Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2024 21:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
59f472db4e131e4e644497840a1d2c0fea1557dab2de620e0d6f437b90d4d964.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
General
-
Target
59f472db4e131e4e644497840a1d2c0fea1557dab2de620e0d6f437b90d4d964.exe
-
Size
106KB
-
MD5
c670a3012341143aa2ceb3fd8aa54400
-
SHA1
fb5b81271c13e3e640af0fa7eddc8e0cd18f9efb
-
SHA256
59f472db4e131e4e644497840a1d2c0fea1557dab2de620e0d6f437b90d4d964
-
SHA512
3861c6461b016e102039af447654635dc6c92a57973ef20b7ac80322766f4a1bcf5c1098b33a6d47c0b6bbeaa7f6e3beffce0f9dd32852c5797b1ee4447c18cf
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+buwUGu3P3CmW:n3C9BRo7MlrWKVT+buBGu3PHW
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3372-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1240-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/860-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2768 frxrxrx.exe 1240 hnhbnn.exe 1628 nntbht.exe 2756 fxxrlrl.exe 3824 fxrlfxr.exe 860 1hbbbt.exe 3128 ppvpd.exe 4880 rfxlxrf.exe 3668 fxfxxrf.exe 1512 hhhbtt.exe 5076 pjvjv.exe 2644 xxxxrlf.exe 2440 htbtnn.exe 4860 1vdvp.exe 3644 vpdvj.exe 4048 lrrxxfr.exe 3704 nbnthb.exe 3004 vjjdv.exe 4528 5vpdj.exe 3120 hbnbtn.exe 2056 3vvjp.exe 3216 rrfxlfx.exe 4696 nbhbnh.exe 1432 bnnhtn.exe 3724 dvjdp.exe 4624 rxflfxl.exe 4012 thbttn.exe 4792 tbbhth.exe 3432 vvjjd.exe 3204 xffrffr.exe 2992 5nnhbh.exe 1332 hhhthh.exe 4752 vjpdp.exe 2984 lrfxfrf.exe 3940 3bnhtn.exe 932 7djdv.exe 1008 1dvvd.exe 2764 fxfxlfr.exe 3840 ttthth.exe 4184 9djdv.exe 3988 jvvjj.exe 4952 3rrlxrl.exe 1940 bntbbh.exe 2940 tnthht.exe 4856 dvjdv.exe 3932 frfffxf.exe 3356 nbbthb.exe 3960 hbttnn.exe 1260 dvpjv.exe 1264 ffrxrll.exe 980 3btnbh.exe 5080 bnthbn.exe 4996 pdvvv.exe 3584 lrxlffx.exe 3484 lrrrlxr.exe 4860 nhbhth.exe 3644 vpvpd.exe 3652 lxfrfxr.exe 4364 xlrlxrl.exe 4620 bbbthb.exe 3144 tttnbt.exe 4528 jjjdp.exe 1464 rxxfxxx.exe 924 lflrlxx.exe -
resource yara_rule behavioral2/memory/3372-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/860-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/860-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/860-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-195-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59f472db4e131e4e644497840a1d2c0fea1557dab2de620e0d6f437b90d4d964.