Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2024 12:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
830828fc55b9dd518a221e81d80c08c0N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
830828fc55b9dd518a221e81d80c08c0N.exe
-
Size
64KB
-
MD5
830828fc55b9dd518a221e81d80c08c0
-
SHA1
184dd47840911eff449d91aeb5b6a6b85f407ef6
-
SHA256
c5b57d09803241e934c7e720d7f1b3da33f11a99c482693f9545d3660f9b414a
-
SHA512
fee7a90399b626710541498e452ed7bfa41b0b9d607a02c71bce2627cbe463342d68b993bc04a04b99bd7661f194cde47868e589bbe414cfca67ee4e36211634
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27B1g:ymb3NkkiQ3mdBjFI9cW
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4560-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/900-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/900-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3776-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3804-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1876-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1716-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2816 ppvdj.exe 1912 9xffflr.exe 900 9xllflf.exe 4444 nbhhtn.exe 4396 1hbbtn.exe 3804 vjpjd.exe 3776 xlrlxxx.exe 4540 tbtbtt.exe 2084 nnbtnt.exe 2224 vjdvp.exe 4440 frxlxll.exe 4248 bhhbnn.exe 1876 jjdjd.exe 2008 rlxxffr.exe 4044 5tbbtn.exe 4864 nhhhbn.exe 3472 vvdvj.exe 1384 dvvpj.exe 2624 xxrrflf.exe 3668 llrlxrl.exe 4524 tthhhn.exe 4388 vpvpv.exe 4476 5pddd.exe 2148 lllrfff.exe 4688 nhnhnn.exe 1212 pvvpp.exe 4768 jvjdv.exe 400 9lffxfx.exe 1716 bthbbt.exe 4464 jdjjj.exe 4092 vjvpj.exe 3412 lrllffx.exe 4892 bbhbtt.exe 1992 nnhhbn.exe 2312 pvjdv.exe 4488 lxffxxr.exe 4508 lrlfxrr.exe 2028 1thbth.exe 5116 bnnhbb.exe 1056 bhtnhh.exe 3896 jvvpp.exe 4824 jjdvv.exe 1020 lrfrrrr.exe 3048 xfllrrx.exe 2420 tbbbtn.exe 2136 btbbbb.exe 3120 9jjjp.exe 4212 jdpjj.exe 4192 rffxxxx.exe 968 5lffxlf.exe 712 hnbttt.exe 2984 ntnnbb.exe 2140 ddjvp.exe 3520 vjddp.exe 776 lrxxrlf.exe 2224 xlrlfxx.exe 3704 7httbb.exe 4744 vvjjd.exe 2352 frxrllf.exe 1876 rxxrrll.exe 2008 3htttb.exe 456 9jddd.exe 4924 1ddvj.exe 2560 rfllfll.exe -
resource yara_rule behavioral2/memory/4560-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/900-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/900-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/900-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3804-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3804-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3804-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1876-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ffxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxfxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4560 