Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28-09-2024 19:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
227ea0cb39c0026144cc0b82ddc9b9b754c339d11f4a8dbb0b85c6aa06673814.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
227ea0cb39c0026144cc0b82ddc9b9b754c339d11f4a8dbb0b85c6aa06673814.exe
-
Size
70KB
-
MD5
9f396473219c27d0707da9b33f7f042f
-
SHA1
bfbf0477561f22032289aa342fc96812f7479064
-
SHA256
227ea0cb39c0026144cc0b82ddc9b9b754c339d11f4a8dbb0b85c6aa06673814
-
SHA512
e4789626adcd99857c95dd40706b571dbf91f85dca91502dd3025d633be29ac8ca7e692496358a48899470fabb66e7046b9bc536b4c8e47a1758fd75410be9a7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJ/RWPqBr9:ymb3NkkiQ3mdBjFIqsr9
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/400-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/996-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1744-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1556-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2884-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 400 xlxrxxr.exe 1744 1thbtb.exe 1724 pjjvj.exe 4448 llrlrfl.exe 624 hntbth.exe 2792 7nnbtn.exe 1556 dvdjd.exe 2296 3nnhbt.exe 2716 jdpvd.exe 4780 lfxxxfx.exe 4756 nbnhbh.exe 2740 ddddd.exe 4168 nnnbtt.exe 1120 vpjdp.exe 4656 rxlrxlr.exe 5068 btbtnn.exe 4396 dpppv.exe 2884 3vvpd.exe 3024 7flfflr.exe 640 5rxxffl.exe 8 vvppj.exe 4988 rxxrffx.exe 2756 9nhbbb.exe 2548 1hhthh.exe 1596 7jjdp.exe 376 dppjd.exe 3056 xfxrllf.exe 4644 xfxlrxf.exe 2452 nhnntt.exe 4196 djddp.exe 4600 vjjdp.exe 3044 fxxrxfr.exe 932 tnnhbt.exe 4164 hnbtbb.exe 1600 pdvdv.exe 5096 rfrxrrx.exe 2796 3rrrxff.exe 4584 bthbhh.exe 4372 bttnhh.exe 4000 jdppv.exe 4924 dvvpj.exe 1448 fxrfxlf.exe 3936 tntnhn.exe 2068 7jjvv.exe 2816 xfxlxlf.exe 4740 ttnhtb.exe 3920 jppjd.exe 4460 lrxllfr.exe 3824 xflfffx.exe 996 bttnhh.exe 3212 tttbnt.exe 4004 pjvjv.exe 2000 llxrflf.exe 4112 htbhbh.exe 2532 3bhhbt.exe 2624 3jdvp.exe 708 7rrffxf.exe 696 5rrlffx.exe 3668 tbtbhh.exe 1820 9pjpd.exe 2456 pjjdv.exe 1796 lflfllr.exe 2360 tbbthn.exe 1716 tbtbnn.exe -
resource yara_rule behavioral2/memory/996-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2884-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ntnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 996 wrote to memory of 400 996 227ea0cb39c0026144cc0b82ddc9b9b754c339d11f4a8dbb0b85c6aa06673814.exe 82 PID 996 wrote to memory of 400 996 227ea0cb39c0026144cc0b82ddc9b9b754c339d11f4a8dbb0b85c6aa06673814.exe 82 PID 996 wrote to memory of 400 996 227ea0cb39c0026144cc0b82ddc9b9b754c339d11f4a8dbb0b85c6aa06673814.exe 82 PID 400 wrote