Analysis
-
max time kernel
120s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 03:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
69cb80d5a3db78996cbef0e7f86182a92e689f3d8d964b244ed0a596fe385cb2N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
69cb80d5a3db78996cbef0e7f86182a92e689f3d8d964b244ed0a596fe385cb2N.exe
-
Size
593KB
-
MD5
4081cbe3e7376ce450e2802b823fd6b0
-
SHA1
7e677856ae40d735168aa79bbfdc4edbb47873a9
-
SHA256
69cb80d5a3db78996cbef0e7f86182a92e689f3d8d964b244ed0a596fe385cb2
-
SHA512
4024219d4520e9868527d7cba962a53ee011e2ef753119649b4e52a6c04766e6f055bf627ba9f2560178af3aecc016e1efa8b52ffec4152f07163b7e189491d2
-
SSDEEP
6144:n3C9BRIj+ebjcSbcY+CaQdaFOY4iGFYtRdzzoyYxJAyfgayL6:n3C9Lebz+xt4vFeFmgay+
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2660-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2660-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1012-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1344-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/960-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3300 pvvvp.exe 1012 xflfxxr.exe 2400 nbnbbb.exe 2668 pppvj.exe 4508 5flfxxr.exe 2244 tnnbhh.exe 3636 jdjdv.exe 1344 flxxrrl.exe 4040 nnnnnh.exe 4752 pjjjd.exe 4936 flxrlll.exe 2212 rxxxfxr.exe 264 tbhtnn.exe 3916 7vvvj.exe 3448 tttnhh.exe 960 5fxxrlx.exe 1272 ddpjd.exe 400 ntbbth.exe 2224 1thbnn.exe 2856 9ntnbb.exe 368 rrlrrxr.exe 3384 tnnhhh.exe 3388 fffxrll.exe 1580 5jpjv.exe 1280 frxrffl.exe 1424 lrxrllf.exe 1060 tbhttn.exe 5044 flrlxxr.exe 1668 hnbhth.exe 3528 rxlfllr.exe 4544 lffxrrl.exe 2532 5pvpj.exe 4520 7xfxfff.exe 4756 jvjjd.exe 3524 5frlfxr.exe 1404 hhbbnn.exe 5088 bhnhnh.exe 3660 jjjdp.exe 3504 rffxffx.exe 4880 hhhbtt.exe 924 tntthh.exe 3176 pppjd.exe 4480 rffxrrx.exe 660 bbnhbh.exe 3840 ppjjv.exe 4372 xrllxxr.exe 4964 7hhnbh.exe 2660 dvpvp.exe 2236 xllfrlx.exe 1360 hhnbhn.exe 3764 1pppd.exe 684 xrrlxxr.exe 4012 5xlfrrr.exe 5032 5hbbbb.exe 3152 pvdvj.exe 4460 xllfxxx.exe 748 5btnhn.exe 2720 pvddv.exe 5004 rfxxrlf.exe 4724 1ntnnn.exe 4936 tbtbbb.exe 2908 ddvpv.exe 1076 1rfxffx.exe 2560 hnhbtt.exe -
resource yara_rule behavioral2/memory/2660-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2660-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1012-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1344-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/960-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3flfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2660 wrote to memory of 3300 2660 69cb80d5a3db78996cbef0e7f86182a92e689f3d8d964b244ed0a596fe385cb2N.exe 82 PID 2660 wrote to memory of 3300 2660 