Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 05:40
Static task
static1
Behavioral task
behavioral1
Sample
df324d02b40aef84514fb392461371048629d46ecf7c670f4580c4dca866f2c4.exe
Resource
win7-20241010-en
General
-
Target
df324d02b40aef84514fb392461371048629d46ecf7c670f4580c4dca866f2c4.exe
-
Size
71KB
-
MD5
1e4ab4d42921fb71305c3bc0e966f7bf
-
SHA1
8759e87fbd6a17ed2c4ced288e48842d28213b38
-
SHA256
df324d02b40aef84514fb392461371048629d46ecf7c670f4580c4dca866f2c4
-
SHA512
d55b46061f9fbc56ee4c5e17c4998ff222dc4ce1e1f60568c11b97bbab44ac1ca877580c7a90b402feb51f713dfe8ea72668c8232daf81d8ae2db11b3202312a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+q8l45CmK:ymb3NkkiQ3mdBjFIj+q8lL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/1716-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1716-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/976-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2160-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hbntnb.exe1lllffx.exebhttnt.exeppdjj.exellrlrrx.exebtbthn.exevjdjj.exefrxlllr.exentnhtt.exexfxxxxr.exenthhnn.exejdjjv.exenbtbtt.exettbhnt.exe3dddd.exerrrrxff.exefrrrlfl.exenntbbh.exerffxrrr.exerxffxrf.exejvvvv.exerflfxxr.exetttttt.exejdddd.exe5rxrlrl.exelxlrrfl.exehbhtbt.exexlffrxx.exelrrrrrl.exennnnhn.exepjvvv.exe9flllll.exetbbbbb.exevpppv.exerlrrlrr.exetbbhnh.exeddjjj.exerrffxfr.exenhnthh.exe5pjjp.exelrfxlfx.exebhhbbb.exe7jpdv.exepjdpj.exerxffxxx.exethbbbb.exevvdvv.exexxxxrxx.exefrlflxx.exeddjpv.exevppvp.exexrfxxrr.exe3nnnhh.exettnhtt.exevpddd.exe7vjdv.exexlllffr.exetbhthh.exevpjpj.exeffffxrl.exe5rrxxff.exebtbbnn.exe9ddvv.exexxxrrrf.exepid Process 3544 hbntnb.exe 4804 1lllffx.exe 2104 bhttnt.exe 3000 ppdjj.exe 2420 llrlrrx.exe 1372 btbthn.exe 1528 vjdjj.exe 4408 frxlllr.exe 3708 ntnhtt.exe 3120 xfxxxxr.exe 2900 nthhnn.exe 2964 jdjjv.exe 4580 nbtbtt.exe 4760 ttbhnt.exe 3532 3dddd.exe 2352 rrrrxff.exe 3268 frrrlfl.exe 4632 nntbbh.exe 3104 rffxrrr.exe 4212 rxffxrf.exe 976 jvvvv.exe 4340 rflfxxr.exe 4064 tttttt.exe 2984 jdddd.exe 3944 5rxrlrl.exe 3684 lxlrrfl.exe 4936 hbhtbt.exe 1924 xlffrxx.exe 1432 lrrrrrl.exe 2160 nnnnhn.exe 4784 pjvvv.exe 1828 9flllll.exe 1808 tbbbbb.exe 3604 vpppv.exe 2680 rlrrlrr.exe 3464 tbbhnh.exe 2796 ddjjj.exe 3548 rrffxfr.exe 2640 nhnthh.exe 3648 5pjjp.exe 4396 lrfxlfx.exe 4324 bhhbbb.exe 5024 7jpdv.exe 1984 pjdpj.exe 5088 rxffxxx.exe 3088 thbbbb.exe 1744 vvdvv.exe 2236 xxxxrxx.exe 5076 frlflxx.exe 3292 ddjpv.exe 1796 vppvp.exe 1044 xrfxxrr.exe 1772 3nnnhh.exe 1612 ttnhtt.exe 1528 vpddd.exe 3656 7vjdv.exe 2272 xlllffr.exe 2644 tbhthh.exe 4372 vpjpj.exe 3428 ffffxrl.exe 3592 5rrxxff.exe 4016 btbbnn.exe 2964 9ddvv.exe 3348 xxxrrrf.exe -
Processes:
resource yara_rule behavioral2/memory/1716-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3532-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/976-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rfrrflx.exefrrxlll.exe1htthn.exefxxrflx.exevvppj.exebtbthh.exe9nhntb.exeddddv.exedvddv.exevjppd.exedjjpj.exedf324d02b40aef84514fb392461371048629d46ecf7c670f4580c4dca866f2c4.exehhnbbb.exerrfxlrx.exepvdvv.exebttnnn.exevjjdv.exebbhnhh.exepjjjj.exenntbbh.exebbtbtb.exebthbtb.exepdddv.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df324d02b40aef84514fb392461371048629d46ecf7c670f4580c4dca866f2c4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
df324d02b40aef84514fb392461371048629d46ecf7c670f4580c4dca866f2c4.exehbntnb.exe1lllffx.exebhttnt.exeppdjj.exellrlrrx.exebtbthn.exevjdjj.exefrxlllr.exentnhtt.exexfxxxxr.exenthhnn.exejdjjv.exenbtbtt.exettbhnt.exe3dddd.exerrrrxff.exefrrrlfl.exenntbbh.exerffxrrr.exerxffxrf.exejvvvv.exedescription pid Process procid_target PID 1716 wrote to memory of 3544 1716 df324d02b40aef84514fb392461371048629d46ecf7c670f4580c4dca866f2c4.exe 83 PID 1716 wrote to memory of 3544 1716 df324d02b40aef84514fb392461371048629d46ecf7c670f4580c4dca866f2c4.exe 83 PID 1716 wrote to memory of 3544 1716 df324d02b40aef84514fb392461371048629d46ecf7c670f4580c4dca866f2c4.exe 83 PID 3544 wrote to memory of 4804 3544 hbntnb.exe 84 PID 3544 wrote to memory of 4804 3544 hbntnb.exe 84 PID 3544 wrote to memory of 4804 3544 hbntnb.exe 84 PID 4804 wrote to memory of 2104 4804 1lllffx.exe 85 PID 4804 wrote to memory of 2104 4804 1lllffx.exe 85 PID 4804 wrote to memory of 2104 4804 1lllffx.exe 85 PID 2104 wrote to memory of 3000 2104 bhttnt.exe 86 PID 2104 wrote to memory of 3000 2104 bhttnt.exe 86 PID 2104 wrote to memory of 3000 2104 bhttnt.exe 86 PID 3000 wrote to memory of 2420 3000 ppdjj.exe 87 PID 3000 wrote to memory of 2420 3000 ppdjj.exe 87 PID 3000 wrote to memory of 2420 3000 ppdjj.exe 87 PID 2420 wrote to memory of 1372 2420 llrlrrx.exe 88 PID 2420 wrote to memory of 1372 2420 llrlrrx.exe 88 PID 2420 wrote to memory of 1372 2420 llrlrrx.exe 88 PID 1372 wrote to memory of 1528 1372 btbthn.exe 89 PID 1372 wrote to memory of 1528 1372 btbthn.exe 89 PID 1372 wrote to memory of 1528 1372 btbthn.exe 89 PID 1528 wrote to memory of 4408 1528 vjdjj.exe 90 PID 1528 wrote to memory of 4408 1528 vjdjj.exe 90 PID 1528 wrote to memory of 4408 1528 vjdjj.exe 90 PID 4408 wrote to memory of 3708 4408 frxlllr.exe 91 PID 4408 wrote to memory of 3708 4408 frxlllr.exe 91 PID 4408 wrote to memory of 3708 4408 frxlllr.exe 91 PID 3708 wrote to memory of 3120 3708 ntnhtt.exe 92 PID 3708 wrote to memory of 3120 3708 ntnhtt.exe 92 PID 3708 wrote to memory of 3120 3708 ntnhtt.exe 92 PID 3120 wrote to memory of 2900 3120 xfxxxxr.exe 93 PID 3120 wrote to memory of 2900 3120 xfxxxxr.exe 93 PID 3120 wrote to memory of 2900 3120 xfxxxxr.exe 93 PID 2900 wrote to memory of 2964 2900 nthhnn.exe 94 PID 2900 wrote to memory of 2964 2900 nthhnn.exe 94 PID 2900 wrote to memory of 2964 2900 nthhnn.exe 94 PID 2964 wrote to memory of 4580 2964 jdjjv.exe 95 PID 2964 wrote to memory of 4580 2964 jdjjv.exe 