Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 16:36
Static task
static1
Behavioral task
behavioral1
Sample
fc37ede157d3ba57cc8567e0df79e7e64ecdbebf7e4e254aed3844af387cfb37N.exe
Resource
win7-20240708-en
General
-
Target
fc37ede157d3ba57cc8567e0df79e7e64ecdbebf7e4e254aed3844af387cfb37N.exe
-
Size
375KB
-
MD5
f32888e02ea69bdf923bf144684e2370
-
SHA1
4405ef9b18bdfa1c00387c444593c9af1f3e477e
-
SHA256
fc37ede157d3ba57cc8567e0df79e7e64ecdbebf7e4e254aed3844af387cfb37
-
SHA512
e0c5d5002b6f6acb97eac15fd85efef60ffc70dff55c429cec5902955c53b6abb846372edc2381a3587631e5677566969f10826bd99e4ddc2f2111139261bd07
-
SSDEEP
6144:n3C9BRIG0asYFm71mJl3/X8mak5gNv9rC8IwLaYNUvtTxTKMMk:n3C9uYA7i3/stR9HGYyvtTxTKMR
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4108-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3776-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-49-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4452-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/884-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2552-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4108 nhnnbb.exe 3776 ppppj.exe 4564 nbbnhb.exe 4744 djjdp.exe 4416 7rllffx.exe 4452 hnthnh.exe 4408 djvpj.exe 3448 rlfflxx.exe 4780 vvjjv.exe 4480 ppjdv.exe 2924 vjjvp.exe 1500 llxrlll.exe 4176 thnhbt.exe 4700 nnhthn.exe 884 7hnhhh.exe 1236 rxfffff.exe 3212 thtnhh.exe 2920 dvvvj.exe 5064 lrrrxxl.exe 2944 hhbttt.exe 4860 jdvpv.exe 1096 xlfrlfx.exe 2232 bbhhhh.exe 2552 xfrlfff.exe 1084 nhhhnn.exe 2720 3ppvd.exe 2392 ppvvp.exe 4708 tbhbnh.exe 3052 dvvjd.exe 3756 xfrllfx.exe 1504 bhnhbb.exe 4656 xllxrxr.exe 4036 jdpdj.exe 4984 xfffxxx.exe 804 hhnttb.exe 3732 vjdjd.exe 4968 vpvjd.exe 1000 rrlllfr.exe 2352 bbnhtn.exe 4360 pdddv.exe 2396 rfrfxrl.exe 3156 nnnnhh.exe 912 pjjdd.exe 4452 xrxflxf.exe 452 nhttnh.exe 3420 nhnttt.exe 1900 vjpjp.exe 1680 ffrrxxf.exe 1628 9hbtnt.exe 3852 dvdvp.exe 1676 pddvp.exe 4724 xrxrffx.exe 3128 bbttnh.exe 1832 bnbbhb.exe 3692 vpvvd.exe 3796 1xfxrrl.exe 3284 9thbbb.exe 4348 vdpjv.exe 2976 rxxxrxx.exe 2772 ppdvp.exe 5104 vpdvp.exe 4048 llfxflr.exe 1288 hbtnhb.exe 4204 pddvv.exe -
resource yara_rule behavioral2/memory/3124-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2552-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1flfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flllxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlffl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3124 wrote to memory of 4108 3124 fc37ede157d3ba57cc8567e0df79e7e64ecdbebf7e4e254aed3844af387cfb37N.exe 85 PID 3124 wrote to memory of 4108 3124 fc37ede157d3ba57cc8567e0df79e7e64ecdbebf7e4e254aed3844af387cfb37N.exe 