Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2024, 17:13
Static task
static1
Behavioral task
behavioral1
Sample
ddc275d87548e5d4a283832799a2754ed32045ca97b608a8c476da6e7900869f.exe
Resource
win7-20240708-en
General
-
Target
ddc275d87548e5d4a283832799a2754ed32045ca97b608a8c476da6e7900869f.exe
-
Size
78KB
-
MD5
e24afa077e062b61829880d7b23a16a4
-
SHA1
a10fd446d8496c4696a98f206852b5ff2e6a3575
-
SHA256
ddc275d87548e5d4a283832799a2754ed32045ca97b608a8c476da6e7900869f
-
SHA512
e559586ef94c5130b8a19815c77d7412117fd72e61e3c81a0cb6eccede170d4fab22662ac18f60f9eab1948b547bd7ea0da1c2927ca596975f6501250b61b772
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qPtOKLjF9QW:ymb3NkkiQ3mdBjFIj+qcKLjF9P
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3280-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1392-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4664-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1100-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1284-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4688 rxxlfrl.exe 4160 bnhhtn.exe 1392 1btnbt.exe 4228 vdvpv.exe 3100 9ppjd.exe 3496 rrlxlfx.exe 3596 nnbttb.exe 4488 vvdvp.exe 1028 dvjdv.exe 1944 rfxflfx.exe 4440 dpjdv.exe 3320 lxlfrfr.exe 2728 rxxlfxr.exe 3272 1hhbbt.exe 4664 vpjvv.exe 1468 xffrlfx.exe 3936 tbtntn.exe 1620 pjjvp.exe 2388 dpjdj.exe 2664 3xlxrlx.exe 1100 nhnhbt.exe 1460 vvjjj.exe 4352 vdpjp.exe 1284 rfxlxrl.exe 3308 xxxrlfx.exe 408 hhnhtn.exe 1820 tbhbnh.exe 3728 dppdj.exe 4272 vjpjd.exe 1908 rflxrlf.exe 3500 thhbnh.exe 4580 5dvpj.exe 1152 rxfrfxr.exe 1536 frrlfxr.exe 2628 tttnhb.exe 4064 hhhthn.exe 760 5vvdj.exe 620 9fxrlll.exe 4900 9tnhbt.exe 3980 btbttn.exe 4360 pjdvp.exe 2460 jpjvd.exe 1188 xlrfrlx.exe 4612 lxlxflr.exe 1428 tnnhhn.exe 1368 bhbtnb.exe 2456 pddjv.exe 624 jdjdp.exe 3548 lfxrfxl.exe 3528 ffxrfxr.exe 3688 nbnhtt.exe 1892 hbbtnh.exe 2904 1dddp.exe 1396 ppvpv.exe 1148 rflxrfr.exe 3612 lrlfxfx.exe 4848 ntthhb.exe 1952 hhtnhh.exe 4908 ppjdj.exe 3468 pjdvj.exe 1432 lrrllrl.exe 5028 rxrlxrl.exe 3300 3nnhhb.exe 2960 hhhbhh.exe -
resource yara_rule behavioral2/memory/3280-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1100-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-214-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3280 wrote to memory of 4688 3280 ddc275d87548e5d4a283832799a2754ed32045ca97b608a8c476da6e7900869f.exe 83 PID 3280 wrote to memory of 4688 3280 ddc275d87548e5d4a283832799a2754ed32045ca97b608a8c476da6e7900869f.exe 83 PID 3280 wrote to memory of 4688 3280 ddc275d87548e5d4a283832799a2754ed32045ca97b608a8c476da6e7900869f.exe 83 PID 4688 