Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2024 04:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6f8d2ec8f015ebf2ffd47a5661b883a0N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
6f8d2ec8f015ebf2ffd47a5661b883a0N.exe
-
Size
64KB
-
MD5
6f8d2ec8f015ebf2ffd47a5661b883a0
-
SHA1
85dbcc238069a0ffa892167b9e71fe66d4c962eb
-
SHA256
d93e9ea22c67c8a0d974c435e5aac21679247d607fa54eb8cb2831aca08bf0c2
-
SHA512
167f7e1f6ed61d5123aa4687c4a26dd5efaa660ca3513570fb72677cc024bd9a0683c5ec300e6539a7a7f8615e0c646deb859c9bf7ddd5e54ed07c0674f87fa0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27Cz:ymb3NkkiQ3mdBjFI9jz
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/4712-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1264-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/924-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1324-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1728-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/992-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2708-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 640 3dvjd.exe 4204 ddpjv.exe 1264 9lrflll.exe 3960 tbhtnh.exe 924 nbnhhb.exe 3256 pppjj.exe 4904 5hbnhb.exe 396 vpjvp.exe 3028 vdpdv.exe 3168 lfrlxxr.exe 3728 flxrffx.exe 2904 nhnbnh.exe 1324 vpjdp.exe 2640 llrlxfr.exe 1880 7flfffx.exe 1728 1hhbtn.exe 2052 9jpjv.exe 2352 pjpjj.exe 2128 5xlrxxr.exe 2960 1rxrlfx.exe 992 nbhbtn.exe 5040 vdvjv.exe 2028 pdjdv.exe 464 lrfrfrx.exe 2708 xxxrlrl.exe 3060 7htnbb.exe 4608 ppvdj.exe 5036 jpdjj.exe 408 llxxxff.exe 5116 bhnbnh.exe 2324 nhbnbt.exe 4296 vpjpv.exe 2356 dvvjp.exe 4236 1fxrfxl.exe 2844 frrfrlf.exe 4848 9bbhtt.exe 3520 5bbnbt.exe 1016 5pjpd.exe 4980 pjvjv.exe 2668 9rlfxxr.exe 2712 frlfrlf.exe 5104 9hhtht.exe 4204 1nnhhb.exe 1264 tttnhb.exe 3524 vddvd.exe 824 vjdvd.exe 924 pppdp.exe 844 lfrrflf.exe 832 lxxrlfx.exe 3340 hnnhbt.exe 368 bhhtbt.exe 3932 jdddp.exe 3028 jvvjd.exe 1640 lxrlxrl.exe 2628 hnhtnh.exe 4836 hbthnh.exe 2904 5bthnh.exe 4800 vdpdj.exe 2836 vpjdp.exe 3108 xrxlxfr.exe 908 lfrlfxr.exe 1276 1nnhtt.exe 4892 3nnhtn.exe 4864 pjpdd.exe -
resource yara_rule behavioral2/memory/4712-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1264-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/924-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2640-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/992-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2708-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4712 wrote to memory of 640 4712 6f8d2ec8f015ebf2ffd47a5661b883a0N.exe 85 PID 4712 wrote to memory of 640 4712 6f8d2ec8f015ebf2ffd47a5661b883a0N.exe 