to memory of 1744 400 xlxrxxr.exe 83 PID 400 wrote to memory of 1744 400 xlxrxxr.exe 83 PID 400 wrote to memory of 1744 400 xlxrxxr.exe 83 PID 1744 wrote to memory of 1724 1744 1thbtb.exe 84 PID 1744 wrote to memory of 1724 1744 1thbtb.exe 84 PID 1744 wrote to memory of 1724 1744 1thbtb.exe 84 PID 1724 wrote to memory of 4448 1724 pjjvj.exe 85 PID 1724 wrote to memory of 4448 1724 pjjvj.exe 85 PID 1724 wrote to memory of 4448 1724 pjjvj.exe 85 PID 4448 wrote to memory of 624 4448 llrlrfl.exe 86 PID 4448 wrote to memory of 624 4448 llrlrfl.exe 86 PID 4448 wrote to memory of 624 4448 llrlrfl.exe 86 PID 624 wrote to memory of 2792 624 hntbth.exe 87 PID 624 wrote to memory of 2792 624 hntbth.exe 87 PID 624 wrote to memory of 2792 624 hntbth.exe 87 PID 2792 wrote to memory of 1556 2792 7nnbtn.exe 88 PID 2792 wrote to memory of 1556 2792 7nnbtn.exe 88 PID 2792 wrote to memory of 1556 2792 7nnbtn.exe 88 PID 1556 wrote to memory of 2296 1556 dvdjd.exe 89 PID 1556 wrote to memory of 2296 1556 dvdjd.exe 89 PID 1556 wrote to memory of 2296 1556 dvdjd.exe 89 PID 2296 wrote to memory of 2716 2296 3nnhbt.exe 90 PID 2296 wrote to memory of 2716 2296 3nnhbt.exe 90 PID 2296 wrote to memory of 2716 2296 3nnhbt.exe 90 PID 2716 wrote to memory of 4780 2716 jdpvd.exe 91 PID 2716 wrote to memory of 4780 2716 jdpvd.exe 91 PID 2716 wrote to memory of 4780 2716 jdpvd.exe 91 PID 4780 wrote to memory of 4756 4780 lfxxxfx.exe 92 PID 4780 wrote to memory of 4756 4780 lfxxxfx.exe 92 PID 4780 wrote to memory of 4756 4780 lfxxxfx.exe 92 PID 4756 wrote to memory of 2740 4756 nbnhbh.exe 93 PID 4756 wrote to memory of 2740 4756 nbnhbh.exe 93 PID 4756 wrote to memory of 2740 4756 nbnhbh.exe 93 PID 2740 wrote to memory of 4168 2740 ddddd.exe 94 PID 2740 wrote to memory of 4168 2740 ddddd.exe 94 PID 2740 wrote to memory of 4168 2740 ddddd.exe 94 PID 4168 wrote to memory of 1120 4168 nnnbtt.exe 95 PID 4168 wrote to memory of 1120 4168 nnnbtt.exe 95 PID 4168 wrote to memory of 1120 4168 nnnbtt.exe 95 PID 1120 wrote to memory of 4656 1120 vpjdp.exe 96 PID 1120 wrote to memory of 4656 1120 vpjdp.exe 96 PID 1120 wrote to memory of 4656 1120 vpjdp.exe 96 PID 4656 wrote to memory of 5068 4656 rxlrxlr.exe 97 PID 4656 wrote to memory of 5068 4656 rxlrxlr.exe 97 PID 4656 wrote to memory of 5068 4656 rxlrxlr.exe 97 PID 5068 wrote to memory of 4396 5068 btbtnn.exe 98 PID 5068 wrote to memory of 4396 5068 btbtnn.exe 98 PID 5068 wrote to memory of 4396 5068 btbtnn.exe 98 PID 4396 wrote to memory of 2884 4396 dpppv.exe 99 PID 4396 wrote to memory of 2884 4396 dpppv.exe 99 PID 4396 wrote to memory of 2884 4396 