nthbtn.exe PID 4652 wrote to memory of 2268 4652 llxrxfx.exe nthbtn.exe PID 4652 wrote to memory of 2268 4652 llxrxfx.exe nthbtn.exe PID 2268 wrote to memory of 736 2268 nthbtn.exe vvpjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78c9ba651a59e549d579042341f942273ebbef1942e3b00cebcbda43389a6e89.exe"C:\Users\Admin\AppData\Local\Temp\78c9ba651a59e549d579042341f942273ebbef1942e3b00cebcbda43389a6e89.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\7xxxrlx.exec:\7xxxrlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\bhthbn.exec:\bhthbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\hbtnhb.exec:\hbtnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\vjvjv.exec:\vjvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\fxrfxrl.exec:\fxrfxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\nnhhbt.exec:\nnhhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\hnnhnn.exec:\hnnhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\dddvd.exec:\dddvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\rxxrfxr.exec:\rxxrfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\ntbthb.exec:\ntbthb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\dpddd.exec:\dpddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\dddvj.exec:\dddvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\hhntbt.exec:\hhntbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\jpjjv.exec:\jpjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\nbhhbb.exec:\nbhhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\vpvdj.exec:\vpvdj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\fffxxxr.exec:\fffxxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\vvdvj.exec:\vvdvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\flllffx.exec:\flllffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\llxrxfx.exec:\llxrxfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\nthbtn.exec:\nthbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\vvpjj.exec:\vvpjj.exe23⤵
- Executes dropped EXE
PID:736 -
\??\c:\lxxrlff.exec:\lxxrlff.exe24⤵
- Executes dropped EXE
PID:3392 -
\??\c:\xxlfxlf.exec:\xxlfxlf.exe25⤵
- Executes dropped EXE
PID:724 -
\??\c:\1ddvj.exec:\1ddvj.exe26⤵
- Executes dropped EXE
PID:4604 -
\??\c:\ttnhtt.exec:\ttnhtt.exe27⤵
- Executes dropped EXE
PID:4856 -
\??\c:\vvvpd.exec:\vvvpd.exe28⤵
- Executes dropped EXE
PID:3988 -
\??\c:\lrllflx.exec:\lrllflx.exe29⤵
- Executes dropped EXE
PID:2104 -
\??\c:\dvvvp.exec:\dvvvp.exe30⤵
- Executes dropped EXE
PID:4836 -
\??\c:\rfxrlfr.exec:\rfxrlfr.exe31⤵
- Executes dropped EXE
PID:3484 -
