Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25-09-2024 01:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c837311a224b8c64760a39229fa386eb6d8da16396d6f816cd0730b27e5b3739N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
c837311a224b8c64760a39229fa386eb6d8da16396d6f816cd0730b27e5b3739N.exe
-
Size
63KB
-
MD5
4858e14794f0f1bd7ecffe3985977150
-
SHA1
3d6e10d4cdf6ee172a84f7c64e4282c3b60fa441
-
SHA256
c837311a224b8c64760a39229fa386eb6d8da16396d6f816cd0730b27e5b3739
-
SHA512
d559610a3c23cfaf0f0b4fb2aa82263ec757e6a83a02ebcb44cdd18400e841d5f0cb69ced509b55a75d3ab3858c33db12626a00b891cc8949acf3062aee71b3d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIhJ44Hhhd8:ymb3NkkiQ3mdBjFILdhj8
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/2264-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2576-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1276-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/696-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/412-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4712 ppvvj.exe 3876 xxllfll.exe 2484 5xrrxxf.exe 1116 ttbthb.exe 1072 ddjjd.exe 4340 pddvd.exe 824 1fffxfx.exe 4844 xrlxrfx.exe 452 7nttnt.exe 832 ppdvv.exe 4328 pvvjp.exe 1148 lffxrrl.exe 2740 llllfff.exe 4044 thhhbb.exe 2392 dddvj.exe 1608 frfxllf.exe 2276 fffxxrl.exe 2336 jvjdv.exe 3552 rflxrrl.exe 2576 btbbtb.exe 2920 jdvpj.exe 1276 rrfrfff.exe 3096 ffffrrr.exe 1224 5hhhbb.exe 696 jdjjd.exe 1908 flffrxx.exe 944 lrfrxfx.exe 412 fxxxxxf.exe 4168 9ttbhn.exe 4972 vpdvv.exe 3948 fffxrrr.exe 4568 xxxxlrl.exe 2044 nhhbbb.exe 4608 hbnbnh.exe 2608 7pdvp.exe 708 vvdvv.exe 3656 flrlxlf.exe 1688 hbtttn.exe 4424 1nnhtb.exe 1660 9jjdj.exe 3644 1ppjd.exe 1604 xlxrlll.exe 2296 rllfxxx.exe 1160 nhtntt.exe 624 jjppp.exe 4076 vpdvd.exe 1100 rrxxxxf.exe 4980 lfxxrrl.exe 2800 hnnhhh.exe 3068 nhnhtb.exe 1208 dvddd.exe 1772 9xrlfff.exe 4204 rxfxrrl.exe 3424 hbttnn.exe 1116 7jvvv.exe 1520 ppvjv.exe 2252 rflxlff.exe 1600 xxfxrxr.exe 824 thhhbb.exe 1900 tnnhtn.exe 1428 vpdvj.exe 2152 9dvvj.exe 628 xrxlllr.exe 3340 tbtnbh.exe -
resource yara_rule behavioral2/memory/2264-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3876-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/832-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/832-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1276-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1224-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/412-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ththn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2264 wrote to memory of 4712 2264 c837311a224b8c64760a39229fa386eb6d8da16396d6f816cd0730b27e5b3739N.exe 84 PID 2264 