Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01-09-2024 03:49
Static task
static1
Behavioral task
behavioral1
Sample
dcebb2e1ea4c0d7c5bb706d6120f27089f8e9318fe3a7aedf603d5bef0a43420.exe
Resource
win7-20240708-en
General
-
Target
dcebb2e1ea4c0d7c5bb706d6120f27089f8e9318fe3a7aedf603d5bef0a43420.exe
-
Size
82KB
-
MD5
bea7a34f32f0930bcff895e355cd3431
-
SHA1
cff2023cbcc339b57ff92ab146f5b2987b504aed
-
SHA256
dcebb2e1ea4c0d7c5bb706d6120f27089f8e9318fe3a7aedf603d5bef0a43420
-
SHA512
1f7bc16379384148e99bb69abf8ea0da60ee9d815e551f1c95740bfe3b05313488b0369df0992379708c4069a39c880b8f1ee4e9145e682ae88274ec61226351
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Q3:ymb3NkkiQ3mdBjFIIp9L9QrrA8e
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral2/memory/3196-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2568-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1132-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3848-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1276-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1768 jjvvj.exe 3448 rfxrflf.exe 2568 ntnbnb.exe 1180 7bnbtn.exe 1916 3jjvv.exe 1132 llfxrrl.exe 4584 9nnhbt.exe 1796 tbnhth.exe 4716 vjdvj.exe 2408 rlfxrlr.exe 2932 5tnbnb.exe 5112 jpppd.exe 2180 7xfrffr.exe 4248 rlfxrff.exe 3848 7btnhh.exe 2288 vjdjd.exe 3460 xrxxffl.exe 2768 nthhnb.exe 2336 vpppd.exe 1276 frlxlrf.exe 2960 hhnntn.exe 716 vvpdv.exe 3780 rxfrxrl.exe 2628 xrrfrlx.exe 3500 fxlfrfx.exe 4140 htbtnt.exe 2200 djpjd.exe 3872 5lfrfxl.exe 2400 3lfrfrf.exe 3468 nntttb.exe 4832 thnhth.exe 1320 vvvpp.exe 3692 lxfrlfl.exe 2520 thbnbt.exe 3524 bbbbbb.exe 4656 9hthnn.exe 4592 3dpjj.exe 2792 5jjdp.exe 4972 fxrxlfl.exe 4220 hnthth.exe 4812 7tthht.exe 1688 djjdv.exe 2032 lfxlxrf.exe 4988 xllxlxl.exe 4084 bbhtnh.exe 2904 nbhtnn.exe 4892 vjdvd.exe 3876 vvjdd.exe 3892 rflfrll.exe 4172 bnnbnh.exe 2740 btnhhh.exe 3380 jjvpj.exe 3032 xrlrlfx.exe 4444 flrrlll.exe 3848 nbtnbb.exe 4196 tnbbbt.exe 3064 vvpjd.exe 4020 jpvvp.exe 4852 rxxrrlf.exe 1276 xxxrfxf.exe 620 nttbnh.exe 4820 bntbnt.exe 3108 ddpjv.exe 716 jpvvj.exe -
resource yara_rule behavioral2/memory/3196-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1276-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3780-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3196 wrote to memory of 1768 3196 dcebb2e1ea4c0d7c5bb706d6120f27089f8e9318fe3a7aedf603d5bef0a43420.exe 84 PID 3196 wrote to memory of 1768 3196 dcebb2e1ea4c0d7c5bb706d6120f27089f8e9318fe3a7aedf603d5bef0a43420.exe 84 PID 3196 wrote to memory of 1768 3196 dcebb2e1ea4c0d7c5bb706d6120f27089f8e9318fe3a7aedf603d5bef0a43420.exe 84 PID 