85 PID 3124 wrote to memory of 4108 3124 fc37ede157d3ba57cc8567e0df79e7e64ecdbebf7e4e254aed3844af387cfb37N.exe 85 PID 4108 wrote to memory of 3776 4108 nhnnbb.exe 86 PID 4108 wrote to memory of 3776 4108 nhnnbb.exe 86 PID 4108 wrote to memory of 3776 4108 nhnnbb.exe 86 PID 3776 wrote to memory of 4564 3776 ppppj.exe 88 PID 3776 wrote to memory of 4564 3776 ppppj.exe 88 PID 3776 wrote to memory of 4564 3776 ppppj.exe 88 PID 4564 wrote to memory of 4744 4564 nbbnhb.exe 89 PID 4564 wrote to memory of 4744 4564 nbbnhb.exe 89 PID 4564 wrote to memory of 4744 4564 nbbnhb.exe 89 PID 4744 wrote to memory of 4416 4744 djjdp.exe 90 PID 4744 wrote to memory of 4416 4744 djjdp.exe 90 PID 4744 wrote to memory of 4416 4744 djjdp.exe 90 PID 4416 wrote to memory of 4452 4416 7rllffx.exe 91 PID 4416 wrote to memory of 4452 4416 7rllffx.exe 91 PID 4416 wrote to memory of 4452 4416 7rllffx.exe 91 PID 4452 wrote to memory of 4408 4452 hnthnh.exe 92 PID 4452 wrote to memory of 4408 4452 hnthnh.exe 92 PID 4452 wrote to memory of 4408 4452 hnthnh.exe 92 PID 4408 wrote to memory of 3448 4408 djvpj.exe 93 PID 4408 wrote to memory of 3448 4408 djvpj.exe 93 PID 4408 wrote to memory of 3448 4408 djvpj.exe 93 PID 3448 wrote to memory of 4780 3448 rlfflxx.exe 94 PID 3448 wrote to memory of 4780 3448 rlfflxx.exe 94 PID 3448 wrote to memory of 4780 3448 rlfflxx.exe 94 PID 4780 wrote to memory of 4480 4780 vvjjv.exe 95 PID 4780 wrote to memory of 4480 4780 vvjjv.exe 95 PID 4780 wrote to memory of 4480 4780 vvjjv.exe 95 PID 4480 wrote to memory of 2924 4480 ppjdv.exe 96 PID 4480 wrote to memory of 2924 4480 ppjdv.exe 96 PID 4480 wrote to memory of 2924 4480 ppjdv.exe 96 PID 2924 wrote to memory of 1500 2924 vjjvp.exe 97 PID 2924 wrote to memory of 1500 2924 vjjvp.exe 97 PID 2924 wrote to memory of 1500 2924 vjjvp.exe 97 PID 1500 wrote to memory of 4176 1500 llxrlll.exe 98 PID 1500 wrote to memory of 4176 1500 llxrlll.exe 98 PID 1500 wrote to memory of 4176 1500 llxrlll.exe 98 PID 4176 wrote to memory of 4700 4176 thnhbt.exe 99 PID 4176 wrote to memory of 4700 4176 thnhbt.exe 99 PID 4176 wrote to memory of 4700 4176 thnhbt.exe 99 PID 4700 wrote to memory of 884 4700 nnhthn.exe 100 PID 4700 wrote to memory of 884 4700 nnhthn.exe 100 PID 4700 wrote to memory of 884 4700 nnhthn.exe 100 PID 884 wrote to memory of 1236 884 7hnhhh.exe 101 PID 884 wrote to memory of 1236 884 7hnhhh.exe 101 PID 884 wrote to memory of 1236 884 7hnhhh.exe 101 PID 1236 wrote to memory of 3212 1236 rxfffff.exe 102 PID 1236 wrote to memory of 3212 1236 rxfffff.exe 102 PID 1236 wrote to memory of 3212 1236 rxfffff.exe 102 PID 3212 wrote to memory of 2920 