wrote to memory of 4160 4688 rxxlfrl.exe 84 PID 4688 wrote to memory of 4160 4688 rxxlfrl.exe 84 PID 4688 wrote to memory of 4160 4688 rxxlfrl.exe 84 PID 4160 wrote to memory of 1392 4160 bnhhtn.exe 85 PID 4160 wrote to memory of 1392 4160 bnhhtn.exe 85 PID 4160 wrote to memory of 1392 4160 bnhhtn.exe 85 PID 1392 wrote to memory of 4228 1392 1btnbt.exe 86 PID 1392 wrote to memory of 4228 1392 1btnbt.exe 86 PID 1392 wrote to memory of 4228 1392 1btnbt.exe 86 PID 4228 wrote to memory of 3100 4228 vdvpv.exe 87 PID 4228 wrote to memory of 3100 4228 vdvpv.exe 87 PID 4228 wrote to memory of 3100 4228 vdvpv.exe 87 PID 3100 wrote to memory of 3496 3100 9ppjd.exe 88 PID 3100 wrote to memory of 3496 3100 9ppjd.exe 88 PID 3100 wrote to memory of 3496 3100 9ppjd.exe 88 PID 3496 wrote to memory of 3596 3496 rrlxlfx.exe 90 PID 3496 wrote to memory of 3596 3496 rrlxlfx.exe 90 PID 3496 wrote to memory of 3596 3496 rrlxlfx.exe 90 PID 3596 wrote to memory of 4488 3596 nnbttb.exe 91 PID 3596 wrote to memory of 4488 3596 nnbttb.exe 91 PID 3596 wrote to memory of 4488 3596 nnbttb.exe 91 PID 4488 wrote to memory of 1028 4488 vvdvp.exe 92 PID 4488 wrote to memory of 1028 4488 vvdvp.exe 92 PID 4488 wrote to memory of 1028 4488 vvdvp.exe 92 PID 1028 wrote to memory of 1944 1028 dvjdv.exe 93 PID 1028 wrote to memory of 1944 1028 dvjdv.exe 93 PID 1028 wrote to memory of 1944 1028 dvjdv.exe 93 PID 1944 wrote to memory of 4440 1944 rfxflfx.exe 95 PID 1944 wrote to memory of 4440 1944 rfxflfx.exe 95 PID 1944 wrote to memory of 4440 1944 rfxflfx.exe 95 PID 4440 wrote to memory of 3320 4440 dpjdv.exe 96 PID 4440 wrote to memory of 3320 4440 dpjdv.exe 96 PID 4440 wrote to memory of 3320 4440 dpjdv.exe 96 PID 3320 wrote to memory of 2728 3320 lxlfrfr.exe 97 PID 3320 wrote to memory of 2728 3320 lxlfrfr.exe 97 PID 3320 wrote to memory of 2728 3320 lxlfrfr.exe 97 PID 2728 wrote to memory of 3272 2728 rxxlfxr.exe 98 PID 2728 wrote to memory of 3272 2728 rxxlfxr.exe 98 PID 2728 wrote to memory of 3272 2728 rxxlfxr.exe 98 PID 3272 wrote to memory of 4664 3272 1hhbbt.exe 99 PID 3272 wrote to memory of 4664 3272 1hhbbt.exe 99 PID 3272 wrote to memory of 4664 3272 1hhbbt.exe 99 PID 4664 wrote to memory of 1468 4664 vpjvv.exe 100 PID 4664 wrote to memory of 1468 4664 vpjvv.exe 100 PID 4664 wrote to memory of 1468 4664 vpjvv.exe 100 PID 1468 wrote to memory of 3936 1468 xffrlfx.exe 102 PID 1468 wrote to memory of 3936 1468 xffrlfx.exe 102 PID 1468 wrote to memory of 3936 1468 xffrlfx.exe 102 PID 3936 wrote to memory of 1620 3936 tbtntn.exe 103 PID 3936 wrote to memory of 1620 3936 tbtntn.exe 103 PID 3936 wrote