85 PID 4712 wrote to memory of 640 4712 6f8d2ec8f015ebf2ffd47a5661b883a0N.exe 85 PID 640 wrote to memory of 4204 640 3dvjd.exe 86 PID 640 wrote to memory of 4204 640 3dvjd.exe 86 PID 640 wrote to memory of 4204 640 3dvjd.exe 86 PID 4204 wrote to memory of 1264 4204 ddpjv.exe 87 PID 4204 wrote to memory of 1264 4204 ddpjv.exe 87 PID 4204 wrote to memory of 1264 4204 ddpjv.exe 87 PID 1264 wrote to memory of 3960 1264 9lrflll.exe 88 PID 1264 wrote to memory of 3960 1264 9lrflll.exe 88 PID 1264 wrote to memory of 3960 1264 9lrflll.exe 88 PID 3960 wrote to memory of 924 3960 tbhtnh.exe 89 PID 3960 wrote to memory of 924 3960 tbhtnh.exe 89 PID 3960 wrote to memory of 924 3960 tbhtnh.exe 89 PID 924 wrote to memory of 3256 924 nbnhhb.exe 90 PID 924 wrote to memory of 3256 924 nbnhhb.exe 90 PID 924 wrote to memory of 3256 924 nbnhhb.exe 90 PID 3256 wrote to memory of 4904 3256 pppjj.exe 92 PID 3256 wrote to memory of 4904 3256 pppjj.exe 92 PID 3256 wrote to memory of 4904 3256 pppjj.exe 92 PID 4904 wrote to memory of 396 4904 5hbnhb.exe 93 PID 4904 wrote to memory of 396 4904 5hbnhb.exe 93 PID 4904 wrote to memory of 396 4904 5hbnhb.exe 93 PID 396 wrote to memory of 3028 396 vpjvp.exe 94 PID 396 wrote to memory of 3028 396 vpjvp.exe 94 PID 396 wrote to memory of 3028 396 vpjvp.exe 94 PID 3028 wrote to memory of 3168 3028 vdpdv.exe 96 PID 3028 wrote to memory of 3168 3028 vdpdv.exe 96 PID 3028 wrote to memory of 3168 3028 vdpdv.exe 96 PID 3168 wrote to memory of 3728 3168 lfrlxxr.exe 97 PID 3168 wrote to memory of 3728 3168 lfrlxxr.exe 97 PID 3168 wrote to memory of 3728 3168 lfrlxxr.exe 97 PID 3728 wrote to memory of 2904 3728 flxrffx.exe 98 PID 3728 wrote to memory of 2904 3728 flxrffx.exe 98 PID 3728 wrote to memory of 2904 3728 flxrffx.exe 98 PID 2904 wrote to memory of 1324 2904 nhnbnh.exe 99 PID 2904 wrote to memory of 1324 2904 nhnbnh.exe 99 PID 2904 wrote to memory of 1324 2904 nhnbnh.exe 99 PID 1324 wrote to memory of 2640 1324 vpjdp.exe 100 PID 1324 wrote to memory of 2640 1324 vpjdp.exe 100 PID 1324 wrote to memory of 2640 1324 vpjdp.exe 100 PID 2640 wrote to memory of 1880 2640 llrlxfr.exe 101 PID 2640 wrote to memory of 1880 2640 llrlxfr.exe 101 PID 2640 wrote to memory of 1880 2640 llrlxfr.exe 101 PID 1880 wrote to memory of 1728 1880 7flfffx.exe 102 PID 1880 wrote to memory of 1728 1880 7flfffx.exe 102 PID 1880 wrote to memory of 1728 1880 7flfffx.exe 102 PID 1728 wrote to memory of 2052 1728 1hhbtn.exe 103 PID 1728 wrote to memory of 2052 1728 1hhbtn.exe 103 PID 1728 wrote to memory of 2052 1728 1hhbtn.exe 103 PID 2052 wrote to memory of 2352 2052 9jpjv.exe 104 