69cb80d5a3db78996cbef0e7f86182a92e689f3d8d964b244ed0a596fe385cb2N.exe 82 PID 2660 wrote to memory of 3300 2660 69cb80d5a3db78996cbef0e7f86182a92e689f3d8d964b244ed0a596fe385cb2N.exe 82 PID 3300 wrote to memory of 1012 3300 pvvvp.exe 83 PID 3300 wrote to memory of 1012 3300 pvvvp.exe 83 PID 3300 wrote to memory of 1012 3300 pvvvp.exe 83 PID 1012 wrote to memory of 2400 1012 xflfxxr.exe 84 PID 1012 wrote to memory of 2400 1012 xflfxxr.exe 84 PID 1012 wrote to memory of 2400 1012 xflfxxr.exe 84 PID 2400 wrote to memory of 2668 2400 nbnbbb.exe 85 PID 2400 wrote to memory of 2668 2400 nbnbbb.exe 85 PID 2400 wrote to memory of 2668 2400 nbnbbb.exe 85 PID 2668 wrote to memory of 4508 2668 pppvj.exe 86 PID 2668 wrote to memory of 4508 2668 pppvj.exe 86 PID 2668 wrote to memory of 4508 2668 pppvj.exe 86 PID 4508 wrote to memory of 2244 4508 5flfxxr.exe 87 PID 4508 wrote to memory of 2244 4508 5flfxxr.exe 87 PID 4508 wrote to memory of 2244 4508 5flfxxr.exe 87 PID 2244 wrote to memory of 3636 2244 tnnbhh.exe 88 PID 2244 wrote to memory of 3636 2244 tnnbhh.exe 88 PID 2244 wrote to memory of 3636 2244 tnnbhh.exe 88 PID 3636 wrote to memory of 1344 3636 jdjdv.exe 89 PID 3636 wrote to memory of 1344 3636 jdjdv.exe 89 PID 3636 wrote to memory of 1344 3636 jdjdv.exe 89 PID 1344 wrote to memory of 4040 1344 flxxrrl.exe 90 PID 1344 wrote to memory of 4040 1344 flxxrrl.exe 90 PID 1344 wrote to memory of 4040 1344 flxxrrl.exe 90 PID 4040 wrote to memory of 4752 4040 nnnnnh.exe 91 PID 4040 wrote to memory of 4752 4040 nnnnnh.exe 91 PID 4040 wrote to memory of 4752 4040 nnnnnh.exe 91 PID 4752 wrote to memory of 4936 4752 pjjjd.exe 92 PID 4752 wrote to memory of 4936 4752 pjjjd.exe 92 PID 4752 wrote to memory of 4936 4752 pjjjd.exe 92 PID 4936 wrote to memory of 2212 4936 flxrlll.exe 93 PID 4936 wrote to memory of 2212 4936 flxrlll.exe 93 PID 4936 wrote to memory of 2212 4936 flxrlll.exe 93 PID 2212 wrote to memory of 264 2212 rxxxfxr.exe 94 PID 2212 wrote to memory of 264 2212 rxxxfxr.exe 94 PID 2212 wrote to memory of 264 2212 rxxxfxr.exe 94 PID 264 wrote to memory of 3916 264 tbhtnn.exe 95 PID 264 wrote to memory of 3916 264 tbhtnn.exe 95 PID 264 wrote to memory of 3916 264 tbhtnn.exe 95 PID 3916 wrote to memory of 3448 3916 7vvvj.exe 96 PID 3916 wrote to memory of 3448 3916 7vvvj.exe 96 PID 3916 wrote to memory of 3448 3916 7vvvj.exe 96 PID 3448 wrote to memory of 960 3448 tttnhh.exe 97 PID 3448 wrote to memory of 960 3448 tttnhh.exe 97 PID 3448 wrote to memory of 960 3448 tttnhh.exe 97 PID 960 wrote to memory of 1272 960 5fxxrlx.exe 98 PID 960 wrote to memory of 1272 960 5fxxrlx.exe 98 PID 960 wrote to memory of 1272 960 5fxxrlx.exe 98 PID 1272 wrote to memory