wrote to memory of 4712 2264 c837311a224b8c64760a39229fa386eb6d8da16396d6f816cd0730b27e5b3739N.exe 84 PID 2264 wrote to memory of 4712 2264 c837311a224b8c64760a39229fa386eb6d8da16396d6f816cd0730b27e5b3739N.exe 84 PID 4712 wrote to memory of 3876 4712 ppvvj.exe 85 PID 4712 wrote to memory of 3876 4712 ppvvj.exe 85 PID 4712 wrote to memory of 3876 4712 ppvvj.exe 85 PID 3876 wrote to memory of 2484 3876 xxllfll.exe 86 PID 3876 wrote to memory of 2484 3876 xxllfll.exe 86 PID 3876 wrote to memory of 2484 3876 xxllfll.exe 86 PID 2484 wrote to memory of 1116 2484 5xrrxxf.exe 87 PID 2484 wrote to memory of 1116 2484 5xrrxxf.exe 87 PID 2484 wrote to memory of 1116 2484 5xrrxxf.exe 87 PID 1116 wrote to memory of 1072 1116 ttbthb.exe 88 PID 1116 wrote to memory of 1072 1116 ttbthb.exe 88 PID 1116 wrote to memory of 1072 1116 ttbthb.exe 88 PID 1072 wrote to memory of 4340 1072 ddjjd.exe 89 PID 1072 wrote to memory of 4340 1072 ddjjd.exe 89 PID 1072 wrote to memory of 4340 1072 ddjjd.exe 89 PID 4340 wrote to memory of 824 4340 pddvd.exe 90 PID 4340 wrote to memory of 824 4340 pddvd.exe 90 PID 4340 wrote to memory of 824 4340 pddvd.exe 90 PID 824 wrote to memory of 4844 824 1fffxfx.exe 91 PID 824 wrote to memory of 4844 824 1fffxfx.exe 91 PID 824 wrote to memory of 4844 824 1fffxfx.exe 91 PID 4844 wrote to memory of 452 4844 xrlxrfx.exe 92 PID 4844 wrote to memory of 452 4844 xrlxrfx.exe 92 PID 4844 wrote to memory of 452 4844 xrlxrfx.exe 92 PID 452 wrote to memory of 832 452 7nttnt.exe 93 PID 452 wrote to memory of 832 452 7nttnt.exe 93 PID 452 wrote to memory of 832 452 7nttnt.exe 93 PID 832 wrote to memory of 4328 832 ppdvv.exe 94 PID 832 wrote to memory of 4328 832 ppdvv.exe 94 PID 832 wrote to memory of 4328 832 ppdvv.exe 94 PID 4328 wrote to memory of 1148 4328 pvvjp.exe 95 PID 4328 wrote to memory of 1148 4328 pvvjp.exe 95 PID 4328 wrote to memory of 1148 4328 pvvjp.exe 95 PID 1148 wrote to memory of 2740 1148 lffxrrl.exe 96 PID 1148 wrote to memory of 2740 1148 lffxrrl.exe 96 PID 1148 wrote to memory of 2740 1148 lffxrrl.exe 96 PID 2740 wrote to memory of 4044 2740 llllfff.exe 97 PID 2740 wrote to memory of 4044 2740 llllfff.exe 97 PID 2740 wrote to memory of 4044 2740 llllfff.exe 97 PID 4044 wrote to memory of 2392 4044 thhhbb.exe 98 PID 4044 wrote to memory of 2392 4044 thhhbb.exe 98 PID 4044 wrote to memory of 2392 4044 thhhbb.exe 98 PID 2392 wrote to memory of 1608 2392 dddvj.exe 99 PID 2392 wrote to memory of 1608 2392 dddvj.exe 99 PID 2392 wrote to memory of 1608 2392 dddvj.exe 99 PID 1608 wrote to memory of 2276 1608 frfxllf.exe 100 PID 1608 wrote to memory of 2276 1608 frfxllf.exe 100 PID 1608 wrote to memory of 2276 1608 frfxllf.exe 