PID 2052 wrote to memory of 2352 2052 9jpjv.exe 104 PID 2052 wrote to memory of 2352 2052 9jpjv.exe 104 PID 2352 wrote to memory of 2128 2352 pjpjj.exe 105 PID 2352 wrote to memory of 2128 2352 pjpjj.exe 105 PID 2352 wrote to memory of 2128 2352 pjpjj.exe 105 PID 2128 wrote to memory of 2960 2128 5xlrxxr.exe 106 PID 2128 wrote to memory of 2960 2128 5xlrxxr.exe 106 PID 2128 wrote to memory of 2960 2128 5xlrxxr.exe 106 PID 2960 wrote to memory of 992 2960 1rxrlfx.exe 107 PID 2960 wrote to memory of 992 2960 1rxrlfx.exe 107 PID 2960 wrote to memory of 992 2960 1rxrlfx.exe 107 PID 992 wrote to memory of 5040 992 nbhbtn.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f8d2ec8f015ebf2ffd47a5661b883a0N.exe"C:\Users\Admin\AppData\Local\Temp\6f8d2ec8f015ebf2ffd47a5661b883a0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\3dvjd.exec:\3dvjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\ddpjv.exec:\ddpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\9lrflll.exec:\9lrflll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\tbhtnh.exec:\tbhtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\nbnhhb.exec:\nbnhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\pppjj.exec:\pppjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\5hbnhb.exec:\5hbnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\vpjvp.exec:\vpjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\vdpdv.exec:\vdpdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\lfrlxxr.exec:\lfrlxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\flxrffx.exec:\flxrffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\nhnbnh.exec:\nhnbnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\vpjdp.exec:\vpjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\llrlxfr.exec:\llrlxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\7flfffx.exec:\7flfffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\1hhbtn.exec:\1hhbtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\9jpjv.exec:\9jpjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\pjpjj.exec:\pjpjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\5xlrxxr.exec:\5xlrxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\1rxrlfx.exec:\1rxrlfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\nbhbtn.exec:\nbhbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\vdvjv.exec:\vdvjv.exe23⤵
- Executes dropped EXE
PID:5040 -
\??\c:\pdjdv.exec:\pdjdv.exe24⤵
- Executes dropped EXE
PID:2028 -
\??\c:\lrfrfrx.exec:\lrfrfrx.exe25⤵
- Executes dropped EXE
PID:464 -
\??\c:\xxxrlrl.exec:\xxxrlrl.exe26⤵
- Executes dropped EXE
PID:2708 -
\??\c:\7htnbb.exec:\7htnbb.exe27⤵
