Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 20:39
Behavioral task
behavioral1
Sample
0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe
Resource
win7-20240508-en
General
-
Target
0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe
-
Size
329KB
-
MD5
06b0facf85ce6ccf71cc9ea2c4b09400
-
SHA1
950a3307b8cf758a82b87906de6d0e5bbc44784b
-
SHA256
0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781
-
SHA512
ba3e548704a1ddf6653cc0d36f541ab29c31c4342db19acd9c543667972358171e1fed0afecc770d1abe2127007bf36881d5af2011bd449d0f82223a77b0e6ef
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhY:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTI
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4072-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3336-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3336-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/428-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/908-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1244-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-732-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-911-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-912-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-1056-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0008000000022f51-3.dat family_berbew behavioral2/files/0x0007000000023403-11.dat family_berbew behavioral2/files/0x0007000000023404-15.dat family_berbew behavioral2/files/0x0007000000023405-23.dat family_berbew behavioral2/files/0x0007000000023406-29.dat family_berbew behavioral2/files/0x0007000000023407-36.dat family_berbew behavioral2/files/0x0007000000023408-43.dat family_berbew behavioral2/files/0x0007000000023409-48.dat family_berbew behavioral2/files/0x000700000002340a-55.dat family_berbew behavioral2/files/0x000700000002340b-60.dat family_berbew behavioral2/files/0x000700000002340c-65.dat family_berbew behavioral2/files/0x000700000002340d-70.dat family_berbew behavioral2/files/0x000700000002340e-77.dat family_berbew behavioral2/files/0x000700000002340f-84.dat family_berbew behavioral2/files/0x00090000000233fc-90.dat family_berbew behavioral2/files/0x0007000000023410-94.dat family_berbew behavioral2/files/0x0007000000023411-100.dat family_berbew behavioral2/files/0x0007000000023412-108.dat family_berbew behavioral2/files/0x0007000000023413-113.dat family_berbew behavioral2/files/0x0007000000023414-119.dat family_berbew behavioral2/files/0x0007000000023416-125.dat family_berbew behavioral2/files/0x0007000000023417-130.dat family_berbew behavioral2/files/0x0007000000023418-136.dat family_berbew behavioral2/files/0x0007000000023419-143.dat family_berbew behavioral2/files/0x000700000002341a-147.dat family_berbew behavioral2/files/0x000700000002341b-152.dat family_berbew behavioral2/files/0x000700000002341c-157.dat family_berbew behavioral2/files/0x000700000002341d-164.dat family_berbew behavioral2/files/0x000700000002341e-170.dat family_berbew behavioral2/files/0x000700000002341f-176.dat family_berbew behavioral2/files/0x0007000000023420-180.dat family_berbew behavioral2/files/0x0007000000023421-187.