Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 01:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e70e908ea274ffc35386dd27c8a5d32436c0632645b5fe790fc270aa375f868N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
2e70e908ea274ffc35386dd27c8a5d32436c0632645b5fe790fc270aa375f868N.exe
-
Size
53KB
-
MD5
cd9c76370ebe37b8d2d902152a1ec5a0
-
SHA1
c288247da3b94aec5ba18f96880d23bb1bab3c6f
-
SHA256
2e70e908ea274ffc35386dd27c8a5d32436c0632645b5fe790fc270aa375f868
-
SHA512
10a3f131e93b15f2a3038b0027fed277ee196291a85027c48aa3c0a603beb3f19db68b78d2a5df3dcc1de509dc6fa5b4b48efcd04279e9844be3e2ea983755c1
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlS:0cdpeeBSHHMHLf9RyIb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3656-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2564-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1832-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/860-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2240-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1340-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2360-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-325-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4128-345-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-359-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-372-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-412-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-423-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2576-442-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-449-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2360-477-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1440-487-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-527-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-543-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-643-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-1118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-1210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-1285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-1972-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 232 3ppvv.exe 3092 9djjd.exe 2772 lxrlfxr.exe 1120 nbnbtn.exe 4092 1ppvp.exe 4872 rxxxfxl.exe 4016 tthbbb.exe 2564 nbhhbh.exe 1692 rlrllfl.exe 2816 bbnhtn.exe 2932 hnnntt.exe 4172 vjjdp.exe 1832 1fffrxx.exe 1436 vvdvv.exe 4788 1ddvp.exe 4992 ntnnhn.exe 1928 7tttnn.exe 2024 ddpjd.exe 1220 5flflfr.exe 628 lllrffr.exe 4492 hhbbtb.exe 4136 jjvvd.exe 448 ppjjd.exe 1968 flrrffr.exe 1776 9thhbh.exe 1856 thtnbb.exe 860 pjjdp.exe 3228 xllxllf.exe 464 fxffxrr.exe 3936 7btnhb.exe 3580 jvvpj.exe 2164 jvjdv.exe 3008 fflfxff.exe 1284 ttttnb.exe 2696 htnnhn.exe 972 ppddj.exe 1800 7ffxlfr.exe 620 bbhbtt.exe 3032 5ttbht.exe 3752 vddvp.exe 2872 rrfrfxl.exe 3212 lllfffr.exe 2240 5hnbbb.exe 4436 jjpdj.exe 3640 ppvvp.exe 4484 1rfrflx.exe 2348 1rfrfxf.exe 1016 9nnbtn.exe 2748 dpvjd.exe 4504 ppvpd.exe 4312 xxxrfxr.exe 1120 hhhbbn.exe 4816 hnhbhh.exe 2132 dddpv.exe 3964 jjdpp.exe 1340 5xffrlf.exe 2564 nnnhhb.exe 4808 hbtntt.exe 428 pjdpj.exe 2360 9djjd.exe 3548 3rlfrlf.exe 2684 xrffxxr.exe 5092 nhnntn.exe 3744 dpvpp.