Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 19:58
Static task
static1
Behavioral task
behavioral1
Sample
695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe
Resource
win7-20240903-en
General
-
Target
695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe
-
Size
49KB
-
MD5
3b9eedf4db998c4f18a0c7ce94a47e44
-
SHA1
8e68b50ae5c2f8b589727f0c9135da44646f03d8
-
SHA256
695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15
-
SHA512
173fc95204b3924949ee001675e653b40e8cafdc3ef0f9b7e5d9e870067eb55b01c6d62ec5b73ab1740733d0ba7d07a50a066fb636246c48b16ae9808e2dbcfc
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5bx7DUa:0cdpeeBSHHMHLf9Rybx7D5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 58 IoCs
Processes:
resource yara_rule behavioral1/memory/1972-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-34-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2144-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2284-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-53-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2832-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-74-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2748-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/356-110-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/588-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-149-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2908-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-165-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1632-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-186-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2792-197-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2592-214-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/2268-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1300-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1600-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-342-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-355-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2668-356-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1164-382-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/692-390-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-398-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1164-405-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1992-412-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-463-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1500-477-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1144-490-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/2148-499-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2148-497-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2324-513-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-564-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-584-0x00000000003B0000-0x00000000003D9000-memory.dmp family_blackmoon behavioral1/memory/1724-851-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-870-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1956-954-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2716-1121-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2260-1061-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2528-1000-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-907-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1572-825-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-775-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-774-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/332-674-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2616-648-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2644-641-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vvdvd.exerrxxffl.exennbhtb.exe9pjpv.exexrflxfr.exerfrrrxl.exebbttbt.exepdppp.exepjddd.exerlxlxxl.exennttnn.exetbnntb.exe9dpdd.exerrrlrlx.exefrrlrrf.exethhhbn.exevvjvv.exevjpvj.exerffllfl.exe3nthth.exetbbntb.exelllfxfx.exexlxxxxf.exebbnbbh.exenbtnth.exeppdpj.exe5rfxxxr.exenbbnnn.exenhnnhh.exepjvpv.exellrxflf.exerlxrffl.exe3hbhnb.exe3jpvp.exepvjjv.exexxllllr.exehhtbnb.exe5hbbhh.exe3jdjj.exe3dddp.exe5rrrrxf.exe7lxflff.exe9nnntt.exeppppj.exevppjv.exellrrxfl.exennbbnt.exebbttbh.exe3pddd.exejjvvv.exefrlrflx.exetnbnnt.exennbhbh.exevpddd.exelllrrfl.exetnthbh.exenhnhnt.exeddppv.exe9rffxfl.exexxlrfrl.exehhttbn.exe5htttn.exedvdjd.exejpvpv.exepid process 1864 vvdvd.exe 2536 rrxxffl.exe 2144 nnbhtb.exe 2284 9pjpv.exe 2832 xrflxfr.exe 3016 rfrrrxl.exe 2772 bbttbt.exe 2748 pdppp.exe 2628 pjddd.exe 2188 rlxlxxl.exe 356 nnttnn.exe 652 tbnntb.exe 2928 9dpdd.exe 588 rrrlrlx.exe 2908 frrlrrf.exe 1996 thhhbn.exe 1824 vvjvv.exe 1632 vjpvj.exe 2988 rffllfl.exe 2792 3nthth.exe 1852 tbbntb.exe 2592 lllfxfx.exe 1288 xlxxxxf.exe 2268 bbnbbh.exe 1620 nbtnth.exe 2136 ppdpj.exe 2180 5rfxxxr.exe 1300 nbbnnn.exe 1040 nhnnhh.exe 2336 pjvpv.exe 1708 llrxflf.exe 1600 rlxrffl.exe 1788 3hbhnb.exe 1724 3jpvp.exe 1264 pvjjv.exe 2836 xxllllr.exe 3024 hhtbnb.exe 2620 5hbbhh.exe 2648 3jdjj.exe 2668 3dddp.exe 2820 5rrrrxf.exe 2676 7lxflff.exe 2168 9nnntt.exe 1164 ppppj.exe 692 vppjv.exe 1536 llrrxfl.exe 2700 nnbbnt.exe 1992 bbttbh.exe 1480 3pddd.exe 1956 jjvvv.exe 1804 frlrflx.exe 1816 tnbnnt.exe 2000 nnbhbh.exe 1528 vpddd.exe 2984 lllrrfl.exe 1636 tnthbh.exe 844 nhnhnt.exe 1500 ddppv.exe 2576 9rffxfl.exe 1144 xxlrfrl.exe 2148 hhttbn.exe 2580 5htttn.exe 2324 dvdjd.exe 3056 jpvpv.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1rrrfxl.exehbtbnt.exelfxxxrx.exe7jjvj.exerlxxlrx.exe1rlrxrx.exe1hhbtn.exennhthn.exevvvdj.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exevvdvd.exerrxxffl.exennbhtb.exe9pjpv.exexrflxfr.exerfrrrxl.exebbttbt.exepdppp.exepjddd.exerlxlxxl.exennttnn.exetbnntb.exe9dpdd.exerrrlrlx.exefrrlrrf.exedescription pid process target process PID 1972 wrote to memory of 1864 1972 695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe vvdvd.exe PID 1972 wrote to memory of 1864 1972 695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe vvdvd.exe PID 1972 wrote to memory of 1864 1972 695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe vvdvd.exe PID 1972 wrote to memory of 1864 1972 695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe vvdvd.exe PID 1864 wrote to memory of 2536 1864 vvdvd.exe rrxxffl.exe PID 1864 wrote to memory of 2536 1864 vvdvd.exe rrxxffl.exe PID 1864 wrote to memory of 2536 1864 vvdvd.exe rrxxffl.exe PID 1864 wrote to memory of 2536 1864 vvdvd.exe rrxxffl.exe PID 2536 wrote to memory of 2144 2536 rrxxffl.exe nnbhtb.exe PID 2536 wrote to memory of 2144 2536 rrxxffl.exe nnbhtb.exe PID 2536 wrote to memory of 2144 2536 rrxxffl.exe nnbhtb.exe PID 2536 wrote to memory of 2144 2536 rrxxffl.exe nnbhtb.exe PID 2144 wrote to memory of 2284 2144 nnbhtb.exe 9pjpv.exe PID 2144 wrote to memory of 2284 2144 nnbhtb.exe 9pjpv.exe PID 2144 wrote