of 400 1272 ddpjd.exe 99 PID 1272 wrote to memory of 400 1272 ddpjd.exe 99 PID 1272 wrote to memory of 400 1272 ddpjd.exe 99 PID 400 wrote to memory of 2224 400 ntbbth.exe 100 PID 400 wrote to memory of 2224 400 ntbbth.exe 100 PID 400 wrote to memory of 2224 400 ntbbth.exe 100 PID 2224 wrote to memory of 2856 2224 1thbnn.exe 101 PID 2224 wrote to memory of 2856 2224 1thbnn.exe 101 PID 2224 wrote to memory of 2856 2224 1thbnn.exe 101 PID 2856 wrote to memory of 368 2856 9ntnbb.exe 102 PID 2856 wrote to memory of 368 2856 9ntnbb.exe 102 PID 2856 wrote to memory of 368 2856 9ntnbb.exe 102 PID 368 wrote to memory of 3384 368 rrlrrxr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\69cb80d5a3db78996cbef0e7f86182a92e689f3d8d964b244ed0a596fe385cb2N.exe"C:\Users\Admin\AppData\Local\Temp\69cb80d5a3db78996cbef0e7f86182a92e689f3d8d964b244ed0a596fe385cb2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\pvvvp.exec:\pvvvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\xflfxxr.exec:\xflfxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\nbnbbb.exec:\nbnbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\pppvj.exec:\pppvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\5flfxxr.exec:\5flfxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\tnnbhh.exec:\tnnbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\jdjdv.exec:\jdjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\flxxrrl.exec:\flxxrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\nnnnnh.exec:\nnnnnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\pjjjd.exec:\pjjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\flxrlll.exec:\flxrlll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\rxxxfxr.exec:\rxxxfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\tbhtnn.exec:\tbhtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\7vvvj.exec:\7vvvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\tttnhh.exec:\tttnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\5fxxrlx.exec:\5fxxrlx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\ddpjd.exec:\ddpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\ntbbth.exec:\ntbbth.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\1thbnn.exec:\1thbnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\9ntnbb.exec:\9ntnbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\rrlrrxr.exec:\rrlrrxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\tnnhhh.exec:\tnnhhh.exe23⤵
- Executes dropped EXE
PID:3384 -
\??\c:\fffxrll.exec:\fffxrll.exe24⤵
- Executes dropped EXE
PID:3388 -
\??\c:\5jpjv.exec:\5jpjv.exe25⤵
- Executes dropped EXE
PID:1580 -
\??\c:\frxrffl.exec:\frxrffl.exe26⤵