1768 wrote to memory of 3448 1768 jjvvj.exe 85 PID 1768 wrote to memory of 3448 1768 jjvvj.exe 85 PID 1768 wrote to memory of 3448 1768 jjvvj.exe 85 PID 3448 wrote to memory of 2568 3448 rfxrflf.exe 86 PID 3448 wrote to memory of 2568 3448 rfxrflf.exe 86 PID 3448 wrote to memory of 2568 3448 rfxrflf.exe 86 PID 2568 wrote to memory of 1180 2568 ntnbnb.exe 87 PID 2568 wrote to memory of 1180 2568 ntnbnb.exe 87 PID 2568 wrote to memory of 1180 2568 ntnbnb.exe 87 PID 1180 wrote to memory of 1916 1180 7bnbtn.exe 88 PID 1180 wrote to memory of 1916 1180 7bnbtn.exe 88 PID 1180 wrote to memory of 1916 1180 7bnbtn.exe 88 PID 1916 wrote to memory of 1132 1916 3jjvv.exe 89 PID 1916 wrote to memory of 1132 1916 3jjvv.exe 89 PID 1916 wrote to memory of 1132 1916 3jjvv.exe 89 PID 1132 wrote to memory of 4584 1132 llfxrrl.exe 90 PID 1132 wrote to memory of 4584 1132 llfxrrl.exe 90 PID 1132 wrote to memory of 4584 1132 llfxrrl.exe 90 PID 4584 wrote to memory of 1796 4584 9nnhbt.exe 91 PID 4584 wrote to memory of 1796 4584 9nnhbt.exe 91 PID 4584 wrote to memory of 1796 4584 9nnhbt.exe 91 PID 1796 wrote to memory of 4716 1796 tbnhth.exe 92 PID 1796 wrote to memory of 4716 1796 tbnhth.exe 92 PID 1796 wrote to memory of 4716 1796 tbnhth.exe 92 PID 4716 wrote to memory of 2408 4716 vjdvj.exe 93 PID 4716 wrote to memory of 2408 4716 vjdvj.exe 93 PID 4716 wrote to memory of 2408 4716 vjdvj.exe 93 PID 2408 wrote to memory of 2932 2408 rlfxrlr.exe 94 PID 2408 wrote to memory of 2932 2408 rlfxrlr.exe 94 PID 2408 wrote to memory of 2932 2408 rlfxrlr.exe 94 PID 2932 wrote to memory of 5112 2932 5tnbnb.exe 95 PID 2932 wrote to memory of 5112 2932 5tnbnb.exe 95 PID 2932 wrote to memory of 5112 2932 5tnbnb.exe 95 PID 5112 wrote to memory of 2180 5112 jpppd.exe 96 PID 5112 wrote to memory of 2180 5112 jpppd.exe 96 PID 5112 wrote to memory of 2180 5112 jpppd.exe 96 PID 2180 wrote to memory of 4248 2180 7xfrffr.exe 97 PID 2180 wrote to memory of 4248 2180 7xfrffr.exe 97 PID 2180 wrote to memory of 4248 2180 7xfrffr.exe 97 PID 4248 wrote to memory of 3848 4248 rlfxrff.exe 98 PID 4248 wrote to memory of 3848 4248 rlfxrff.exe 98 PID 4248 wrote to memory of 3848 4248 rlfxrff.exe 98 PID 3848 wrote to memory of 2288 3848 7btnhh.exe 100 PID 3848 wrote to memory of 2288 3848 7btnhh.exe 100 PID 3848 wrote to memory of 2288 3848 7btnhh.exe 100 PID 2288 wrote to memory of 3460 2288 vjdjd.exe 101 PID 2288 wrote to memory of 3460 2288 vjdjd.exe 101 PID 2288 wrote to memory of 3460 2288 vjdjd.exe 101 PID 3460 wrote to memory of 2768 3460 xrxxffl.exe 102 PID 3460 wrote to memory of 2768 3460 xrxxffl.exe 102 PID 3460 wrote