100 PID 2276 wrote to memory of 2336 2276 fffxxrl.exe 101 PID 2276 wrote to memory of 2336 2276 fffxxrl.exe 101 PID 2276 wrote to memory of 2336 2276 fffxxrl.exe 101 PID 2336 wrote to memory of 3552 2336 jvjdv.exe 102 PID 2336 wrote to memory of 3552 2336 jvjdv.exe 102 PID 2336 wrote to memory of 3552 2336 jvjdv.exe 102 PID 3552 wrote to memory of 2576 3552 rflxrrl.exe 103 PID 3552 wrote to memory of 2576 3552 rflxrrl.exe 103 PID 3552 wrote to memory of 2576 3552 rflxrrl.exe 103 PID 2576 wrote to memory of 2920 2576 btbbtb.exe 104 PID 2576 wrote to memory of 2920 2576 btbbtb.exe 104 PID 2576 wrote to memory of 2920 2576 btbbtb.exe 104 PID 2920 wrote to memory of 1276 2920 jdvpj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\c837311a224b8c64760a39229fa386eb6d8da16396d6f816cd0730b27e5b3739N.exe"C:\Users\Admin\AppData\Local\Temp\c837311a224b8c64760a39229fa386eb6d8da16396d6f816cd0730b27e5b3739N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\ppvvj.exec:\ppvvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\xxllfll.exec:\xxllfll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\5xrrxxf.exec:\5xrrxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\ttbthb.exec:\ttbthb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\ddjjd.exec:\ddjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\pddvd.exec:\pddvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\1fffxfx.exec:\1fffxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\xrlxrfx.exec:\xrlxrfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\7nttnt.exec:\7nttnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\ppdvv.exec:\ppdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\pvvjp.exec:\pvvjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\lffxrrl.exec:\lffxrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\llllfff.exec:\llllfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\thhhbb.exec:\thhhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\dddvj.exec:\dddvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\frfxllf.exec:\frfxllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\fffxxrl.exec:\fffxxrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\jvjdv.exec:\jvjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\rflxrrl.exec:\rflxrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\btbbtb.exec:\btbbtb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\jdvpj.exec:\jdvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\rrfrfff.exec:\rrfrfff.exe23⤵
- Executes dropped EXE
PID:1276 -
\??\c:\ffffrrr.exec:\ffffrrr.exe24⤵
- Executes dropped EXE
PID:3096 -
\??\c:\5hhhbb.exec:\5hhhbb.exe25⤵
- Executes dropped EXE
PID:1224 -
