Analysis
-
max time kernel
115s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 04:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b251ce76f743ddb46f67a3170e1d97d0N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
b251ce76f743ddb46f67a3170e1d97d0N.exe
-
Size
61KB
-
MD5
b251ce76f743ddb46f67a3170e1d97d0
-
SHA1
264a037acd641fd612c7e7e09c0c50e50a05ccb4
-
SHA256
6419c4a3e02b93443720fc09ec19483a534c64832a3cff5434a46b77496837dd
-
SHA512
264b6dca71043d05bff8ac41704b5d071e81883f73082901913bc237e137a4f752dc0de04ad8a5fa94821c690d12965ac0dc529c1f014e1d76982c9f5b514808
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDII9ZvHKE0:ymb3NkkiQ3mdBjFII9ZvHKE0
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/5064-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1620 nnnnhh.exe 1468 vddjd.exe 4784 xlffxxr.exe 744 btnhhh.exe 3768 ntnhbb.exe 2376 jvvpp.exe 1784 pjdpd.exe 4952 rxxrffl.exe 2004 3lllllf.exe 1600 9btnnn.exe 3016 frllffx.exe 116 lflxffx.exe 1512 1hhhbb.exe 4712 5jjdv.exe 4120 7lrrxrx.exe 1212 xrrlffx.exe 1720 thhhbb.exe 3044 vvddv.exe 1544 5xfxrrl.exe 3812 thhhtt.exe 2364 hbhbtn.exe 1660 jpvpp.exe 3244 rlllxll.exe 2308 7lxrlff.exe 752 hnbhhn.exe 5056 9jjpp.exe 2456 jdvpj.exe 2388 xxfrxxx.exe 4032 1htthh.exe 1648 hhhhbb.exe 4920 5djdp.exe 4232 rflffxf.exe 5044 tbtthh.exe 5100 thnhnh.exe 4856 jdvpd.exe 1828 vpjdd.exe 4300 pddvj.exe 1620 rxxrlfx.exe 3360 lfxrllf.exe 2008 3flfrrf.exe 1464 bbtbbt.exe 2280 3ttbbt.exe 3768 pdvpj.exe 4968 vpjdp.exe 2376 1fflxrl.exe 3796 fxlxlfx.exe 912 nhbthh.exe 4740 vjdvd.exe 2692 lfxlxrl.exe 3960 nbtnnh.exe 4172 thhtnh.exe 1372 pdvjv.exe 2060 vvjjd.exe 4204 5rxrllr.exe 4688 flrlxxl.exe 4712 htthtn.exe 1556 bbbtnh.exe 4904 htnhhb.exe 2996 9jjdp.exe 400 pvpjv.exe 1084 dvjdv.exe 4064 rlffrlx.exe 3528 3frfrll.exe 3804 nnhhhb.exe -
resource yara_rule behavioral2/memory/5064-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5064 wrote to memory of 1620 5064 b251ce76f743ddb46f67a3170e1d97d0N.exe 84 PID 5064 wrote to memory of 1620 5064 b251ce76f743ddb46f67a3170e1d97d0N.exe 84 PID 5064 wrote to memory of 1620 5064 b251ce76f743ddb46f67a3170e1d97d0N.exe 84 PID 1620 wrote to memory of 1468 1620 nnnnhh.exe 85 PID 1620 wrote to memory of 1468 1620 nnnnhh.exe 85 PID 1620 wrote to memory of 1468 1620 nnnnhh.exe 85 PID 1468 wrote to memory of 4784 1468 vddjd.exe 86 PID 1468 wrote to memory of 4784 1468 vddjd.exe 86 PID 1468 wrote to memory of 4784 1468 vddjd.exe 86 PID 4784 wrote to memory of 744 4784 xlffxxr.exe 87 PID 4784 