Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 04:18
Behavioral task
behavioral1
Sample
1c6a72c78d81bb8c162da23e0a71af66c44f07215d51907cccfad76d7c82e0f9.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1c6a72c78d81bb8c162da23e0a71af66c44f07215d51907cccfad76d7c82e0f9.exe
-
Size
92KB
-
MD5
20ed6741410ecfbce8a2b6b577336ea0
-
SHA1
f7e6ac3d3e37f350479911e645b0d408e6b5cc64
-
SHA256
1c6a72c78d81bb8c162da23e0a71af66c44f07215d51907cccfad76d7c82e0f9
-
SHA512
4c64b8946354ac84602a5d7a2401a0105670c2f5562ea70bca08aca69efa5094b6e001891a5abc411d7cee4efdffeddf82c08dd88cf6f8040bfd9f386aee5331
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWpWW:8hOmTsF93UYfwC6GIout0fmCiiiXA6mD
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4100-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4632-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2772-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4276-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2192-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3232-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2172-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4168-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1200-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3872-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3108-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2976-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4104-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2240-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3424-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2264-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/432-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2820-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1816-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3420-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1764-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3936-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2216-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3668-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4244-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4236-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4588-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1412-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4100-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2428-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2656-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1200-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1200-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1832-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3676-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3164-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-550-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-559-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2820-588-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
