Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 22:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dd0038ce3a5311bcb19bb53b66bb1203b968adefe28f21416259da3d27c92a6dN.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
dd0038ce3a5311bcb19bb53b66bb1203b968adefe28f21416259da3d27c92a6dN.exe
-
Size
65KB
-
MD5
7f68282ce25368c0ee4572a49cfa93f0
-
SHA1
7f27b5ee03c9eb6f159efe65d7af6156c3fab21d
-
SHA256
dd0038ce3a5311bcb19bb53b66bb1203b968adefe28f21416259da3d27c92a6d
-
SHA512
c2e2998ff196224f54107892d1216af109f5ff42b8ae67b9c01fa66c0cdd7235336041ff2a609725aa049df459ad41e013ff3157f01c37322eb038746a73a94a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27elY:ymb3NkkiQ3mdBjFI9Pm
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2100-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/832-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3788-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/684-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1144-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/544-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1568-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1096-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2100 thhbhb.exe 3556 1hhbbt.exe 3788 djdvj.exe 3128 1lxlxlf.exe 3996 tnbthb.exe 684 jdpvv.exe 4004 rlffrrf.exe 2264 1xrffxl.exe 1144 hhhbnh.exe 544 frrlfxr.exe 636 xrrlflf.exe 2104 tnntbh.exe 2792 vjdvj.exe 1340 pdpdp.exe 3856 lrlrfxl.exe 3612 tnbthb.exe 4220 7nbthb.exe 1568 pvpjv.exe 3024 ffrrfrr.exe 1520 5nbtnn.exe 3936 3jpjd.exe 1208 xxxlxlf.exe 1096 7nnhtt.exe 2248 1ppdd.exe 4636 dpdpd.exe 1700 9fxxxfx.exe 2892 thbtnh.exe 1032 ddjdp.exe 3328 3lrfrrr.exe 3008 7vdvv.exe 1900 xfrlfxr.exe 3104 5hnnhh.exe 916 hbbnbb.exe 4364 3dddp.exe 2224 lllfrrr.exe 4036 fxxrrll.exe 2512 htbntn.exe 3208 1vdpp.exe 220 5jvjd.exe 3756 9xllfrr.exe 752 bhtnhb.exe 4856 tbhthb.exe 4228 vpjdp.exe 1688 3pjvj.exe 4480 rlfxlfr.exe 3692 lrrlfxx.exe 1404 bhhbnn.exe 1400 thbtbb.exe 784 dvpjv.exe 1904 fllxlxr.exe 544 xlfrxlr.exe 508 xxlffxx.exe 4828 nbnnhb.exe 2392 5vdvp.exe 4632 1ppjv.exe 5004 rrfrlxl.exe 3504 xrxxffl.exe 3628 nnnhtt.exe 3612 jpvjd.exe 1988 jjdpd.exe 1092 xrffxrx.exe 2028 1llfxxr.exe 5060 thhbhb.exe 3688 nhtnhb.exe -
resource yara_rule behavioral2/memory/832-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/832-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3788-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/684-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/684-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/684-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1144-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1144-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1144-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/544-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3856-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1568-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1096-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dd0038ce3a5311bcb19bb53b66bb1203b968adefe28f21416259da3d27c92a6dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 