dpppv.exe 99 PID 2884 wrote to memory of 3024 2884 3vvpd.exe 100 PID 2884 wrote to memory of 3024 2884 3vvpd.exe 100 PID 2884 wrote to memory of 3024 2884 3vvpd.exe 100 PID 3024 wrote to memory of 640 3024 7flfflr.exe 101 PID 3024 wrote to memory of 640 3024 7flfflr.exe 101 PID 3024 wrote to memory of 640 3024 7flfflr.exe 101 PID 640 wrote to memory of 8 640 5rxxffl.exe 102 PID 640 wrote to memory of 8 640 5rxxffl.exe 102 PID 640 wrote to memory of 8 640 5rxxffl.exe 102 PID 8 wrote to memory of 4988 8 vvppj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\227ea0cb39c0026144cc0b82ddc9b9b754c339d11f4a8dbb0b85c6aa06673814.exe"C:\Users\Admin\AppData\Local\Temp\227ea0cb39c0026144cc0b82ddc9b9b754c339d11f4a8dbb0b85c6aa06673814.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\xlxrxxr.exec:\xlxrxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\1thbtb.exec:\1thbtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\pjjvj.exec:\pjjvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\llrlrfl.exec:\llrlrfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\hntbth.exec:\hntbth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\7nnbtn.exec:\7nnbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\dvdjd.exec:\dvdjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\3nnhbt.exec:\3nnhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\jdpvd.exec:\jdpvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\lfxxxfx.exec:\lfxxxfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\nbnhbh.exec:\nbnhbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\ddddd.exec:\ddddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\nnnbtt.exec:\nnnbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\vpjdp.exec:\vpjdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\rxlrxlr.exec:\rxlrxlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\btbtnn.exec:\btbtnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\dpppv.exec:\dpppv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\3vvpd.exec:\3vvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\7flfflr.exec:\7flfflr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\5rxxffl.exec:\5rxxffl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\vvppj.exec:\vvppj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\rxxrffx.exec:\rxxrffx.exe23⤵
- Executes dropped EXE
PID:4988 -
\??\c:\9nhbbb.exec:\9nhbbb.exe24⤵
- Executes dropped EXE
PID:2756 -
\??\c:\1hhthh.exec:\1hhthh.exe25⤵
- Executes dropped EXE
PID:2548 -
\??\c:\7jjdp.exec:\7jjdp.exe26⤵
- Executes dropped EXE
PID:1596 -
\??\c:\dppjd.exec:\dppjd.exe27⤵