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 3336 ppjpp.exe 2788 ntnhnt.exe 4308 djpvj.exe 4792 hbthnh.exe 2220 btntbh.exe 552 jpjpv.exe 2620 fxxffff.exe 1988 hhhtht.exe 3640 fflllrl.exe 3464 dvjdd.exe 2164 ttnntt.exe 4776 xlxxrlf.exe 1624 jpdjd.exe 5000 lxxxxxf.exe 1604 nbhhhn.exe 556 xllrxfx.exe 2468 pjpjd.exe 844 nbbhnn.exe 2280 jpdvv.exe 1044 fffllll.exe 2976 ppppp.exe 2552 rfrrffl.exe 4128 ttnnbt.exe 920 dvdvv.exe 1016 tbbtnn.exe 4440 tbtbbb.exe 884 llxflxr.exe 3104 rlrxrrr.exe 4572 bnnhnn.exe 2868 xlllxxx.exe 4988 btbttn.exe 4468 dpjvp.exe 1424 llllfxx.exe 1908 ppjjd.exe 4092 frxrlff.exe 4452 vdjjj.exe 5036 5vdvv.exe 960 frxxxxr.exe 4616 thnhbh.exe 3188 jjjdd.exe 4612 frrrlrf.exe 3024 bbhttb.exe 3336 dpppv.exe 1504 xlfxrlf.exe 1856 hhbtbt.exe 4548 ppjvd.exe 4792 dvdvp.exe 60 fxlfxrl.exe 1004 7tnhnn.exe 4356 jjppv.exe 4428 hhhhtn.exe 2440 thbbtb.exe 516 xxlllrr.exe 4980 rfllllr.exe 2164 tbbhbh.exe 3240 lfxflfl.exe 428 ttbtnh.exe 1624 pjjdd.exe 4604 rrrlflx.exe 908 tthhbt.exe 3208 ppddv.exe 3468 3ddvv.exe 844 xffrrxf.exe 4728 nbtnbb.exe -
resource yara_rule behavioral2/memory/4072-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3336-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3336-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/428-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/908-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1244-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-502-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4072 wrote to memory of 3336 4072 0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe 83 PID 4072 wrote to memory of 3336 4072 0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe 83 PID 4072 wrote to memory of 3336 4072 0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe 83 PID 3336 wrote to memory of 2788 3336 ppjpp.exe 84 PID 3336 wrote to memory of 2788 3336 ppjpp.exe 84 PID 3336 wrote to memory of 2788 3336 ppjpp.exe 84 PID 2788 wrote to memory of 4308 2788 ntnhnt.exe 85 PID 2788 wrote to memory of 4308 2788 ntnhnt.exe 85 PID 2788 wrote to memory of 4308 2788 ntnhnt.exe 85 PID 4308 wrote to memory of 4792 4308 djpvj.exe 86 PID 4308 wrote to memory of 4792 4308 djpvj.exe 86 PID 4308 wrote to memory of 4792 4308 djpvj.exe 86 PID 4792 wrote to memory of 2220 4792 hbthnh.exe 87 PID 4792 wrote to memory of 2220 4792 hbthnh.exe 87 PID 4792 wrote to memory of 2220 4792 hbthnh.exe 87 PID 2220 wrote to memory of 552 2220 btntbh.exe 88 PID 2220 wrote to memory of 552 2220 btntbh.exe 88 PID 2220 wrote to memory of 552 2220 btntbh.exe 88 PID 552 wrote to memory of 2620 552 jpjpv.exe 89 PID 552 wrote to memory of 2620 552 jpjpv.exe 89 PID 552 wrote to memory of 2620 552 jpjpv.exe 89 PID 2620 wrote to memory of 1988 2620 fxxffff.exe 90 PID 2620 wrote to memory of 1988 2620 fxxffff.exe 90 PID 2620 wrote to memory of 1988 2620 fxxffff.exe 90 PID 1988 wrote to memory of 3640 1988 hhhtht.exe 91 PID 1988 wrote to memory of 3640 1988 hhhtht.exe 91 PID 1988 wrote to memory