832 wrote to memory of 2100 832 dd0038ce3a5311bcb19bb53b66bb1203b968adefe28f21416259da3d27c92a6dN.exe 83 PID 832 wrote to memory of 2100 832 dd0038ce3a5311bcb19bb53b66bb1203b968adefe28f21416259da3d27c92a6dN.exe 83 PID 832 wrote to memory of 2100 832 dd0038ce3a5311bcb19bb53b66bb1203b968adefe28f21416259da3d27c92a6dN.exe 83 PID 2100 wrote to memory of 3556 2100 thhbhb.exe 85 PID 2100 wrote to memory of 3556 2100 thhbhb.exe 85 PID 2100 wrote to memory of 3556 2100 thhbhb.exe 85 PID 3556 wrote to memory of 3788 3556 1hhbbt.exe 86 PID 3556 wrote to memory of 3788 3556 1hhbbt.exe 86 PID 3556 wrote to memory of 3788 3556 1hhbbt.exe 86 PID 3788 wrote to memory of 3128 3788 djdvj.exe 87 PID 3788 wrote to memory of 3128 3788 djdvj.exe 87 PID 3788 wrote to memory of 3128 3788 djdvj.exe 87 PID 3128 wrote to memory of 3996 3128 1lxlxlf.exe 88 PID 3128 wrote to memory of 3996 3128 1lxlxlf.exe 88 PID 3128 wrote to memory of 3996 3128 1lxlxlf.exe 88 PID 3996 wrote to memory of 684 3996 tnbthb.exe 89 PID 3996 wrote to memory of 684 3996 tnbthb.exe 89 PID 3996 wrote to memory of 684 3996 tnbthb.exe 89 PID 684 wrote to memory of 4004 684 jdpvv.exe 90 PID 684 wrote to memory of 4004 684 jdpvv.exe 90 PID 684 wrote to memory of 4004 684 jdpvv.exe 90 PID 4004 wrote to memory of 2264 4004 rlffrrf.exe 92 PID 4004 wrote to memory of 2264 4004 rlffrrf.exe 92 PID 4004 wrote to memory of 2264 4004 rlffrrf.exe 92 PID 2264 wrote to memory of 1144 2264 1xrffxl.exe 93 PID 2264 wrote to memory of 1144 2264 1xrffxl.exe 93 PID 2264 wrote to memory of 1144 2264 1xrffxl.exe 93 PID 1144 wrote to memory of 544 1144 hhhbnh.exe 94 PID 1144 wrote to memory of 544 1144 hhhbnh.exe 94 PID 1144 wrote to memory of 544 1144 hhhbnh.exe 94 PID 544 wrote to memory of 636 544 frrlfxr.exe 95 PID 544 wrote to memory of 636 544 frrlfxr.exe 95 PID 544 wrote to memory of 636 544 frrlfxr.exe 95 PID 636 wrote to memory of 2104 636 xrrlflf.exe 96 PID 636 wrote to memory of 2104 636 xrrlflf.exe 96 PID 636 wrote to memory of 2104 636 xrrlflf.exe 96 PID 2104 wrote to memory of 2792 2104 tnntbh.exe 97 PID 2104 wrote to memory of 2792 2104 tnntbh.exe 97 PID 2104 wrote to memory of 2792 2104 tnntbh.exe 97 PID 2792 wrote to memory of 1340 2792 vjdvj.exe 98 PID 2792 wrote to memory of 1340 2792 vjdvj.exe 98 PID 2792 wrote to memory of 1340 2792 vjdvj.exe 98 PID 1340 wrote to memory of 3856 1340 pdpdp.exe 99 PID 1340 wrote to memory of 3856 1340 pdpdp.exe 