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3656 wrote to memory of 232 3656 2e70e908ea274ffc35386dd27c8a5d32436c0632645b5fe790fc270aa375f868N.exe 82 PID 3656 wrote to memory of 232 3656 2e70e908ea274ffc35386dd27c8a5d32436c0632645b5fe790fc270aa375f868N.exe 82 PID 3656 wrote to memory of 232 3656 2e70e908ea274ffc35386dd27c8a5d32436c0632645b5fe790fc270aa375f868N.exe 82 PID 232 wrote to memory of 3092 232 3ppvv.exe 83 PID 232 wrote to memory of 3092 232 3ppvv.exe 83 PID 232 wrote to memory of 3092 232 3ppvv.exe 83 PID 3092 wrote to memory of 2772 3092 9djjd.exe 84 PID 3092 wrote to memory of 2772 3092 9djjd.exe 84 PID 3092 wrote to memory of 2772 3092 9djjd.exe 84 PID 2772 wrote to memory of 1120 2772 lxrlfxr.exe 85 PID 2772 wrote to memory of 1120 2772 lxrlfxr.exe 85 PID 2772 wrote to memory of 1120 2772 lxrlfxr.exe 85 PID 1120 wrote to memory of 4092 1120 nbnbtn.exe 86 PID 1120 wrote to memory of 4092 1120 nbnbtn.exe 86 PID 1120 wrote to memory of 4092 1120 nbnbtn.exe 86 PID 4092 wrote to memory of 4872 4092 1ppvp.exe 87 PID 4092 wrote to memory of 4872 4092 1ppvp.exe 87 PID 4092 wrote to memory of 4872 4092 1ppvp.exe 87 PID 4872 wrote to memory of 4016 4872 rxxxfxl.exe 88 PID 4872 wrote to memory of 4016 4872 rxxxfxl.exe 88 PID 4872 wrote to memory of 4016 4872 rxxxfxl.exe 88 PID 4016 wrote to memory of 2564 4016 tthbbb.exe 89 PID 4016 wrote to memory of 2564 4016 tthbbb.exe 89 PID 4016 wrote to memory of 2564 4016 tthbbb.exe 89 PID 2564 wrote to memory of 1692 2564 nbhhbh.exe 90 PID 2564 wrote to memory of 1692 2564 nbhhbh.exe 90 PID 2564 wrote to memory of 1692 2564 nbhhbh.exe 90 PID 1692 wrote to memory of 2816 1692 rlrllfl.exe 91 PID 1692 wrote to memory of 2816 1692 rlrllfl.exe 91 PID 1692 wrote to memory of 2816 1692 rlrllfl.exe 91 PID 2816 wrote to memory of 2932 2816 bbnhtn.exe 92 PID 2816 wrote to memory of 2932 2816 bbnhtn.exe 92 PID 2816 wrote to memory of 2932 2816 bbnhtn.exe 92 PID 2932 wrote to memory of 4172 2932 hnnntt.exe 93 PID 2932 wrote to memory of 4172 2932 hnnntt.exe 93 PID 2932 wrote to memory of 4172 2932 hnnntt.exe 93 PID 4172 wrote to memory of 1832 4172 vjjdp.exe 94 PID 4172 wrote to memory of 1832 4172 vjjdp.exe 94 PID 4172 wrote to memory of 1832 4172 vjjdp.exe 94 PID 1832 wrote to memory of 1436 1832 1fffrxx.exe 95 PID 1832 wrote to memory of 1436 1832 1fffrxx.exe 95 PID 1832 wrote to memory of 1436 1832 1fffrxx.exe 95 PID 1436 wrote to memory of 4788 1436 vvdvv.exe 96 PID 1436 wrote to memory of 4788 1436 vvdvv.exe 96 PID 1436 wrote to memory of 4788 1436 vvdvv.exe 96 PID 4788 wrote to memory of 4992 4788 1ddvp.exe 97 PID 4788 wrote to memory of 4992 4788 1ddvp.exe 97 PID 4788 wrote to memory of 4992 4788 1ddvp.exe 97 PID 4992 wrote to memory of 1928 4992 ntnnhn.exe 98 PID 4992 wrote to memory of 1928 4992 ntnnhn.exe 98 PID 4992 wrote to memory of 1928 4992 ntnnhn.exe 98 PID 1928 wrote to memory of 2024 1928 7tttnn.exe 99 PID 1928 wrote to memory of 2024 1928 7tttnn.exe 99 PID 1928 wrote to memory of 2024 1928 7tttnn.exe 99 PID 2024 wrote to memory of 1220 2024 ddpjd.exe 100 PID 2024 wrote to memory