Analysis
- max time kernel
150s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
18/06/2024, 14:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bc7f9ea43984ac2c2335609c55c390cf_JaffaCakes118.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target bc7f9ea43984ac2c2335609c55c390cf_JaffaCakes118.exe
- Size 191KB
- Sample240618-r43mcssdmk
- SHA256 54a9d4b8abd239d0c33d45d27ea206ec0d0cf98dffb53961e286a5c381cef1b4
- MD5 bc7f9ea43984ac2c2335609c55c390cf
- SHA1 cc075c369fba1e37d2c96781d578eb913f31bdc8
- SHA512 0f14f95299e2e89a22b1f53b9b8f45c617474e429ed50bb8854ae7bab47c3fef4e9cca80dd0eac421cd9da1830364f4b7f646c6a52c613a1a2aad4c47fd5d439
- SSDEEP 1536:EvQBeOGtrYSSsrc93UBIfdC67m6AJiqjt3ufT/FRxZOYsU58O:EhOm2sI93UufdC67ciyt3ujFf7jaO
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3420-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/744-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3848-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2524-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/832-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/616-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/692-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2672-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/680-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3788-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-648-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-681-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-723-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-785-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-935-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-1291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4760 hhhhbt.exe 4704 1xxxrxr.exe 744 hntnhh.exe 4788 rxxlffx.exe 1632 xxrlrlr.exe 4836 hhnnnn.exe 388 tnhhhb.exe 464 dpvpj.exe 3848 3xlrlxr.exe 1908 nnbtbb.exe 1144 pddvp.exe 3188 xrrrllf.exe 2524 tbnhbb.exe 4212 jddpj.exe 1776 9rrlffx.exe 2684 tbnttn.exe 3736 dpjjj.exe 3236 fxxrllf.exe 1664 nhhbbb.exe 3148 7jjdd.exe 4464 fffxxxx.exe 4700 ttnnhn.exe 392 jjpdj.exe 1556 frxlllf.exe 4188 fxrllrl.exe 4608 jpppj.exe 512 pjjvj.exe 4720 xxxrllf.exe 1480 vddvj.exe 2408 jdppd.exe 2908 frllffx.exe 2312 nbnhbb.exe 832 vvdvv.exe 3216 1vpjv.exe 4328 7flrffx.exe 3860 nnnbnh.exe 2840 nbhnbb.exe 616 dvpjv.exe 4028 3xlxrlf.exe 3924 hthhnh.exe 4644 hbhhhh.exe 3664 pjjjd.exe 456 3pdvd.exe 3684 tnhhth.exe 3344 hhnbbb.exe 1200 vvpjj.exe 2516 lfxxlll.exe 4508 lllfrrf.exe 3672 1nnnhh.exe 1964 jvddv.exe 692 frrxxrl.exe 1760 9flfxrr.exe 3352 tnnnhh.exe 4616 nhhbnb.exe 2912 pddvj.exe 2636 5rllxrr.exe 3660 bnbnhh.exe 2564 pdjdp.exe 2892 jpvpd.exe 740 1lrlrxr.exe 5012 bbbbhh.exe 1196 vpdvv.exe 2004 vjpjv.exe 1492 rllfrxr.exe -