\??\c:\jdjjd.exec:\jdjjd.exe26⤵
- Executes dropped EXE
PID:696 -
\??\c:\flffrxx.exec:\flffrxx.exe27⤵
- Executes dropped EXE
PID:1908 -
\??\c:\lrfrxfx.exec:\lrfrxfx.exe28⤵
- Executes dropped EXE
PID:944 -
\??\c:\fxxxxxf.exec:\fxxxxxf.exe29⤵
- Executes dropped EXE
PID:412 -
\??\c:\9ttbhn.exec:\9ttbhn.exe30⤵
- Executes dropped EXE
PID:4168 -
\??\c:\vpdvv.exec:\vpdvv.exe31⤵
- Executes dropped EXE
PID:4972 -
\??\c:\fffxrrr.exec:\fffxrrr.exe32⤵
- Executes dropped EXE
PID:3948 -
\??\c:\xxxxlrl.exec:\xxxxlrl.exe33⤵
- Executes dropped EXE
PID:4568 -
\??\c:\nhhbbb.exec:\nhhbbb.exe34⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hbnbnh.exec:\hbnbnh.exe35⤵
- Executes dropped EXE
PID:4608 -
\??\c:\7pdvp.exec:\7pdvp.exe36⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vvdvv.exec:\vvdvv.exe37⤵
- Executes dropped EXE
PID:708 -
\??\c:\flrlxlf.exec:\flrlxlf.exe38⤵
- Executes dropped EXE
PID:3656 -
\??\c:\hbtttn.exec:\hbtttn.exe39⤵
- Executes dropped EXE
PID:1688 -
\??\c:\1nnhtb.exec:\1nnhtb.exe40⤵
- Executes dropped EXE
PID:4424 -
\??\c:\9jjdj.exec:\9jjdj.exe41⤵
- Executes dropped EXE
PID:1660 -
\??\c:\1ppjd.exec:\1ppjd.exe42⤵
- Executes dropped EXE
PID:3644 -
\??\c:\xlxrlll.exec:\xlxrlll.exe43⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rllfxxx.exec:\rllfxxx.exe44⤵
- Executes dropped EXE
PID:2296 -
\??\c:\nhtntt.exec:\nhtntt.exe45⤵
- Executes dropped EXE
PID:1160 -
\??\c:\jjppp.exec:\jjppp.exe46⤵
- Executes dropped EXE
PID:624 -
\??\c:\vpdvd.exec:\vpdvd.exe47⤵
- Executes dropped EXE
PID:4076 -
\??\c:\rrxxxxf.exec:\rrxxxxf.exe48⤵
- Executes dropped EXE
PID:1100 -
\??\c:\lfxxrrl.exec:\lfxxrrl.exe49⤵
- Executes dropped EXE
PID:4980 -
\??\c:\hnnhhh.exec:\hnnhhh.exe50⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nhnhtb.exec:\nhnhtb.exe51⤵
- Executes dropped EXE
PID:3068 -
\??\c:\dvddd.exec:\dvddd.exe52⤵
- Executes dropped EXE
PID:1208 -
\??\c:\9xrlfff.exec:\9xrlfff.exe53⤵
- Executes dropped EXE
PID:1772 -
\??\c:\rxfxrrl.exec:\rxfxrrl.exe54⤵
- Executes dropped EXE
PID:4204 -
\??\c:\hbttnn.exec:\hbttnn.exe55⤵
- Executes dropped EXE
PID:3424 -
\??\c:\7jvvv.exec:\7jvvv.exe56⤵
- Executes dropped EXE
PID:1116 -
\??\c:\ppvjv.exec:\ppvjv.exe57⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rflxlff.exec:\rflxlff.exe58⤵
- Executes dropped EXE
PID:2252 -
\??\c:\xxfxrxr.exec:\xxfxrxr.exe59⤵
- Executes dropped EXE
PID:1600 -
\??\c:\thhhbb.exec:\thhhbb.exe60⤵
- Executes dropped EXE
PID:824 -
\??\c:\tnnhtn.exec:\tnnhtn.exe61⤵
- Executes dropped EXE
PID:1900 -
\??\c:\vpdvj.exec:\vpdvj.exe62⤵
- Executes dropped EXE
PID:1428 -
\??\c:\9dvvj.exec:\9dvvj.exe63⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xrxlllr.exec:\xrxlllr.exe64⤵
- Executes dropped EXE
