Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 06:45
Static task
static1
Behavioral task
behavioral1
Sample
4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe
Resource
win7-20240903-en
General
-
Target
4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe
-
Size
75KB
-
MD5
3b2cfa78ac01b81ef92a5aca15213f52
-
SHA1
31a8050eaa5aa43c3cb9adab4e6ec3bbf5ea778d
-
SHA256
4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce
-
SHA512
df725d212f9174c192b66510349d7cd663262b71b37dc523cb1dbdd16a0f6f62b8c4fc2aa9883f6003cbd226ca62b66f104013932a7b8be99483d9a708839136
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qiImgS5ih6:ymb3NkkiQ3mdBjFIj+qiImgS5ih6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2468-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1320-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/812-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1128-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1420-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3292 9fllllr.exe 3552 hhtthn.exe 1444 pjjjv.exe 2940 jvpjv.exe 3456 nhhhbt.exe 3056 9nhhhh.exe 4028 lrxrrxx.exe 532 bnhhbn.exe 4980 djjjj.exe 2120 vvdjj.exe 1488 lrxrlrx.exe 1320 bhttbh.exe 4908 3jddd.exe 4828 rrflrrr.exe 4772 fxffxff.exe 812 5nttth.exe 4720 3bnttn.exe 2720 ddjjp.exe 5072 7xrllff.exe 2304 rxxxrxf.exe 4032 9bnnhn.exe 1128 vvvdd.exe 1420 ppvvv.exe 2216 rrxrrrl.exe 1260 thbhhh.exe 3452 djjpp.exe 3180 vpdpv.exe 3588 bbnhtt.exe 4060 jdddd.exe 1824 pppvp.exe 2620 rrlllrl.exe 1244 bhbbbb.exe 4064 bbbbtt.exe 4788 jpvvp.exe 4692 lllrrxr.exe 4220 lrxlxxl.exe 2724 bbbbbh.exe 2420 nhhhhh.exe 4312 pdvpj.exe 1108 xlrlflf.exe 4272 1fffxxr.exe 3412 3nhbtt.exe 3516 1rxxxxx.exe 5100 xfxxrrl.exe 4092 3vddd.exe 952 jvvvv.exe 3456 xxxfflf.exe 1968 1xlllll.exe 3056 7bhbbb.exe 4028 ppjdj.exe 912 rrrxxfl.exe 4388 9rrrxfx.exe 1540 bntttt.exe 4800 jjjdj.exe 3952 vvjjp.exe 4684 rlrrrxx.exe 1204 hbnbtn.exe 1636 vdvpj.exe 3028 flfxxrr.exe 3024 nnthtb.exe 2428 dvvpp.exe 812 5jjjj.exe 5104 lflrlrr.exe 4720 lfrrrxx.exe -
resource yara_rule behavioral2/memory/2468-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1320-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/812-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1128-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-192-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnhn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2468 wrote to memory of 3292 2468 4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe 83 PID 2468 wrote to memory of 3292 2468 4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe 83 PID 2468 wrote to memory of 3292 2468 4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe 83 PID 3292 wrote to memory of 3552 3292 9fllllr.exe 84 PID 3292 wrote to memory of 3552 3292 9fllllr.exe 84 PID 3292 wrote to memory of 3552 3292 9fllllr.exe 84 PID 3552 wrote to memory of 1444 3552 hhtthn.exe 85 PID 3552 wrote to memory of 1444 3552 hhtthn.exe 85 PID 3552 wrote to memory of 1444 3552 hhtthn.exe 85 PID 1444 wrote to memory of 2940 1444 pjjjv.exe 86 PID 1444 wrote to memory of 2940 1444 pjjjv.exe 86 PID 1444 wrote to memory of 2940 1444 pjjjv.exe 86 PID 2940 wrote to memory of 3456 2940 jvpjv.exe 87 PID 2940 wrote to memory of 3456 2940 