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3372 wrote to memory of 2768 3372 59f472db4e131e4e644497840a1d2c0fea1557dab2de620e0d6f437b90d4d964.exe 83 PID 3372 wrote to memory of 2768 3372 59f472db4e131e4e644497840a1d2c0fea1557dab2de620e0d6f437b90d4d964.exe 83 PID 3372 wrote to memory of 2768 3372 59f472db4e131e4e644497840a1d2c0fea1557dab2de620e0d6f437b90d4d964.exe 83 PID 2768 wrote to memory of 1240 2768 frxrxrx.exe 84 PID 2768 wrote to memory of 1240 2768 frxrxrx.exe 84 PID 2768 wrote to memory of 1240 2768 frxrxrx.exe 84 PID 1240 wrote to memory of 1628 1240 hnhbnn.exe 85 PID 1240 wrote to memory of 1628 1240 hnhbnn.exe 85 PID 1240 wrote to memory of 1628 1240 hnhbnn.exe 85 PID 1628 wrote to memory of 2756 1628 nntbht.exe 86 PID 1628 wrote to memory of 2756 1628 nntbht.exe 86 PID 1628 wrote to memory of 2756 1628 nntbht.exe 86 PID 2756 wrote to memory of 3824 2756 fxxrlrl.exe 87 PID 2756 wrote to memory of 3824 2756 fxxrlrl.exe 87 PID 2756 wrote to memory of 3824 2756 fxxrlrl.exe 87 PID 3824 wrote to memory of 860 3824 fxrlfxr.exe 88 PID 3824 wrote to memory of 860 3824 fxrlfxr.exe 88 PID 3824 wrote to memory of 860 3824 fxrlfxr.exe 88 PID 860 wrote to memory of 3128 860 1hbbbt.exe 89 PID 860 wrote to memory of 3128 860 1hbbbt.exe 89 PID 860 wrote to memory of 3128 860 1hbbbt.exe 89 PID 3128 wrote to memory of 4880 3128 ppvpd.exe 90 PID 3128 wrote to memory of 4880 3128 ppvpd.exe 90 PID 3128 wrote to memory of 4880 3128 ppvpd.exe 90 PID 4880 wrote to memory of 3668 4880 rfxlxrf.exe 91 PID 4880 wrote to memory of 3668 4880 rfxlxrf.exe 91 PID 4880 wrote to memory of 3668 4880 rfxlxrf.exe 91 PID 3668 wrote to memory of 1512 3668 fxfxxrf.exe 92 PID 3668 wrote to memory of 1512 3668 fxfxxrf.exe 92 PID 3668 wrote to memory of 1512 3668 fxfxxrf.exe 92 PID 1512 wrote to memory of 5076 1512 hhhbtt.exe 93 PID 1512 wrote to memory of 5076 1512 hhhbtt.exe 93 PID 1512 wrote to memory of 5076 1512 hhhbtt.exe 93 PID 5076 wrote to memory of 2644 5076 pjvjv.exe 94 PID 5076 wrote to memory of 2644 5076 pjvjv.exe 94 PID 5076 wrote to memory of 2644 5076 pjvjv.exe 94 PID 2644 wrote to memory of 2440 2644 xxxxrlf.exe 95 PID 2644 wrote to memory of 2440 2644 xxxxrlf.exe 95 PID 2644 wrote to memory of 2440 2644 xxxxrlf.exe 95 PID 2440 wrote to memory of 4860 2440 htbtnn.exe 96 PID 2440 wrote to memory of 4860 2440 htbtnn.exe 96 PID 2440 wrote to memory of 4860 2440 htbtnn.exe 96 PID 4860 wrote to memory of 3644 4860 1vdvp.exe 97 PID 4860 wrote to memory of 3644 4860 1vdvp.exe 97 PID 4860 wrote to memory of 3644 4860 1vdvp.exe 97 PID 3644 wrote to memory of 4048 3644 vpdvj.exe 98 PID 3644 wrote to memory of 4048 3644 vpdvj.exe 98 PID 3644 wrote to memory of 4048 3644 vpdvj.exe 98 PID 4048 wrote to memory of 3704 4048 lrrxxfr.exe 100 PID 4048 wrote to memory of 3704 4048 lrrxxfr.exe 100 PID 4048 wrote to memory of 3704 4048 lrrxxfr.exe 100 PID 3704 wrote