of 1220 2024 ddpjd.exe 100 PID 2024 wrote to memory of 1220 2024 ddpjd.exe 100 PID 1220 wrote to memory of 628 1220 5flflfr.exe 101 PID 1220 wrote to memory of 628 1220 5flflfr.exe 101 PID 1220 wrote to memory of 628 1220 5flflfr.exe 101 PID 628 wrote to memory of 4492 628 lllrffr.exe 102 PID 628 wrote to memory of 4492 628 lllrffr.exe 102 PID 628 wrote to memory of 4492 628 lllrffr.exe 102 PID 4492 wrote to memory of 4136 4492 hhbbtb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e70e908ea274ffc35386dd27c8a5d32436c0632645b5fe790fc270aa375f868N.exe"C:\Users\Admin\AppData\Local\Temp\2e70e908ea274ffc35386dd27c8a5d32436c0632645b5fe790fc270aa375f868N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\3ppvv.exec:\3ppvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\9djjd.exec:\9djjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\nbnbtn.exec:\nbnbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\1ppvp.exec:\1ppvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\rxxxfxl.exec:\rxxxfxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\tthbbb.exec:\tthbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\nbhhbh.exec:\nbhhbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\rlrllfl.exec:\rlrllfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\bbnhtn.exec:\bbnhtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\hnnntt.exec:\hnnntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\vjjdp.exec:\vjjdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\1fffrxx.exec:\1fffrxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\vvdvv.exec:\vvdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\1ddvp.exec:\1ddvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\ntnnhn.exec:\ntnnhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\7tttnn.exec:\7tttnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\ddpjd.exec:\ddpjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\5flflfr.exec:\5flflfr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\lllrffr.exec:\lllrffr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\hhbbtb.exec:\hhbbtb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\jjvvd.exec:\jjvvd.exe23⤵
- Executes dropped EXE
PID:4136 -
\??\c:\ppjjd.exec:\ppjjd.exe24⤵
- Executes dropped EXE
PID:448 -
\??\c:\flrrffr.exec:\flrrffr.exe25⤵
- Executes dropped EXE
PID:1968 -
\??\c:\9thhbh.exec:\9thhbh.exe26⤵
- Executes dropped EXE
PID:1776 -
\??\c:\thtnbb.exec:\thtnbb.exe27⤵
- Executes dropped EXE
PID:1856 -
\??\c:\pjjdp.exec:\pjjdp.exe28⤵
- Executes dropped EXE
PID:860 -
\??\c:\xllxllf.exec:\xllxllf.exe29⤵
- Executes dropped EXE
PID:3228 -
\??\c:\fxffxrr.exec:\fxffxrr.exe30⤵
- Executes dropped EXE
PID:464 -
\??\c:\7btnhb.exec:\7btnhb.exe31⤵
- Executes dropped EXE
PID:3936 -
\??\c:\jvvpj.exec:\jvvpj.exe32⤵
- Executes dropped EXE
PID:3580 -
\??\c:\jvjdv.exec:\jvjdv.exe33⤵
- Executes dropped EXE
PID:2164 -
\??\c:\fflfxff.exec:\fflfxff.exe34⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ttttnb.exec:\ttttnb.exe35⤵
- Executes dropped EXE
PID:1284 -
\??\c:\htnnhn.exec:\htnnhn.exe36⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ppddj.exec:\ppddj.exe37⤵