3vddd.exejjddd.exefxfxffl.exe5bhnhh.exedjppj.exevppjj.exerxxxrrx.exehhhthb.exe3vddd.exexxxllff.exejdjdv.exe1vvvj.exexrxlfrf.exehtbhbh.exepjvpp.exefrlffff.exe5rxfflf.exetbtbhb.exevdjpd.exerrrxxlr.exe5xllllf.exetbntnb.exevvddv.exepdjdv.exe3lrxrxr.exebtthhn.exe3pvpp.exeppddp.exerlrrllf.exehtbbbb.exepjjdd.exelrxflxf.exexxffllr.exebbttbh.exejdvvd.exe9vppd.exerxxxllx.exehbbtnn.exepjvpp.exepjppd.exexrfxrfx.exebhhhnt.exevddjv.exeppjdp.exe9frrxfr.exebhhbtt.exenhtnbh.exejjjjp.exelfflrrr.exefllrxll.exebhttbb.exebhnhnt.exe1dvpj.exe9rfxxrx.exebbtntn.exenhbbbb.exepjddv.exeflrlxlf.exe3hbtbh.exehnhbnn.exe7djdd.exexrxrxxf.exehtbntb.exeddpjj.exepid process 2012 3vddd.exe 1288 jjddd.exe 4632 fxfxffl.exe 3924 5bhnhh.exe 4276 djppj.exe 2772 vppjj.exe 2192 rxxxrrx.exe 3232 hhhthb.exe 2172 3vddd.exe 4168 xxxllff.exe 1488 jdjdv.exe 3808 1vvvj.exe 1200 xrxlfrf.exe 3872 htbhbh.exe 4352 pjvpp.exe 4660 frlffff.exe 5044 5rxfflf.exe 448 tbtbhb.exe 1956 vdjpd.exe 3108 rrrxxlr.exe 4816 5xllllf.exe 2976 tbntnb.exe 2040 vvddv.exe 4104 pdjdv.exe 2240 3lrxrxr.exe 3424 btthhn.exe 5032 3pvpp.exe 4612 ppddp.exe 3212 rlrrllf.exe 1724 htbbbb.exe 4644 pjjdd.exe 1516 lrxflxf.exe 2312 xxffllr.exe 2264 bbttbh.exe 4672 jdvvd.exe 432 9vppd.exe 1436 rxxxllx.exe 3228 hbbtnn.exe 8 pjvpp.exe 208 pjppd.exe 4464 xrfxrfx.exe 4800 bhhhnt.exe 2820 vddjv.exe 1816 ppjdp.exe 4524 9frrxfr.exe 1284 bhhbtt.exe 4852 nhtnbh.exe 1288 jjjjp.exe 3420 lfflrrr.exe 2656 fllrxll.exe 3036 bhttbb.exe 1768 bhnhnt.exe 3428 1dvpj.exe 4540 9rfxxrx.exe 1764 bbtntn.exe 3936 nhbbbb.exe 2216 pjddv.exe 2696 flrlxlf.exe 2288 3hbtbh.exe 1488 hnhbnn.exe 3808 7djdd.exe 3668 xrxrxxf.exe 2508 htbntb.exe 1832 ddpjj.exe -
Processes:
resource yara_rule behavioral2/memory/4100-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2012-6-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3vddd.exe upx C:\jjddd.exe upx behavioral2/memory/1288-10-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxfxffl.exe upx behavioral2/memory/4632-16-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5bhnhh.exe upx behavioral2/memory/3924-20-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\djppj.exe upx behavioral2/memory/3924-25-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vppjj.exe upx C:\rxxxrrx.exe upx behavioral2/memory/2772-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4276-28-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhhthb.exe upx behavioral2/memory/2192-40-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3vddd.exe upx behavioral2/memory/3232-44-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxxllff.exe upx behavioral2/memory/2172-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4168-55-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdjdv.exe upx behavioral2/memory/1488-57-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1vvvj.exe upx behavioral2/memory/3808-64-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrxlfrf.exe upx C:\htbhbh.exe upx behavioral2/memory/1200-69-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjvpp.exe upx behavioral2/memory/3872-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4352-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4352-80-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frlffff.exe upx C:\5rxfflf.exe upx behavioral2/memory/5044-89-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbtbhb.exe upx C:\vdjpd.exe upx C:\rrrxxlr.exe upx behavioral2/memory/3108-99-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5xllllf.exe upx \??