resource yara_rule behavioral2/memory/4760-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/744-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3848-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2524-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/832-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/616-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/692-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2672-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/680-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-455-0x0000000000400000-0x000000000042A000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3420 wrote to memory of 4760 3420 bc7f9ea43984ac2c2335609c55c390cf_JaffaCakes118.exe 81 PID 3420 wrote to memory of 4760 3420 bc7f9ea43984ac2c2335609c55c390cf_JaffaCakes118.exe 81 PID 3420 wrote to memory of 4760 3420 bc7f9ea43984ac2c2335609c55c390cf_JaffaCakes118.exe 81 PID 4760 wrote to memory of 4704 4760 hhhhbt.exe 82 PID 4760 wrote to memory of 4704 4760 hhhhbt.exe 82 PID 4760 wrote to memory of 4704 4760 hhhhbt.exe 82 PID 4704 wrote to memory of 744 4704 1xxxrxr.exe 83 PID 4704 wrote to memory of 744 4704 1xxxrxr.exe 83 PID 4704 wrote to memory of 744 4704 1xxxrxr.exe 83 PID 744 wrote to memory of 4788 744 hntnhh.exe 84 PID 744 wrote to memory of 4788 744 hntnhh.exe 84 PID 744 wrote to memory of 4788 744 hntnhh.exe 84 PID 4788 wrote to memory of 1632 4788 rxxlffx.exe 85 PID 4788 wrote to memory of 1632 4788 rxxlffx.exe 85 PID 4788 wrote to memory of 1632 4788 rxxlffx.exe 85 PID 1632 wrote to memory of 4836 1632 xxrlrlr.exe 86 PID 1632 wrote to memory of 4836 1632 xxrlrlr.exe 86 PID 1632 wrote to memory of 4836 1632 xxrlrlr.exe 86 PID 4836 wrote to memory of 388 4836 hhnnnn.exe 87 PID 4836 wrote to memory of 388 4836 hhnnnn.exe 87 PID 4836 wrote to memory of 388 4836 hhnnnn.exe 87 PID 388 wrote to memory of 464 388 tnhhhb.exe 88 PID 388 wrote to memory of 464 388 tnhhhb.exe 88 PID 388 wrote to memory of 464 388 tnhhhb.exe 88 PID 464 wrote to memory of 3848 464 dpvpj.exe 89 PID 464 wrote to memory of 3848 464 dpvpj.exe 89 PID 464 wrote to memory of 3848 464 dpvpj.exe 89 PID 3848 wrote to memory of 1908 3848 3xlrlxr.exe 91 PID 3848 wrote to memory of 1908 3848 3xlrlxr.exe 91 PID 3848 wrote to memory of 1908 3848 3xlrlxr.exe 91 PID 1908 wrote to memory of 1144 1908 nnbtbb.exe 92 PID 1908 wrote to memory of 1144 1908 nnbtbb.exe 92 PID 1908 wrote to memory of 1144 1908 nnbtbb.exe 92 PID 1144 wrote to memory of 3188 1144 pddvp.exe 93 PID 1144 wrote to memory of 3188 1144 pddvp.exe 93 PID 1144 wrote to memory of 3188 1144 pddvp.exe 93 PID 3188 wrote to memory of 2524 3188 xrrrllf.exe 94 PID 3188 wrote to memory of 2524 3188 xrrrllf.exe 94 PID 3188 wrote to memory of 2524 3188 xrrrllf.exe 94 PID 2524 wrote to memory of 4212 2524 tbnhbb.exe 96 PID 2524 wrote to memory of 4212 2524 tbnhbb.exe 96 