to memory of 2284 2144 nnbhtb.exe 9pjpv.exe PID 2144 wrote to memory of 2284 2144 nnbhtb.exe 9pjpv.exe PID 2284 wrote to memory of 2832 2284 9pjpv.exe xrflxfr.exe PID 2284 wrote to memory of 2832 2284 9pjpv.exe xrflxfr.exe PID 2284 wrote to memory of 2832 2284 9pjpv.exe xrflxfr.exe PID 2284 wrote to memory of 2832 2284 9pjpv.exe xrflxfr.exe PID 2832 wrote to memory of 3016 2832 xrflxfr.exe rfrrrxl.exe PID 2832 wrote to memory of 3016 2832 xrflxfr.exe rfrrrxl.exe PID 2832 wrote to memory of 3016 2832 xrflxfr.exe rfrrrxl.exe PID 2832 wrote to memory of 3016 2832 xrflxfr.exe rfrrrxl.exe PID 3016 wrote to memory of 2772 3016 rfrrrxl.exe bbttbt.exe PID 3016 wrote to memory of 2772 3016 rfrrrxl.exe bbttbt.exe PID 3016 wrote to memory of 2772 3016 rfrrrxl.exe bbttbt.exe PID 3016 wrote to memory of 2772 3016 rfrrrxl.exe bbttbt.exe PID 2772 wrote to memory of 2748 2772 bbttbt.exe pdppp.exe PID 2772 wrote to memory of 2748 2772 bbttbt.exe pdppp.exe PID 2772 wrote to memory of 2748 2772 bbttbt.exe pdppp.exe PID 2772 wrote to memory of 2748 2772 bbttbt.exe pdppp.exe PID 2748 wrote to memory of 2628 2748 pdppp.exe pjddd.exe PID 2748 wrote to memory of 2628 2748 pdppp.exe pjddd.exe PID 2748 wrote to memory of 2628 2748 pdppp.exe pjddd.exe PID 2748 wrote to memory of 2628 2748 pdppp.exe pjddd.exe PID 2628 wrote to memory of 2188 2628 pjddd.exe rlxlxxl.exe PID 2628 wrote to memory of 2188 2628 pjddd.exe rlxlxxl.exe PID 2628 wrote to memory of 2188 2628 pjddd.exe rlxlxxl.exe PID 2628 wrote to memory of 2188 2628 pjddd.exe rlxlxxl.exe PID 2188 wrote to memory of 356 2188 rlxlxxl.exe nnttnn.exe PID 2188 wrote to memory of 356 2188 rlxlxxl.exe nnttnn.exe PID 2188 wrote to memory of 356 2188 rlxlxxl.exe nnttnn.exe PID 2188 wrote to memory of 356 2188 rlxlxxl.exe nnttnn.exe PID 356 wrote to memory of 652 356 nnttnn.exe tbnntb.exe PID 356 wrote to memory of 652 356 nnttnn.exe tbnntb.exe PID 356 wrote to memory of 652 356 nnttnn.exe tbnntb.exe PID 356 wrote to memory of 652 356 nnttnn.exe tbnntb.exe PID 652 wrote to memory of 2928 652 tbnntb.exe 9dpdd.exe PID 652 wrote to memory of 2928 652 tbnntb.exe 9dpdd.exe PID 652 wrote to memory of 2928 652 tbnntb.exe 9dpdd.exe PID 652 wrote to memory of 2928 652 tbnntb.exe 9dpdd.exe PID 2928 wrote to memory of 588 2928 9dpdd.exe rrrlrlx.exe PID 2928 wrote to memory of 588 2928 9dpdd.exe rrrlrlx.exe PID 2928 wrote to memory of 588 2928 9dpdd.exe rrrlrlx.exe PID 2928 wrote to memory of 588 2928 9dpdd.exe rrrlrlx.exe PID 588 wrote to memory of 2908 588 rrrlrlx.exe frrlrrf.exe PID 588 wrote to memory of 2908 588 rrrlrlx.exe frrlrrf.exe PID 588 wrote to memory of 2908 588 rrrlrlx.exe frrlrrf.exe PID 588 wrote to memory of 2908 588 rrrlrlx.exe frrlrrf.exe PID 2908 wrote to memory of 1996 2908 frrlrrf.exe thhhbn.exe PID 2908 wrote to memory of 1996 2908 frrlrrf.exe thhhbn.exe PID 2908 wrote to memory of 1996 2908 frrlrrf.exe thhhbn.exe PID 2908 wrote to memory of 1996 2908 frrlrrf.exe thhhbn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe"C:\Users\Admin\AppData\Local\Temp\695df4f9eb709628fbaff8fde466997c6373d3efd15bb683bc580d8d60421f15.