to memory of 3004 3704 nbnthb.exe 101 PID 3704 wrote to memory of 3004 3704 nbnthb.exe 101 PID 3704 wrote to memory of 3004 3704 nbnthb.exe 101 PID 3004 wrote to memory of 4528 3004 vjjdv.exe 102 PID 3004 wrote to memory of 4528 3004 vjjdv.exe 102 PID 3004 wrote to memory of 4528 3004 vjjdv.exe 102 PID 4528 wrote to memory of 3120 4528 5vpdj.exe 103 PID 4528 wrote to memory of 3120 4528 5vpdj.exe 103 PID 4528 wrote to memory of 3120 4528 5vpdj.exe 103 PID 3120 wrote to memory of 2056 3120 hbnbtn.exe 105 PID 3120 wrote to memory of 2056 3120 hbnbtn.exe 105 PID 3120 wrote to memory of 2056 3120 hbnbtn.exe 105 PID 2056 wrote to memory of 3216 2056 3vvjp.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\59f472db4e131e4e644497840a1d2c0fea1557dab2de620e0d6f437b90d4d964.exe"C:\Users\Admin\AppData\Local\Temp\59f472db4e131e4e644497840a1d2c0fea1557dab2de620e0d6f437b90d4d964.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\frxrxrx.exec:\frxrxrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\hnhbnn.exec:\hnhbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\nntbht.exec:\nntbht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\fxxrlrl.exec:\fxxrlrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\1hbbbt.exec:\1hbbbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\ppvpd.exec:\ppvpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\rfxlxrf.exec:\rfxlxrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\fxfxxrf.exec:\fxfxxrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\hhhbtt.exec:\hhhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\pjvjv.exec:\pjvjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\xxxxrlf.exec:\xxxxrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\htbtnn.exec:\htbtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\1vdvp.exec:\1vdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\vpdvj.exec:\vpdvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\lrrxxfr.exec:\lrrxxfr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\nbnthb.exec:\nbnthb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\vjjdv.exec:\vjjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\5vpdj.exec:\5vpdj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\hbnbtn.exec:\hbnbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\3vvjp.exec:\3vvjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\rrfxlfx.exec:\rrfxlfx.exe23⤵
- Executes dropped EXE
PID:3216 -
\??\c:\nbhbnh.exec:\nbhbnh.exe24⤵
- Executes dropped EXE
PID:4696 -
\??\c:\bnnhtn.exec:\bnnhtn.exe25⤵
- Executes dropped EXE
PID:1432 -
\??\c:\dvjdp.exec:\dvjdp.exe26⤵
- Executes dropped EXE
PID:3724 -