PID 2524 wrote to memory of 4212 2524 tbnhbb.exe 96 PID 4212 wrote to memory of 1776 4212 jddpj.exe 97 PID 4212 wrote to memory of 1776 4212 jddpj.exe 97 PID 4212 wrote to memory of 1776 4212 jddpj.exe 97 PID 1776 wrote to memory of 2684 1776 9rrlffx.exe 98 PID 1776 wrote to memory of 2684 1776 9rrlffx.exe 98 PID 1776 wrote to memory of 2684 1776 9rrlffx.exe 98 PID 2684 wrote to memory of 3736 2684 tbnttn.exe 99 PID 2684 wrote to memory of 3736 2684 tbnttn.exe 99 PID 2684 wrote to memory of 3736 2684 tbnttn.exe 99 PID 3736 wrote to memory of 3236 3736 dpjjj.exe 101 PID 3736 wrote to memory of 3236 3736 dpjjj.exe 101 PID 3736 wrote to memory of 3236 3736 dpjjj.exe 101 PID 3236 wrote to memory of 1664 3236 fxxrllf.exe 102 PID 3236 wrote to memory of 1664 3236 fxxrllf.exe 102 PID 3236 wrote to memory of 1664 3236 fxxrllf.exe 102 PID 1664 wrote to memory of 3148 1664 nhhbbb.exe 103 PID 1664 wrote to memory of 3148 1664 nhhbbb.exe 103 PID 1664 wrote to memory of 3148 1664 nhhbbb.exe 103 PID 3148 wrote to memory of 4464 3148 7jjdd.exe 104 PID 3148 wrote to memory of 4464 3148 7jjdd.exe 104 PID 3148 wrote to memory of 4464 3148 7jjdd.exe 104 PID 4464 wrote to memory of 4700 4464 fffxxxx.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc7f9ea43984ac2c2335609c55c390cf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bc7f9ea43984ac2c2335609c55c390cf_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\hhhhbt.exec:\hhhhbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\1xxxrxr.exec:\1xxxrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\hntnhh.exec:\hntnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\rxxlffx.exec:\rxxlffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\xxrlrlr.exec:\xxrlrlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\hhnnnn.exec:\hhnnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\tnhhhb.exec:\tnhhhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\dpvpj.exec:\dpvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\3xlrlxr.exec:\3xlrlxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\nnbtbb.exec:\nnbtbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\pddvp.exec:\pddvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\xrrrllf.exec:\xrrrllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\tbnhbb.exec:\tbnhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\jddpj.exec:\jddpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\9rrlffx.exec:\9rrlffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\tbnttn.exec:\tbnttn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\dpjjj.exec:\dpjjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\fxxrllf.exec:\fxxrllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\nhhbbb.exec:\nhhbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\7jjdd.exec:\7jjdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\fffxxxx.exec:\fffxxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\ttnnhn.exec:\ttnnhn.exe23⤵