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\vvdvd.exec:\vvdvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\rrxxffl.exec:\rrxxffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\nnbhtb.exec:\nnbhtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\9pjpv.exec:\9pjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\xrflxfr.exec:\xrflxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\rfrrrxl.exec:\rfrrrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\bbttbt.exec:\bbttbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\pdppp.exec:\pdppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\pjddd.exec:\pjddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\rlxlxxl.exec:\rlxlxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\nnttnn.exec:\nnttnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:356 -
\??\c:\tbnntb.exec:\tbnntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\9dpdd.exec:\9dpdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\rrrlrlx.exec:\rrrlrlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\frrlrrf.exec:\frrlrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\thhhbn.exec:\thhhbn.exe17⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vvjvv.exec:\vvjvv.exe18⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vjpvj.exec:\vjpvj.exe19⤵
- Executes dropped EXE
PID:1632 -
\??\c:\rffllfl.exec:\rffllfl.exe20⤵
- Executes dropped EXE
PID:2988 -
\??\c:\3nthth.exec:\3nthth.exe21⤵
- Executes dropped EXE
PID:2792 -
\??\c:\tbbntb.exec:\tbbntb.exe22⤵
- Executes dropped EXE
PID:1852 -
\??\c:\lllfxfx.exec:\lllfxfx.exe23⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xlxxxxf.exec:\xlxxxxf.exe24⤵
- Executes dropped EXE
PID:1288 -
\??\c:\bbnbbh.exec:\bbnbbh.exe25⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nbtnth.exec:\nbtnth.exe26⤵
- Executes dropped EXE
PID:1620 -
\??\c:\ppdpj.exec:\ppdpj.exe27⤵
- Executes dropped EXE
PID:2136 -
\??\c:\5rfxxxr.exec:\5rfxxxr.exe28⤵
- Executes dropped EXE
PID:2180 -
\??\c:\nbbnnn.exec:\nbbnnn.exe29⤵
- Executes dropped EXE
PID:1300 -
\??\c:\nhnnhh.exec:\nhnnhh.exe30⤵
- Executes dropped EXE
PID:1040 -
\??\c:\pjvpv.exec:\pjvpv.exe31⤵
- Executes dropped EXE
PID:2336 -
\??\c:\llrxflf.exec:\llrxflf.exe32⤵
- Executes dropped EXE
PID:1708 -
\??\c:\rlxrffl.exec:\rlxrffl.exe33⤵
- Executes dropped EXE
PID:1600 -
\??\c:\3hbhnb.exec:\3hbhnb.exe34⤵
- Executes dropped EXE
PID:1788 -
\??\c:\3jpvp.exec:\3jpvp.exe35⤵
- Executes dropped EXE
PID:1724 -
\??\c:\pvjjv.exec:\pvjjv.exe36⤵
- Executes dropped EXE
PID:1264 -
\??\c:\xxllllr.exec:\xxllllr.exe37⤵
- Executes dropped EXE
PID:2836 -
\??\c:\hhtbnb.exec:\hhtbnb.exe38⤵
- Executes dropped EXE
PID:3024 -
\??\c:\5hbbhh.exec:\5hbbhh.exe39⤵
- Executes dropped EXE
PID:2620 -
\??\c:\3jdjj.exec:\3jdjj.exe40⤵
- Executes dropped EXE
PID:2648 -
\??\c:\3dddp.exec:\3dddp.exe41⤵
- Executes dropped EXE
PID:2668 -
\??\c:\5rrrrxf.exec:\5rrrrxf.exe42⤵
- Executes dropped EXE
PID:2820 -
\??\c:\7lxflff.exec:\7lxflff.exe43⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9nnntt.exec:\9nnntt.exe44⤵
- Executes dropped EXE
PID:2168 -
\??\c:\ppppj.exec:\ppppj.exe45⤵
- Executes dropped EXE
PID:1164 -
\??\c:\vppjv.exec:\vppjv.exe46⤵
- Executes dropped EXE
PID:692 -
\??\c:\llrrxfl.exec:\llrrxfl.exe47⤵
- Executes dropped EXE
PID:1536 -
\??\c:\nnbbnt.exec:\nnbbnt.exe48⤵
- Executes dropped EXE
PID:2700 -
\??\c:\bbttbh.exec:\bbttbh.exe49⤵
- Executes dropped EXE
PID:1992 -
\??\c:\3pddd.exec:\3pddd.exe50⤵
- Executes dropped EXE
PID:1480 -
\??\c:\jjvvv.exec:\jjvvv.exe51⤵
- Executes dropped EXE
PID:1956 -
\??\c:\frlrflx.exec:\frlrflx.exe52⤵
- Executes dropped EXE
PID:1804 -
\??\c:\tnbnnt.exec:\tnbnnt.exe53⤵
- Executes dropped EXE
PID:1816 -
\??\c:\nnbhbh.exec:\nnbhbh.exe54⤵