95 PID 2964 wrote to memory of 4580 2964 jdjjv.exe 95 PID 4580 wrote to memory of 4760 4580 nbtbtt.exe 96 PID 4580 wrote to memory of 4760 4580 nbtbtt.exe 96 PID 4580 wrote to memory of 4760 4580 nbtbtt.exe 96 PID 4760 wrote to memory of 3532 4760 ttbhnt.exe 97 PID 4760 wrote to memory of 3532 4760 ttbhnt.exe 97 PID 4760 wrote to memory of 3532 4760 ttbhnt.exe 97 PID 3532 wrote to memory of 2352 3532 3dddd.exe 98 PID 3532 wrote to memory of 2352 3532 3dddd.exe 98 PID 3532 wrote to memory of 2352 3532 3dddd.exe 98 PID 2352 wrote to memory of 3268 2352 rrrrxff.exe 99 PID 2352 wrote to memory of 3268 2352 rrrrxff.exe 99 PID 2352 wrote to memory of 3268 2352 rrrrxff.exe 99 PID 3268 wrote to memory of 4632 3268 frrrlfl.exe 100 PID 3268 wrote to memory of 4632 3268 frrrlfl.exe 100 PID 3268 wrote to memory of 4632 3268 frrrlfl.exe 100 PID 4632 wrote to memory of 3104 4632 nntbbh.exe 101 PID 4632 wrote to memory of 3104 4632 nntbbh.exe 101 PID 4632 wrote to memory of 3104 4632 nntbbh.exe 101 PID 3104 wrote to memory of 4212 3104 rffxrrr.exe 102 PID 3104 wrote to memory of 4212 3104 rffxrrr.exe 102 PID 3104 wrote to memory of 4212 3104 rffxrrr.exe 102 PID 4212 wrote to memory of 976 4212 rxffxrf.exe 103 PID 4212 wrote to memory of 976 4212 rxffxrf.exe 103 PID 4212 wrote to memory of 976 4212 rxffxrf.exe 103 PID 976 wrote to memory of 4340 976 jvvvv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\df324d02b40aef84514fb392461371048629d46ecf7c670f4580c4dca866f2c4.exe"C:\Users\Admin\AppData\Local\Temp\df324d02b40aef84514fb392461371048629d46ecf7c670f4580c4dca866f2c4.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\hbntnb.exec:\hbntnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\1lllffx.exec:\1lllffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\bhttnt.exec:\bhttnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\ppdjj.exec:\ppdjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\llrlrrx.exec:\llrlrrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\btbthn.exec:\btbthn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\vjdjj.exec:\vjdjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\frxlllr.exec:\frxlllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\ntnhtt.exec:\ntnhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\xfxxxxr.exec:\xfxxxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\nthhnn.exec:\nthhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\jdjjv.exec:\jdjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\nbtbtt.exec:\nbtbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\ttbhnt.exec:\ttbhnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\3dddd.exec:\3dddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\rrrrxff.exec:\rrrrxff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\frrrlfl.exec:\frrrlfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\nntbbh.exec:\nntbbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\rffxrrr.exec:\rffxrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\rxffxrf.exec:\rxffxrf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\jvvvv.exec:\jvvvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\rflfxxr.exec:\rflfxxr.exe23⤵