of 3640 1988 hhhtht.exe 91 PID 3640 wrote to memory of 3464 3640 fflllrl.exe 92 PID 3640 wrote to memory of 3464 3640 fflllrl.exe 92 PID 3640 wrote to memory of 3464 3640 fflllrl.exe 92 PID 3464 wrote to memory of 2164 3464 dvjdd.exe 93 PID 3464 wrote to memory of 2164 3464 dvjdd.exe 93 PID 3464 wrote to memory of 2164 3464 dvjdd.exe 93 PID 2164 wrote to memory of 4776 2164 ttnntt.exe 94 PID 2164 wrote to memory of 4776 2164 ttnntt.exe 94 PID 2164 wrote to memory of 4776 2164 ttnntt.exe 94 PID 4776 wrote to memory of 1624 4776 xlxxrlf.exe 95 PID 4776 wrote to memory of 1624 4776 xlxxrlf.exe 95 PID 4776 wrote to memory of 1624 4776 xlxxrlf.exe 95 PID 1624 wrote to memory of 5000 1624 jpdjd.exe 96 PID 1624 wrote to memory of 5000 1624 jpdjd.exe 96 PID 1624 wrote to memory of 5000 1624 jpdjd.exe 96 PID 5000 wrote to memory of 1604 5000 lxxxxxf.exe 97 PID 5000 wrote to memory of 1604 5000 lxxxxxf.exe 97 PID 5000 wrote to memory of 1604 5000 lxxxxxf.exe 97 PID 1604 wrote to memory of 556 1604 nbhhhn.exe 98 PID 1604 wrote to memory of 556 1604 nbhhhn.exe 98 PID 1604 wrote to memory of 556 1604 nbhhhn.exe 98 PID 556 wrote to memory of 2468 556 xllrxfx.exe 99 PID 556 wrote to memory of 2468 556 xllrxfx.exe 99 PID 556 wrote to memory of 2468 556 xllrxfx.exe 99 PID 2468 wrote to memory of 844 2468 pjpjd.exe 100 PID 2468 wrote to memory of 844 2468 pjpjd.exe 100 PID 2468 wrote to memory of 844 2468 pjpjd.exe 100 PID 844 wrote to memory of 2280 844 nbbhnn.exe 101 PID 844 wrote to memory of 2280 844 nbbhnn.exe 101 PID 844 wrote to memory of 2280 844 nbbhnn.exe 101 PID 2280 wrote to memory of 1044 2280 jpdvv.exe 102 PID 2280 wrote to memory of 1044 2280 jpdvv.exe 102 PID 2280 wrote to memory of 1044 2280 jpdvv.exe 102 PID 1044 wrote to memory of 2976 1044 fffllll.exe 103 PID 1044 wrote to memory of 2976 1044 fffllll.exe 103 PID 1044 wrote to memory of 2976 1044 fffllll.exe 103 PID 2976 wrote to memory of 2552 2976 ppppp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe"C:\Users\Admin\AppData\Local\Temp\0a0a16e27290d72113428814b57031d8e8796888c8ebc04d0cb0fa4778aca781.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\ppjpp.exec:\ppjpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\ntnhnt.exec:\ntnhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\djpvj.exec:\djpvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\hbthnh.exec:\hbthnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\btntbh.exec:\btntbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\jpjpv.exec:\jpjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\fxxffff.exec:\fxxffff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\hhhtht.exec:\hhhtht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\fflllrl.exec:\fflllrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\dvjdd.exec:\dvjdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\ttnntt.exec:\ttnntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\xlxxrlf.exec:\xlxxrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\jpdjd.exec:\jpdjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