to memory of 2768 3460 xrxxffl.exe 102 PID 2768 wrote to memory of 2336 2768 nthhnb.exe 104 PID 2768 wrote to memory of 2336 2768 nthhnb.exe 104 PID 2768 wrote to memory of 2336 2768 nthhnb.exe 104 PID 2336 wrote to memory of 1276 2336 vpppd.exe 105 PID 2336 wrote to memory of 1276 2336 vpppd.exe 105 PID 2336 wrote to memory of 1276 2336 vpppd.exe 105 PID 1276 wrote to memory of 2960 1276 frlxlrf.exe 106 PID 1276 wrote to memory of 2960 1276 frlxlrf.exe 106 PID 1276 wrote to memory of 2960 1276 frlxlrf.exe 106 PID 2960 wrote to memory of 716 2960 hhnntn.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcebb2e1ea4c0d7c5bb706d6120f27089f8e9318fe3a7aedf603d5bef0a43420.exe"C:\Users\Admin\AppData\Local\Temp\dcebb2e1ea4c0d7c5bb706d6120f27089f8e9318fe3a7aedf603d5bef0a43420.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\jjvvj.exec:\jjvvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\rfxrflf.exec:\rfxrflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\ntnbnb.exec:\ntnbnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\7bnbtn.exec:\7bnbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\3jjvv.exec:\3jjvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\llfxrrl.exec:\llfxrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\9nnhbt.exec:\9nnhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\tbnhth.exec:\tbnhth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\vjdvj.exec:\vjdvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\rlfxrlr.exec:\rlfxrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\5tnbnb.exec:\5tnbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\jpppd.exec:\jpppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\7xfrffr.exec:\7xfrffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\rlfxrff.exec:\rlfxrff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\7btnhh.exec:\7btnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\vjdjd.exec:\vjdjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\xrxxffl.exec:\xrxxffl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\nthhnb.exec:\nthhnb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\vpppd.exec:\vpppd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\frlxlrf.exec:\frlxlrf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\hhnntn.exec:\hhnntn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\vvpdv.exec:\vvpdv.exe23⤵
- Executes dropped EXE
PID:716 -
\??\c:\rxfrxrl.exec:\rxfrxrl.exe24⤵
- Executes dropped EXE
PID:3780 -
\??\c:\xrrfrlx.exec:\xrrfrlx.exe25⤵
- Executes dropped EXE
PID:2628 -
\??\c:\fxlfrfx.exec:\fxlfrfx.exe26⤵
- Executes dropped EXE
PID:3500 -