\c:\tbntnb.exe upx behavioral2/memory/4816-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2976-113-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdjdv.exe upx \??\c:\vvddv.exe upx behavioral2/memory/4104-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2240-125-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3lrxrxr.exe upx C:\btthhn.exe upx behavioral2/memory/3424-128-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3pvpp.exe upx C:\ppddp.exe upx behavioral2/memory/4612-137-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlrrllf.exe upx \??\c:\htbbbb.exe upx C:\pjjdd.exe upx C:\lrxflxf.exe upx behavioral2/memory/4644-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2264-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/432-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3228-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2820-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1816-185-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1c6a72c78d81bb8c162da23e0a71af66c44f07215d51907cccfad76d7c82e0f9.exe3vddd.exejjddd.exefxfxffl.exe5bhnhh.exedjppj.exevppjj.exerxxxrrx.exehhhthb.exe3vddd.exexxxllff.exejdjdv.exe1vvvj.exexrxlfrf.exehtbhbh.exepjvpp.exefrlffff.exe5rxfflf.exetbtbhb.exevdjpd.exerrrxxlr.exe5xllllf.exedescription pid process target process PID 4100 wrote to memory of 2012 4100 1c6a72c78d81bb8c162da23e0a71af66c44f07215d51907cccfad76d7c82e0f9.exe 3vddd.exe PID 4100 wrote to memory of 2012 4100 1c6a72c78d81bb8c162da23e0a71af66c44f07215d51907cccfad76d7c82e0f9.exe 3vddd.exe PID 4100 wrote to memory of 2012 4100 1c6a72c78d81bb8c162da23e0a71af66c44f07215d51907cccfad76d7c82e0f9.exe 3vddd.exe PID 2012 wrote to memory of 1288 2012 3vddd.exe jjddd.exe PID 2012 wrote to memory of 1288 2012 3vddd.exe jjddd.exe PID 2012 wrote to memory of 1288 2012 3vddd.exe jjddd.exe PID 1288 wrote to memory of 4632 1288 jjddd.exe fxfxffl.exe PID 1288 wrote to memory of 4632 1288 jjddd.exe fxfxffl.exe PID 1288 wrote to memory of 4632 1288 jjddd.exe fxfxffl.exe PID 4632 wrote to memory of 3924 4632 fxfxffl.exe 5bhnhh.exe PID 4632 wrote to memory of 3924 4632 fxfxffl.exe 5bhnhh.exe PID 4632 wrote to memory of 3924 4632 fxfxffl.exe 5bhnhh.exe PID 3924 wrote to memory of 4276 3924 5bhnhh.exe djppj.exe PID 3924 wrote to memory of 4276 3924 5bhnhh.exe djppj.exe PID 3924 wrote to memory of 4276 3924 5bhnhh.exe djppj.exe PID 4276 wrote to memory of 2772 4276 djppj.exe vppjj.exe PID 4276 wrote to memory of 2772 4276 djppj.exe vppjj.exe PID 4276 wrote to memory of 2772 4276 djppj.exe vppjj.exe PID 2772 wrote to memory of 2192 2772 vppjj.exe rxxxrrx.exe PID 2772 wrote to memory of 2192 2772 vppjj.exe rxxxrrx.exe PID 2772 wrote to memory of 2192 2772 vppjj.exe rxxxrrx.exe PID 2192 wrote to memory of 3232 2192 rxxxrrx.exe hhhthb.exe PID 2192 wrote to memory of 3232 2192 rxxxrrx.exe hhhthb.exe PID 2192 wrote to memory of 3232 2192 rxxxrrx.exe hhhthb.exe PID 3232 wrote to memory of 2172 3232 hhhthb.exe 3vddd.exe PID 3232 wrote to memory of 2172 3232 hhhthb.exe 3vddd.exe PID 