wrote to memory of 744 4784 xlffxxr.exe 87 PID 4784 wrote to memory of 744 4784 xlffxxr.exe 87 PID 744 wrote to memory of 3768 744 btnhhh.exe 88 PID 744 wrote to memory of 3768 744 btnhhh.exe 88 PID 744 wrote to memory of 3768 744 btnhhh.exe 88 PID 3768 wrote to memory of 2376 3768 ntnhbb.exe 89 PID 3768 wrote to memory of 2376 3768 ntnhbb.exe 89 PID 3768 wrote to memory of 2376 3768 ntnhbb.exe 89 PID 2376 wrote to memory of 1784 2376 jvvpp.exe 90 PID 2376 wrote to memory of 1784 2376 jvvpp.exe 90 PID 2376 wrote to memory of 1784 2376 jvvpp.exe 90 PID 1784 wrote to memory of 4952 1784 pjdpd.exe 91 PID 1784 wrote to memory of 4952 1784 pjdpd.exe 91 PID 1784 wrote to memory of 4952 1784 pjdpd.exe 91 PID 4952 wrote to memory of 2004 4952 rxxrffl.exe 92 PID 4952 wrote to memory of 2004 4952 rxxrffl.exe 92 PID 4952 wrote to memory of 2004 4952 rxxrffl.exe 92 PID 2004 wrote to memory of 1600 2004 3lllllf.exe 93 PID 2004 wrote to memory of 1600 2004 3lllllf.exe 93 PID 2004 wrote to memory of 1600 2004 3lllllf.exe 93 PID 1600 wrote to memory of 3016 1600 9btnnn.exe 94 PID 1600 wrote to memory of 3016 1600 9btnnn.exe 94 PID 1600 wrote to memory of 3016 1600 9btnnn.exe 94 PID 3016 wrote to memory of 116 3016 frllffx.exe 95 PID 3016 wrote to memory of 116 3016 frllffx.exe 95 PID 3016 wrote to memory of 116 3016 frllffx.exe 95 PID 116 wrote to memory of 1512 116 lflxffx.exe 96 PID 116 wrote to memory of 1512 116 lflxffx.exe 96 PID 116 wrote to memory of 1512 116 lflxffx.exe 96 PID 1512 wrote to memory of 4712 1512 1hhhbb.exe 97 PID 1512 wrote to memory of 4712 1512 1hhhbb.exe 97 PID 1512 wrote to memory of 4712 1512 1hhhbb.exe 97 PID 4712 wrote to memory of 4120 4712 5jjdv.exe 98 PID 4712 wrote to memory of 4120 4712 5jjdv.exe 98 PID 4712 wrote to memory of 4120 4712 5jjdv.exe 98 PID 4120 wrote to memory of 1212 4120 7lrrxrx.exe 99 PID 4120 wrote to memory of 1212 4120 7lrrxrx.exe 99 PID 4120 wrote to memory of 1212 4120 7lrrxrx.exe 99 PID 1212 wrote to memory of 1720 1212 xrrlffx.exe 100 PID 1212 wrote to memory of 1720 1212 xrrlffx.exe 100 PID 1212 wrote to memory of 1720 1212 xrrlffx.exe 100 PID 1720 wrote to memory of 3044 1720 thhhbb.exe 101 PID 1720 wrote to memory of 3044 1720 thhhbb.exe 101 PID 1720 wrote to memory of 3044 1720 thhhbb.exe 101 PID 3044 wrote to memory of 1544 3044 vvddv.exe 103 PID 3044 wrote to memory of 1544 3044 vvddv.exe 103 PID 3044 wrote to memory of 1544 3044 vvddv.exe 103 PID 1544 wrote to memory of 3812 1544 5xfxrrl.exe 105 PID 1544 wrote to memory of 3812 1544 5xfxrrl.exe 105 PID 1544 wrote to memory of 3812 1544 5xfxrrl.exe 105 PID 3812 wrote to memory of 2364 3812 thhhtt.exe 106 PID 3812 wrote to memory of 2364 3812 thhhtt.exe 106 PID 3812 wrote to memory of 2364 3812 thhhtt.exe 106 PID 2364 wrote to memory of 1660 2364 hbhbtn.