\??\c:\rxflfxl.exec:\rxflfxl.exe27⤵
- Executes dropped EXE
PID:4624 -
\??\c:\thbttn.exec:\thbttn.exe28⤵
- Executes dropped EXE
PID:4012 -
\??\c:\tbbhth.exec:\tbbhth.exe29⤵
- Executes dropped EXE
PID:4792 -
\??\c:\vvjjd.exec:\vvjjd.exe30⤵
- Executes dropped EXE
PID:3432 -
\??\c:\xffrffr.exec:\xffrffr.exe31⤵
- Executes dropped EXE
PID:3204 -
\??\c:\5nnhbh.exec:\5nnhbh.exe32⤵
- Executes dropped EXE
PID:2992 -
\??\c:\hhhthh.exec:\hhhthh.exe33⤵
- Executes dropped EXE
PID:1332 -
\??\c:\vjpdp.exec:\vjpdp.exe34⤵
- Executes dropped EXE
PID:4752 -
\??\c:\lrfxfrf.exec:\lrfxfrf.exe35⤵
- Executes dropped EXE
PID:2984 -
\??\c:\bnnnbt.exec:\bnnnbt.exe36⤵PID:4428
-
\??\c:\3bnhtn.exec:\3bnhtn.exe37⤵
- Executes dropped EXE
PID:3940 -
\??\c:\7djdv.exec:\7djdv.exe38⤵
- Executes dropped EXE
PID:932 -
\??\c:\1dvvd.exec:\1dvvd.exe39⤵
- Executes dropped EXE
PID:1008 -
\??\c:\fxfxlfr.exec:\fxfxlfr.exe40⤵
- Executes dropped EXE
PID:2764 -
\??\c:\ttthth.exec:\ttthth.exe41⤵
- Executes dropped EXE
PID:3840 -
\??\c:\9djdv.exec:\9djdv.exe42⤵
- Executes dropped EXE
PID:4184 -
\??\c:\jvvjj.exec:\jvvjj.exe43⤵
- Executes dropped EXE
PID:3988 -
\??\c:\3rrlxrl.exec:\3rrlxrl.exe44⤵
- Executes dropped EXE
PID:4952 -
\??\c:\bntbbh.exec:\bntbbh.exe45⤵
- Executes dropped EXE
PID:1940 -
\??\c:\tnthht.exec:\tnthht.exe46⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dvjdv.exec:\dvjdv.exe47⤵
- Executes dropped EXE
PID:4856 -
\??\c:\frfffxf.exec:\frfffxf.exe48⤵
- Executes dropped EXE
PID:3932 -
\??\c:\nbbthb.exec:\nbbthb.exe49⤵
- Executes dropped EXE
PID:3356 -
\??\c:\hbttnn.exec:\hbttnn.exe50⤵
- Executes dropped EXE
PID:3960 -
\??\c:\dvpjv.exec:\dvpjv.exe51⤵
- Executes dropped EXE
PID:1260 -
\??\c:\ffrxrll.exec:\ffrxrll.exe52⤵
- Executes dropped EXE
PID:1264 -
\??\c:\3btnbh.exec:\3btnbh.exe53⤵
- Executes dropped EXE
PID:980 -
\??\c:\bnthbn.exec:\bnthbn.exe54⤵
- Executes dropped EXE
PID:5080 -
\??\c:\pdvvv.exec:\pdvvv.exe55⤵
- Executes dropped EXE
PID:4996 -
\??\c:\lrxlffx.exec:\lrxlffx.exe56⤵
- Executes dropped EXE
PID:3584 -
\??\c:\lrrrlxr.exec:\lrrrlxr.exe57⤵
- Executes dropped EXE
PID:3484 -
\??\c:\nhbhth.exec:\nhbhth.exe58⤵
- Executes dropped EXE
PID:4860 -
\??\c:\vpvpd.exec:\vpvpd.exe59⤵
- Executes dropped EXE
PID:3644 -
\??\c:\lxfrfxr.exec:\lxfrfxr.exe60⤵
- Executes dropped EXE
PID:3652 -
\??\c:\xlrlxrl.exec:\xlrlxrl.exe61⤵
- Executes dropped EXE
PID:4364 -
\??\c:\bbbthb.exec:\bbbthb.exe62⤵
- Executes dropped EXE
PID:4620 -
\??\c:\tttnbt.exec:\tttnbt.exe63⤵
- Executes dropped EXE
PID:3144 -
\??\c:\jjjdp.exec:\jjjdp.exe64⤵
- Executes dropped EXE
PID:4528 -
\??\c:\rxxfxxx.exec:\rxxfxxx.exe65⤵
- Executes dropped EXE