3212 thtnhh.exe 103 PID 3212 wrote to memory of 2920 3212 thtnhh.exe 103 PID 3212 wrote to memory of 2920 3212 thtnhh.exe 103 PID 2920 wrote to memory of 5064 2920 dvvvj.exe 104 PID 2920 wrote to memory of 5064 2920 dvvvj.exe 104 PID 2920 wrote to memory of 5064 2920 dvvvj.exe 104 PID 5064 wrote to memory of 2944 5064 lrrrxxl.exe 105 PID 5064 wrote to memory of 2944 5064 lrrrxxl.exe 105 PID 5064 wrote to memory of 2944 5064 lrrrxxl.exe 105 PID 2944 wrote to memory of 4860 2944 hhbttt.exe 106 PID 2944 wrote to memory of 4860 2944 hhbttt.exe 106 PID 2944 wrote to memory of 4860 2944 hhbttt.exe 106 PID 4860 wrote to memory of 1096 4860 jdvpv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc37ede157d3ba57cc8567e0df79e7e64ecdbebf7e4e254aed3844af387cfb37N.exe"C:\Users\Admin\AppData\Local\Temp\fc37ede157d3ba57cc8567e0df79e7e64ecdbebf7e4e254aed3844af387cfb37N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\nhnnbb.exec:\nhnnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\ppppj.exec:\ppppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\nbbnhb.exec:\nbbnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\djjdp.exec:\djjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\7rllffx.exec:\7rllffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\hnthnh.exec:\hnthnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\djvpj.exec:\djvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\rlfflxx.exec:\rlfflxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\vvjjv.exec:\vvjjv.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\ppjdv.exec:\ppjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\vjjvp.exec:\vjjvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\llxrlll.exec:\llxrlll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\thnhbt.exec:\thnhbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\nnhthn.exec:\nnhthn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\7hnhhh.exec:\7hnhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\rxfffff.exec:\rxfffff.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\thtnhh.exec:\thtnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\dvvvj.exec:\dvvvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\lrrrxxl.exec:\lrrrxxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\hhbttt.exec:\hhbttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\jdvpv.exec:\jdvpv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\xlfrlfx.exec:\xlfrlfx.exe23⤵
- Executes dropped EXE
PID:1096 -
\??\c:\bbhhhh.exec:\bbhhhh.exe24⤵
- Executes dropped EXE
PID:2232 -
\??\c:\xfrlfff.exec:\xfrlfff.exe25⤵
- Executes dropped EXE
PID:2552 -
\??\c:\nhhhnn.exec:\nhhhnn.exe26⤵