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\b251ce76f743ddb46f67a3170e1d97d0N.exe"C:\Users\Admin\AppData\Local\Temp\b251ce76f743ddb46f67a3170e1d97d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\nnnnhh.exec:\nnnnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\vddjd.exec:\vddjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\xlffxxr.exec:\xlffxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\btnhhh.exec:\btnhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\ntnhbb.exec:\ntnhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\jvvpp.exec:\jvvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\pjdpd.exec:\pjdpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\rxxrffl.exec:\rxxrffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\3lllllf.exec:\3lllllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\9btnnn.exec:\9btnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\frllffx.exec:\frllffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\lflxffx.exec:\lflxffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\1hhhbb.exec:\1hhhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\5jjdv.exec:\5jjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\7lrrxrx.exec:\7lrrxrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\xrrlffx.exec:\xrrlffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\thhhbb.exec:\thhhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\vvddv.exec:\vvddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\5xfxrrl.exec:\5xfxrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\thhhtt.exec:\thhhtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\hbhbtn.exec:\hbhbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\jpvpp.exec:\jpvpp.exe23⤵
- Executes dropped EXE
PID:1660 -
\??\c:\rlllxll.exec:\rlllxll.exe24⤵
- Executes dropped EXE
PID:3244 -
\??\c:\7lxrlff.exec:\7lxrlff.exe25⤵
- Executes dropped EXE
PID:2308 -
\??\c:\hnbhhn.exec:\hnbhhn.exe26⤵
- Executes dropped EXE
PID:752 -
\??\c:\9jjpp.exec:\9jjpp.exe27⤵
- Executes dropped EXE
PID:5056 -
\??\c:\jdvpj.exec:\jdvpj.exe28⤵
- Executes dropped EXE
PID:2456 -
\??\c:\xxfrxxx.exec:\xxfrxxx.exe29⤵
- Executes dropped EXE
PID:2388 -
\??\c:\1htthh.exec:\1htthh.exe30⤵