\lxxxxxf.exec:\lxxxxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\nbhhhn.exec:\nbhhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\xllrxfx.exec:\xllrxfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\pjpjd.exec:\pjpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\nbbhnn.exec:\nbbhnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\jpdvv.exec:\jpdvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\fffllll.exec:\fffllll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\ppppp.exec:\ppppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\rfrrffl.exec:\rfrrffl.exe23⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ttnnbt.exec:\ttnnbt.exe24⤵
- Executes dropped EXE
PID:4128 -
\??\c:\dvdvv.exec:\dvdvv.exe25⤵
- Executes dropped EXE
PID:920 -
\??\c:\tbbtnn.exec:\tbbtnn.exe26⤵
- Executes dropped EXE
PID:1016 -
\??\c:\tbtbbb.exec:\tbtbbb.exe27⤵
- Executes dropped EXE
PID:4440 -
\??\c:\llxflxr.exec:\llxflxr.exe28⤵
- Executes dropped EXE
PID:884 -
\??\c:\rlrxrrr.exec:\rlrxrrr.exe29⤵
- Executes dropped EXE
PID:3104 -
\??\c:\bnnhnn.exec:\bnnhnn.exe30⤵
- Executes dropped EXE
PID:4572 -
\??\c:\xlllxxx.exec:\xlllxxx.exe31⤵
- Executes dropped EXE
PID:2868 -
\??\c:\btbttn.exec:\btbttn.exe32⤵
- Executes dropped EXE
PID:4988 -
\??\c:\dpjvp.exec:\dpjvp.exe33⤵
- Executes dropped EXE
PID:4468 -
\??\c:\llllfxx.exec:\llllfxx.exe34⤵
- Executes dropped EXE
PID:1424 -
\??\c:\ppjjd.exec:\ppjjd.exe35⤵
- Executes dropped EXE
PID:1908 -
\??\c:\frxrlff.exec:\frxrlff.exe36⤵
- Executes dropped EXE
PID:4092 -
\??\c:\vdjjj.exec:\vdjjj.exe37⤵
- Executes dropped EXE
PID:4452 -
\??\c:\5vdvv.exec:\5vdvv.exe38⤵
- Executes dropped EXE
PID:5036 -
\??\c:\frxxxxr.exec:\frxxxxr.exe39⤵
- Executes dropped EXE
PID:960 -
\??\c:\thnhbh.exec:\thnhbh.exe40⤵
- Executes dropped EXE
PID:4616 -
\??\c:\jjjdd.exec:\jjjdd.exe41⤵
- Executes dropped EXE
PID:3188 -
\??\c:\frrrlrf.exec:\frrrlrf.exe42⤵
- Executes dropped EXE
PID:4612 -
\??\c:\bbhttb.exec:\bbhttb.exe43⤵
- Executes dropped EXE
PID:3024 -
\??\c:\dpppv.exec:\dpppv.exe44⤵
- Executes dropped EXE
PID:3336 -
\??\c:\xlfxrlf.exec:\xlfxrlf.exe45⤵
- Executes dropped EXE
PID:1504 -
\??\c:\hhbtbt.exec:\hhbtbt.exe46⤵
- Executes dropped EXE
PID:1856 -
\??\c:\ppjvd.exec:\ppjvd.exe47⤵
- Executes dropped EXE
PID:4548 -
\??\c:\dvdvp.exec:\dvdvp.exe48⤵
- Executes dropped EXE
PID:4792 -
\??\c:\fxlfxrl.exec:\fxlfxrl.exe49⤵
- Executes dropped EXE
PID:60 -
\??\c:\7tnhnn.exec:\7tnhnn.exe50⤵
- Executes dropped EXE
PID:1004 -
\??\c:\jjppv.exec:\jjppv.exe51⤵
- Executes dropped EXE
PID:4356 -
\??\c:\hhhhtn.exec:\hhhhtn.exe52⤵
- Executes dropped EXE
PID:4428 -
\??\c:\thbbtb.exec:\thbbtb.exe53⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xxlllrr.exec:\xxlllrr.exe54⤵
- Executes dropped EXE
PID:516 -
\??\c:\rfllllr.exec:\rfllllr.exe55⤵
- Executes dropped EXE
PID:4980 -
\??\c:\tbbhbh.exec:\tbbhbh.exe56⤵
- Executes dropped EXE
PID:2164 -
\??\c:\lfxflfl.exec:\lfxflfl.exe57⤵
- Executes dropped EXE
PID:3240 -
\??\c:\ttbtnh.exec:\ttbtnh.exe58⤵
- Executes dropped EXE
PID:428 -
\??\c:\pjjdd.exec:\pjjdd.exe59⤵