- Executes dropped EXE
PID:3060 -
\??\c:\ppvdj.exec:\ppvdj.exe28⤵
- Executes dropped EXE
PID:4608 -
\??\c:\jpdjj.exec:\jpdjj.exe29⤵
- Executes dropped EXE
PID:5036 -
\??\c:\llxxxff.exec:\llxxxff.exe30⤵
- Executes dropped EXE
PID:408 -
\??\c:\bhnbnh.exec:\bhnbnh.exe31⤵
- Executes dropped EXE
PID:5116 -
\??\c:\nhbnbt.exec:\nhbnbt.exe32⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vpjpv.exec:\vpjpv.exe33⤵
- Executes dropped EXE
PID:4296 -
\??\c:\dvvjp.exec:\dvvjp.exe34⤵
- Executes dropped EXE
PID:2356 -
\??\c:\1fxrfxl.exec:\1fxrfxl.exe35⤵
- Executes dropped EXE
PID:4236 -
\??\c:\frrfrlf.exec:\frrfrlf.exe36⤵
- Executes dropped EXE
PID:2844 -
\??\c:\9bbhtt.exec:\9bbhtt.exe37⤵
- Executes dropped EXE
PID:4848 -
\??\c:\5bbnbt.exec:\5bbnbt.exe38⤵
- Executes dropped EXE
PID:3520 -
\??\c:\5pjpd.exec:\5pjpd.exe39⤵
- Executes dropped EXE
PID:1016 -
\??\c:\pjvjv.exec:\pjvjv.exe40⤵
- Executes dropped EXE
PID:4980 -
\??\c:\9rlfxxr.exec:\9rlfxxr.exe41⤵
- Executes dropped EXE
PID:2668 -
\??\c:\frlfrlf.exec:\frlfrlf.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\9hhtht.exec:\9hhtht.exe43⤵
- Executes dropped EXE
PID:5104 -
\??\c:\1nnhhb.exec:\1nnhhb.exe44⤵
- Executes dropped EXE
PID:4204 -
\??\c:\tttnhb.exec:\tttnhb.exe45⤵
- Executes dropped EXE
PID:1264 -
\??\c:\vddvd.exec:\vddvd.exe46⤵
- Executes dropped EXE
PID:3524 -
\??\c:\vjdvd.exec:\vjdvd.exe47⤵
- Executes dropped EXE
PID:824 -
\??\c:\pppdp.exec:\pppdp.exe48⤵
- Executes dropped EXE
PID:924 -
\??\c:\lfrrflf.exec:\lfrrflf.exe49⤵
- Executes dropped EXE
PID:844 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe50⤵
- Executes dropped EXE
PID:832 -
\??\c:\hnnhbt.exec:\hnnhbt.exe51⤵
- Executes dropped EXE
PID:3340 -
\??\c:\bhhtbt.exec:\bhhtbt.exe52⤵
- Executes dropped EXE
PID:368 -
\??\c:\jdddp.exec:\jdddp.exe53⤵
- Executes dropped EXE
PID:3932 -
\??\c:\jvvjd.exec:\jvvjd.exe54⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lxrlxrl.exec:\lxrlxrl.exe55⤵
- Executes dropped EXE
PID:1640 -
\??\c:\hnhtnh.exec:\hnhtnh.exe56⤵
- Executes dropped EXE
PID:2628 -
\??\c:\hbthnh.exec:\hbthnh.exe57⤵
- Executes dropped EXE
PID:4836 -
\??\c:\5bthnh.exec:\5bthnh.exe58⤵
- Executes dropped EXE
PID:2904 -
\??\c:\vdpdj.exec:\vdpdj.exe59⤵
- Executes dropped EXE
PID:4800 -
\??\c:\vpjdp.exec:\vpjdp.exe60⤵
- Executes dropped EXE
PID:2836 -
\??\c:\xrxlxfr.exec:\xrxlxfr.exe61⤵
- Executes dropped EXE
PID:3108 -
\??\c:\lfrlfxr.exec:\lfrlfxr.exe62⤵
- Executes dropped EXE
PID:908 -
\??\c:\1nnhtt.exec:\1nnhtt.exe63⤵
- Executes dropped EXE
PID:1276 -
\??\c:\3nnhtn.exec:\3nnhtn.exe64⤵
- Executes dropped EXE
PID:4892 -
\??\c:\pjpdd.exec:\pjpdd.exe65⤵