wrote to memory of 2816 4560 830828fc55b9dd518a221e81d80c08c0N.exe 83 PID 4560 wrote to memory of 2816 4560 830828fc55b9dd518a221e81d80c08c0N.exe 83 PID 4560 wrote to memory of 2816 4560 830828fc55b9dd518a221e81d80c08c0N.exe 83 PID 2816 wrote to memory of 1912 2816 ppvdj.exe 84 PID 2816 wrote to memory of 1912 2816 ppvdj.exe 84 PID 2816 wrote to memory of 1912 2816 ppvdj.exe 84 PID 1912 wrote to memory of 900 1912 9xffflr.exe 85 PID 1912 wrote to memory of 900 1912 9xffflr.exe 85 PID 1912 wrote to memory of 900 1912 9xffflr.exe 85 PID 900 wrote to memory of 4444 900 9xllflf.exe 86 PID 900 wrote to memory of 4444 900 9xllflf.exe 86 PID 900 wrote to memory of 4444 900 9xllflf.exe 86 PID 4444 wrote to memory of 4396 4444 nbhhtn.exe 87 PID 4444 wrote to memory of 4396 4444 nbhhtn.exe 87 PID 4444 wrote to memory of 4396 4444 nbhhtn.exe 87 PID 4396 wrote to memory of 3804 4396 1hbbtn.exe 88 PID 4396 wrote to memory of 3804 4396 1hbbtn.exe 88 PID 4396 wrote to memory of 3804 4396 1hbbtn.exe 88 PID 3804 wrote to memory of 3776 3804 vjpjd.exe 89 PID 3804 wrote to memory of 3776 3804 vjpjd.exe 89 PID 3804 wrote to memory of 3776 3804 vjpjd.exe 89 PID 3776 wrote to memory of 4540 3776 xlrlxxx.exe 90 PID 3776 wrote to memory of 4540 3776 xlrlxxx.exe 90 PID 3776 wrote to memory of 4540 3776 xlrlxxx.exe 90 PID 4540 wrote to memory of 2084 4540 tbtbtt.exe 91 PID 4540 wrote to memory of 2084 4540 tbtbtt.exe 91 PID 4540 wrote to memory of 2084 4540 tbtbtt.exe 91 PID 2084 wrote to memory of 2224 2084 nnbtnt.exe 92 PID 2084 wrote to memory of 2224 2084 nnbtnt.exe 92 PID 2084 wrote to memory of 2224 2084 nnbtnt.exe 92 PID 2224 wrote to memory of 4440 2224 vjdvp.exe 93 PID 2224 wrote to memory of 4440 2224 vjdvp.exe 93 PID 2224 wrote to memory of 4440 2224 vjdvp.exe 93 PID 4440 wrote to memory of 4248 4440 frxlxll.exe 94 PID 4440 wrote to memory of 4248 4440 frxlxll.exe 94 PID 4440 wrote to memory of 4248 4440 frxlxll.exe 94 PID 4248 wrote to memory of 1876 4248 bhhbnn.exe 95 PID 4248 wrote to memory of 1876 4248 bhhbnn.exe 95 PID 4248 wrote to memory of 1876 4248 bhhbnn.exe 95 PID 1876 wrote to memory of 2008 1876 jjdjd.exe 97 PID 1876 wrote to memory of 2008 1876 jjdjd.exe 97 PID 1876 wrote to memory of 2008 1876 jjdjd.exe 97 PID 2008 wrote to memory of 4044 2008 rlxxffr.exe 98 PID 2008 wrote to memory of 4044 2008 rlxxffr.exe 98 PID 2008 wrote to memory of 4044 2008 rlxxffr.exe 98 PID 4044 wrote to memory of 4864 4044 5tbbtn.exe 99 PID 4044 wrote to memory of 4864 4044 5tbbtn.exe 99 PID 4044 wrote to memory of 4864 4044 5tbbtn.exe 99 PID 4864 wrote to memory of 3472 4864 nhhhbn.exe 100 PID 4864 wrote