jvpjv.exe 87 PID 2940 wrote to memory of 3456 2940 jvpjv.exe 87 PID 3456 wrote to memory of 3056 3456 nhhhbt.exe 88 PID 3456 wrote to memory of 3056 3456 nhhhbt.exe 88 PID 3456 wrote to memory of 3056 3456 nhhhbt.exe 88 PID 3056 wrote to memory of 4028 3056 9nhhhh.exe 89 PID 3056 wrote to memory of 4028 3056 9nhhhh.exe 89 PID 3056 wrote to memory of 4028 3056 9nhhhh.exe 89 PID 4028 wrote to memory of 532 4028 lrxrrxx.exe 90 PID 4028 wrote to memory of 532 4028 lrxrrxx.exe 90 PID 4028 wrote to memory of 532 4028 lrxrrxx.exe 90 PID 532 wrote to memory of 4980 532 bnhhbn.exe 91 PID 532 wrote to memory of 4980 532 bnhhbn.exe 91 PID 532 wrote to memory of 4980 532 bnhhbn.exe 91 PID 4980 wrote to memory of 2120 4980 djjjj.exe 92 PID 4980 wrote to memory of 2120 4980 djjjj.exe 92 PID 4980 wrote to memory of 2120 4980 djjjj.exe 92 PID 2120 wrote to memory of 1488 2120 vvdjj.exe 93 PID 2120 wrote to memory of 1488 2120 vvdjj.exe 93 PID 2120 wrote to memory of 1488 2120 vvdjj.exe 93 PID 1488 wrote to memory of 1320 1488 lrxrlrx.exe 94 PID 1488 wrote to memory of 1320 1488 lrxrlrx.exe 94 PID 1488 wrote to memory of 1320 1488 lrxrlrx.exe 94 PID 1320 wrote to memory of 4908 1320 bhttbh.exe 95 PID 1320 wrote to memory of 4908 1320 bhttbh.exe 95 PID 1320 wrote to memory of 4908 1320 bhttbh.exe 95 PID 4908 wrote to memory of 4828 4908 3jddd.exe 96 PID 4908 wrote to memory of 4828 4908 3jddd.exe 96 PID 4908 wrote to memory of 4828 4908 3jddd.exe 96 PID 4828 wrote to memory of 4772 4828 rrflrrr.exe 97 PID 4828 wrote to memory of 4772 4828 rrflrrr.exe 97 PID 4828 wrote to memory of 4772 4828 rrflrrr.exe 97 PID 4772 wrote to memory of 812 4772 fxffxff.exe 98 PID 4772 wrote to memory of 812 4772 fxffxff.exe 98 PID 4772 wrote to memory of 812 4772 fxffxff.exe 98 PID 812 wrote to memory of 4720 812 5nttth.exe 99 PID 812 wrote to memory of 4720 812 5nttth.exe 99 PID 812 wrote to memory of 4720 812 5nttth.exe 99 PID 4720 wrote to memory of 2720 4720 3bnttn.exe 100 PID 4720 wrote to memory of 2720 4720 3bnttn.exe 100 PID 4720 wrote to memory of 2720 4720 3bnttn.exe 100 PID 2720 wrote to memory of 5072 2720 ddjjp.exe 101 PID 2720 wrote to memory of 5072 2720 ddjjp.exe 101 PID 2720 wrote to memory of 5072 2720 ddjjp.exe 101 PID 5072 wrote to memory of 2304 5072 7xrllff.exe 102 PID 5072 wrote to memory of 2304 5072 7xrllff.exe 102 PID 5072 wrote to memory of 2304 5072 7xrllff.exe 102 PID 2304 wrote to memory of 4032 2304 rxxxrxf.exe 103 PID 2304 wrote to memory of 4032 2304 rxxxrxf.exe 103 PID 2304 wrote to memory of 4032 2304 rxxxrxf.exe 103 PID 4032 wrote to memory of 1128 4032 9bnnhn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe"C:\Users\Admin\AppData\Local\Temp\4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\9fllllr.exec:\9fllllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\hhtthn.exec:\hhtthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\pjjjv.exec:\pjjjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\jvpjv.exec:\jvpjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\nhhhbt.exec:\nhhhbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\9nhhhh.exec:\9nhhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\lrxrrxx.exec:\lrxrrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\bnhhbn.exec:\bnhhbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\djjjj.exec:\djjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\vvdjj.exec:\vvdjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\lrxrlrx.exec:\lrxrlrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\bhttbh.exec:\bhttbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\3jddd.exec:\3jddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\rrflrrr.exec:\rrflrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\fxffxff.exec:\fxffxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\5nttth.exec:\5nttth.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\3bnttn.exec:\3bnttn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\ddjjp.exec:\ddjjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\7xrllff.exec:\7xrllff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\rxxxrxf.exec:\rxxxrxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\9bnnhn.exec:\9bnnhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\vvvdd.exec:\vvvdd.exe23⤵
- Executes dropped EXE
PID:1128 -
\??\c:\ppvvv.exec:\ppvvv.exe24⤵
- Executes dropped EXE
PID:1420 -
\??\c:\rrxrrrl.exec:\rrxrrrl.exe25⤵
- Executes dropped EXE
PID:2216 -
\??\c:\thbhhh.exec:\thbhhh.exe26⤵
- Executes dropped EXE
PID:1260 -
\??\c:\djjpp.exec:\djjpp.exe27⤵
- Executes dropped EXE
PID:3452 -
\??\c:\vpdpv.exec:\vpdpv.exe28⤵
- Executes dropped EXE
PID:3180 -
\??\c:\bbnhtt.exec:\bbnhtt.exe29⤵
- Executes dropped EXE
PID:3588 -
\??\c:\jdddd.exec:\jdddd.exe30⤵
- Executes dropped EXE
PID:4060 -
\??\c:\pppvp.exec:\pppvp.exe31⤵
- Executes dropped EXE
PID:1824 -
\??\c:\rrlllrl.exec:\rrlllrl.exe32⤵
- Executes dropped EXE
PID:2620 -
\??\c:\bhbbbb.exec:\bhbbbb.exe33⤵
- Executes dropped EXE
PID:1244 -
\??\c:\bbbbtt.exec:\bbbbtt.exe34⤵
- Executes dropped EXE
PID:4064 -
\??\c:\jpvvp.exec:\jpvvp.exe35⤵
- Executes dropped EXE
PID:4788 -
\??\c:\lllrrxr.exec:\lllrrxr.exe36⤵
- Executes dropped EXE
PID:4692 -
\??\c:\lrxlxxl.exec:\lrxlxxl.exe37⤵
- Executes dropped EXE
PID:4220 -
\??\c:\bbbbbh.exec:\bbbbbh.exe38⤵
- Executes dropped EXE
PID:2724 -
\??\c:\nhhhhh.exec:\nhhhhh.exe39⤵
- Executes dropped EXE
PID:2420 -
\??\c:\pdvpj.exec:\pdvpj.exe40⤵
- Executes dropped EXE
PID:4312 -
\??\c:\xlrlflf.exec:\xlrlflf.exe41⤵
- Executes dropped EXE
PID:1108 -
\??\c:\1fffxxr.exec:\1fffxxr.exe42⤵
- Executes dropped EXE
PID:4272 -
\??\c:\3nhbtt.exec:\3nhbtt.exe43⤵
- Executes dropped EXE
PID:3412 -
\??\c:\1rxxxxx.exec:\1rxxxxx.exe44⤵
- Executes dropped EXE
PID:3516 -
\??\c:\xfxxrrl.exec:\xfxxrrl.exe45⤵
- Executes dropped EXE
PID:5100 -
\??\c:\3vddd.exec:\3vddd.exe46⤵
- Executes dropped EXE
PID:4092 -
\??\c:\jvvvv.exec:\jvvvv.exe47⤵
- Executes dropped EXE
PID:952 -
\??\c:\xxxfflf.exec:\xxxfflf.exe48⤵
- Executes dropped EXE
PID:3456 -
\??\c:\1xlllll.exec:\1xlllll.exe49⤵
- Executes dropped EXE
PID:1968 -
\??\c:\7bhbbb.exec:\7bhbbb.exe50⤵
- Executes dropped EXE
PID:3056 -
\??\c:\ppjdj.exec:\ppjdj.exe51⤵
- Executes dropped EXE
PID:4028 -
\??\c:\rrrxxfl.exec:\rrrxxfl.exe52⤵
- Executes dropped EXE
PID:912 -
\??\c:\9rrrxfx.exec:\9rrrxfx.exe53⤵
- Executes dropped EXE
PID:4388 -
\??\c:\bntttt.exec:\bntttt.exe54⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jjjdj.exec:\jjjdj.exe55⤵
- Executes dropped EXE
PID:4800 -
\??\c:\vvjjp.exec:\vvjjp.exe56⤵