\??\c:\nhnbtb.exec:\nhnbtb.exe32⤵
- Executes dropped EXE
PID:720 -
\??\c:\vddpp.exec:\vddpp.exe33⤵
- Executes dropped EXE
PID:876 -
\??\c:\frfxrlf.exec:\frfxrlf.exe34⤵
- Executes dropped EXE
PID:3568 -
\??\c:\ththtn.exec:\ththtn.exe35⤵
- Executes dropped EXE
PID:1512 -
\??\c:\vvvpd.exec:\vvvpd.exe36⤵
- Executes dropped EXE
PID:3884 -
\??\c:\fllrxxf.exec:\fllrxxf.exe37⤵
- Executes dropped EXE
PID:4376 -
\??\c:\bbthbb.exec:\bbthbb.exe38⤵
- Executes dropped EXE
PID:1972 -
\??\c:\htnbtn.exec:\htnbtn.exe39⤵
- Executes dropped EXE
PID:1524 -
\??\c:\7pjdp.exec:\7pjdp.exe40⤵
- Executes dropped EXE
PID:4656 -
\??\c:\rrxxxrl.exec:\rrxxxrl.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\tnhbbt.exec:\tnhbbt.exe42⤵
- Executes dropped EXE
PID:2100 -
\??\c:\nttnhb.exec:\nttnhb.exe43⤵
- Executes dropped EXE
PID:3068 -
\??\c:\ddpjd.exec:\ddpjd.exe44⤵
- Executes dropped EXE
PID:2000 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe45⤵
- Executes dropped EXE
PID:1040 -
\??\c:\1rrlflf.exec:\1rrlflf.exe46⤵
- Executes dropped EXE
PID:3136 -
\??\c:\ttbthb.exec:\ttbthb.exe47⤵
- Executes dropped EXE
PID:4996 -
\??\c:\jvdvp.exec:\jvdvp.exe48⤵
- Executes dropped EXE
PID:1836 -
\??\c:\rllrlff.exec:\rllrlff.exe49⤵
- Executes dropped EXE
PID:4588 -
\??\c:\rxxrllf.exec:\rxxrllf.exe50⤵
- Executes dropped EXE
PID:4684 -
\??\c:\ntnhnb.exec:\ntnhnb.exe51⤵
- Executes dropped EXE
PID:2008 -
\??\c:\pjddd.exec:\pjddd.exe52⤵
- Executes dropped EXE
PID:1896 -
\??\c:\lrfrlrr.exec:\lrfrlrr.exe53⤵
- Executes dropped EXE
PID:1504 -
\??\c:\tbhhbh.exec:\tbhhbh.exe54⤵
- Executes dropped EXE
PID:1444 -
\??\c:\ddvvp.exec:\ddvvp.exe55⤵
- Executes dropped EXE
PID:4852 -
\??\c:\3flfxxr.exec:\3flfxxr.exe56⤵
- Executes dropped EXE
PID:2152 -
\??\c:\fxlffff.exec:\fxlffff.exe57⤵
- Executes dropped EXE
PID:4464 -
\??\c:\3hntnt.exec:\3hntnt.exe58⤵
- Executes dropped EXE
PID:2108 -
\??\c:\dppjd.exec:\dppjd.exe59⤵
- Executes dropped EXE
PID:1968 -
\??\c:\fxlffrx.exec:\fxlffrx.exe60⤵
- Executes dropped EXE
PID:708 -
\??\c:\nbhtbb.exec:\nbhtbb.exe61⤵
- Executes dropped EXE
PID:440 -
\??\c:\nbtnhh.exec:\nbtnhh.exe62⤵
- Executes dropped EXE
PID:2188 -
\??\c:\3vpjv.exec:\3vpjv.exe63⤵
- Executes dropped EXE
PID:4396 -
\??\c:\xxfxffl.exec:\xxfxffl.exe64⤵
- Executes dropped EXE
PID:4108 -
\??\c:\9rxxxxr.exec:\9rxxxxr.exe65⤵
- Executes dropped EXE
PID:2056 -
\??\c:\3ntttb.exec:\3ntttb.exe66⤵PID:4284
-
\??\c:\1vjvp.exec:\1vjvp.exe67⤵PID:2268
-
\??\c:\lflrfxr.exec:\lflrfxr.exe68⤵PID:736
-
\??\c:\nhnntt.exec:\nhnntt.exe69⤵PID:3392
-
\??\c:\hbbnhb.exec:\hbbnhb.exe70⤵PID:3696
-