99 PID 1340 wrote to memory of 3856 1340 pdpdp.exe 99 PID 3856 wrote to memory of 3612 3856 lrlrfxl.exe 101 PID 3856 wrote to memory of 3612 3856 lrlrfxl.exe 101 PID 3856 wrote to memory of 3612 3856 lrlrfxl.exe 101 PID 3612 wrote to memory of 4220 3612 tnbthb.exe 102 PID 3612 wrote to memory of 4220 3612 tnbthb.exe 102 PID 3612 wrote to memory of 4220 3612 tnbthb.exe 102 PID 4220 wrote to memory of 1568 4220 7nbthb.exe 103 PID 4220 wrote to memory of 1568 4220 7nbthb.exe 103 PID 4220 wrote to memory of 1568 4220 7nbthb.exe 103 PID 1568 wrote to memory of 3024 1568 pvpjv.exe 104 PID 1568 wrote to memory of 3024 1568 pvpjv.exe 104 PID 1568 wrote to memory of 3024 1568 pvpjv.exe 104 PID 3024 wrote to memory of 1520 3024 ffrrfrr.exe 105 PID 3024 wrote to memory of 1520 3024 ffrrfrr.exe 105 PID 3024 wrote to memory of 1520 3024 ffrrfrr.exe 105 PID 1520 wrote to memory of 3936 1520 5nbtnn.exe 106 PID 1520 wrote to memory of 3936 1520 5nbtnn.exe 106 PID 1520 wrote to memory of 3936 1520 5nbtnn.exe 106 PID 3936 wrote to memory of 1208 3936 3jpjd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd0038ce3a5311bcb19bb53b66bb1203b968adefe28f21416259da3d27c92a6dN.exe"C:\Users\Admin\AppData\Local\Temp\dd0038ce3a5311bcb19bb53b66bb1203b968adefe28f21416259da3d27c92a6dN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\thhbhb.exec:\thhbhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\1hhbbt.exec:\1hhbbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\djdvj.exec:\djdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\1lxlxlf.exec:\1lxlxlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\tnbthb.exec:\tnbthb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\jdpvv.exec:\jdpvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\rlffrrf.exec:\rlffrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\1xrffxl.exec:\1xrffxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\hhhbnh.exec:\hhhbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\frrlfxr.exec:\frrlfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\xrrlflf.exec:\xrrlflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\tnntbh.exec:\tnntbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\vjdvj.exec:\vjdvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\pdpdp.exec:\pdpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\lrlrfxl.exec:\lrlrfxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\tnbthb.exec:\tnbthb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\7nbthb.exec:\7nbthb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\pvpjv.exec:\pvpjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\ffrrfrr.exec:\ffrrfrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\5nbtnn.exec:\5nbtnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\3jpjd.exec:\3jpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\xxxlxlf.exec:\xxxlxlf.exe23⤵