- Executes dropped EXE
PID:3952 -
\??\c:\rlrrrxx.exec:\rlrrrxx.exe57⤵
- Executes dropped EXE
PID:4684 -
\??\c:\hbnbtn.exec:\hbnbtn.exe58⤵
- Executes dropped EXE
PID:1204 -
\??\c:\vdvpj.exec:\vdvpj.exe59⤵
- Executes dropped EXE
PID:1636 -
\??\c:\flfxxrr.exec:\flfxxrr.exe60⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nnthtb.exec:\nnthtb.exe61⤵
- Executes dropped EXE
PID:3024 -
\??\c:\dvvpp.exec:\dvvpp.exe62⤵
- Executes dropped EXE
PID:2428 -
\??\c:\5jjjj.exec:\5jjjj.exe63⤵
- Executes dropped EXE
PID:812 -
\??\c:\lflrlrr.exec:\lflrlrr.exe64⤵
- Executes dropped EXE
PID:5104 -
\??\c:\lfrrrxx.exec:\lfrrrxx.exe65⤵
- Executes dropped EXE
PID:4720 -
\??\c:\bhhhnn.exec:\bhhhnn.exe66⤵PID:2320
-
\??\c:\nhhttn.exec:\nhhttn.exe67⤵PID:1004
-
\??\c:\vdjpj.exec:\vdjpj.exe68⤵PID:1784
-
\??\c:\lfffrrr.exec:\lfffrrr.exe69⤵PID:1296
-
\??\c:\3hhhhn.exec:\3hhhhn.exe70⤵PID:3104
-
\??\c:\lffffff.exec:\lffffff.exe71⤵PID:1424
-
\??\c:\ttbbnn.exec:\ttbbnn.exe72⤵PID:1632
-
\??\c:\9jpvv.exec:\9jpvv.exe73⤵PID:4252
-
\??\c:\fxflffx.exec:\fxflffx.exe74⤵PID:1020
-
\??\c:\1xrllxx.exec:\1xrllxx.exe75⤵PID:1984
-
\??\c:\ntnhtb.exec:\ntnhtb.exe76⤵PID:2684
-
\??\c:\pdjpp.exec:\pdjpp.exe77⤵PID:1268
-
\??\c:\1rrfxxx.exec:\1rrfxxx.exe78⤵PID:3208
-
\??\c:\rxllrrf.exec:\rxllrrf.exe79⤵PID:1040
-
\??\c:\tbhnhh.exec:\tbhnhh.exe80⤵PID:1852
-
\??\c:\nbbtbt.exec:\nbbtbt.exe81⤵PID:916
-
\??\c:\1xfffll.exec:\1xfffll.exe82⤵PID:764
-
\??\c:\bhhnnt.exec:\bhhnnt.exe83⤵PID:1092
-
\??\c:\vpvvv.exec:\vpvvv.exe84⤵PID:1716
-
\??\c:\xfffxfr.exec:\xfffxfr.exe85⤵PID:2924
-
\??\c:\ttnntt.exec:\ttnntt.exe86⤵PID:3328
-
\??\c:\tbbtnn.exec:\tbbtnn.exe87⤵PID:2520
-
\??\c:\lrlllxx.exec:\lrlllxx.exe88⤵PID:4308
-
\??\c:\tbbbbh.exec:\tbbbbh.exe89⤵PID:2312
-
\??\c:\9ntthh.exec:\9ntthh.exe90⤵PID:1664
-
\??\c:\1jppp.exec:\1jppp.exe91⤵PID:4824
-
\??\c:\frllrxf.exec:\frllrxf.exe92⤵PID:2640
-
\??\c:\rxffrxl.exec:\rxffrxl.exe93⤵PID:2116
-
\??\c:\nnnnhn.exec:\nnnnhn.exe94⤵PID:5100
-
\??\c:\bhhtnt.exec:\bhhtnt.exe95⤵PID:2940
-
\??\c:\ppppp.exec:\ppppp.exe96⤵PID:3428
-
\??\c:\jdjjj.exec:\jdjjj.exe97⤵PID:244
-
\??\c:\1lrxrfl.exec:\1lrxrfl.exe98⤵PID:2100
-
\??\c:\xxxxrxr.exec:\xxxxrxr.exe99⤵PID:3056
-
\??\c:\ntttbh.exec:\ntttbh.exe100⤵PID:4300
-
\??\c:\dvvvv.exec:\dvvvv.exe101⤵PID:3772
-
\??\c:\pvppp.exec:\pvppp.exe102⤵PID:2884
-
\??\c:\xlxllrr.exec:\xlxllrr.exe103⤵PID:3408
-
\??\c:\xxffxxl.exec:\xxffxxl.exe104⤵PID:2912
-
\??\c:\9tbbbh.exec:\9tbbbh.exe105⤵PID:4908
-
\??\c:\pdvdd.exec:\pdvdd.exe106⤵PID:4828
-
\??\c:\pjjjj.exec:\pjjjj.exe107⤵PID:636
-
\??\c:\xlllfll.exec:\xlllfll.exe108⤵PID:4416
-
\??\c:\lfxxxxr.exec:\lfxxxxr.exe109⤵PID:812
-
\??\c:\fxrrrrx.exec:\fxrrrrx.exe110⤵PID:3240
-
\??\c:\5nnttb.exec:\5nnttb.exe111⤵PID:2720
-
\??\c:\xxffflr.exec:\xxffflr.exe112⤵PID:3316
-
\??\c:\rlxxxlr.exec:\rlxxxlr.exe113⤵PID:5020
-
\??\c:\bnhbtn.exec:\bnhbtn.exe114⤵PID:3688
-
\??\c:\nbttnt.exec:\nbttnt.exe115⤵PID:1424
-
\??\c:\jdddd.exec:\jdddd.exe116⤵PID:1260
-
\??\c:\3pddj.exec:\3pddj.exe117⤵PID:3268
-
\??\c:\lxfllrr.exec:\lxfllrr.exe118⤵PID:2308
-
\??\c:\llflrrr.exec:\llflrrr.exe119⤵PID:1984
-
\??\c:\tttttt.exec:\tttttt.exe120⤵PID:4060
-
\??\c:\tttttb.exec:\tttttb.exe121⤵PID:4024
-
\??\c:\jdvvd.exec:\jdvvd.exe122⤵PID:1040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-