- Executes dropped EXE
PID:1624 -
\??\c:\rrrlflx.exec:\rrrlflx.exe60⤵
- Executes dropped EXE
PID:4604 -
\??\c:\tthhbt.exec:\tthhbt.exe61⤵
- Executes dropped EXE
PID:908 -
\??\c:\ppddv.exec:\ppddv.exe62⤵
- Executes dropped EXE
PID:3208 -
\??\c:\3ddvv.exec:\3ddvv.exe63⤵
- Executes dropped EXE
PID:3468 -
\??\c:\xffrrxf.exec:\xffrrxf.exe64⤵
- Executes dropped EXE
PID:844 -
\??\c:\nbtnbb.exec:\nbtnbb.exe65⤵
- Executes dropped EXE
PID:4728 -
\??\c:\dvddp.exec:\dvddp.exe66⤵PID:4760
-
\??\c:\llfxlll.exec:\llfxlll.exe67⤵PID:3960
-
\??\c:\bhnnnn.exec:\bhnnnn.exe68⤵PID:4088
-
\??\c:\pvdvd.exec:\pvdvd.exe69⤵PID:2464
-
\??\c:\frxxrxr.exec:\frxxrxr.exe70⤵PID:4128
-
\??\c:\tnbbth.exec:\tnbbth.exe71⤵PID:3268
-
\??\c:\hhbnnh.exec:\hhbnnh.exe72⤵PID:1540
-
\??\c:\jjppv.exec:\jjppv.exe73⤵PID:3988
-
\??\c:\3xxxrrl.exec:\3xxxrrl.exe74⤵PID:4436
-
\??\c:\tnnbnb.exec:\tnnbnb.exe75⤵PID:884
-
\??\c:\tnhtnn.exec:\tnhtnn.exe76⤵PID:3104
-
\??\c:\vvjdd.exec:\vvjdd.exe77⤵PID:1488
-
\??\c:\5rlfxrl.exec:\5rlfxrl.exe78⤵PID:2388
-
\??\c:\tnntnn.exec:\tnntnn.exe79⤵PID:2868
-
\??\c:\ntnnhb.exec:\ntnnhb.exe80⤵PID:3880
-
\??\c:\dpdvv.exec:\dpdvv.exe81⤵PID:3064
-
\??\c:\lflflfx.exec:\lflflfx.exe82⤵PID:4408
-
\??\c:\hnhbbn.exec:\hnhbbn.exe83⤵PID:412
-
\??\c:\vvvpj.exec:\vvvpj.exe84⤵PID:4288
-
\??\c:\djpdp.exec:\djpdp.exe85⤵PID:1244
-
\??\c:\9xxrlff.exec:\9xxrlff.exe86⤵PID:3764
-
\??\c:\nhnnhh.exec:\nhnnhh.exe87⤵PID:960
-
\??\c:\dpvpd.exec:\dpvpd.exe88⤵PID:4616
-
\??\c:\pdjdd.exec:\pdjdd.exe89⤵PID:4480
-
\??\c:\7ffrfxl.exec:\7ffrfxl.exe90⤵PID:4940
-
\??\c:\9nnbbb.exec:\9nnbbb.exe91⤵PID:2124
-
\??\c:\jpdvd.exec:\jpdvd.exe92⤵PID:4628
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe93⤵PID:2788
-
\??\c:\xrrxrfx.exec:\xrrxrfx.exe94⤵PID:3996
-
\??\c:\nnnhbb.exec:\nnnhbb.exe95⤵PID:3324
-
\??\c:\dvdvd.exec:\dvdvd.exe96⤵PID:4660
-
\??\c:\jjjjd.exec:\jjjjd.exe97⤵PID:60
-
\??\c:\flfxrrl.exec:\flfxrrl.exe98⤵PID:2620
-
\??\c:\bbnnnt.exec:\bbnnnt.exe99⤵PID:2704
-
\??\c:\htbbbb.exec:\htbbbb.exe100⤵PID:2440
-
\??\c:\dvdvd.exec:\dvdvd.exe101⤵PID:5028
-
\??\c:\rrlfffx.exec:\rrlfffx.exe102⤵PID:4776
-
\??\c:\rlxxxrr.exec:\rlxxxrr.exe103⤵PID:1032
-
\??\c:\ntnhbb.exec:\ntnhbb.exe104⤵PID:3236
-
\??\c:\hbnbnn.exec:\hbnbnn.exe105⤵PID:4604
-
\??\c:\9vppj.exec:\9vppj.exe106⤵PID:972
-
\??\c:\xrxrlfx.exec:\xrxrlfx.exe107⤵PID:3648
-
\??\c:\ffllxxx.exec:\ffllxxx.exe108⤵PID:968
-
\??\c:\1hthht.exec:\1hthht.exe109⤵PID:4640
-
\??\c:\xxrrrll.exec:\xxrrrll.exe110⤵PID:1960
-
\??\c:\fxfffff.exec:\fxfffff.exe111⤵PID:4900
-
\??\c:\ppjjv.exec:\ppjjv.exe112⤵PID:4876
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe113⤵PID:4556
-
\??\c:\tnhntb.exec:\tnhntb.exe114⤵PID:2428
-
\??\c:\dvdvj.exec:\dvdvj.exe115⤵PID:996
-
\??\c:\xllffff.exec:\xllffff.exe116⤵PID:1444
-
\??\c:\bttbtt.exec:\bttbtt.exe117⤵PID:2012
-
\??\c:\fllflxl.exec:\fllflxl.exe118⤵PID:464
-
\??\c:\hthbht.exec:\hthbht.exe119⤵PID:1800
-
\??\c:\jdpjp.exec:\jdpjp.exe120⤵PID:2800
-
\??\c:\ffxrxfx.exec:\ffxrxfx.exe121⤵PID:4572
-
\??\c:\rrlfllx.exec:\rrlfllx.exe122⤵PID:4852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-