- Executes dropped EXE
PID:4700 -
\??\c:\jjpdj.exec:\jjpdj.exe24⤵
- Executes dropped EXE
PID:392 -
\??\c:\frxlllf.exec:\frxlllf.exe25⤵
- Executes dropped EXE
PID:1556 -
\??\c:\fxrllrl.exec:\fxrllrl.exe26⤵
- Executes dropped EXE
PID:4188 -
\??\c:\jpppj.exec:\jpppj.exe27⤵
- Executes dropped EXE
PID:4608 -
\??\c:\pjjvj.exec:\pjjvj.exe28⤵
- Executes dropped EXE
PID:512 -
\??\c:\xxxrllf.exec:\xxxrllf.exe29⤵
- Executes dropped EXE
PID:4720 -
\??\c:\vddvj.exec:\vddvj.exe30⤵
- Executes dropped EXE
PID:1480 -
\??\c:\jdppd.exec:\jdppd.exe31⤵
- Executes dropped EXE
PID:2408 -
\??\c:\frllffx.exec:\frllffx.exe32⤵
- Executes dropped EXE
PID:2908 -
\??\c:\nbnhbb.exec:\nbnhbb.exe33⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vvdvv.exec:\vvdvv.exe34⤵
- Executes dropped EXE
PID:832 -
\??\c:\1vpjv.exec:\1vpjv.exe35⤵
- Executes dropped EXE
PID:3216 -
\??\c:\7flrffx.exec:\7flrffx.exe36⤵
- Executes dropped EXE
PID:4328 -
\??\c:\nnnbnh.exec:\nnnbnh.exe37⤵
- Executes dropped EXE
PID:3860 -
\??\c:\nbhnbb.exec:\nbhnbb.exe38⤵
- Executes dropped EXE
PID:2840 -
\??\c:\dvpjv.exec:\dvpjv.exe39⤵
- Executes dropped EXE
PID:616 -
\??\c:\3xlxrlf.exec:\3xlxrlf.exe40⤵
- Executes dropped EXE
PID:4028 -
\??\c:\hthhnh.exec:\hthhnh.exe41⤵
- Executes dropped EXE
PID:3924 -
\??\c:\hbhhhh.exec:\hbhhhh.exe42⤵
- Executes dropped EXE
PID:4644 -
\??\c:\pjjjd.exec:\pjjjd.exe43⤵
- Executes dropped EXE
PID:3664 -
\??\c:\3pdvd.exec:\3pdvd.exe44⤵
- Executes dropped EXE
PID:456 -
\??\c:\9lrfrrx.exec:\9lrfrrx.exe45⤵PID:4480
-
\??\c:\tnhhth.exec:\tnhhth.exe46⤵
- Executes dropped EXE
PID:3684 -
\??\c:\hhnbbb.exec:\hhnbbb.exe47⤵
- Executes dropped EXE
PID:3344 -
\??\c:\vvpjj.exec:\vvpjj.exe48⤵
- Executes dropped EXE
PID:1200 -
\??\c:\lfxxlll.exec:\lfxxlll.exe49⤵
- Executes dropped EXE
PID:2516 -
\??\c:\lllfrrf.exec:\lllfrrf.exe50⤵
- Executes dropped EXE
PID:4508 -
\??\c:\1nnnhh.exec:\1nnnhh.exe51⤵
- Executes dropped EXE
PID:3672 -
\??\c:\jvddv.exec:\jvddv.exe52⤵
- Executes dropped EXE
PID:1964 -
\??\c:\frrxxrl.exec:\frrxxrl.exe53⤵
- Executes dropped EXE
PID:692 -
\??\c:\9flfxrr.exec:\9flfxrr.exe54⤵
- Executes dropped EXE
PID:1760 -
\??\c:\tnnnhh.exec:\tnnnhh.exe55⤵
- Executes dropped EXE
PID:3352 -
\??\c:\nhhbnb.exec:\nhhbnb.exe56⤵
- Executes dropped EXE
PID:4616 -
\??\c:\pddvj.exec:\pddvj.exe57⤵
- Executes dropped EXE
PID:2912 -
\??\c:\5rllxrr.exec:\5rllxrr.exe58⤵
- Executes dropped EXE
PID:2636 -
\??\c:\bnbnhh.exec:\bnbnhh.exe59⤵
- Executes dropped EXE
PID:3660 -
\??\c:\pdjdp.exec:\pdjdp.exe60⤵
- Executes dropped EXE
PID:2564 -
\??\c:\jpvpd.exec:\jpvpd.exe61⤵
- Executes dropped EXE
PID:2892 -
\??\c:\1lrlrxr.exec:\1lrlrxr.exe62⤵
- Executes dropped EXE
PID:740 -