to memory of 1620 3936 tbtntn.exe 103 PID 1620 wrote to memory of 2388 1620 pjjvp.exe 104 PID 1620 wrote to memory of 2388 1620 pjjvp.exe 104 PID 1620 wrote to memory of 2388 1620 pjjvp.exe 104 PID 2388 wrote to memory of 2664 2388 dpjdj.exe 105 PID 2388 wrote to memory of 2664 2388 dpjdj.exe 105 PID 2388 wrote to memory of 2664 2388 dpjdj.exe 105 PID 2664 wrote to memory of 1100 2664 3xlxrlx.exe 106 PID 2664 wrote to memory of 1100 2664 3xlxrlx.exe 106 PID 2664 wrote to memory of 1100 2664 3xlxrlx.exe 106 PID 1100 wrote to memory of 1460 1100 nhnhbt.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddc275d87548e5d4a283832799a2754ed32045ca97b608a8c476da6e7900869f.exe"C:\Users\Admin\AppData\Local\Temp\ddc275d87548e5d4a283832799a2754ed32045ca97b608a8c476da6e7900869f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\rxxlfrl.exec:\rxxlfrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\bnhhtn.exec:\bnhhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\1btnbt.exec:\1btnbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\vdvpv.exec:\vdvpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\9ppjd.exec:\9ppjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\rrlxlfx.exec:\rrlxlfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\nnbttb.exec:\nnbttb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\vvdvp.exec:\vvdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\dvjdv.exec:\dvjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\rfxflfx.exec:\rfxflfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\dpjdv.exec:\dpjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\lxlfrfr.exec:\lxlfrfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\rxxlfxr.exec:\rxxlfxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\1hhbbt.exec:\1hhbbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\vpjvv.exec:\vpjvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\xffrlfx.exec:\xffrlfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\tbtntn.exec:\tbtntn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\pjjvp.exec:\pjjvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\dpjdj.exec:\dpjdj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\3xlxrlx.exec:\3xlxrlx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\nhnhbt.exec:\nhnhbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\vvjjj.exec:\vvjjj.exe23⤵
- Executes dropped EXE
PID:1460 -
\??\c:\vdpjp.exec:\vdpjp.exe24⤵
- Executes dropped EXE
PID:4352 -
\??\c:\rfxlxrl.exec:\rfxlxrl.exe25⤵
- Executes dropped EXE
PID:1284 -
\??\c:\xxxrlfx.exec:\xxxrlfx.exe26⤵
- Executes dropped EXE
PID:3308 -