- Executes dropped EXE
PID:4032 -
\??\c:\hhhhbb.exec:\hhhhbb.exe31⤵
- Executes dropped EXE
PID:1648 -
\??\c:\5djdp.exec:\5djdp.exe32⤵
- Executes dropped EXE
PID:4920 -
\??\c:\rflffxf.exec:\rflffxf.exe33⤵
- Executes dropped EXE
PID:4232 -
\??\c:\tbtthh.exec:\tbtthh.exe34⤵
- Executes dropped EXE
PID:5044 -
\??\c:\thnhnh.exec:\thnhnh.exe35⤵
- Executes dropped EXE
PID:5100 -
\??\c:\jdvpd.exec:\jdvpd.exe36⤵
- Executes dropped EXE
PID:4856 -
\??\c:\vpjdd.exec:\vpjdd.exe37⤵
- Executes dropped EXE
PID:1828 -
\??\c:\pddvj.exec:\pddvj.exe38⤵
- Executes dropped EXE
PID:4300 -
\??\c:\rxxrlfx.exec:\rxxrlfx.exe39⤵
- Executes dropped EXE
PID:1620 -
\??\c:\lfxrllf.exec:\lfxrllf.exe40⤵
- Executes dropped EXE
PID:3360 -
\??\c:\3flfrrf.exec:\3flfrrf.exe41⤵
- Executes dropped EXE
PID:2008 -
\??\c:\bbtbbt.exec:\bbtbbt.exe42⤵
- Executes dropped EXE
PID:1464 -
\??\c:\3ttbbt.exec:\3ttbbt.exe43⤵
- Executes dropped EXE
PID:2280 -
\??\c:\pdvpj.exec:\pdvpj.exe44⤵
- Executes dropped EXE
PID:3768 -
\??\c:\vpjdp.exec:\vpjdp.exe45⤵
- Executes dropped EXE
PID:4968 -
\??\c:\1fflxrl.exec:\1fflxrl.exe46⤵
- Executes dropped EXE
PID:2376 -
\??\c:\fxlxlfx.exec:\fxlxlfx.exe47⤵
- Executes dropped EXE
PID:3796 -
\??\c:\nhbthh.exec:\nhbthh.exe48⤵
- Executes dropped EXE
PID:912 -
\??\c:\vjdvd.exec:\vjdvd.exe49⤵
- Executes dropped EXE
PID:4740 -
\??\c:\lfxlxrl.exec:\lfxlxrl.exe50⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nbtnnh.exec:\nbtnnh.exe51⤵
- Executes dropped EXE
PID:3960 -
\??\c:\thhtnh.exec:\thhtnh.exe52⤵
- Executes dropped EXE
PID:4172 -
\??\c:\pdvjv.exec:\pdvjv.exe53⤵
- Executes dropped EXE
PID:1372 -
\??\c:\vvjjd.exec:\vvjjd.exe54⤵
- Executes dropped EXE
PID:2060 -
\??\c:\5rxrllr.exec:\5rxrllr.exe55⤵
- Executes dropped EXE
PID:4204 -
\??\c:\flrlxxl.exec:\flrlxxl.exe56⤵
- Executes dropped EXE
PID:4688 -
\??\c:\htthtn.exec:\htthtn.exe57⤵
- Executes dropped EXE
PID:4712 -
\??\c:\bbbtnh.exec:\bbbtnh.exe58⤵
- Executes dropped EXE
PID:1556 -
\??\c:\htnhhb.exec:\htnhhb.exe59⤵
- Executes dropped EXE
PID:4904 -
\??\c:\9jjdp.exec:\9jjdp.exe60⤵
- Executes dropped EXE
PID:2996 -
\??\c:\pvpjv.exec:\pvpjv.exe61⤵
- Executes dropped EXE
PID:400 -
\??\c:\dvjdv.exec:\dvjdv.exe62⤵
- Executes dropped EXE
PID:1084 -
\??\c:\rlffrlx.exec:\rlffrlx.exe63⤵
- Executes dropped EXE
PID:4064 -
\??\c:\3frfrll.exec:\3frfrll.exe64⤵
- Executes dropped EXE
PID:3528 -
\??\c:\nnhhhb.exec:\nnhhhb.exe65⤵
- Executes dropped EXE
PID:3804 -
\??\c:\5hbthh.exec:\5hbthh.exe66⤵PID:3860
-
\??\c:\pvdpd.exec:\pvdpd.exe67⤵PID:2104