- Executes dropped EXE
PID:1280 -
\??\c:\lrxrllf.exec:\lrxrllf.exe27⤵
- Executes dropped EXE
PID:1424 -
\??\c:\tbhttn.exec:\tbhttn.exe28⤵
- Executes dropped EXE
PID:1060 -
\??\c:\flrlxxr.exec:\flrlxxr.exe29⤵
- Executes dropped EXE
PID:5044 -
\??\c:\hnbhth.exec:\hnbhth.exe30⤵
- Executes dropped EXE
PID:1668 -
\??\c:\rxlfllr.exec:\rxlfllr.exe31⤵
- Executes dropped EXE
PID:3528 -
\??\c:\lffxrrl.exec:\lffxrrl.exe32⤵
- Executes dropped EXE
PID:4544 -
\??\c:\5pvpj.exec:\5pvpj.exe33⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7xfxfff.exec:\7xfxfff.exe34⤵
- Executes dropped EXE
PID:4520 -
\??\c:\jvjjd.exec:\jvjjd.exe35⤵
- Executes dropped EXE
PID:4756 -
\??\c:\5frlfxr.exec:\5frlfxr.exe36⤵
- Executes dropped EXE
PID:3524 -
\??\c:\hhbbnn.exec:\hhbbnn.exe37⤵
- Executes dropped EXE
PID:1404 -
\??\c:\bhnhnh.exec:\bhnhnh.exe38⤵
- Executes dropped EXE
PID:5088 -
\??\c:\jjjdp.exec:\jjjdp.exe39⤵
- Executes dropped EXE
PID:3660 -
\??\c:\rffxffx.exec:\rffxffx.exe40⤵
- Executes dropped EXE
PID:3504 -
\??\c:\hhhbtt.exec:\hhhbtt.exe41⤵
- Executes dropped EXE
PID:4880 -
\??\c:\tntthh.exec:\tntthh.exe42⤵
- Executes dropped EXE
PID:924 -
\??\c:\pppjd.exec:\pppjd.exe43⤵
- Executes dropped EXE
PID:3176 -
\??\c:\rffxrrx.exec:\rffxrrx.exe44⤵
- Executes dropped EXE
PID:4480 -
\??\c:\bbnhbh.exec:\bbnhbh.exe45⤵
- Executes dropped EXE
PID:660 -
\??\c:\ppjjv.exec:\ppjjv.exe46⤵
- Executes dropped EXE
PID:3840 -
\??\c:\xrllxxr.exec:\xrllxxr.exe47⤵
- Executes dropped EXE
PID:4372 -
\??\c:\7hhnbh.exec:\7hhnbh.exe48⤵
- Executes dropped EXE
PID:4964 -
\??\c:\dvpvp.exec:\dvpvp.exe49⤵
- Executes dropped EXE
PID:2660 -
\??\c:\xllfrlx.exec:\xllfrlx.exe50⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hhnbhn.exec:\hhnbhn.exe51⤵
- Executes dropped EXE
PID:1360 -
\??\c:\1pppd.exec:\1pppd.exe52⤵
- Executes dropped EXE
PID:3764 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe53⤵
- Executes dropped EXE
PID:684 -
\??\c:\5xlfrrr.exec:\5xlfrrr.exe54⤵
- Executes dropped EXE
PID:4012 -
\??\c:\5hbbbb.exec:\5hbbbb.exe55⤵
- Executes dropped EXE
PID:5032 -
\??\c:\pvdvj.exec:\pvdvj.exe56⤵
- Executes dropped EXE
PID:3152 -
\??\c:\xllfxxx.exec:\xllfxxx.exe57⤵
- Executes dropped EXE
PID:4460 -
\??\c:\5btnhn.exec:\5btnhn.exe58⤵
- Executes dropped EXE
PID:748 -
\??\c:\pvddv.exec:\pvddv.exe59⤵
- Executes dropped EXE
PID:2720 -
\??\c:\rfxxrlf.exec:\rfxxrlf.exe60⤵
- Executes dropped EXE
PID:5004 -
\??\c:\1ntnnn.exec:\1ntnnn.exe61⤵
- Executes dropped EXE
PID:4724 -
\??\c:\tbtbbb.exec:\tbtbbb.exe62⤵
- Executes dropped EXE
PID:4936 -
\??\c:\ddvpv.exec:\ddvpv.exe63⤵
- Executes dropped EXE
PID:2908 -
\??\c:\1rfxffx.exec:\1rfxffx.exe64⤵
- Executes dropped EXE