\??\c:\hhnhtn.exec:\hhnhtn.exe27⤵
- Executes dropped EXE
PID:408 -
\??\c:\tbhbnh.exec:\tbhbnh.exe28⤵
- Executes dropped EXE
PID:1820 -
\??\c:\dppdj.exec:\dppdj.exe29⤵
- Executes dropped EXE
PID:3728 -
\??\c:\vjpjd.exec:\vjpjd.exe30⤵
- Executes dropped EXE
PID:4272 -
\??\c:\rflxrlf.exec:\rflxrlf.exe31⤵
- Executes dropped EXE
PID:1908 -
\??\c:\thhbnh.exec:\thhbnh.exe32⤵
- Executes dropped EXE
PID:3500 -
\??\c:\5dvpj.exec:\5dvpj.exe33⤵
- Executes dropped EXE
PID:4580 -
\??\c:\vdpdp.exec:\vdpdp.exe34⤵PID:1732
-
\??\c:\rxfrfxr.exec:\rxfrfxr.exe35⤵
- Executes dropped EXE
PID:1152 -
\??\c:\frrlfxr.exec:\frrlfxr.exe36⤵
- Executes dropped EXE
PID:1536 -
\??\c:\tttnhb.exec:\tttnhb.exe37⤵
- Executes dropped EXE
PID:2628 -
\??\c:\hhhthn.exec:\hhhthn.exe38⤵
- Executes dropped EXE
PID:4064 -
\??\c:\5vvdj.exec:\5vvdj.exe39⤵
- Executes dropped EXE
PID:760 -
\??\c:\9fxrlll.exec:\9fxrlll.exe40⤵
- Executes dropped EXE
PID:620 -
\??\c:\9tnhbt.exec:\9tnhbt.exe41⤵
- Executes dropped EXE
PID:4900 -
\??\c:\btbttn.exec:\btbttn.exe42⤵
- Executes dropped EXE
PID:3980 -
\??\c:\pjdvp.exec:\pjdvp.exe43⤵
- Executes dropped EXE
PID:4360 -
\??\c:\jpjvd.exec:\jpjvd.exe44⤵
- Executes dropped EXE
PID:2460 -
\??\c:\xlrfrlx.exec:\xlrfrlx.exe45⤵
- Executes dropped EXE
PID:1188 -
\??\c:\lxlxflr.exec:\lxlxflr.exe46⤵
- Executes dropped EXE
PID:4612 -
\??\c:\tnnhhn.exec:\tnnhhn.exe47⤵
- Executes dropped EXE
PID:1428 -
\??\c:\bhbtnb.exec:\bhbtnb.exe48⤵
- Executes dropped EXE
PID:1368 -
\??\c:\pddjv.exec:\pddjv.exe49⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jdjdp.exec:\jdjdp.exe50⤵
- Executes dropped EXE
PID:624 -
\??\c:\lfxrfxl.exec:\lfxrfxl.exe51⤵
- Executes dropped EXE
PID:3548 -
\??\c:\ffxrfxr.exec:\ffxrfxr.exe52⤵
- Executes dropped EXE
PID:3528 -
\??\c:\nbnhtt.exec:\nbnhtt.exe53⤵
- Executes dropped EXE
PID:3688 -
\??\c:\hbbtnh.exec:\hbbtnh.exe54⤵
- Executes dropped EXE
PID:1892 -
\??\c:\1dddp.exec:\1dddp.exe55⤵
- Executes dropped EXE
PID:2904 -
\??\c:\ppvpv.exec:\ppvpv.exe56⤵
- Executes dropped EXE
PID:1396 -
\??\c:\rflxrfr.exec:\rflxrfr.exe57⤵
- Executes dropped EXE
PID:1148 -
\??\c:\lrlfxfx.exec:\lrlfxfx.exe58⤵
- Executes dropped EXE
PID:3612 -
\??\c:\ntthhb.exec:\ntthhb.exe59⤵
- Executes dropped EXE
PID:4848 -
\??\c:\hhtnhh.exec:\hhtnhh.exe60⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ppjdj.exec:\ppjdj.exe61⤵
- Executes dropped EXE
PID:4908 -
\??\c:\pjdvj.exec:\pjdvj.exe62⤵
- Executes dropped EXE
PID:3468 -
\??\c:\lrrllrl.exec:\lrrllrl.exe63⤵
- Executes dropped EXE
PID:1432 -
\??\c:\rxrlxrl.exec:\rxrlxrl.exe64⤵
- Executes dropped EXE
PID:5028 -
\??\c:\3nnhhb.exec:\3nnhhb.exe65⤵
- Executes dropped EXE