- Executes dropped EXE
PID:4340 -
\??\c:\tttttt.exec:\tttttt.exe24⤵
- Executes dropped EXE
PID:4064 -
\??\c:\jdddd.exec:\jdddd.exe25⤵
- Executes dropped EXE
PID:2984 -
\??\c:\5rxrlrl.exec:\5rxrlrl.exe26⤵
- Executes dropped EXE
PID:3944 -
\??\c:\lxlrrfl.exec:\lxlrrfl.exe27⤵
- Executes dropped EXE
PID:3684 -
\??\c:\hbhtbt.exec:\hbhtbt.exe28⤵
- Executes dropped EXE
PID:4936 -
\??\c:\xlffrxx.exec:\xlffrxx.exe29⤵
- Executes dropped EXE
PID:1924 -
\??\c:\lrrrrrl.exec:\lrrrrrl.exe30⤵
- Executes dropped EXE
PID:1432 -
\??\c:\nnnnhn.exec:\nnnnhn.exe31⤵
- Executes dropped EXE
PID:2160 -
\??\c:\pjvvv.exec:\pjvvv.exe32⤵
- Executes dropped EXE
PID:4784 -
\??\c:\9flllll.exec:\9flllll.exe33⤵
- Executes dropped EXE
PID:1828 -
\??\c:\tbbbbb.exec:\tbbbbb.exe34⤵
- Executes dropped EXE
PID:1808 -
\??\c:\vpppv.exec:\vpppv.exe35⤵
- Executes dropped EXE
PID:3604 -
\??\c:\rlrrlrr.exec:\rlrrlrr.exe36⤵
- Executes dropped EXE
PID:2680 -
\??\c:\tbbhnh.exec:\tbbhnh.exe37⤵
- Executes dropped EXE
PID:3464 -
\??\c:\ddjjj.exec:\ddjjj.exe38⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rrffxfr.exec:\rrffxfr.exe39⤵
- Executes dropped EXE
PID:3548 -
\??\c:\nhnthh.exec:\nhnthh.exe40⤵
- Executes dropped EXE
PID:2640 -
\??\c:\5pjjp.exec:\5pjjp.exe41⤵
- Executes dropped EXE
PID:3648 -
\??\c:\lrfxlfx.exec:\lrfxlfx.exe42⤵
- Executes dropped EXE
PID:4396 -
\??\c:\bhhbbb.exec:\bhhbbb.exe43⤵
- Executes dropped EXE
PID:4324 -
\??\c:\7jpdv.exec:\7jpdv.exe44⤵
- Executes dropped EXE
PID:5024 -
\??\c:\pjdpj.exec:\pjdpj.exe45⤵
- Executes dropped EXE
PID:1984 -
\??\c:\rxffxxx.exec:\rxffxxx.exe46⤵
- Executes dropped EXE
PID:5088 -
\??\c:\thbbbb.exec:\thbbbb.exe47⤵
- Executes dropped EXE
PID:3088 -
\??\c:\vvdvv.exec:\vvdvv.exe48⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xxxxrxx.exec:\xxxxrxx.exe49⤵
- Executes dropped EXE
PID:2236 -
\??\c:\frlflxx.exec:\frlflxx.exe50⤵
- Executes dropped EXE
PID:5076 -
\??\c:\ddjpv.exec:\ddjpv.exe51⤵
- Executes dropped EXE
PID:3292 -
\??\c:\vppvp.exec:\vppvp.exe52⤵
- Executes dropped EXE
PID:1796 -
\??\c:\xrfxxrr.exec:\xrfxxrr.exe53⤵
- Executes dropped EXE
PID:1044 -
\??\c:\3nnnhh.exec:\3nnnhh.exe54⤵
- Executes dropped EXE
PID:1772 -
\??\c:\ttnhtt.exec:\ttnhtt.exe55⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vpddd.exec:\vpddd.exe56⤵
- Executes dropped EXE
PID:1528 -
\??\c:\7vjdv.exec:\7vjdv.exe57⤵
- Executes dropped EXE
PID:3656 -
\??\c:\xlllffr.exec:\xlllffr.exe58⤵
- Executes dropped EXE
PID:2272 -
\??\c:\tbhthh.exec:\tbhthh.exe59⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vpjpj.exec:\vpjpj.exe60⤵
- Executes dropped EXE
PID:4372 -
\??\c:\ffffxrl.exec:\ffffxrl.exe61⤵