\??\c:\ppddj.exec:\ppddj.exe71⤵PID:3428
-
\??\c:\llxlfxr.exec:\llxlfxr.exe72⤵PID:3404
-
\??\c:\7hhnnt.exec:\7hhnnt.exe73⤵PID:1652
-
\??\c:\jdjvp.exec:\jdjvp.exe74⤵PID:3964
-
\??\c:\pvppd.exec:\pvppd.exe75⤵PID:396
-
\??\c:\rfrfllf.exec:\rfrfllf.exe76⤵PID:4212
-
\??\c:\bhthbb.exec:\bhthbb.exe77⤵PID:4316
-
\??\c:\dvdvv.exec:\dvdvv.exe78⤵PID:4520
-
\??\c:\rfffxll.exec:\rfffxll.exe79⤵PID:1440
-
\??\c:\tntnbt.exec:\tntnbt.exe80⤵PID:4004
-
\??\c:\dvvjp.exec:\dvvjp.exe81⤵PID:4944
-
\??\c:\5lxxxxr.exec:\5lxxxxr.exe82⤵PID:1416
-
\??\c:\bttnhh.exec:\bttnhh.exe83⤵PID:876
-
\??\c:\nhbtnn.exec:\nhbtnn.exe84⤵PID:4768
-
\??\c:\vddvv.exec:\vddvv.exe85⤵PID:4552
-
\??\c:\7fxrffx.exec:\7fxrffx.exe86⤵PID:1520
-
\??\c:\3pjpj.exec:\3pjpj.exe87⤵PID:4380
-
\??\c:\5vvjv.exec:\5vvjv.exe88⤵PID:428
-
\??\c:\fxffrrl.exec:\fxffrrl.exe89⤵PID:3140
-
\??\c:\ttbnhb.exec:\ttbnhb.exe90⤵PID:1120
-
\??\c:\hhtnnh.exec:\hhtnnh.exe91⤵PID:1744
-
\??\c:\5vpjv.exec:\5vpjv.exe92⤵PID:4572
-
\??\c:\rrlrrrr.exec:\rrlrrrr.exe93⤵PID:2100
-
\??\c:\hbbtnh.exec:\hbbtnh.exe94⤵PID:5088
-
\??\c:\tthnht.exec:\tthnht.exe95⤵PID:4228
-
\??\c:\jdvpv.exec:\jdvpv.exe96⤵PID:2040
-
\??\c:\7xxlxrl.exec:\7xxlxrl.exe97⤵PID:5048
-
\??\c:\flrlflf.exec:\flrlflf.exe98⤵PID:4676
-
\??\c:\tnnbtt.exec:\tnnbtt.exe99⤵PID:5108
-
\??\c:\pvjvd.exec:\pvjvd.exe100⤵PID:3060
-
\??\c:\rxxxxrx.exec:\rxxxxrx.exe101⤵PID:4776
-
\??\c:\xrlxrrl.exec:\xrlxrrl.exe102⤵PID:3984
-
\??\c:\thbthh.exec:\thbthh.exe103⤵PID:1904
-
\??\c:\vpjdp.exec:\vpjdp.exe104⤵PID:2316
-
\??\c:\rrlxfrr.exec:\rrlxfrr.exe105⤵PID:2152
-
\??\c:\btnhhh.exec:\btnhhh.exe106⤵PID:4464
-
\??\c:\dvvvp.exec:\dvvvp.exe107⤵PID:528
-
\??\c:\5ffrllf.exec:\5ffrllf.exe108⤵PID:1532
-
\??\c:\hbtthh.exec:\hbtthh.exe109⤵PID:708
-
\??\c:\9tbthb.exec:\9tbthb.exe110⤵PID:116
-
\??\c:\pjvdd.exec:\pjvdd.exe111⤵PID:2188
-
\??\c:\lfflxll.exec:\lfflxll.exe112⤵PID:4396
-
\??\c:\httnhb.exec:\httnhb.exe113⤵PID:4108
-
\??\c:\hhhtnt.exec:\hhhtnt.exe114⤵PID:816
-
\??\c:\dvpjd.exec:\dvpjd.exe115⤵PID:2884
-
\??\c:\rllfllx.exec:\rllfllx.exe116⤵PID:3216
-
\??\c:\bbtnhh.exec:\bbtnhh.exe117⤵PID:736
-
\??\c:\bntnbb.exec:\bntnbb.exe118⤵PID:724
-
\??\c:\vpjdp.exec:\vpjdp.exe119⤵PID:1976
-
\??\c:\7rlfrlx.exec:\7rlfrlx.exe120⤵PID:432
-
\??\c:\5fllxfx.exec:\5fllxfx.exe121⤵PID:4784
-
\??\c:\hnthhn.exec:\hnthhn.exe122⤵PID:3876
-
\??\c:\pjjdp.exec:\pjjdp.exe123⤵PID:1328
-
\??\c:\dpvvj.exec:\dpvvj.exe124⤵PID:912
-
\??\c:\rrrxrll.exec:\rrrxrll.exe125⤵PID:2184
-
\??\c:\thbtnh.exec:\thbtnh.exe126⤵PID:3368
-
\??\c:\jdjjj.exec:\jdjjj.exe127⤵PID:4004
-
\??\c:\frrrlff.exec:\frrrlff.exe128⤵PID:1640