3232 wrote to memory of 2172 3232 hhhthb.exe 3vddd.exe PID 2172 wrote to memory of 4168 2172 3vddd.exe xxxllff.exe PID 2172 wrote to memory of 4168 2172 3vddd.exe xxxllff.exe PID 2172 wrote to memory of 4168 2172 3vddd.exe xxxllff.exe PID 4168 wrote to memory of 1488 4168 xxxllff.exe jdjdv.exe PID 4168 wrote to memory of 1488 4168 xxxllff.exe jdjdv.exe PID 4168 wrote to memory of 1488 4168 xxxllff.exe jdjdv.exe PID 1488 wrote to memory of 3808 1488 jdjdv.exe 1vvvj.exe PID 1488 wrote to memory of 3808 1488 jdjdv.exe 1vvvj.exe PID 1488 wrote to memory of 3808 1488 jdjdv.exe 1vvvj.exe PID 3808 wrote to memory of 1200 3808 1vvvj.exe xrxlfrf.exe PID 3808 wrote to memory of 1200 3808 1vvvj.exe xrxlfrf.exe PID 3808 wrote to memory of 1200 3808 1vvvj.exe xrxlfrf.exe PID 1200 wrote to memory of 3872 1200 xrxlfrf.exe htbhbh.exe PID 1200 wrote to memory of 3872 1200 xrxlfrf.exe htbhbh.exe PID 1200 wrote to memory of 3872 1200 xrxlfrf.exe htbhbh.exe PID 3872 wrote to memory of 4352 3872 htbhbh.exe pjvpp.exe PID 3872 wrote to memory of 4352 3872 htbhbh.exe pjvpp.exe PID 3872 wrote to memory of 4352 3872 htbhbh.exe pjvpp.exe PID 4352 wrote to memory of 4660 4352 pjvpp.exe frlffff.exe PID 4352 wrote to memory of 4660 4352 pjvpp.exe frlffff.exe PID 4352 wrote to memory of 4660 4352 pjvpp.exe frlffff.exe PID 4660 wrote to memory of 5044 4660 frlffff.exe 5rxfflf.exe PID 4660 wrote to memory of 5044 4660 frlffff.exe 5rxfflf.exe PID 4660 wrote to memory of 5044 4660 frlffff.exe 5rxfflf.exe PID 5044 wrote to memory of 448 5044 5rxfflf.exe tbtbhb.exe PID 5044 wrote to memory of 448 5044 5rxfflf.exe tbtbhb.exe PID 5044 wrote to memory of 448 5044 5rxfflf.exe tbtbhb.exe PID 448 wrote to memory of 1956 448 tbtbhb.exe vdjpd.exe PID 448 wrote to memory of 1956 448 tbtbhb.exe vdjpd.exe PID 448 wrote to memory of 1956 448 tbtbhb.exe vdjpd.exe PID 1956 wrote to memory of 3108 1956 vdjpd.exe rrrxxlr.exe PID 1956 wrote to memory of 3108 1956 vdjpd.exe rrrxxlr.exe PID 1956 wrote to memory of 3108 1956 vdjpd.exe rrrxxlr.exe PID 3108 wrote to memory of 4816 3108 rrrxxlr.exe 5xllllf.exe PID 3108 wrote to memory of 4816 3108 rrrxxlr.exe 5xllllf.exe PID 3108 wrote to memory of 4816 3108 rrrxxlr.exe 5xllllf.exe PID 4816 wrote to memory of 2976 4816 5xllllf.exe tbntnb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c6a72c78d81bb8c162da23e0a71af66c44f07215d51907cccfad76d7c82e0f9.exe"C:\Users\Admin\AppData\Local\Temp\1c6a72c78d81bb8c162da23e0a71af66c44f07215d51907cccfad76d7c82e0f9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\3vddd.exec:\3vddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\jjddd.exec:\jjddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\fxfxffl.exec:\fxfxffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\5bhnhh.exec:\5bhnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\djppj.exec:\djppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\vppjj.exec:\vppjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\rxxxrrx.exec:\rxxxrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\hhhthb.exec:\hhhthb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\3vddd.exec:\3vddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\xxxllff