- Executes dropped EXE
PID:376 -
\??\c:\xfxrllf.exec:\xfxrllf.exe28⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xfxlrxf.exec:\xfxlrxf.exe29⤵
- Executes dropped EXE
PID:4644 -
\??\c:\nhnntt.exec:\nhnntt.exe30⤵
- Executes dropped EXE
PID:2452 -
\??\c:\djddp.exec:\djddp.exe31⤵
- Executes dropped EXE
PID:4196 -
\??\c:\vjjdp.exec:\vjjdp.exe32⤵
- Executes dropped EXE
PID:4600 -
\??\c:\fxxrxfr.exec:\fxxrxfr.exe33⤵
- Executes dropped EXE
PID:3044 -
\??\c:\tnnhbt.exec:\tnnhbt.exe34⤵
- Executes dropped EXE
PID:932 -
\??\c:\hnbtbb.exec:\hnbtbb.exe35⤵
- Executes dropped EXE
PID:4164 -
\??\c:\pdvdv.exec:\pdvdv.exe36⤵
- Executes dropped EXE
PID:1600 -
\??\c:\rfrxrrx.exec:\rfrxrrx.exe37⤵
- Executes dropped EXE
PID:5096 -
\??\c:\3rrrxff.exec:\3rrrxff.exe38⤵
- Executes dropped EXE
PID:2796 -
\??\c:\bthbhh.exec:\bthbhh.exe39⤵
- Executes dropped EXE
PID:4584 -
\??\c:\bttnhh.exec:\bttnhh.exe40⤵
- Executes dropped EXE
PID:4372 -
\??\c:\jdppv.exec:\jdppv.exe41⤵
- Executes dropped EXE
PID:4000 -
\??\c:\dvvpj.exec:\dvvpj.exe42⤵
- Executes dropped EXE
PID:4924 -
\??\c:\fxrfxlf.exec:\fxrfxlf.exe43⤵
- Executes dropped EXE
PID:1448 -
\??\c:\tntnhn.exec:\tntnhn.exe44⤵
- Executes dropped EXE
PID:3936 -
\??\c:\7jjvv.exec:\7jjvv.exe45⤵
- Executes dropped EXE
PID:2068 -
\??\c:\xfxlxlf.exec:\xfxlxlf.exe46⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ttnhtb.exec:\ttnhtb.exe47⤵
- Executes dropped EXE
PID:4740 -
\??\c:\jppjd.exec:\jppjd.exe48⤵
- Executes dropped EXE
PID:3920 -
\??\c:\lrxllfr.exec:\lrxllfr.exe49⤵
- Executes dropped EXE
PID:4460 -
\??\c:\xflfffx.exec:\xflfffx.exe50⤵
- Executes dropped EXE
PID:3824 -
\??\c:\bttnhh.exec:\bttnhh.exe51⤵
- Executes dropped EXE
PID:996 -
\??\c:\tttbnt.exec:\tttbnt.exe52⤵
- Executes dropped EXE
PID:3212 -
\??\c:\pjvjv.exec:\pjvjv.exe53⤵
- Executes dropped EXE
PID:4004 -
\??\c:\llxrflf.exec:\llxrflf.exe54⤵
- Executes dropped EXE
PID:2000 -
\??\c:\htbhbh.exec:\htbhbh.exe55⤵
- Executes dropped EXE
PID:4112 -
\??\c:\3bhhbt.exec:\3bhhbt.exe56⤵
- Executes dropped EXE
PID:2532 -
\??\c:\3jdvp.exec:\3jdvp.exe57⤵
- Executes dropped EXE
PID:2624 -
\??\c:\7rrffxf.exec:\7rrffxf.exe58⤵
- Executes dropped EXE
PID:708 -
\??\c:\5rrlffx.exec:\5rrlffx.exe59⤵
- Executes dropped EXE
PID:696 -
\??\c:\tbtbhh.exec:\tbtbhh.exe60⤵
- Executes dropped EXE
PID:3668 -
\??\c:\9pjpd.exec:\9pjpd.exe61⤵
- Executes dropped EXE
PID:1820 -
\??\c:\pjjdv.exec:\pjjdv.exe62⤵
- Executes dropped EXE
PID:2456 -
\??\c:\lflfllr.exec:\lflfllr.exe63⤵
- Executes dropped EXE
PID:1796 -
\??\c:\tbbthn.exec:\tbbthn.exe64⤵
- Executes dropped EXE
PID:2360 -
\??\c:\tbtbnn.exec:\tbtbnn.exe65⤵