-
\??\c:\7lrlxxr.exec:\7lrlxxr.exe129⤵PID:4456
-
\??\c:\5bbthh.exec:\5bbthh.exe130⤵PID:1512
-
\??\c:\nhnhbt.exec:\nhnhbt.exe131⤵PID:1520
-
\??\c:\ppjjp.exec:\ppjjp.exe132⤵PID:428
-
\??\c:\9xxlxxr.exec:\9xxlxxr.exe133⤵PID:4000
-
\??\c:\nhbtbt.exec:\nhbtbt.exe134⤵PID:2916
-
\??\c:\hbtnhh.exec:\hbtnhh.exe135⤵PID:380
-
\??\c:\dddpj.exec:\dddpj.exe136⤵PID:1492
-
\??\c:\5lrfxxr.exec:\5lrfxxr.exe137⤵PID:3136
-
\??\c:\thhbnn.exec:\thhbnn.exe138⤵PID:2140
-
\??\c:\hnnhbt.exec:\hnnhbt.exe139⤵PID:4664
-
\??\c:\jpjdd.exec:\jpjdd.exe140⤵PID:3312
-
\??\c:\rxfrffx.exec:\rxfrffx.exe141⤵PID:2712
-
\??\c:\tnnhtt.exec:\tnnhtt.exe142⤵PID:4116
-
\??\c:\nbhnbb.exec:\nbhnbb.exe143⤵PID:4776
-
\??\c:\jpppj.exec:\jpppj.exe144⤵PID:4800
-
\??\c:\xrfrxrr.exec:\xrfrxrr.exe145⤵PID:8
-
\??\c:\tnbtbt.exec:\tnbtbt.exe146⤵PID:3836
-
\??\c:\hnhtnh.exec:\hnhtnh.exe147⤵PID:4932
-
\??\c:\pjdpd.exec:\pjdpd.exe148⤵PID:4176
-
\??\c:\rxxlfxf.exec:\rxxlfxf.exe149⤵PID:2980
-
\??\c:\hbnbtn.exec:\hbnbtn.exe150⤵PID:3464
-
\??\c:\dvvvj.exec:\dvvvj.exe151⤵PID:4164
-
\??\c:\rlllxxr.exec:\rlllxxr.exe152⤵PID:4304
-
\??\c:\rrlffff.exec:\rrlffff.exe153⤵PID:1664
-
\??\c:\bbbtbb.exec:\bbbtbb.exe154⤵PID:1880
-
\??\c:\1jjdv.exec:\1jjdv.exe155⤵PID:2936
-
\??\c:\djddv.exec:\djddv.exe156⤵PID:1680
-
\??\c:\rflxxxf.exec:\rflxxxf.exe157⤵PID:436
-
\??\c:\bhhbbt.exec:\bhhbbt.exe158⤵PID:4940
-
\??\c:\jvjvp.exec:\jvjvp.exe159⤵PID:3392
-
\??\c:\vjdvj.exec:\vjdvj.exe160⤵PID:4384
-
\??\c:\fffxfxf.exec:\fffxfxf.exe161⤵PID:1344
-
\??\c:\btnhbt.exec:\btnhbt.exe162⤵PID:3652
-
\??\c:\7pjdp.exec:\7pjdp.exe163⤵PID:1648
-
\??\c:\pjdvj.exec:\pjdvj.exe164⤵PID:4880
-
\??\c:\xrxrfxr.exec:\xrxrfxr.exe165⤵PID:4752
-
\??\c:\xflffxx.exec:\xflffxx.exe166⤵PID:4504
-
\??\c:\thhbtt.exec:\thhbtt.exe167⤵PID:2460
-
\??\c:\jvjvp.exec:\jvjvp.exe168⤵PID:720
-
\??\c:\ffxrffl.exec:\ffxrffl.exe169⤵PID:748
-
\??\c:\nhthhb.exec:\nhthhb.exe170⤵PID:876
-
\??\c:\9bnnhh.exec:\9bnnhh.exe171⤵PID:4356
-
\??\c:\vjvjd.exec:\vjvjd.exe172⤵PID:1380
-
\??\c:\lfxfxxf.exec:\lfxfxxf.exe173⤵PID:1852
-
\??\c:\lffxlfx.exec:\lffxlfx.exe174⤵PID:428
-
\??\c:\hbbttn.exec:\hbbttn.exe175⤵PID:4440
-
\??\c:\1vvpv.exec:\1vvpv.exe176⤵PID:1616
-
\??\c:\9rrfxrl.exec:\9rrfxrl.exe177⤵PID:1960
-
\??\c:\lrlfffl.exec:\lrlfffl.exe178⤵PID:4276
-
\??\c:\nbhhnh.exec:\nbhhnh.exe179⤵PID:3136
-
\??\c:\pjjpj.exec:\pjjpj.exe180⤵PID:680
-
\??\c:\jpvjd.exec:\jpvjd.exe181⤵PID:1704
-
\??\c:\3xxlfrf.exec:\3xxlfrf.exe182⤵PID:3420
-
\??\c:\hbbhbt.exec:\hbbhbt.exe183⤵PID:2008
-
\??\c:\5jjdp.exec:\5jjdp.exe184⤵PID:1220
-
\??\c:\lrrlxxr.exec:\lrrlxxr.exe185⤵PID:1444
-