\??\c:\bbbbhh.exec:\bbbbhh.exe63⤵
- Executes dropped EXE
PID:5012 -
\??\c:\vpdvv.exec:\vpdvv.exe64⤵
- Executes dropped EXE
PID:1196 -
\??\c:\vjpjv.exec:\vjpjv.exe65⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rllfrxr.exec:\rllfrxr.exe66⤵
- Executes dropped EXE
PID:1492 -
\??\c:\nnnbtt.exec:\nnnbtt.exe67⤵PID:2652
-
\??\c:\ttnhtb.exec:\ttnhtb.exe68⤵PID:1748
-
\??\c:\jjppp.exec:\jjppp.exe69⤵PID:2296
-
\??\c:\xrlfxlf.exec:\xrlfxlf.exe70⤵PID:1004
-
\??\c:\nbnnnn.exec:\nbnnnn.exe71⤵PID:4088
-
\??\c:\djpvp.exec:\djpvp.exe72⤵PID:1052
-
\??\c:\1dvdv.exec:\1dvdv.exe73⤵PID:872
-
\??\c:\vjjdj.exec:\vjjdj.exe74⤵PID:2860
-
\??\c:\rxfrfxx.exec:\rxfrfxx.exe75⤵PID:1588
-
\??\c:\nhbtnn.exec:\nhbtnn.exe76⤵PID:4620
-
\??\c:\dddpj.exec:\dddpj.exe77⤵PID:1636
-
\??\c:\9vdvp.exec:\9vdvp.exe78⤵PID:2672
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe79⤵PID:604
-
\??\c:\tnbtnn.exec:\tnbtnn.exe80⤵PID:4888
-
\??\c:\tbnhtt.exec:\tbnhtt.exe81⤵PID:644
-
\??\c:\vppdv.exec:\vppdv.exe82⤵PID:880
-
\??\c:\9ddpp.exec:\9ddpp.exe83⤵PID:4100
-
\??\c:\1xrlxrr.exec:\1xrlxrr.exe84⤵PID:3584
-
\??\c:\rlfrfxr.exec:\rlfrfxr.exe85⤵PID:4348
-
\??\c:\9tbtnh.exec:\9tbtnh.exe86⤵PID:1480
-
\??\c:\3ddvj.exec:\3ddvj.exe87⤵PID:4392
-
\??\c:\pdvdj.exec:\pdvdj.exe88⤵PID:3992
-
\??\c:\rffrflx.exec:\rffrflx.exe89⤵PID:2908
-
\??\c:\nttbth.exec:\nttbth.exe90⤵PID:2312
-
\??\c:\pddvj.exec:\pddvj.exe91⤵PID:4980
-
\??\c:\jdpdp.exec:\jdpdp.exe92⤵PID:3216
-
\??\c:\jvdvj.exec:\jvdvj.exe93⤵PID:3212
-
\??\c:\xfflxxr.exec:\xfflxxr.exe94⤵PID:5100
-
\??\c:\tnhbnt.exec:\tnhbnt.exe95⤵PID:3348
-
\??\c:\vjdpp.exec:\vjdpp.exe96⤵PID:680
-
\??\c:\jvdvj.exec:\jvdvj.exe97⤵PID:1084
-
\??\c:\rlrlxxl.exec:\rlrlxxl.exe98⤵PID:2436
-
\??\c:\hhnbnb.exec:\hhnbnb.exe99⤵PID:1444
-
\??\c:\btthbt.exec:\btthbt.exe100⤵PID:4368
-
\??\c:\djddv.exec:\djddv.exe101⤵PID:4372
-
\??\c:\lxlxxlr.exec:\lxlxxlr.exe102⤵PID:4480
-
\??\c:\btnbnn.exec:\btnbnn.exe103⤵PID:2456
-
\??\c:\7hnbnh.exec:\7hnbnh.exe104⤵PID:5036
-
\??\c:\jvjvp.exec:\jvjvp.exe105⤵PID:4872
-
\??\c:\rffrlff.exec:\rffrlff.exe106⤵PID:744
-
\??\c:\bnhhtt.exec:\bnhhtt.exe107⤵PID:868
-
\??\c:\hbthbb.exec:\hbthbb.exe108⤵PID:4292
-
\??\c:\jvjvj.exec:\jvjvj.exe109⤵PID:4444
-
\??\c:\flrlffx.exec:\flrlffx.exe110⤵PID:4360
-
\??\c:\bntnbt.exec:\bntnbt.exe111⤵PID:1792
-
\??\c:\djvpp.exec:\djvpp.exe112⤵PID:2588
-
\??\c:\rlxrrlr.exec:\rlxrrlr.exe113⤵PID:1940
-
\??\c:\5bhhbb.exec:\5bhhbb.exe114⤵PID:3908
-
\??\c:\bnnhhh.exec:\bnnhhh.exe115⤵PID:2912
-
\??\c:\pjdvv.exec:\pjdvv.exe116⤵PID:2636
-
\??\c:\rrfffrx.exec:\rrfffrx.exe117⤵PID:2896
-
\??\c:\3rxrrrx.exec:\3rxrrrx.exe118⤵PID:4840
-
\??\c:\thbtnn.exec:\thbtnn.exe119⤵PID:4432
-
\??\c:\tttnnt.exec:\tttnnt.exe120⤵PID:1820
-
\??\c:\dvjjp.exec:\dvjjp.exe121⤵PID:4572
-
\??\c:\vppdv.exec:\vppdv.exe122⤵PID:3772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-