- Executes dropped EXE
PID:1716 -
\??\c:\dppjp.exec:\dppjp.exe66⤵PID:2720
-
\??\c:\rffxllf.exec:\rffxllf.exe67⤵PID:4612
-
\??\c:\3xxrlfr.exec:\3xxrlfr.exe68⤵PID:4488
-
\??\c:\9tbbbt.exec:\9tbbbt.exe69⤵PID:2120
-
\??\c:\rrrlffx.exec:\rrrlffx.exe70⤵PID:636
-
\??\c:\htbttn.exec:\htbttn.exe71⤵PID:4092
-
\??\c:\tnthhb.exec:\tnthhb.exe72⤵PID:1156
-
\??\c:\pvvpp.exec:\pvvpp.exe73⤵PID:1848
-
\??\c:\ffllrxf.exec:\ffllrxf.exe74⤵PID:3016
-
\??\c:\tnhbbt.exec:\tnhbbt.exe75⤵PID:2076
-
\??\c:\btthth.exec:\btthth.exe76⤵PID:3696
-
\??\c:\dpvdp.exec:\dpvdp.exe77⤵PID:1904
-
\??\c:\rrlfxxl.exec:\rrlfxxl.exe78⤵PID:3856
-
\??\c:\xllfrrl.exec:\xllfrrl.exe79⤵PID:3492
-
\??\c:\5hnhnn.exec:\5hnhnn.exe80⤵PID:4192
-
\??\c:\bnbnht.exec:\bnbnht.exe81⤵PID:3944
-
\??\c:\pdjdp.exec:\pdjdp.exe82⤵PID:3360
-
\??\c:\pvvpp.exec:\pvvpp.exe83⤵PID:3536
-
\??\c:\lxfrrrx.exec:\lxfrrrx.exe84⤵PID:3748
-
\??\c:\thbhbt.exec:\thbhbt.exe85⤵PID:1416
-
\??\c:\7hhbnn.exec:\7hhbnn.exe86⤵PID:1632
-
\??\c:\pjdvv.exec:\pjdvv.exe87⤵PID:4624
-
\??\c:\lxflxxx.exec:\lxflxxx.exe88⤵PID:3924
-
\??\c:\fxxflxx.exec:\fxxflxx.exe89⤵PID:4812
-
\??\c:\thhhbh.exec:\thhhbh.exe90⤵PID:4856
-
\??\c:\hbtnbh.exec:\hbtnbh.exe91⤵PID:4660
-
\??\c:\djjpd.exec:\djjpd.exe92⤵PID:3076
-
\??\c:\vpjdp.exec:\vpjdp.exe93⤵PID:1220
-
\??\c:\fflfxxl.exec:\fflfxxl.exe94⤵PID:388
-
\??\c:\ffrlffx.exec:\ffrlffx.exe95⤵PID:1812
-
\??\c:\9tnhhh.exec:\9tnhhh.exe96⤵PID:932
-
\??\c:\djpjp.exec:\djpjp.exe97⤵PID:740
-
\??\c:\pjpjd.exec:\pjpjd.exe98⤵PID:1612
-
\??\c:\xlxlxrx.exec:\xlxlxrx.exe99⤵PID:5096
-
\??\c:\ffllffr.exec:\ffllffr.exe100⤵PID:2796
-
\??\c:\hbnntt.exec:\hbnntt.exe101⤵PID:4584
-
\??\c:\btnhbh.exec:\btnhbh.exe102⤵PID:2384
-
\??\c:\jvppj.exec:\jvppj.exe103⤵PID:4000
-
\??\c:\jvpvp.exec:\jvpvp.exe104⤵PID:852
-
\??\c:\frlrflf.exec:\frlrflf.exe105⤵PID:1776
-
\??\c:\nbnnhh.exec:\nbnnhh.exe106⤵PID:2768
-
\??\c:\pvppp.exec:\pvppp.exe107⤵PID:2820
-
\??\c:\dvddv.exec:\dvddv.exe108⤵PID:5012
-
\??\c:\frfxlrl.exec:\frfxlrl.exe109⤵PID:4984
-
\??\c:\lxxflfl.exec:\lxxflfl.exe110⤵PID:4524
-
\??\c:\thnhbt.exec:\thnhbt.exe111⤵PID:3448
-
\??\c:\vpjpd.exec:\vpjpd.exe112⤵PID:3516
-
\??\c:\jjppv.exec:\jjppv.exe113⤵PID:3312
-
\??\c:\rrrlrrl.exec:\rrrlrrl.exe114⤵PID:3476
-
\??\c:\bttnhb.exec:\bttnhb.exe115⤵PID:628
-
\??\c:\ntnhnt.exec:\ntnhnt.exe116⤵PID:5044
-
\??\c:\tnhthh.exec:\tnhthh.exe117⤵PID:1792
-
\??\c:\1xfxrrr.exec:\1xfxrrr.exe118⤵PID:4884
-
\??\c:\ntbnbt.exec:\ntbnbt.exe119⤵PID:2800
-
\??\c:\vpdvj.exec:\vpdvj.exe120⤵PID:2052
-
\??\c:\7jjdj.exec:\7jjdj.exe121⤵PID:2792
-
\??\c:\1lrlxrr.exec:\1lrlxrr.exe122⤵PID:4952
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-