to memory of 3472 4864 nhhhbn.exe 100 PID 4864 wrote to memory of 3472 4864 nhhhbn.exe 100 PID 3472 wrote to memory of 1384 3472 vvdvj.exe 101 PID 3472 wrote to memory of 1384 3472 vvdvj.exe 101 PID 3472 wrote to memory of 1384 3472 vvdvj.exe 101 PID 1384 wrote to memory of 2624 1384 dvvpj.exe 102 PID 1384 wrote to memory of 2624 1384 dvvpj.exe 102 PID 1384 wrote to memory of 2624 1384 dvvpj.exe 102 PID 2624 wrote to memory of 3668 2624 xxrrflf.exe 103 PID 2624 wrote to memory of 3668 2624 xxrrflf.exe 103 PID 2624 wrote to memory of 3668 2624 xxrrflf.exe 103 PID 3668 wrote to memory of 4524 3668 llrlxrl.exe 104 PID 3668 wrote to memory of 4524 3668 llrlxrl.exe 104 PID 3668 wrote to memory of 4524 3668 llrlxrl.exe 104 PID 4524 wrote to memory of 4388 4524 tthhhn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\830828fc55b9dd518a221e81d80c08c0N.exe"C:\Users\Admin\AppData\Local\Temp\830828fc55b9dd518a221e81d80c08c0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\ppvdj.exec:\ppvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\9xffflr.exec:\9xffflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\9xllflf.exec:\9xllflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\nbhhtn.exec:\nbhhtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\1hbbtn.exec:\1hbbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\vjpjd.exec:\vjpjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\xlrlxxx.exec:\xlrlxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\tbtbtt.exec:\tbtbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\nnbtnt.exec:\nnbtnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\vjdvp.exec:\vjdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\frxlxll.exec:\frxlxll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\bhhbnn.exec:\bhhbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\jjdjd.exec:\jjdjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\rlxxffr.exec:\rlxxffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\5tbbtn.exec:\5tbbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\nhhhbn.exec:\nhhhbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\vvdvj.exec:\vvdvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\dvvpj.exec:\dvvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\xxrrflf.exec:\xxrrflf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\llrlxrl.exec:\llrlxrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\tthhhn.exec:\tthhhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\vpvpv.exec:\vpvpv.exe23⤵
- Executes dropped EXE
PID:4388 -
\??\c:\5pddd.exec:\5pddd.exe24⤵
- Executes dropped EXE
PID:4476 -
\??\c:\lllrfff.exec:\lllrfff.exe25⤵
- Executes dropped EXE