- Executes dropped EXE
PID:3428 -
\??\c:\5rrxxff.exec:\5rrxxff.exe62⤵
- Executes dropped EXE
PID:3592 -
\??\c:\btbbnn.exec:\btbbnn.exe63⤵
- Executes dropped EXE
PID:4016 -
\??\c:\9ddvv.exec:\9ddvv.exe64⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xxxrrrf.exec:\xxxrrrf.exe65⤵
- Executes dropped EXE
PID:3348 -
\??\c:\rrrxfxx.exec:\rrrxfxx.exe66⤵PID:4216
-
\??\c:\1bhhnb.exec:\1bhhnb.exe67⤵PID:1480
-
\??\c:\dpdjj.exec:\dpdjj.exe68⤵PID:4208
-
\??\c:\jjjdd.exec:\jjjdd.exe69⤵PID:5036
-
\??\c:\lfrxxlr.exec:\lfrxxlr.exe70⤵PID:4956
-
\??\c:\3nbthn.exec:\3nbthn.exe71⤵PID:4364
-
\??\c:\bhbhnn.exec:\bhbhnn.exe72⤵PID:3976
-
\??\c:\pjpvv.exec:\pjpvv.exe73⤵PID:436
-
\??\c:\lrfflrr.exec:\lrfflrr.exe74⤵PID:4212
-
\??\c:\1xxfffx.exec:\1xxfffx.exe75⤵PID:1916
-
\??\c:\5tthbh.exec:\5tthbh.exe76⤵PID:2684
-
\??\c:\5dpvp.exec:\5dpvp.exe77⤵PID:2336
-
\??\c:\rlrrfll.exec:\rlrrfll.exe78⤵PID:2660
-
\??\c:\5frrlrr.exec:\5frrlrr.exe79⤵PID:4816
-
\??\c:\nhntbn.exec:\nhntbn.exe80⤵PID:4856
-
\??\c:\vvpjj.exec:\vvpjj.exe81⤵PID:4772
-
\??\c:\jjppp.exec:\jjppp.exe82⤵PID:688
-
\??\c:\lrxrllf.exec:\lrxrllf.exe83⤵PID:224
-
\??\c:\bnttbh.exec:\bnttbh.exe84⤵PID:4248
-
\??\c:\bhnttn.exec:\bhnttn.exe85⤵PID:1968
-
\??\c:\pdjvj.exec:\pdjvj.exe86⤵PID:2648
-
\??\c:\dvvdd.exec:\dvvdd.exe87⤵PID:4784
-
\??\c:\llxxlrx.exec:\llxxlrx.exe88⤵PID:1808
-
\??\c:\hbtbhn.exec:\hbtbhn.exe89⤵PID:3960
-
\??\c:\htnhht.exec:\htnhht.exe90⤵PID:4476
-
\??\c:\djddv.exec:\djddv.exe91⤵PID:2936
-
\??\c:\jdjdp.exec:\jdjdp.exe92⤵PID:5104
-
\??\c:\rllrxff.exec:\rllrxff.exe93⤵PID:2128
-
\??\c:\jjppp.exec:\jjppp.exe94⤵PID:4560
-
\??\c:\xxrrrxr.exec:\xxrrrxr.exe95⤵PID:1132
-
\??\c:\tthbbn.exec:\tthbbn.exe96⤵PID:2760
-
\??\c:\tbntnt.exec:\tbntnt.exe97⤵PID:4668
-
\??\c:\pdppv.exec:\pdppv.exe98⤵PID:1368
-
\??\c:\ffrrxll.exec:\ffrrxll.exe99⤵PID:2428
-
\??\c:\bnntnt.exec:\bnntnt.exe100⤵PID:2696
-
\??\c:\ddvdd.exec:\ddvdd.exe101⤵PID:2892
-
\??\c:\xfxffxr.exec:\xfxffxr.exe102⤵PID:4808
-
\??\c:\hhthnh.exec:\hhthnh.exe103⤵PID:664
-
\??\c:\9bhhnh.exec:\9bhhnh.exe104⤵PID:1748
-
\??\c:\pjdvp.exec:\pjdvp.exe105⤵PID:4072
-
\??\c:\1rfllxr.exec:\1rfllxr.exe106⤵PID:2448
-
\??\c:\tnnnnn.exec:\tnnnnn.exe107⤵PID:1672
-
\??\c:\nhtnhh.exec:\nhtnhh.exe108⤵PID:3856
-
\??\c:\xfrfrfr.exec:\xfrfrfr.exe109⤵PID:1876
-
\??\c:\nhnbbh.exec:\nhnbbh.exe110⤵PID:2188
-
\??\c:\nbhhbb.exec:\nbhhbb.exe111⤵PID:3404
-
\??\c:\3vjjd.exec:\3vjjd.exe112⤵PID:2436
-
\??\c:\rfxxrxx.exec:\rfxxrxx.exe113⤵PID:5048
-
\??\c:\bbnthn.exec:\bbnthn.exe114⤵PID:4672
-
\??\c:\ppdpv.exec:\ppdpv.exe115⤵PID:2144
-
\??\c:\vpvvp.exec:\vpvvp.exe116⤵PID:2264
-
\??\c:\xxrxflx.exec:\xxrxflx.exe117⤵PID:1608
-
\??\c:\ntnhht.exec:\ntnhht.exe118⤵PID:1288
-
\??\c:\9hntbh.exec:\9hntbh.exe119⤵PID:2184
-
\??\c:\ppjjp.exec:\ppjjp.exe120⤵PID:4956
-
\??\c:\9frxfll.exec:\9frxfll.exe121⤵PID:4756
-
\??\c:\bbhtbn.exec:\bbhtbn.exe122⤵PID:1960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-