- Executes dropped EXE
PID:1208 -
\??\c:\7nnhtt.exec:\7nnhtt.exe24⤵
- Executes dropped EXE
PID:1096 -
\??\c:\1ppdd.exec:\1ppdd.exe25⤵
- Executes dropped EXE
PID:2248 -
\??\c:\dpdpd.exec:\dpdpd.exe26⤵
- Executes dropped EXE
PID:4636 -
\??\c:\9fxxxfx.exec:\9fxxxfx.exe27⤵
- Executes dropped EXE
PID:1700 -
\??\c:\thbtnh.exec:\thbtnh.exe28⤵
- Executes dropped EXE
PID:2892 -
\??\c:\ddjdp.exec:\ddjdp.exe29⤵
- Executes dropped EXE
PID:1032 -
\??\c:\3lrfrrr.exec:\3lrfrrr.exe30⤵
- Executes dropped EXE
PID:3328 -
\??\c:\7vdvv.exec:\7vdvv.exe31⤵
- Executes dropped EXE
PID:3008 -
\??\c:\xfrlfxr.exec:\xfrlfxr.exe32⤵
- Executes dropped EXE
PID:1900 -
\??\c:\5hnnhh.exec:\5hnnhh.exe33⤵
- Executes dropped EXE
PID:3104 -
\??\c:\hbbnbb.exec:\hbbnbb.exe34⤵
- Executes dropped EXE
PID:916 -
\??\c:\3dddp.exec:\3dddp.exe35⤵
- Executes dropped EXE
PID:4364 -
\??\c:\lllfrrr.exec:\lllfrrr.exe36⤵
- Executes dropped EXE
PID:2224 -
\??\c:\fxxrrll.exec:\fxxrrll.exe37⤵
- Executes dropped EXE
PID:4036 -
\??\c:\htbntn.exec:\htbntn.exe38⤵
- Executes dropped EXE
PID:2512 -
\??\c:\1vdpp.exec:\1vdpp.exe39⤵
- Executes dropped EXE
PID:3208 -
\??\c:\5jvjd.exec:\5jvjd.exe40⤵
- Executes dropped EXE
PID:220 -
\??\c:\9xllfrr.exec:\9xllfrr.exe41⤵
- Executes dropped EXE
PID:3756 -
\??\c:\bhtnhb.exec:\bhtnhb.exe42⤵
- Executes dropped EXE
PID:752 -
\??\c:\tbhthb.exec:\tbhthb.exe43⤵
- Executes dropped EXE
PID:4856 -
\??\c:\vpjdp.exec:\vpjdp.exe44⤵
- Executes dropped EXE
PID:4228 -
\??\c:\3pjvj.exec:\3pjvj.exe45⤵
- Executes dropped EXE
PID:1688 -
\??\c:\rlfxlfr.exec:\rlfxlfr.exe46⤵
- Executes dropped EXE
PID:4480 -
\??\c:\lrrlfxx.exec:\lrrlfxx.exe47⤵
- Executes dropped EXE
PID:3692 -
\??\c:\bhhbnn.exec:\bhhbnn.exe48⤵
- Executes dropped EXE
PID:1404 -
\??\c:\thbtbb.exec:\thbtbb.exe49⤵
- Executes dropped EXE
PID:1400 -
\??\c:\dvpjv.exec:\dvpjv.exe50⤵
- Executes dropped EXE
PID:784 -
\??\c:\fllxlxr.exec:\fllxlxr.exe51⤵
- Executes dropped EXE
PID:1904 -
\??\c:\xlfrxlr.exec:\xlfrxlr.exe52⤵
- Executes dropped EXE
PID:544 -
\??\c:\xxlffxx.exec:\xxlffxx.exe53⤵
- Executes dropped EXE
PID:508 -
\??\c:\nbnnhb.exec:\nbnnhb.exe54⤵
- Executes dropped EXE
PID:4828 -
\??\c:\5vdvp.exec:\5vdvp.exe55⤵
- Executes dropped EXE
PID:2392 -
\??\c:\1ppjv.exec:\1ppjv.exe56⤵
- Executes dropped EXE
PID:4632 -
\??\c:\rrfrlxl.exec:\rrfrlxl.exe57⤵
- Executes dropped EXE
PID:5004 -
\??\c:\xrxxffl.exec:\xrxxffl.exe58⤵
- Executes dropped EXE
PID:3504 -
\??\c:\nnnhtt.exec:\nnnhtt.exe59⤵
- Executes dropped EXE
PID:3628 -
\??\c:\jpvjd.exec:\jpvjd.exe60⤵
- Executes dropped EXE
PID:3612 -
\??\c:\jjdpd.exec:\jjdpd.exe61⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xrffxrx.exec:\xrffxrx.exe62⤵
- Executes dropped EXE
PID:1092 -