- Executes dropped EXE
PID:1084 -
\??\c:\3ppvd.exec:\3ppvd.exe27⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ppvvp.exec:\ppvvp.exe28⤵
- Executes dropped EXE
PID:2392 -
\??\c:\tbhbnh.exec:\tbhbnh.exe29⤵
- Executes dropped EXE
PID:4708 -
\??\c:\dvvjd.exec:\dvvjd.exe30⤵
- Executes dropped EXE
PID:3052 -
\??\c:\xfrllfx.exec:\xfrllfx.exe31⤵
- Executes dropped EXE
PID:3756 -
\??\c:\bhnhbb.exec:\bhnhbb.exe32⤵
- Executes dropped EXE
PID:1504 -
\??\c:\xllxrxr.exec:\xllxrxr.exe33⤵
- Executes dropped EXE
PID:4656 -
\??\c:\jdpdj.exec:\jdpdj.exe34⤵
- Executes dropped EXE
PID:4036 -
\??\c:\xfffxxx.exec:\xfffxxx.exe35⤵
- Executes dropped EXE
PID:4984 -
\??\c:\1llffxr.exec:\1llffxr.exe36⤵PID:4824
-
\??\c:\hhnttb.exec:\hhnttb.exe37⤵
- Executes dropped EXE
PID:804 -
\??\c:\vjdjd.exec:\vjdjd.exe38⤵
- Executes dropped EXE
PID:3732 -
\??\c:\vpvjd.exec:\vpvjd.exe39⤵
- Executes dropped EXE
PID:4968 -
\??\c:\rrlllfr.exec:\rrlllfr.exe40⤵
- Executes dropped EXE
PID:1000 -
\??\c:\bbnhtn.exec:\bbnhtn.exe41⤵
- Executes dropped EXE
PID:2352 -
\??\c:\pdddv.exec:\pdddv.exe42⤵
- Executes dropped EXE
PID:4360 -
\??\c:\rfrfxrl.exec:\rfrfxrl.exe43⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nnnnhh.exec:\nnnnhh.exe44⤵
- Executes dropped EXE
PID:3156 -
\??\c:\pjjdd.exec:\pjjdd.exe45⤵
- Executes dropped EXE
PID:912 -
\??\c:\xrxflxf.exec:\xrxflxf.exe46⤵
- Executes dropped EXE
PID:4452 -
\??\c:\nhttnh.exec:\nhttnh.exe47⤵
- Executes dropped EXE
PID:452 -
\??\c:\nhnttt.exec:\nhnttt.exe48⤵
- Executes dropped EXE
PID:3420 -
\??\c:\vjpjp.exec:\vjpjp.exe49⤵
- Executes dropped EXE
PID:1900 -
\??\c:\ffrrxxf.exec:\ffrrxxf.exe50⤵
- Executes dropped EXE
PID:1680 -
\??\c:\9hbtnt.exec:\9hbtnt.exe51⤵
- Executes dropped EXE
PID:1628 -
\??\c:\dvdvp.exec:\dvdvp.exe52⤵
- Executes dropped EXE
PID:3852 -
\??\c:\pddvp.exec:\pddvp.exe53⤵
- Executes dropped EXE
PID:1676 -
\??\c:\xrxrffx.exec:\xrxrffx.exe54⤵
- Executes dropped EXE
PID:4724 -
\??\c:\bbttnh.exec:\bbttnh.exe55⤵
- Executes dropped EXE
PID:3128 -
\??\c:\bnbbhb.exec:\bnbbhb.exe56⤵
- Executes dropped EXE
PID:1832 -
\??\c:\vpvvd.exec:\vpvvd.exe57⤵
- Executes dropped EXE
PID:3692 -
\??\c:\1xfxrrl.exec:\1xfxrrl.exe58⤵
- Executes dropped EXE
PID:3796 -
\??\c:\9thbbb.exec:\9thbbb.exe59⤵
- Executes dropped EXE
PID:3284 -
\??\c:\vdpjv.exec:\vdpjv.exe60⤵
- Executes dropped EXE
PID:4348 -
\??\c:\rxxxrxx.exec:\rxxxrxx.exe61⤵
- Executes dropped EXE
PID:2976 -
\??\c:\ppdvp.exec:\ppdvp.exe62⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vpdvp.exec:\vpdvp.exe63⤵
- Executes dropped EXE
PID:5104 -
\??\c:\llfxflr.exec:\llfxflr.exe64⤵
- Executes dropped EXE
PID:4048 -