PID:3300 -
\??\c:\hhhbhh.exec:\hhhbhh.exe66⤵
- Executes dropped EXE
PID:2960 -
\??\c:\pdjdv.exec:\pdjdv.exe67⤵PID:1460
-
\??\c:\jjdvp.exec:\jjdvp.exe68⤵PID:4696
-
\??\c:\frrlrrl.exec:\frrlrrl.exe69⤵PID:392
-
\??\c:\lxxrlxx.exec:\lxxrlxx.exe70⤵PID:2256
-
\??\c:\thhbnh.exec:\thhbnh.exe71⤵PID:4628
-
\??\c:\hbtnhb.exec:\hbtnhb.exe72⤵PID:2516
-
\??\c:\ppjdp.exec:\ppjdp.exe73⤵PID:3656
-
\??\c:\vpvpj.exec:\vpvpj.exe74⤵PID:2520
-
\??\c:\lxxxrlr.exec:\lxxxrlr.exe75⤵PID:1504
-
\??\c:\9lfxxxx.exec:\9lfxxxx.exe76⤵PID:4600
-
\??\c:\nnntbb.exec:\nnntbb.exe77⤵PID:1276
-
\??\c:\jdvjv.exec:\jdvjv.exe78⤵PID:5112
-
\??\c:\dddvp.exec:\dddvp.exe79⤵PID:2940
-
\??\c:\xxrlxrl.exec:\xxrlxrl.exe80⤵PID:1732
-
\??\c:\nntbbb.exec:\nntbbb.exe81⤵PID:3280
-
\??\c:\tntnbb.exec:\tntnbb.exe82⤵PID:1536
-
\??\c:\ppvvj.exec:\ppvvj.exe83⤵PID:4080
-
\??\c:\pdvpv.exec:\pdvpv.exe84⤵PID:4160
-
\??\c:\rflffxx.exec:\rflffxx.exe85⤵PID:4672
-
\??\c:\xfflffx.exec:\xfflffx.exe86⤵PID:4936
-
\??\c:\btnnbb.exec:\btnnbb.exe87⤵PID:3232
-
\??\c:\3ttnbb.exec:\3ttnbb.exe88⤵PID:1696
-
\??\c:\dpjvj.exec:\dpjvj.exe89⤵PID:4296
-
\??\c:\dvppp.exec:\dvppp.exe90⤵PID:4636
-
\??\c:\3nntnh.exec:\3nntnh.exe91⤵PID:2472
-
\??\c:\pdvpj.exec:\pdvpj.exe92⤵PID:4032
-
\??\c:\dvpjv.exec:\dvpjv.exe93⤵PID:2400
-
\??\c:\lxxxlfx.exec:\lxxxlfx.exe94⤵PID:1944
-
\??\c:\rfrlfxr.exec:\rfrlfxr.exe95⤵PID:2348
-
\??\c:\bhbtnt.exec:\bhbtnt.exe96⤵PID:3316
-
\??\c:\htnbnh.exec:\htnbnh.exe97⤵PID:3320
-
\??\c:\vpddp.exec:\vpddp.exe98⤵PID:4340
-
\??\c:\9jdpd.exec:\9jdpd.exe99⤵PID:4940
-
\??\c:\lflfllx.exec:\lflfllx.exe100⤵PID:4596
-
\??\c:\hbbnth.exec:\hbbnth.exe101⤵PID:4640
-
\??\c:\bhtnhh.exec:\bhtnhh.exe102⤵PID:1380
-
\??\c:\dpjdd.exec:\dpjdd.exe103⤵PID:3236
-
\??\c:\dvpdp.exec:\dvpdp.exe104⤵PID:2020
-
\??\c:\rflxlfx.exec:\rflxlfx.exe105⤵PID:3116
-
\??\c:\9rxrrrl.exec:\9rxrrrl.exe106⤵PID:2404
-
\??\c:\7hbthb.exec:\7hbthb.exe107⤵PID:1620
-
\??\c:\htttnb.exec:\htttnb.exe108⤵PID:2936
-
\??\c:\ddddj.exec:\ddddj.exe109⤵PID:2664
-
\??\c:\vvpdj.exec:\vvpdj.exe110⤵PID:856
-
\??\c:\xffxllr.exec:\xffxllr.exe111⤵PID:4060
-
\??\c:\5htbtn.exec:\5htbtn.exe112⤵PID:5100
-
\??\c:\3ppdp.exec:\3ppdp.exe113⤵PID:3056
-
\??\c:\jvvvj.exec:\jvvvj.exe114⤵PID:388
-
\??\c:\5xrfflf.exec:\5xrfflf.exe115⤵PID:4960
-
\??\c:\3xxlxrf.exec:\3xxlxrf.exe116⤵PID:1912
-
\??\c:\nnhhhb.exec:\nnhhhb.exe117⤵PID:4092
-
\??\c:\bthnht.exec:\bthnht.exe118⤵PID:4700
-
\??\c:\vdvpp.exec:\vdvpp.exe119⤵PID:1520
-
\??\c:\xxfxrlf.exec:\xxfxrlf.exe120⤵PID:3240
-
\??\c:\frfxllf.exec:\frfxllf.exe121⤵PID:1880
-
\??\c:\tbtnbb.exec:\tbtnbb.exe122⤵PID:4484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-