-
\??\c:\jvvpj.exec:\jvvpj.exe68⤵PID:2096
-
\??\c:\9ffrllx.exec:\9ffrllx.exe69⤵PID:3292
-
\??\c:\llfxlfr.exec:\llfxlfr.exe70⤵PID:2700
-
\??\c:\htnhbb.exec:\htnhbb.exe71⤵PID:456
-
\??\c:\hntthb.exec:\hntthb.exe72⤵PID:2032
-
\??\c:\dpvpp.exec:\dpvpp.exe73⤵PID:860
-
\??\c:\pppdv.exec:\pppdv.exe74⤵PID:3212
-
\??\c:\5xfxxxf.exec:\5xfxxxf.exe75⤵PID:3448
-
\??\c:\rffffff.exec:\rffffff.exe76⤵PID:3996
-
\??\c:\bbbbbb.exec:\bbbbbb.exe77⤵PID:2340
-
\??\c:\nnhnhb.exec:\nnhnhb.exe78⤵PID:5024
-
\??\c:\pvvvj.exec:\pvvvj.exe79⤵PID:3080
-
\??\c:\pjpdv.exec:\pjpdv.exe80⤵PID:3684
-
\??\c:\lrlxrlf.exec:\lrlxrlf.exe81⤵PID:2912
-
\??\c:\xxxlfrx.exec:\xxxlfrx.exe82⤵PID:1344
-
\??\c:\thtnbb.exec:\thtnbb.exe83⤵PID:4544
-
\??\c:\hbbtbt.exec:\hbbtbt.exe84⤵PID:3464
-
\??\c:\pdjdp.exec:\pdjdp.exe85⤵PID:3136
-
\??\c:\vdvvp.exec:\vdvvp.exe86⤵PID:5040
-
\??\c:\fxrlxlf.exec:\fxrlxlf.exe87⤵PID:228
-
\??\c:\hhhthb.exec:\hhhthb.exe88⤵PID:1168
-
\??\c:\pdjvj.exec:\pdjvj.exe89⤵PID:1912
-
\??\c:\xllrflf.exec:\xllrflf.exe90⤵PID:5068
-
\??\c:\tbthbt.exec:\tbthbt.exe91⤵PID:1732
-
\??\c:\nnnhtt.exec:\nnnhtt.exe92⤵PID:1960
-
\??\c:\dddpv.exec:\dddpv.exe93⤵PID:4948
-
\??\c:\7jvpd.exec:\7jvpd.exe94⤵PID:2580
-
\??\c:\flrfrrl.exec:\flrfrrl.exe95⤵PID:684
-
\??\c:\hnhntt.exec:\hnhntt.exe96⤵PID:3552
-
\??\c:\vvvpd.exec:\vvvpd.exe97⤵PID:2704
-
\??\c:\ddpjv.exec:\ddpjv.exe98⤵PID:1372
-
\??\c:\lffxllf.exec:\lffxllf.exe99⤵PID:2060
-
\??\c:\xxxrfrl.exec:\xxxrfrl.exe100⤵PID:4204
-
\??\c:\hbtbtn.exec:\hbtbtn.exe101⤵PID:4688
-
\??\c:\hnnhtn.exec:\hnnhtn.exe102⤵PID:1064
-
\??\c:\pvjvp.exec:\pvjvp.exe103⤵PID:1212
-
\??\c:\5vpdp.exec:\5vpdp.exe104⤵PID:2868
-
\??\c:\rxxxrxr.exec:\rxxxrxr.exe105⤵PID:2996
-
\??\c:\lffrlrf.exec:\lffrlrf.exe106⤵PID:3000
-
\??\c:\nbbtnh.exec:\nbbtnh.exe107⤵PID:756
-
\??\c:\jddvv.exec:\jddvv.exe108⤵PID:4040
-
\??\c:\1ddvj.exec:\1ddvj.exe109⤵PID:368
-
\??\c:\rxxllfx.exec:\rxxllfx.exe110⤵PID:1940
-
\??\c:\1xrfrlf.exec:\1xrfrlf.exe111⤵PID:1300
-
\??\c:\3hhbtn.exec:\3hhbtn.exe112⤵PID:2380
-
\??\c:\nhbhtt.exec:\nhbhtt.exe113⤵PID:4736
-
\??\c:\vjvjv.exec:\vjvjv.exe114⤵PID:3764
-
\??\c:\vppjd.exec:\vppjd.exe115⤵PID:1808
-
\??\c:\xlxxllf.exec:\xlxxllf.exe116⤵PID:4820
-
\??\c:\nnnhtn.exec:\nnnhtn.exe117⤵PID:3640
-
\??\c:\ththhb.exec:\ththhb.exe118⤵PID:2456
-
\??\c:\pvpdd.exec:\pvpdd.exe119⤵PID:5012
-
\??\c:\vjddv.exec:\vjddv.exe120⤵PID:4788
-
\??\c:\fllfllx.exec:\fllfllx.exe121⤵PID:2216
-
\??\c:\1lffrxr.exec:\1lffrxr.exe122⤵PID:4228
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-