\??\c:\htbtnt.exec:\htbtnt.exe27⤵
- Executes dropped EXE
PID:4140 -
\??\c:\djpjd.exec:\djpjd.exe28⤵
- Executes dropped EXE
PID:2200 -
\??\c:\5lfrfxl.exec:\5lfrfxl.exe29⤵
- Executes dropped EXE
PID:3872 -
\??\c:\3lfrfrf.exec:\3lfrfrf.exe30⤵
- Executes dropped EXE
PID:2400 -
\??\c:\nntttb.exec:\nntttb.exe31⤵
- Executes dropped EXE
PID:3468 -
\??\c:\thnhth.exec:\thnhth.exe32⤵
- Executes dropped EXE
PID:4832 -
\??\c:\vvvpp.exec:\vvvpp.exe33⤵
- Executes dropped EXE
PID:1320 -
\??\c:\lxfrlfl.exec:\lxfrlfl.exe34⤵
- Executes dropped EXE
PID:3692 -
\??\c:\thbnbt.exec:\thbnbt.exe35⤵
- Executes dropped EXE
PID:2520 -
\??\c:\bbbbbb.exec:\bbbbbb.exe36⤵
- Executes dropped EXE
PID:3524 -
\??\c:\9hthnn.exec:\9hthnn.exe37⤵
- Executes dropped EXE
PID:4656 -
\??\c:\3dpjj.exec:\3dpjj.exe38⤵
- Executes dropped EXE
PID:4592 -
\??\c:\5jjdp.exec:\5jjdp.exe39⤵
- Executes dropped EXE
PID:2792 -
\??\c:\fxrxlfl.exec:\fxrxlfl.exe40⤵
- Executes dropped EXE
PID:4972 -
\??\c:\hnthth.exec:\hnthth.exe41⤵
- Executes dropped EXE
PID:4220 -
\??\c:\7tthht.exec:\7tthht.exe42⤵
- Executes dropped EXE
PID:4812 -
\??\c:\djjdv.exec:\djjdv.exe43⤵
- Executes dropped EXE
PID:1688 -
\??\c:\lfxlxrf.exec:\lfxlxrf.exe44⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xllxlxl.exec:\xllxlxl.exe45⤵
- Executes dropped EXE
PID:4988 -
\??\c:\bbhtnh.exec:\bbhtnh.exe46⤵
- Executes dropped EXE
PID:4084 -
\??\c:\nbhtnn.exec:\nbhtnn.exe47⤵
- Executes dropped EXE
PID:2904 -
\??\c:\vjdvd.exec:\vjdvd.exe48⤵
- Executes dropped EXE
PID:4892 -
\??\c:\vvjdd.exec:\vvjdd.exe49⤵
- Executes dropped EXE
PID:3876 -
\??\c:\rflfrll.exec:\rflfrll.exe50⤵
- Executes dropped EXE
PID:3892 -
\??\c:\bnnbnh.exec:\bnnbnh.exe51⤵
- Executes dropped EXE
PID:4172 -
\??\c:\btnhhh.exec:\btnhhh.exe52⤵
- Executes dropped EXE
PID:2740 -
\??\c:\jjvpj.exec:\jjvpj.exe53⤵
- Executes dropped EXE
PID:3380 -
\??\c:\xrlrlfx.exec:\xrlrlfx.exe54⤵
- Executes dropped EXE
PID:3032 -
\??\c:\flrrlll.exec:\flrrlll.exe55⤵
- Executes dropped EXE
PID:4444 -
\??\c:\nbtnbb.exec:\nbtnbb.exe56⤵
- Executes dropped EXE
PID:3848 -
\??\c:\tnbbbt.exec:\tnbbbt.exe57⤵
- Executes dropped EXE
PID:4196 -
\??\c:\vvpjd.exec:\vvpjd.exe58⤵
- Executes dropped EXE
PID:3064 -
\??\c:\jpvvp.exec:\jpvvp.exe59⤵
- Executes dropped EXE
PID:4020 -
\??\c:\rxxrrlf.exec:\rxxrrlf.exe60⤵
- Executes dropped EXE
PID:4852 -
\??\c:\xxxrfxf.exec:\xxxrfxf.exe61⤵
- Executes dropped EXE
PID:1276 -
\??\c:\nttbnh.exec:\nttbnh.exe62⤵
- Executes dropped EXE
PID:620 -
\??\c:\bntbnt.exec:\bntbnt.exe63⤵
- Executes dropped EXE
PID:4820 -
\??\c:\ddpjv.exec:\ddpjv.exe64⤵
- Executes dropped EXE
PID:3108 -
\??\c:\jpvvj.exec:\jpvvj.exe65⤵