.exec:\xxxllff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\jdjdv.exec:\jdjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\1vvvj.exec:\1vvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\xrxlfrf.exec:\xrxlfrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\htbhbh.exec:\htbhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\pjvpp.exec:\pjvpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\frlffff.exec:\frlffff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\5rxfflf.exec:\5rxfflf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\tbtbhb.exec:\tbtbhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\vdjpd.exec:\vdjpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\rrrxxlr.exec:\rrrxxlr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\5xllllf.exec:\5xllllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\tbntnb.exec:\tbntnb.exe23⤵
- Executes dropped EXE
PID:2976 -
\??\c:\vvddv.exec:\vvddv.exe24⤵
- Executes dropped EXE
PID:2040 -
\??\c:\pdjdv.exec:\pdjdv.exe25⤵
- Executes dropped EXE
PID:4104 -
\??\c:\3lrxrxr.exec:\3lrxrxr.exe26⤵
- Executes dropped EXE
PID:2240 -
\??\c:\btthhn.exec:\btthhn.exe27⤵
- Executes dropped EXE
PID:3424 -
\??\c:\3pvpp.exec:\3pvpp.exe28⤵
- Executes dropped EXE
PID:5032 -
\??\c:\ppddp.exec:\ppddp.exe29⤵
- Executes dropped EXE
PID:4612 -
\??\c:\rlrrllf.exec:\rlrrllf.exe30⤵
- Executes dropped EXE
PID:3212 -
\??\c:\htbbbb.exec:\htbbbb.exe31⤵
- Executes dropped EXE
PID:1724 -
\??\c:\pjjdd.exec:\pjjdd.exe32⤵
- Executes dropped EXE
PID:4644 -
\??\c:\lrxflxf.exec:\lrxflxf.exe33⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xxffllr.exec:\xxffllr.exe34⤵
- Executes dropped EXE
PID:2312 -
\??\c:\bbttbh.exec:\bbttbh.exe35⤵
- Executes dropped EXE
PID:2264 -
\??\c:\jdvvd.exec:\jdvvd.exe36⤵
- Executes dropped EXE
PID:4672 -
\??\c:\9vppd.exec:\9vppd.exe37⤵
- Executes dropped EXE
PID:432 -
\??\c:\rxxxllx.exec:\rxxxllx.exe38⤵
- Executes dropped EXE
PID:1436 -
\??\c:\hbbtnn.exec:\hbbtnn.exe39⤵
- Executes dropped EXE
PID:3228 -
\??\c:\pjvpp.exec:\pjvpp.exe40⤵
- Executes dropped EXE
PID:8 -
\??\c:\pjppd.exec:\pjppd.exe41⤵
- Executes dropped EXE
PID:208 -
\??\c:\xrfxrfx.exec:\xrfxrfx.exe42⤵
- Executes dropped EXE
PID:4464 -
\??\c:\bhhhnt.exec:\bhhhnt.exe43⤵
- Executes dropped EXE
PID:4800 -
\??\c:\vddjv.exec:\vddjv.exe44⤵
- Executes dropped EXE
PID:2820 -
\??\c:\ppjdp.exec:\ppjdp.exe45⤵
- Executes dropped EXE
PID:1816 -
\??\c:\9frrxfr.exec:\9frrxfr.exe46⤵
- Executes dropped EXE
PID:4524 -
\??\c:\bhhbtt.exec:\bhhbtt.exe47⤵
- Executes dropped EXE
PID:1284 -
\??\c:\nhtnbh.exec:\nhtnbh.exe48⤵
- Executes dropped EXE
PID:4852 -
\??\c:\jjjjp.exec:\jjjjp.exe49⤵
- Executes dropped EXE
PID:1288 -
\??\c:\lfflrrr.exec:\lfflrrr.exe50⤵
- Executes dropped EXE
PID:3420 -
\??\c:\fllrxll.exec:\fllrxll.exe51⤵
- Executes dropped EXE
PID:2656 -
\??\c:\bhttbb.exec:\bhttbb.exe52⤵
- Executes dropped EXE
PID:3036 -
\??\c:\bhnhnt.exec:\bhnhnt.exe53⤵
- Executes dropped EXE
PID:1768 -
\??\c:\1dvpj.exec:\1dvpj.exe54⤵
- Executes dropped EXE
PID:3428 -
\??\c:\9rfxxrx.exec:\9rfxxrx.exe55⤵
- Executes dropped EXE
PID:4540 -
\??\c:\bbtntn.exec:\bbtntn.exe56⤵
- Executes dropped EXE
PID:1764 -
\??\c:\nhbbbb.exec:\nhbbbb.exe57⤵