\??\c:\nhbbnh.exec:\nhbbnh.exe186⤵PID:5032
-
\??\c:\dpjvp.exec:\dpjvp.exe187⤵PID:3808
-
\??\c:\ddpjv.exec:\ddpjv.exe188⤵PID:2152
-
\??\c:\rxxrlrr.exec:\rxxrlrr.exe189⤵PID:2924
-
\??\c:\nnhnnb.exec:\nnhnnb.exe190⤵PID:560
-
\??\c:\vdjjd.exec:\vdjjd.exe191⤵PID:3792
-
\??\c:\xflffll.exec:\xflffll.exe192⤵PID:2452
-
\??\c:\fxlfffx.exec:\fxlfffx.exe193⤵PID:2424
-
\??\c:\bbtbbb.exec:\bbtbbb.exe194⤵PID:4616
-
\??\c:\jddpv.exec:\jddpv.exe195⤵PID:2052
-
\??\c:\jdjdv.exec:\jdjdv.exe196⤵PID:4284
-
\??\c:\fxfrrll.exec:\fxfrrll.exe197⤵PID:5084
-
\??\c:\tnnhbb.exec:\tnnhbb.exe198⤵PID:2844
-
\??\c:\vjjvp.exec:\vjjvp.exe199⤵PID:1792
-
\??\c:\vppdv.exec:\vppdv.exe200⤵PID:3392
-
\??\c:\lxxrlff.exec:\lxxrlff.exe201⤵PID:2940
-
\??\c:\tttntn.exec:\tttntn.exe202⤵PID:548
-
\??\c:\tthtnh.exec:\tthtnh.exe203⤵PID:4784
-
\??\c:\vvjvj.exec:\vvjvj.exe204⤵PID:3768
-
\??\c:\jpvpd.exec:\jpvpd.exe205⤵PID:396
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe206⤵PID:676
-
\??\c:\nntnhh.exec:\nntnhh.exe207⤵PID:3664
-
\??\c:\hthbtn.exec:\hthbtn.exe208⤵PID:3424
-
\??\c:\vvvpv.exec:\vvvpv.exe209⤵PID:2024
-
\??\c:\xrrxlrl.exec:\xrrxlrl.exe210⤵PID:3568
-
\??\c:\rffrfxr.exec:\rffrfxr.exe211⤵PID:4456
-
\??\c:\hbbtnt.exec:\hbbtnt.exe212⤵PID:2520
-
\??\c:\9jjdp.exec:\9jjdp.exe213⤵PID:4744
-
\??\c:\3ffrfxr.exec:\3ffrfxr.exe214⤵PID:4000
-
\??\c:\7xxrfrl.exec:\7xxrfrl.exe215⤵PID:1596
-
\??\c:\bnnhtt.exec:\bnnhtt.exe216⤵PID:3708
-
\??\c:\djvvj.exec:\djvvj.exe217⤵PID:1040
-
\??\c:\dvvvj.exec:\dvvvj.exe218⤵PID:4492
-
\??\c:\frxxxrr.exec:\frxxxrr.exe219⤵PID:3136
-
\??\c:\hhthbb.exec:\hhthbb.exe220⤵PID:116
-
\??\c:\tbhbtn.exec:\tbhbtn.exe221⤵PID:4684
-
\??\c:\dvdpp.exec:\dvdpp.exe222⤵PID:452
-
\??\c:\fxfxxrx.exec:\fxfxxrx.exe223⤵PID:3984
-
\??\c:\rfrflfl.exec:\rfrflfl.exe224⤵PID:5096
-
\??\c:\nbhhbb.exec:\nbhhbb.exe225⤵PID:3480
-
\??\c:\dppdp.exec:\dppdp.exe226⤵PID:3808
-
\??\c:\rlxlrrf.exec:\rlxlrrf.exe227⤵PID:528
-
\??\c:\rfrllll.exec:\rfrllll.exe228⤵PID:4272
-
\??\c:\nbtttt.exec:\nbtttt.exe229⤵PID:2868
-
\??\c:\dpjvp.exec:\dpjvp.exe230⤵PID:1208
-
\??\c:\dpjjd.exec:\dpjjd.exe231⤵PID:2452
-
\??\c:\xrrlffx.exec:\xrrlffx.exe232⤵PID:1592
-
\??\c:\htbtth.exec:\htbtth.exe233⤵PID:3048
-
\??\c:\3hnhbh.exec:\3hnhbh.exe234⤵PID:3684
-
\??\c:\9dddv.exec:\9dddv.exe235⤵PID:2936
-
\??\c:\rlxrllr.exec:\rlxrllr.exe236⤵PID:4940
-
\??\c:\bnbthb.exec:\bnbthb.exe237⤵PID:4384
-
\??\c:\tnhbtn.exec:\tnhbtn.exe238⤵PID:1652
-
\??\c:\vjpjj.exec:\vjpjj.exe239⤵PID:3620
-
\??\c:\xrlxrlf.exec:\xrlxrlf.exe240⤵PID:548
-
\??\c:\bnhtnh.exec:\bnhtnh.exe241⤵PID:1328
-
\??\c:\vpjvp.exec:\vpjvp.exe242⤵PID:3768