\??\c:\1llfxxr.exec:\1llfxxr.exe63⤵
- Executes dropped EXE
PID:2028 -
\??\c:\thhbhb.exec:\thhbhb.exe64⤵
- Executes dropped EXE
PID:5060 -
\??\c:\nhtnhb.exec:\nhtnhb.exe65⤵
- Executes dropped EXE
PID:3688 -
\??\c:\7ppdp.exec:\7ppdp.exe66⤵PID:3828
-
\??\c:\5vvpd.exec:\5vvpd.exe67⤵PID:2292
-
\??\c:\5fxrrlf.exec:\5fxrrlf.exe68⤵PID:2732
-
\??\c:\fxlxfxx.exec:\fxlxfxx.exe69⤵PID:2240
-
\??\c:\hbbbtn.exec:\hbbbtn.exe70⤵PID:2248
-
\??\c:\3ddpd.exec:\3ddpd.exe71⤵PID:3644
-
\??\c:\5ddpd.exec:\5ddpd.exe72⤵PID:3320
-
\??\c:\rfxlxrl.exec:\rfxlxrl.exe73⤵PID:2376
-
\??\c:\rlflxlf.exec:\rlflxlf.exe74⤵PID:1436
-
\??\c:\3hnbhn.exec:\3hnbhn.exe75⤵PID:512
-
\??\c:\9hhhbt.exec:\9hhhbt.exe76⤵PID:3080
-
\??\c:\dpjdj.exec:\dpjdj.exe77⤵PID:4576
-
\??\c:\vppjv.exec:\vppjv.exe78⤵PID:1228
-
\??\c:\1xfxxrr.exec:\1xfxxrr.exe79⤵PID:3104
-
\??\c:\htbtnn.exec:\htbtnn.exe80⤵PID:4376
-
\??\c:\thbntt.exec:\thbntt.exe81⤵PID:4732
-
\??\c:\tbbnbb.exec:\tbbnbb.exe82⤵PID:1928
-
\??\c:\djjvj.exec:\djjvj.exe83⤵PID:4280
-
\??\c:\llllrxx.exec:\llllrxx.exe84⤵PID:1964
-
\??\c:\nntnbb.exec:\nntnbb.exe85⤵PID:4008
-
\??\c:\hhbnbb.exec:\hhbnbb.exe86⤵PID:1552
-
\??\c:\7vdpd.exec:\7vdpd.exe87⤵PID:1252
-
\??\c:\vjpjd.exec:\vjpjd.exe88⤵PID:444
-
\??\c:\ffrrlxx.exec:\ffrrlxx.exe89⤵PID:2664
-
\??\c:\lrxxrxr.exec:\lrxxrxr.exe90⤵PID:4844
-
\??\c:\9nnnhb.exec:\9nnnhb.exe91⤵PID:1992
-
\??\c:\htbthb.exec:\htbthb.exe92⤵PID:684
-
\??\c:\ddjdp.exec:\ddjdp.exe93⤵PID:4480
-
\??\c:\vdvdd.exec:\vdvdd.exe94⤵PID:1540
-
\??\c:\7flrlfl.exec:\7flrlfl.exe95⤵PID:4352
-
\??\c:\7bbbbn.exec:\7bbbbn.exe96⤵PID:1144
-
\??\c:\bbnhnn.exec:\bbnhnn.exe97⤵PID:4984
-
\??\c:\dvvvp.exec:\dvvvp.exe98⤵PID:624
-
\??\c:\1pjdp.exec:\1pjdp.exe99⤵PID:3532
-
\??\c:\5lffrfr.exec:\5lffrfr.exe100⤵PID:1112
-
\??\c:\btbhhh.exec:\btbhhh.exe101⤵PID:4416
-
\??\c:\ttnnnt.exec:\ttnnnt.exe102⤵PID:4988
-
\??\c:\vpjdp.exec:\vpjdp.exe103⤵PID:1836
-
\??\c:\ffrllrr.exec:\ffrllrr.exe104⤵PID:4288
-
\??\c:\fflrxxf.exec:\fflrxxf.exe105⤵PID:3856
-
\??\c:\bntttt.exec:\bntttt.exe106⤵PID:3268
-
\??\c:\3tbbnn.exec:\3tbbnn.exe107⤵PID:2188
-
\??\c:\dpdvj.exec:\dpdvj.exe108⤵PID:452
-
\??\c:\pvvpd.exec:\pvvpd.exe109⤵PID:1568
-
\??\c:\fxlflfl.exec:\fxlflfl.exe110⤵PID:4424
-
\??\c:\7fllfff.exec:\7fllfff.exe111⤵PID:1912
-
\??\c:\1ntttt.exec:\1ntttt.exe112⤵PID:2472
-
\??\c:\bnnnhh.exec:\bnnnhh.exe113⤵PID:3828
-
\??\c:\5nnnhh.exec:\5nnnhh.exe114⤵PID:1208
-
\??\c:\3vvvv.exec:\3vvvv.exe115⤵PID:1108
-
\??\c:\rlllxxr.exec:\rlllxxr.exe116⤵PID:1536
-
\??\c:\flllffx.exec:\flllffx.exe117⤵PID:2076
-
\??\c:\hhtttt.exec:\hhtttt.exe118⤵PID:4716
-
\??\c:\ntbbnn.exec:\ntbbnn.exe119⤵PID:3132
-
\??\c:\jvjdp.exec:\jvjdp.exe120⤵PID:2032
-
\??\c:\3vpjv.exec:\3vpjv.exe121⤵PID:2928
-
\??\c:\rxxfrxx.exec:\rxxfrxx.exe122⤵PID:4452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-