PID:2148 -
\??\c:\nhnhnn.exec:\nhnhnn.exe26⤵
- Executes dropped EXE
PID:4688 -
\??\c:\pvvpp.exec:\pvvpp.exe27⤵
- Executes dropped EXE
PID:1212 -
\??\c:\jvjdv.exec:\jvjdv.exe28⤵
- Executes dropped EXE
PID:4768 -
\??\c:\9lffxfx.exec:\9lffxfx.exe29⤵
- Executes dropped EXE
PID:400 -
\??\c:\bthbbt.exec:\bthbbt.exe30⤵
- Executes dropped EXE
PID:1716 -
\??\c:\jdjjj.exec:\jdjjj.exe31⤵
- Executes dropped EXE
PID:4464 -
\??\c:\vjvpj.exec:\vjvpj.exe32⤵
- Executes dropped EXE
PID:4092 -
\??\c:\lrllffx.exec:\lrllffx.exe33⤵
- Executes dropped EXE
PID:3412 -
\??\c:\bbhbtt.exec:\bbhbtt.exe34⤵
- Executes dropped EXE
PID:4892 -
\??\c:\nnhhbn.exec:\nnhhbn.exe35⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pvjdv.exec:\pvjdv.exe36⤵
- Executes dropped EXE
PID:2312 -
\??\c:\lxffxxr.exec:\lxffxxr.exe37⤵
- Executes dropped EXE
PID:4488 -
\??\c:\lrlfxrr.exec:\lrlfxrr.exe38⤵
- Executes dropped EXE
PID:4508 -
\??\c:\1thbth.exec:\1thbth.exe39⤵
- Executes dropped EXE
PID:2028 -
\??\c:\bnnhbb.exec:\bnnhbb.exe40⤵
- Executes dropped EXE
PID:5116 -
\??\c:\bhtnhh.exec:\bhtnhh.exe41⤵
- Executes dropped EXE
PID:1056 -
\??\c:\jvvpp.exec:\jvvpp.exe42⤵
- Executes dropped EXE
PID:3896 -
\??\c:\jjdvv.exec:\jjdvv.exe43⤵
- Executes dropped EXE
PID:4824 -
\??\c:\lrfrrrr.exec:\lrfrrrr.exe44⤵
- Executes dropped EXE
PID:1020 -
\??\c:\xfllrrx.exec:\xfllrrx.exe45⤵
- Executes dropped EXE
PID:3048 -
\??\c:\tbbbtn.exec:\tbbbtn.exe46⤵
- Executes dropped EXE
PID:2420 -
\??\c:\btbbbb.exec:\btbbbb.exe47⤵
- Executes dropped EXE
PID:2136 -
\??\c:\9jjjp.exec:\9jjjp.exe48⤵
- Executes dropped EXE
PID:3120 -
\??\c:\jdpjj.exec:\jdpjj.exe49⤵
- Executes dropped EXE
PID:4212 -
\??\c:\rffxxxx.exec:\rffxxxx.exe50⤵
- Executes dropped EXE
PID:4192 -
\??\c:\5lffxlf.exec:\5lffxlf.exe51⤵
- Executes dropped EXE
PID:968 -
\??\c:\hnbttt.exec:\hnbttt.exe52⤵
- Executes dropped EXE
PID:712 -
\??\c:\ntnnbb.exec:\ntnnbb.exe53⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ddjvp.exec:\ddjvp.exe54⤵
- Executes dropped EXE
PID:2140 -
\??\c:\vjddp.exec:\vjddp.exe55⤵
- Executes dropped EXE
PID:3520 -
\??\c:\lrxxrlf.exec:\lrxxrlf.exe56⤵
- Executes dropped EXE
PID:776 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe57⤵
- Executes dropped EXE
PID:2224 -
\??\c:\7httbb.exec:\7httbb.exe58⤵
- Executes dropped EXE
PID:3704 -
\??\c:\vvjjd.exec:\vvjjd.exe59⤵
- Executes dropped EXE
PID:4744 -
\??\c:\frxrllf.exec:\frxrllf.exe60⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rxxrrll.exec:\rxxrrll.exe61⤵
- Executes dropped EXE
PID:1876 -
\??\c:\3htttb.exec:\3htttb.exe62⤵
- Executes dropped EXE
PID:2008 -
\??\c:\9jddd.exec:\9jddd.exe63⤵
- Executes dropped EXE
PID:456 -
\??\c:\1ddvj.exec:\1ddvj.exe64⤵