PID:1464 -
\??\c:\lflrlxx.exec:\lflrlxx.exe66⤵
- Executes dropped EXE
PID:924 -
\??\c:\htnhbb.exec:\htnhbb.exe67⤵PID:1552
-
\??\c:\3djvd.exec:\3djvd.exe68⤵PID:2260
-
\??\c:\1ffrflf.exec:\1ffrflf.exe69⤵PID:3044
-
\??\c:\tbtbbb.exec:\tbtbbb.exe70⤵PID:1948
-
\??\c:\1tbtbn.exec:\1tbtbn.exe71⤵PID:3112
-
\??\c:\pvpjp.exec:\pvpjp.exe72⤵PID:1624
-
\??\c:\frxrlxf.exec:\frxrlxf.exe73⤵PID:4872
-
\??\c:\nhnbnn.exec:\nhnbnn.exe74⤵PID:3092
-
\??\c:\hhhbnt.exec:\hhhbnt.exe75⤵PID:3108
-
\??\c:\dvppj.exec:\dvppj.exe76⤵PID:2068
-
\??\c:\pvvjv.exec:\pvvjv.exe77⤵PID:4820
-
\??\c:\rxlxlfx.exec:\rxlxlfx.exe78⤵PID:116
-
\??\c:\tbnhnh.exec:\tbnhnh.exe79⤵PID:2848
-
\??\c:\3tbthh.exec:\3tbthh.exe80⤵PID:4036
-
\??\c:\9nhnht.exec:\9nhnht.exe81⤵PID:1900
-
\??\c:\dvvpj.exec:\dvvpj.exe82⤵PID:4376
-
\??\c:\xlfxlfx.exec:\xlfxlfx.exe83⤵PID:556
-
\??\c:\3llxlfx.exec:\3llxlfx.exe84⤵PID:4428
-
\??\c:\9thbbt.exec:\9thbbt.exe85⤵PID:3940
-
\??\c:\9nhbtt.exec:\9nhbtt.exe86⤵PID:884
-
\??\c:\vvpjj.exec:\vvpjj.exe87⤵PID:1008
-
\??\c:\lrlxrlx.exec:\lrlxrlx.exe88⤵PID:1628
-
\??\c:\7xlllxx.exec:\7xlllxx.exe89⤵PID:3344
-
\??\c:\bbbtnh.exec:\bbbtnh.exe90⤵PID:4920
-
\??\c:\9vvdv.exec:\9vvdv.exe91⤵PID:3988
-
\??\c:\ddvjp.exec:\ddvjp.exe92⤵PID:4952
-
\??\c:\frlfxrl.exec:\frlfxrl.exe93⤵PID:4816
-
\??\c:\nbbhht.exec:\nbbhht.exe94⤵PID:2940
-
\??\c:\vvppj.exec:\vvppj.exe95⤵PID:4856
-
\??\c:\1vvjv.exec:\1vvjv.exe96⤵PID:2004
-
\??\c:\xxxlflf.exec:\xxxlflf.exe97⤵PID:3356
-
\??\c:\xrrxrxf.exec:\xrrxrxf.exe98⤵PID:3588
-
\??\c:\5bbbtn.exec:\5bbbtn.exe99⤵PID:4100
-
\??\c:\jjpjv.exec:\jjpjv.exe100⤵PID:4212
-
\??\c:\vdvvv.exec:\vdvvv.exe101⤵PID:2644
-
\??\c:\frlrffx.exec:\frlrffx.exe102⤵PID:5096
-
\??\c:\vjvvj.exec:\vjvvj.exe103⤵PID:4468
-
\??\c:\llrrllr.exec:\llrrllr.exe104⤵PID:668
-
\??\c:\lffxxrx.exec:\lffxxrx.exe105⤵PID:4976
-
\??\c:\tnbnbh.exec:\tnbnbh.exe106⤵PID:2076
-
\??\c:\1vvjv.exec:\1vvjv.exe107⤵PID:5092
-
\??\c:\pjdvd.exec:\pjdvd.exe108⤵PID:3704
-
\??\c:\rfrxrlf.exec:\rfrxrlf.exe109⤵PID:1100
-
\??\c:\9htnbb.exec:\9htnbb.exe110⤵PID:3864
-
\??\c:\nbbnbb.exec:\nbbnbb.exe111⤵PID:3952
-
\??\c:\pjdpp.exec:\pjdpp.exe112⤵PID:1612
-
\??\c:\jjppv.exec:\jjppv.exe113⤵PID:2608
-
\??\c:\rlllxxx.exec:\rlllxxx.exe114⤵PID:1560
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe115⤵PID:1804
-
\??\c:\hhbnnb.exec:\hhbnnb.exe116⤵PID:1268
-
\??\c:\pvvjv.exec:\pvvjv.exe117⤵PID:1432
-
\??\c:\pppdv.exec:\pppdv.exe118⤵PID:2424
-
\??\c:\flrrfrx.exec:\flrrfrx.exe119⤵PID:4460
-
\??\c:\7tnntt.exec:\7tnntt.exe120⤵PID:1416
-
\??\c:\vjdvp.exec:\vjdvp.exe121⤵PID:4796
-
\??\c:\llllfff.exec:\llllfff.exe122⤵PID:5012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-