\??\c:\hbtnhb.exec:\hbtnhb.exe65⤵
- Executes dropped EXE
PID:1288 -
\??\c:\pddvv.exec:\pddvv.exe66⤵
- Executes dropped EXE
PID:4204 -
\??\c:\7jvpp.exec:\7jvpp.exe67⤵PID:932
-
\??\c:\frrfxxr.exec:\frrfxxr.exe68⤵PID:1456
-
\??\c:\bttnhh.exec:\bttnhh.exe69⤵PID:4432
-
\??\c:\3pppj.exec:\3pppj.exe70⤵PID:4040
-
\??\c:\fxlfxrl.exec:\fxlfxrl.exe71⤵PID:2608
-
\??\c:\hbhhbb.exec:\hbhhbb.exe72⤵PID:220
-
\??\c:\9djdd.exec:\9djdd.exe73⤵PID:1696
-
\??\c:\xxfxlfr.exec:\xxfxlfr.exe74⤵PID:1444
-
\??\c:\ttbnbh.exec:\ttbnbh.exe75⤵PID:2584
-
\??\c:\pjpjv.exec:\pjpjv.exe76⤵PID:3604
-
\??\c:\dvjvp.exec:\dvjvp.exe77⤵PID:4044
-
\??\c:\thhbbb.exec:\thhbbb.exe78⤵PID:2788
-
\??\c:\1jvpp.exec:\1jvpp.exe79⤵PID:1572
-
\??\c:\fxxrlxx.exec:\fxxrlxx.exe80⤵PID:1524
-
\??\c:\hnbbhh.exec:\hnbbhh.exe81⤵PID:3980
-
\??\c:\9hnhhh.exec:\9hnhhh.exe82⤵PID:4216
-
\??\c:\jpjdv.exec:\jpjdv.exe83⤵PID:3540
-
\??\c:\3lflllf.exec:\3lflllf.exe84⤵PID:4340
-
\??\c:\nbnnhh.exec:\nbnnhh.exe85⤵PID:2984
-
\??\c:\pjjpj.exec:\pjjpj.exe86⤵PID:4024
-
\??\c:\pjpjd.exec:\pjpjd.exe87⤵PID:4108
-
\??\c:\5lrrlll.exec:\5lrrlll.exe88⤵PID:1888
-
\??\c:\xllffff.exec:\xllffff.exe89⤵PID:3832
-
\??\c:\thhhbh.exec:\thhhbh.exe90⤵PID:2352
-
\??\c:\dpdvd.exec:\dpdvd.exe91⤵PID:1116
-
\??\c:\fxfxffl.exec:\fxfxffl.exe92⤵PID:2448
-
\??\c:\flrrllx.exec:\flrrllx.exe93⤵PID:1996
-
\??\c:\tbhbtn.exec:\tbhbtn.exe94⤵PID:4416
-
\??\c:\jdvjd.exec:\jdvjd.exe95⤵PID:4904
-
\??\c:\xrrlxxx.exec:\xrrlxxx.exe96⤵PID:3688
-
\??\c:\bbhbtt.exec:\bbhbtt.exe97⤵PID:3556
-
\??\c:\3thbnh.exec:\3thbnh.exe98⤵PID:3452
-
\??\c:\1ppjd.exec:\1ppjd.exe99⤵PID:468
-
\??\c:\ppvpv.exec:\ppvpv.exe100⤵PID:1684
-
\??\c:\frxxrxx.exec:\frxxrxx.exe101⤵PID:4712
-
\??\c:\nhhnhn.exec:\nhhnhn.exe102⤵PID:3024
-
\??\c:\nbhbnn.exec:\nbhbnn.exe103⤵PID:1788
-
\??\c:\1jjdv.exec:\1jjdv.exe104⤵PID:836
-
\??\c:\flxrrrr.exec:\flxrrrr.exe105⤵PID:1520
-
\??\c:\xrllfxx.exec:\xrllfxx.exe106⤵PID:4488
-
\??\c:\bnhhbt.exec:\bnhhbt.exe107⤵PID:4460
-
\??\c:\1jvpd.exec:\1jvpd.exe108⤵PID:3304
-
\??\c:\5ppdv.exec:\5ppdv.exe109⤵PID:3764
-
\??\c:\xlxrfxr.exec:\xlxrfxr.exe110⤵PID:1416
-
\??\c:\9ttnbb.exec:\9ttnbb.exe111⤵PID:5024
-
\??\c:\btbnbb.exec:\btbnbb.exe112⤵PID:3324
-
\??\c:\vpppv.exec:\vpppv.exe113⤵PID:1360
-
\??\c:\1rxxrrr.exec:\1rxxrrr.exe114⤵PID:5064
-
\??\c:\xlffrrl.exec:\xlffrrl.exe115⤵PID:5084
-
\??\c:\nhnntn.exec:\nhnntn.exe116⤵PID:3048
-
\??\c:\jvjvp.exec:\jvjvp.exe117⤵PID:2356
-
\??\c:\7jvpv.exec:\7jvpv.exe118⤵PID:3416
-
\??\c:\xrxrflf.exec:\xrxrflf.exe119⤵PID:4168
-
\??\c:\9hhbtt.exec:\9hhbtt.exe120⤵PID:2224
-
\??\c:\hbhbhh.exec:\hbhbhh.exe121⤵PID:640
-
\??\c:\3vvpd.exec:\3vvpd.exe122⤵PID:760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-