- Executes dropped EXE
PID:4924 -
\??\c:\rfllfll.exec:\rfllfll.exe65⤵
- Executes dropped EXE
PID:2560 -
\??\c:\rlrlfxr.exec:\rlrlfxr.exe66⤵PID:4432
-
\??\c:\bbhhbh.exec:\bbhhbh.exe67⤵PID:2408
-
\??\c:\7ttbbh.exec:\7ttbbh.exe68⤵PID:2624
-
\??\c:\pvjdp.exec:\pvjdp.exe69⤵PID:4364
-
\??\c:\ddvvv.exec:\ddvvv.exe70⤵PID:3868
-
\??\c:\fxfrxrl.exec:\fxfrxrl.exe71⤵PID:740
-
\??\c:\rffffxx.exec:\rffffxx.exe72⤵PID:2000
-
\??\c:\hnhhbh.exec:\hnhhbh.exe73⤵PID:4476
-
\??\c:\ppvvv.exec:\ppvvv.exe74⤵PID:4240
-
\??\c:\jdjdv.exec:\jdjdv.exe75⤵PID:1396
-
\??\c:\fxlfllx.exec:\fxlfllx.exe76⤵PID:1696
-
\??\c:\rxffflf.exec:\rxffflf.exe77⤵PID:1588
-
\??\c:\nbnnnt.exec:\nbnnnt.exe78⤵PID:1556
-
\??\c:\htnnbb.exec:\htnnbb.exe79⤵PID:2100
-
\??\c:\vvdvp.exec:\vvdvp.exe80⤵PID:3492
-
\??\c:\dvvvp.exec:\dvvvp.exe81⤵PID:2200
-
\??\c:\jvppj.exec:\jvppj.exe82⤵PID:3504
-
\??\c:\fflfxll.exec:\fflfxll.exe83⤵PID:1688
-
\??\c:\llrrxff.exec:\llrrxff.exe84⤵PID:4464
-
\??\c:\nhnntn.exec:\nhnntn.exe85⤵PID:2296
-
\??\c:\btbtbn.exec:\btbtbn.exe86⤵PID:3412
-
\??\c:\jdvvd.exec:\jdvvd.exe87⤵PID:4356
-
\??\c:\jvdvp.exec:\jvdvp.exe88⤵PID:4316
-
\??\c:\fxxrlll.exec:\fxxrlll.exe89⤵PID:2156
-
\??\c:\vvvpd.exec:\vvvpd.exe90⤵PID:640
-
\??\c:\3xfrlll.exec:\3xfrlll.exe91⤵PID:3320
-
\??\c:\1rxxxxf.exec:\1rxxxxf.exe92⤵PID:4384
-
\??\c:\tnbbhh.exec:\tnbbhh.exe93⤵PID:2020
-
\??\c:\hhttnn.exec:\hhttnn.exe94⤵PID:1672
-
\??\c:\pjjjv.exec:\pjjjv.exe95⤵PID:3364
-
\??\c:\5vpjd.exec:\5vpjd.exe96⤵PID:2344
-
\??\c:\lrxrlll.exec:\lrxrlll.exe97⤵PID:3684
-
\??\c:\xrrxrxr.exec:\xrrxrxr.exe98⤵PID:1124
-
\??\c:\tntthh.exec:\tntthh.exe99⤵PID:1220
-
\??\c:\ttnntb.exec:\ttnntb.exe100⤵PID:1228
-
\??\c:\3pjjd.exec:\3pjjd.exe101⤵PID:4856
-
\??\c:\7jdvp.exec:\7jdvp.exe102⤵PID:2328
-
\??\c:\fxllllx.exec:\fxllllx.exe103⤵PID:4512
-
\??\c:\lrxrlfl.exec:\lrxrlfl.exe104⤵PID:2252
-
\??\c:\tbnnbh.exec:\tbnnbh.exe105⤵PID:3204
-
\??\c:\tnbtnn.exec:\tnbtnn.exe106⤵PID:4948
-
\??\c:\dpjjv.exec:\dpjjv.exe107⤵PID:228
-
\??\c:\pjpdv.exec:\pjpdv.exe108⤵PID:4904
-
\??\c:\rffrfxl.exec:\rffrfxl.exe109⤵PID:3164
-
\??\c:\3flxrxl.exec:\3flxrxl.exe110⤵PID:2064
-
\??\c:\lrlfrlf.exec:\lrlfrlf.exe111⤵PID:3236
-
\??\c:\thnhbh.exec:\thnhbh.exe112⤵PID:4764
-
\??\c:\htnbtt.exec:\htnbtt.exe113⤵PID:3144
-
\??\c:\jdvpd.exec:\jdvpd.exe114⤵PID:1164
-
\??\c:\jvpjd.exec:\jvpjd.exe115⤵PID:3920
-
\??\c:\xrrxffr.exec:\xrrxffr.exe116⤵PID:4992
-
\??\c:\rlxrfll.exec:\rlxrfll.exe117⤵PID:3208
-
\??\c:\hbbtbt.exec:\hbbtbt.exe118⤵PID:1384
-
\??\c:\tntnbt.exec:\tntnbt.exe119⤵PID:1908
-
\??\c:\dvvpd.exec:\dvvpd.exe120⤵PID:5028
-
\??\c:\5dpjv.exec:\5dpjv.exe121⤵PID:1640
-
\??\c:\lrlxlfx.exec:\lrlxlfx.exe122⤵PID:732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-