- Executes dropped EXE
PID:3936 -
\??\c:\pjddv.exec:\pjddv.exe58⤵
- Executes dropped EXE
PID:2216 -
\??\c:\flrlxlf.exec:\flrlxlf.exe59⤵
- Executes dropped EXE
PID:2696 -
\??\c:\3hbtbh.exec:\3hbtbh.exe60⤵
- Executes dropped EXE
PID:2288 -
\??\c:\hnhbnn.exec:\hnhbnn.exe61⤵
- Executes dropped EXE
PID:1488 -
\??\c:\7djdd.exec:\7djdd.exe62⤵
- Executes dropped EXE
PID:3808 -
\??\c:\xrxrxxf.exec:\xrxrxxf.exe63⤵
- Executes dropped EXE
PID:3668 -
\??\c:\htbntb.exec:\htbntb.exe64⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ddpjj.exec:\ddpjj.exe65⤵
- Executes dropped EXE
PID:1832 -
\??\c:\3flfxxr.exec:\3flfxxr.exe66⤵PID:4568
-
\??\c:\hbbbtt.exec:\hbbbtt.exe67⤵PID:3520
-
\??\c:\hnbttn.exec:\hnbttn.exe68⤵PID:5000
-
\??\c:\5jjdd.exec:\5jjdd.exe69⤵PID:1020
-
\??\c:\xxxrffx.exec:\xxxrffx.exe70⤵PID:4856
-
\??\c:\rfxlfxf.exec:\rfxlfxf.exe71⤵PID:1808
-
\??\c:\ttbbbb.exec:\ttbbbb.exe72⤵PID:4400
-
\??\c:\htnbnn.exec:\htnbnn.exe73⤵PID:4608
-
\??\c:\pvvjj.exec:\pvvjj.exe74⤵PID:1892
-
\??\c:\9jjdp.exec:\9jjdp.exe75⤵PID:4428
-
\??\c:\rlxfrlr.exec:\rlxfrlr.exe76⤵PID:4224
-
\??\c:\tnhbnh.exec:\tnhbnh.exe77⤵PID:1576
-
\??\c:\thnnht.exec:\thnnht.exe78⤵PID:4172
-
\??\c:\pdvvp.exec:\pdvvp.exe79⤵PID:1496
-
\??\c:\pjjvj.exec:\pjjvj.exe80⤵PID:4244
-
\??\c:\rfffrfx.exec:\rfffrfx.exe81⤵PID:4640
-
\??\c:\ttbhtt.exec:\ttbhtt.exe82⤵PID:4944
-
\??\c:\tnbbbt.exec:\tnbbbt.exe83⤵PID:4588
-
\??\c:\jdjdp.exec:\jdjdp.exe84⤵PID:3548
-
\??\c:\pjdvj.exec:\pjdvj.exe85⤵PID:3988
-
\??\c:\xlfllxl.exec:\xlfllxl.exe86⤵PID:4576
-
\??\c:\btnntt.exec:\btnntt.exe87⤵PID:1436
-
\??\c:\7tnnhh.exec:\7tnnhh.exe88⤵PID:1316
-
\??\c:\pddvp.exec:\pddvp.exe89⤵PID:2900
-
\??\c:\rxxrxfl.exec:\rxxrxfl.exe90⤵PID:4020
-
\??\c:\5rrllff.exec:\5rrllff.exe91⤵PID:2200
-
\??\c:\bttnnh.exec:\bttnnh.exe92⤵PID:3080
-
\??\c:\9tbthb.exec:\9tbthb.exe93⤵PID:2368
-
\??\c:\pjpjj.exec:\pjpjj.exe94⤵PID:4036
-
\??\c:\jjddv.exec:\jjddv.exe95⤵PID:4928
-
\??\c:\1rlxxxx.exec:\1rlxxxx.exe96⤵PID:2428
-
\??\c:\xxlllxl.exec:\xxlllxl.exe97⤵PID:1104
-
\??\c:\hbhhnn.exec:\hbhhnn.exe98⤵PID:4320
-
\??\c:\bhnnhn.exec:\bhnnhn.exe99⤵PID:3868
-
\??\c:\ppdpj.exec:\ppdpj.exe100⤵PID:2044
-
\??\c:\jdjdv.exec:\jdjdv.exe101⤵PID:3276
-
\??\c:\xrrfxrl.exec:\xrrfxrl.exe102⤵PID:4276
-
\??\c:\rlxrfxr.exec:\rlxrfxr.exe103⤵PID:1180
-
\??\c:\nhnnhh.exec:\nhnnhh.exe104⤵PID:1768
-
\??\c:\3pvvj.exec:\3pvvj.exe105⤵PID:3240
-
\??\c:\jdvpd.exec:\jdvpd.exe106⤵PID:2192
-
\??\c:\xfxrxrl.exec:\xfxrxrl.exe107⤵PID:3328
-
\??\c:\tbhbtn.exec:\tbhbtn.exe108⤵PID:2216
-
\??\c:\ttbnnb.exec:\ttbnnb.exe109⤵PID:4520
-
\??\c:\dpvvp.exec:\dpvvp.exe110⤵PID:3000
-
\??\c:\frxxrlf.exec:\frxxrlf.exe111⤵PID:1780
-
\??\c:\flfxxrr.exec:\flfxxrr.exe112⤵PID:4356
-
\??\c:\hthbtn.exec:\hthbtn.exe113⤵PID:3964
-
\??\c:\hhnbnh.exec:\hhnbnh.exe114⤵PID:4884
-
\??\c:\dpddp.exec:\dpddp.exe115⤵PID:2024
-
\??\c:\7rxrffr.exec:\7rxrffr.exe116⤵PID:4824
-
\??\c:\xllxllf.exec:\xllxllf.exe117⤵PID:4404
-
\??\c:\thhthh.exec:\thhthh.exe118⤵PID:4236
-
\??\c:\1nnhbb.exec:\1nnhbb.exe119⤵PID:5096
-
\??\c:\3vppj.exec:\3vppj.exe120⤵PID:4624
-
\??\c:\rlrlfxl.exec:\rlrlfxl.exe121⤵PID:1672
-
\??\c:\1tbbtn.exec:\1tbbtn.exe122⤵PID:728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-