PID:1076 -
\??\c:\hnhbtt.exec:\hnhbtt.exe65⤵
- Executes dropped EXE
PID:2560 -
\??\c:\vjpjd.exec:\vjpjd.exe66⤵PID:328
-
\??\c:\fxxxxrr.exec:\fxxxxrr.exe67⤵PID:4324
-
\??\c:\xllfxxr.exec:\xllfxxr.exe68⤵PID:3168
-
\??\c:\ntbbth.exec:\ntbbth.exe69⤵PID:4928
-
\??\c:\pjpvp.exec:\pjpvp.exe70⤵PID:2864
-
\??\c:\ppvjj.exec:\ppvjj.exe71⤵PID:2548
-
\??\c:\flrlffx.exec:\flrlffx.exe72⤵PID:1908
-
\??\c:\7dpjd.exec:\7dpjd.exe73⤵PID:3180
-
\??\c:\lxxxrrx.exec:\lxxxrrx.exe74⤵PID:1932
-
\??\c:\3bthbt.exec:\3bthbt.exe75⤵PID:1820
-
\??\c:\dddvj.exec:\dddvj.exe76⤵PID:1860
-
\??\c:\xffxrll.exec:\xffxrll.exe77⤵PID:1488
-
\??\c:\bbhbhh.exec:\bbhbhh.exe78⤵PID:2360
-
\??\c:\3pvpj.exec:\3pvpj.exe79⤵PID:3780
-
\??\c:\1lfxrfx.exec:\1lfxrfx.exe80⤵PID:1276
-
\??\c:\nbnhbt.exec:\nbnhbt.exe81⤵PID:1684
-
\??\c:\pddvp.exec:\pddvp.exe82⤵PID:1400
-
\??\c:\fxrfxrf.exec:\fxrfxrf.exe83⤵PID:3628
-
\??\c:\bhhbnn.exec:\bhhbnn.exe84⤵PID:2088
-
\??\c:\jvjdv.exec:\jvjdv.exe85⤵PID:2404
-
\??\c:\ddpjd.exec:\ddpjd.exe86⤵PID:844
-
\??\c:\xrrlffl.exec:\xrrlffl.exe87⤵PID:3692
-
\??\c:\ttnnhb.exec:\ttnnhb.exe88⤵PID:1792
-
\??\c:\dvdvv.exec:\dvdvv.exe89⤵PID:1204
-
\??\c:\5vvjd.exec:\5vvjd.exe90⤵PID:4456
-
\??\c:\rlffffl.exec:\rlffffl.exe91⤵PID:2692
-
\??\c:\hnhhbh.exec:\hnhhbh.exe92⤵PID:4516
-
\??\c:\dpvpj.exec:\dpvpj.exe93⤵PID:3924
-
\??\c:\dpvpj.exec:\dpvpj.exe94⤵PID:2364
-
\??\c:\lllfxrl.exec:\lllfxrl.exe95⤵PID:2248
-
\??\c:\tbbnht.exec:\tbbnht.exe96⤵PID:4464
-
\??\c:\pddvp.exec:\pddvp.exe97⤵PID:1100
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe98⤵PID:3540
-
\??\c:\tbhtnn.exec:\tbhtnn.exe99⤵PID:4312
-
\??\c:\hhhhbt.exec:\hhhhbt.exe100⤵PID:5060
-
\??\c:\5llfxlf.exec:\5llfxlf.exe101⤵PID:4352
-
\??\c:\ntbtbt.exec:\ntbtbt.exe102⤵PID:808
-
\??\c:\nbthnn.exec:\nbthnn.exe103⤵PID:3600
-
\??\c:\jjjdv.exec:\jjjdv.exe104⤵PID:3204
-
\??\c:\rxlfxxx.exec:\rxlfxxx.exe105⤵PID:2400
-
\??\c:\thnnnh.exec:\thnnnh.exe106⤵PID:604
-
\??\c:\dpddd.exec:\dpddd.exe107⤵PID:2060
-
\??\c:\lxlfxxr.exec:\lxlfxxr.exe108⤵PID:2244
-
\??\c:\hthtnh.exec:\hthtnh.exe109⤵PID:3636
-
\??\c:\pvdvj.exec:\pvdvj.exe110⤵PID:1992
-
\??\c:\pjpdv.exec:\pjpdv.exe111⤵PID:4812
-
\??\c:\1flfrrl.exec:\1flfrrl.exe112⤵PID:1336
-
\??\c:\bnbtnh.exec:\bnbtnh.exe113⤵PID:4752
-
\??\c:\ddjjv.exec:\ddjjv.exe114⤵PID:4908
-
\??\c:\rllfxxr.exec:\rllfxxr.exe115⤵PID:4936
-
\??\c:\nhbntt.exec:\nhbntt.exe116⤵PID:220
-
\??\c:\9jpdv.exec:\9jpdv.exe117⤵PID:1076
-
\??\c:\flxlxxr.exec:\flxlxxr.exe118⤵PID:2636
-
\??\c:\nhhbtn.exec:\nhhbtn.exe119⤵PID:960
-
\??\c:\nhbttn.exec:\nhbttn.exe120⤵PID:4324
-
\??\c:\vjjdp.exec:\vjjdp.exe121⤵PID:2716
-
\??\c:\lfffxxr.exec:\lfffxxr.exe122⤵PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-