- Executes dropped EXE
PID:4864 -
\??\c:\vvvjp.exec:\vvvjp.exe66⤵PID:1224
-
\??\c:\9jdvp.exec:\9jdvp.exe67⤵PID:4900
-
\??\c:\3rllffx.exec:\3rllffx.exe68⤵PID:1148
-
\??\c:\fllfllf.exec:\fllfllf.exe69⤵PID:1908
-
\??\c:\nbthtn.exec:\nbthtn.exe70⤵PID:2960
-
\??\c:\7nntbt.exec:\7nntbt.exe71⤵PID:1816
-
\??\c:\9dvjv.exec:\9dvjv.exe72⤵PID:3304
-
\??\c:\lxlrlff.exec:\lxlrlff.exe73⤵PID:1712
-
\??\c:\xxffrlr.exec:\xxffrlr.exe74⤵PID:684
-
\??\c:\1bhbhb.exec:\1bhbhb.exe75⤵PID:904
-
\??\c:\nbhtnh.exec:\nbhtnh.exe76⤵PID:1448
-
\??\c:\9vjvp.exec:\9vjvp.exe77⤵PID:4508
-
\??\c:\dvdpd.exec:\dvdpd.exe78⤵PID:1812
-
\??\c:\7rxxlrf.exec:\7rxxlrf.exe79⤵PID:2012
-
\??\c:\1nhtnh.exec:\1nhtnh.exe80⤵PID:4816
-
\??\c:\tnbbnt.exec:\tnbbnt.exe81⤵PID:5084
-
\??\c:\dvpjv.exec:\dvpjv.exe82⤵PID:3128
-
\??\c:\7vvjv.exec:\7vvjv.exe83⤵PID:3588
-
\??\c:\3xxrlfr.exec:\3xxrlfr.exe84⤵PID:5024
-
\??\c:\lrrfxlf.exec:\lrrfxlf.exe85⤵PID:3984
-
\??\c:\1nnthb.exec:\1nnthb.exe86⤵PID:4956
-
\??\c:\nhhtbb.exec:\nhhtbb.exe87⤵PID:2144
-
\??\c:\jvjjd.exec:\jvjjd.exe88⤵PID:4292
-
\??\c:\5fflfrf.exec:\5fflfrf.exe89⤵PID:4176
-
\??\c:\bnnnhb.exec:\bnnnhb.exe90⤵PID:4256
-
\??\c:\tbbhnh.exec:\tbbhnh.exe91⤵PID:4272
-
\??\c:\7dpdp.exec:\7dpdp.exe92⤵PID:2672
-
\??\c:\rrrflfx.exec:\rrrflfx.exe93⤵PID:964
-
\??\c:\lfffxrf.exec:\lfffxrf.exe94⤵PID:3016
-
\??\c:\fxlxrfx.exec:\fxlxrfx.exe95⤵PID:2436
-
\??\c:\3hhbtt.exec:\3hhbtt.exe96⤵PID:1892
-
\??\c:\7ffrllx.exec:\7ffrllx.exe97⤵PID:2880
-
\??\c:\xlflxfr.exec:\xlflxfr.exe98⤵PID:1928
-
\??\c:\bhhbnh.exec:\bhhbnh.exe99⤵PID:1204
-
\??\c:\1tthnn.exec:\1tthnn.exe100⤵PID:1048
-
\??\c:\nttbht.exec:\nttbht.exe101⤵PID:1404
-
\??\c:\jdvpd.exec:\jdvpd.exe102⤵PID:3648
-
\??\c:\xrffllf.exec:\xrffllf.exe103⤵PID:4624
-
\??\c:\xllxrlf.exec:\xllxrlf.exe104⤵PID:3744
-
\??\c:\hbhtbt.exec:\hbhtbt.exe105⤵PID:4444
-
\??\c:\pppvd.exec:\pppvd.exe106⤵PID:2000
-
\??\c:\9lrfrll.exec:\9lrfrll.exe107⤵PID:4576
-
\??\c:\btthtn.exec:\btthtn.exe108⤵PID:2040
-
\??\c:\bnthbt.exec:\bnthbt.exe109⤵PID:4408
-
\??\c:\dvjdv.exec:\dvjdv.exe110⤵PID:1324
-
\??\c:\fffrfxl.exec:\fffrfxl.exe111⤵PID:4084
-
\??\c:\1nnhnh.exec:\1nnhnh.exe112⤵PID:2632
-
\??\c:\btnhbb.exec:\btnhbb.exe113⤵PID:3096
-
\??\c:\djvpd.exec:\djvpd.exe114⤵PID:1348
-
\??\c:\3fxxrxl.exec:\3fxxrxl.exe115⤵PID:2052
-
\??\c:\1hnbnh.exec:\1hnbnh.exe116⤵PID:4620
-
\??\c:\nhnhtn.exec:\nhnhtn.exe117⤵PID:2352
-
\??\c:\5ppdd.exec:\5ppdd.exe118⤵PID:3404
-
\??\c:\dpjvv.exec:\dpjvv.exe119⤵PID:1760
-
\??\c:\xflfxfx.exec:\xflfxfx.exe120⤵PID:4744
-
\??\c:\bbtbtb.exec:\bbtbtb.exe121⤵PID:1424
-
\??\c:\tnttbn.exec:\tnttbn.exe122⤵PID:5040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-