- Executes dropped EXE
PID:716 -
\??\c:\xrxrlrx.exec:\xrxrlrx.exe66⤵PID:4300
-
\??\c:\9bbbtt.exec:\9bbbtt.exe67⤵PID:3456
-
\??\c:\bhhhbb.exec:\bhhhbb.exe68⤵PID:2052
-
\??\c:\jpvdd.exec:\jpvdd.exe69⤵PID:2120
-
\??\c:\jdvpd.exec:\jdvpd.exe70⤵PID:2900
-
\??\c:\fxllllx.exec:\fxllllx.exe71⤵PID:3028
-
\??\c:\bbhhbb.exec:\bbhhbb.exe72⤵PID:2148
-
\??\c:\thhnnh.exec:\thhnnh.exe73⤵PID:5052
-
\??\c:\9dddd.exec:\9dddd.exe74⤵PID:3788
-
\??\c:\dvppj.exec:\dvppj.exe75⤵PID:3216
-
\??\c:\5rlxllf.exec:\5rlxllf.exe76⤵PID:652
-
\??\c:\frfrxlx.exec:\frfrxlx.exe77⤵PID:2480
-
\??\c:\bhtnhh.exec:\bhtnhh.exe78⤵PID:1216
-
\??\c:\nhhbtt.exec:\nhhbtt.exe79⤵PID:4764
-
\??\c:\jdvpp.exec:\jdvpp.exe80⤵PID:1848
-
\??\c:\nhhhnn.exec:\nhhhnn.exe81⤵PID:1652
-
\??\c:\jdvvj.exec:\jdvvj.exe82⤵PID:3068
-
\??\c:\ppdvj.exec:\ppdvj.exe83⤵PID:3888
-
\??\c:\rfffrxr.exec:\rfffrxr.exe84⤵PID:2844
-
\??\c:\5rrfrlx.exec:\5rrfrlx.exe85⤵PID:4272
-
\??\c:\tttnbt.exec:\tttnbt.exe86⤵PID:2524
-
\??\c:\7pjdj.exec:\7pjdj.exe87⤵PID:4884
-
\??\c:\1rrxllf.exec:\1rrxllf.exe88⤵PID:3000
-
\??\c:\rlllffx.exec:\rlllffx.exe89⤵PID:4716
-
\??\c:\9thhbb.exec:\9thhbb.exe90⤵PID:3384
-
\??\c:\dvvjd.exec:\dvvjd.exe91⤵PID:760
-
\??\c:\pjjdp.exec:\pjjdp.exe92⤵PID:3180
-
\??\c:\fxxrfff.exec:\fxxrfff.exe93⤵PID:396
-
\??\c:\rlffxxr.exec:\rlffxxr.exe94⤵PID:2576
-
\??\c:\tnnhbb.exec:\tnnhbb.exe95⤵PID:4880
-
\??\c:\3bhbnn.exec:\3bhbnn.exe96⤵PID:2192
-
\??\c:\ddddp.exec:\ddddp.exe97⤵PID:636
-
\??\c:\vjppj.exec:\vjppj.exe98⤵PID:5080
-
\??\c:\fxxrffr.exec:\fxxrffr.exe99⤵PID:736
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe100⤵PID:4692
-
\??\c:\rfrxlxx.exec:\rfrxlxx.exe101⤵PID:4680
-
\??\c:\nnhhbb.exec:\nnhhbb.exe102⤵PID:216
-
\??\c:\nhnhbt.exec:\nhnhbt.exe103⤵PID:2848
-
\??\c:\jppjd.exec:\jppjd.exe104⤵PID:4760
-
\??\c:\vdjpp.exec:\vdjpp.exe105⤵PID:2800
-
\??\c:\frrrrrl.exec:\frrrrrl.exe106⤵PID:3412
-
\??\c:\hhhtht.exec:\hhhtht.exe107⤵PID:3984
-
\??\c:\btbttt.exec:\btbttt.exe108⤵PID:1964
-
\??\c:\7nhhbb.exec:\7nhhbb.exe109⤵PID:2628
-
\??\c:\1djdp.exec:\1djdp.exe110⤵PID:2804
-
\??\c:\frlxlxl.exec:\frlxlxl.exe111⤵PID:3148
-
\??\c:\bttbtb.exec:\bttbtb.exe112⤵PID:3388
-
\??\c:\hhnthh.exec:\hhnthh.exe113⤵PID:4964
-
\??\c:\jdvdv.exec:\jdvdv.exe114⤵PID:2496
-
\??\c:\1vjvv.exec:\1vjvv.exe115⤵PID:4744
-
\??\c:\lffxxxr.exec:\lffxxxr.exe116⤵PID:3784
-
\??\c:\lxxxxfr.exec:\lxxxxfr.exe117⤵PID:1572
-
\??\c:\nhhbtt.exec:\nhhbtt.exe118⤵PID:4832
-
\??\c:\jjjjd.exec:\jjjjd.exe119⤵PID:2084
-
\??\c:\dvdpd.exec:\dvdpd.exe120⤵PID:3692
-
\??\c:\lfllfff.exec:\lfllfff.exe121⤵PID:3392
-
\??\c:\7nbhhh.exec:\7nbhhh.exe122⤵PID:692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-