PID:628 -
\??\c:\tbtnbh.exec:\tbtnbh.exe65⤵
- Executes dropped EXE
PID:3340 -
\??\c:\9ppjv.exec:\9ppjv.exe66⤵PID:1156
-
\??\c:\9jjjd.exec:\9jjjd.exe67⤵PID:4216
-
\??\c:\rflxlrl.exec:\rflxlrl.exe68⤵PID:2412
-
\??\c:\htnnhh.exec:\htnnhh.exe69⤵PID:3676
-
\??\c:\bnhbhh.exec:\bnhbhh.exe70⤵PID:2468
-
\??\c:\9dvdp.exec:\9dvdp.exe71⤵PID:2392
-
\??\c:\xllllfl.exec:\xllllfl.exe72⤵PID:1592
-
\??\c:\fxxrrxr.exec:\fxxrrxr.exe73⤵PID:3188
-
\??\c:\hbbtnh.exec:\hbbtnh.exe74⤵PID:1400
-
\??\c:\ppvjp.exec:\ppvjp.exe75⤵PID:2580
-
\??\c:\jvvjj.exec:\jvvjj.exe76⤵PID:1344
-
\??\c:\lfxrxrx.exec:\lfxrxrx.exe77⤵PID:3552
-
\??\c:\rfffxxx.exec:\rfffxxx.exe78⤵PID:3416
-
\??\c:\bhhbtn.exec:\bhhbtn.exe79⤵PID:1192
-
\??\c:\hnbnhn.exec:\hnbnhn.exe80⤵PID:1136
-
\??\c:\vpvvv.exec:\vpvvv.exe81⤵PID:4912
-
\??\c:\1rxrrrx.exec:\1rxrrrx.exe82⤵PID:4892
-
\??\c:\1xllllr.exec:\1xllllr.exe83⤵PID:2816
-
\??\c:\hbnhnn.exec:\hbnhnn.exe84⤵PID:1872
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe85⤵PID:3112
-
\??\c:\hthtnn.exec:\hthtnn.exe86⤵PID:4720
-
\??\c:\dvjdp.exec:\dvjdp.exe87⤵PID:5080
-
\??\c:\5pjvd.exec:\5pjvd.exe88⤵PID:2824
-
\??\c:\7rrfrlr.exec:\7rrfrlr.exe89⤵PID:1904
-
\??\c:\frlfxrl.exec:\frlfxrl.exe90⤵PID:860
-
\??\c:\nbbtnh.exec:\nbbtnh.exe91⤵PID:2024
-
\??\c:\thbthb.exec:\thbthb.exe92⤵PID:2444
-
\??\c:\vjdpd.exec:\vjdpd.exe93⤵PID:4164
-
\??\c:\rrlrrff.exec:\rrlrrff.exe94⤵PID:4608
-
\??\c:\frxrfff.exec:\frxrfff.exe95⤵PID:4404
-
\??\c:\hbbtnh.exec:\hbbtnh.exe96⤵PID:4924
-
\??\c:\1bhtnt.exec:\1bhtnt.exe97⤵PID:2268
-
\??\c:\dvpjv.exec:\dvpjv.exe98⤵PID:3888
-
\??\c:\jpjvj.exec:\jpjvj.exe99⤵PID:4952
-
\??\c:\3rlfllx.exec:\3rlfllx.exe100⤵PID:5112
-
\??\c:\1btnhb.exec:\1btnhb.exe101⤵PID:2196
-
\??\c:\5ntnhb.exec:\5ntnhb.exe102⤵PID:3516
-
\??\c:\djdjd.exec:\djdjd.exe103⤵PID:4736
-
\??\c:\9rrlxrl.exec:\9rrlxrl.exe104⤵PID:4828
-
\??\c:\frlfxxx.exec:\frlfxxx.exe105⤵PID:2980
-
\??\c:\tbhnnn.exec:\tbhnnn.exe106⤵PID:4076
-
\??\c:\nttttn.exec:\nttttn.exe107⤵PID:1100
-
\??\c:\dvpjd.exec:\dvpjd.exe108⤵PID:996
-
\??\c:\5jpdp.exec:\5jpdp.exe109⤵PID:2800
-
\??\c:\7rrlrxx.exec:\7rrlrxx.exe110⤵PID:4784
-
\??\c:\hnnntn.exec:\hnnntn.exe111⤵PID:1208
-
\??\c:\9hhhtt.exec:\9hhhtt.exe112⤵PID:3672
-
\??\c:\7pjdp.exec:\7pjdp.exe113⤵PID:4204
-
\??\c:\fxfxlll.exec:\fxfxlll.exe114⤵PID:3424
-
\??\c:\btnhbb.exec:\btnhbb.exe115⤵PID:1184
-
\??\c:\tbhhbh.exec:\tbhhbh.exe116⤵PID:1496
-
\??\c:\htbbhh.exec:\htbbhh.exe117⤵PID:2252
-
\??\c:\7dvpv.exec:\7dvpv.exe118⤵PID:1600
-
\??\c:\rxxrffr.exec:\rxxrffr.exe119⤵PID:844
-
\??\c:\xfffxrl.exec:\xfffxrl.exe120⤵PID:1900
-
\??\c:\thhtnh.exec:\thhtnh.exe121⤵PID:1428
-
\??\c:\vvvvj.exec:\vvvvj.exe122⤵PID:4824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-