- Executes dropped EXE
PID:2000 -
\??\c:\vpddd.exec:\vpddd.exe55⤵
- Executes dropped EXE
PID:1528 -
\??\c:\lllrrfl.exec:\lllrrfl.exe56⤵
- Executes dropped EXE
PID:2984 -
\??\c:\tnthbh.exec:\tnthbh.exe57⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nhnhnt.exec:\nhnhnt.exe58⤵
- Executes dropped EXE
PID:844 -
\??\c:\ddppv.exec:\ddppv.exe59⤵
- Executes dropped EXE
PID:1500 -
\??\c:\9rffxfl.exec:\9rffxfl.exe60⤵
- Executes dropped EXE
PID:2576 -
\??\c:\xxlrfrl.exec:\xxlrfrl.exe61⤵
- Executes dropped EXE
PID:1144 -
\??\c:\hhttbn.exec:\hhttbn.exe62⤵
- Executes dropped EXE
PID:2148 -
\??\c:\5htttn.exec:\5htttn.exe63⤵
- Executes dropped EXE
PID:2580 -
\??\c:\dvdjd.exec:\dvdjd.exe64⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jpvpv.exec:\jpvpv.exe65⤵
- Executes dropped EXE
PID:3056 -
\??\c:\ffrrflx.exec:\ffrrflx.exe66⤵PID:2412
-
\??\c:\frllrrr.exec:\frllrrr.exe67⤵PID:1672
-
\??\c:\nhhhtn.exec:\nhhhtn.exe68⤵PID:2844
-
\??\c:\nhtbbb.exec:\nhtbbb.exe69⤵PID:1064
-
\??\c:\9jjjv.exec:\9jjjv.exe70⤵PID:1040
-
\??\c:\dvjdv.exec:\dvjdv.exe71⤵PID:888
-
\??\c:\jjpvv.exec:\jjpvv.exe72⤵PID:1716
-
\??\c:\1rlxlfx.exec:\1rlxlfx.exe73⤵PID:1224
-
\??\c:\httnbt.exec:\httnbt.exe74⤵PID:2800
-
\??\c:\nhhtnb.exec:\nhhtnb.exe75⤵PID:1932
-
\??\c:\5jvvd.exec:\5jvvd.exe76⤵PID:2716
-
\??\c:\vppvv.exec:\vppvv.exe77⤵PID:2884
-
\??\c:\xfxxfxl.exec:\xfxxfxl.exe78⤵PID:2460
-
\??\c:\fxfxxff.exec:\fxfxxff.exe79⤵PID:3024
-
\??\c:\xxfflfl.exec:\xxfflfl.exe80⤵PID:2848
-
\??\c:\hnnbbh.exec:\hnnbbh.exe81⤵PID:2780
-
\??\c:\3tbtnh.exec:\3tbtnh.exe82⤵PID:2184
-
\??\c:\hhnnhh.exec:\hhnnhh.exe83⤵PID:2636
-
\??\c:\jdjdj.exec:\jdjdj.exe84⤵PID:2644
-
\??\c:\dvjdj.exec:\dvjdj.exe85⤵PID:2616
-
\??\c:\5pdpp.exec:\5pdpp.exe86⤵PID:280
-
\??\c:\rrxffxf.exec:\rrxffxf.exe87⤵PID:1524
-
\??\c:\5xfllxf.exec:\5xfllxf.exe88⤵PID:1680
-
\??\c:\5flxxrf.exec:\5flxxrf.exe89⤵PID:332
-
\??\c:\bbnnbb.exec:\bbnnbb.exe90⤵PID:1952
-
\??\c:\hthtbt.exec:\hthtbt.exe91⤵PID:920
-
\??\c:\hbtbhb.exec:\hbtbhb.exe92⤵PID:2908
-
\??\c:\djvdj.exec:\djvdj.exe93⤵PID:1996
-
\??\c:\9vpjv.exec:\9vpjv.exe94⤵PID:2672
-
\??\c:\jjvvd.exec:\jjvvd.exe95⤵PID:1556
-
\??\c:\1dpdd.exec:\1dpdd.exe96⤵PID:1372
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe97⤵PID:1656
-
\??\c:\ffllfxf.exec:\ffllfxf.exe98⤵PID:1416
-
\??\c:\hhnbhn.exec:\hhnbhn.exe99⤵PID:1748
-
\??\c:\nhtnhh.exec:\nhtnhh.exe100⤵PID:2060
-
\??\c:\7ntbbt.exec:\7ntbbt.exe101⤵PID:1500
-
\??\c:\pjjpv.exec:\pjjpv.exe102⤵PID:2576
-
\??\c:\frxlrfl.exec:\frxlrfl.exe103⤵PID:1288
-
\??\c:\rffxrlf.exec:\rffxrlf.exe104⤵PID:2148
-
\??\c:\rrrrrxl.exec:\rrrrrxl.exe105⤵PID:1676
-
\??\c:\nhtnth.exec:\nhtnth.exe106⤵PID:3052
-
\??\c:\1ntnhh.exec:\1ntnhh.exe107⤵PID:328
-
\??\c:\vpdjv.exec:\vpdjv.exe108⤵PID:3060
-
\??\c:\3vdjd.exec:\3vdjd.exe109⤵PID:2428
-
\??\c:\1ddvp.exec:\1ddvp.exe110⤵PID:592
-
\??\c:\xxflllr.exec:\xxflllr.exe111⤵PID:2512
-
\??\c:\xlrlfll.exec:\xlrlfll.exe112⤵PID:1944
-
\??\c:\9rflxll.exec:\9rflxll.exe113⤵PID:1572
-
\??\c:\nbbbbn.exec:\nbbbbn.exe114⤵PID:1864
-
\??\c:\hbtbbb.exec:\hbtbbb.exe115⤵PID:2548
-
\??\c:\nbnhnn.exec:\nbnhnn.exe116⤵PID:2404
-
\??\c:\3jddp.exec:\3jddp.exe117⤵PID:1724
-
\??\c:\dvjjd.exec:\dvjjd.exe118⤵PID:1788
-
\??\c:\flxxxxx.exec:\flxxxxx.exe119⤵PID:2888
-
\??\c:\fxfxxrx.exec:\fxfxxrx.exe120⤵PID:2828
-
\??\c:\rlrrxrr.exec:\rlrrxrr.exe121⤵PID:2620
-
\??\c:\tttbbt.exec:\tttbbt.exe122⤵PID:1720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-