- Executes dropped EXE
PID:972 -
\??\c:\7ffxlfr.exec:\7ffxlfr.exe38⤵
- Executes dropped EXE
PID:1800 -
\??\c:\bbhbtt.exec:\bbhbtt.exe39⤵
- Executes dropped EXE
PID:620 -
\??\c:\5ttbht.exec:\5ttbht.exe40⤵
- Executes dropped EXE
PID:3032 -
\??\c:\vddvp.exec:\vddvp.exe41⤵
- Executes dropped EXE
PID:3752 -
\??\c:\rrfrfxl.exec:\rrfrfxl.exe42⤵
- Executes dropped EXE
PID:2872 -
\??\c:\lllfffr.exec:\lllfffr.exe43⤵
- Executes dropped EXE
PID:3212 -
\??\c:\5hnbbb.exec:\5hnbbb.exe44⤵
- Executes dropped EXE
PID:2240 -
\??\c:\jjpdj.exec:\jjpdj.exe45⤵
- Executes dropped EXE
PID:4436 -
\??\c:\ppvvp.exec:\ppvvp.exe46⤵
- Executes dropped EXE
PID:3640 -
\??\c:\1rfrflx.exec:\1rfrflx.exe47⤵
- Executes dropped EXE
PID:4484 -
\??\c:\1rfrfxf.exec:\1rfrfxf.exe48⤵
- Executes dropped EXE
PID:2348 -
\??\c:\9nnbtn.exec:\9nnbtn.exe49⤵
- Executes dropped EXE
PID:1016 -
\??\c:\dpvjd.exec:\dpvjd.exe50⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ppvpd.exec:\ppvpd.exe51⤵
- Executes dropped EXE
PID:4504 -
\??\c:\xxxrfxr.exec:\xxxrfxr.exe52⤵
- Executes dropped EXE
PID:4312 -
\??\c:\hhhbbn.exec:\hhhbbn.exe53⤵
- Executes dropped EXE
PID:1120 -
\??\c:\hnhbhh.exec:\hnhbhh.exe54⤵
- Executes dropped EXE
PID:4816 -
\??\c:\dddpv.exec:\dddpv.exe55⤵
- Executes dropped EXE
PID:2132 -
\??\c:\jjdpp.exec:\jjdpp.exe56⤵
- Executes dropped EXE
PID:3964 -
\??\c:\5xffrlf.exec:\5xffrlf.exe57⤵
- Executes dropped EXE
PID:1340 -
\??\c:\nnnhhb.exec:\nnnhhb.exe58⤵
- Executes dropped EXE
PID:2564 -
\??\c:\hbtntt.exec:\hbtntt.exe59⤵
- Executes dropped EXE
PID:4808 -
\??\c:\pjdpj.exec:\pjdpj.exe60⤵
- Executes dropped EXE
PID:428 -
\??\c:\9djjd.exec:\9djjd.exe61⤵
- Executes dropped EXE
PID:2360 -
\??\c:\3rlfrlf.exec:\3rlfrlf.exe62⤵
- Executes dropped EXE
PID:3548 -
\??\c:\xrffxxr.exec:\xrffxxr.exe63⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nhnntn.exec:\nhnntn.exe64⤵
- Executes dropped EXE
PID:5092 -
\??\c:\dpvpp.exec:\dpvpp.exe65⤵
- Executes dropped EXE
PID:3744 -
\??\c:\pjdpj.exec:\pjdpj.exe66⤵PID:4716
-
\??\c:\llrllrl.exec:\llrllrl.exe67⤵PID:1780
-
\??\c:\thbtth.exec:\thbtth.exe68⤵PID:4972
-
\??\c:\vpvjj.exec:\vpvjj.exe69⤵PID:4992
-
\??\c:\jjvpp.exec:\jjvpp.exe70⤵PID:1936
-
\??\c:\7fffrxr.exec:\7fffrxr.exe71⤵PID:968
-
\??\c:\nhbtbt.exec:\nhbtbt.exe72⤵PID:2008
-
\??\c:\nnhbhh.exec:\nnhbhh.exe73⤵PID:1736
-
\??\c:\5jdjv.exec:\5jdjv.exe74⤵PID:2760
-
\??\c:\vpddv.exec:\vpddv.exe75⤵PID:4920
-
\??\c:\9fxxflx.exec:\9fxxflx.exe76⤵PID:4492
-
\??\c:\1hnnnn.exec:\1hnnnn.exe77⤵PID:3892
-
\??\c:\jjppv.exec:\jjppv.exe78⤵PID:4128
-
\??\c:\llrfxxx.exec:\llrfxxx.exe79⤵PID:3484
-
\??\c:\tnbbbn.exec:\tnbbbn.exe80⤵PID:1652
-
\??\c:\nhbthh.exec:\nhbthh.exe81⤵PID:3408
-
\??\c:\3vddd.exec:\3vddd.exe82⤵PID:1856
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe83⤵PID:544
-
\??\c:\xrrlffx.exec:\xrrlffx.exe84⤵PID:316
-
\??\c:\hhtthn.exec:\hhtthn.exe85⤵PID:1672
-
\??\c:\jvpdv.exec:\jvpdv.exe86⤵PID:464
-
\??\c:\dvvdj.exec:\dvvdj.exe87⤵PID:4908
-
\??\c:\rffxxrl.exec:\rffxxrl.exe88⤵PID:4516
-
\??\c:\lrrlfxr.exec:\lrrlfxr.exe89⤵PID:3584
-
\??\c:\ttbbtt.exec:\ttbbtt.exe90⤵PID:4004
-
\??\c:\bntnht.exec:\bntnht.exe91⤵PID:4496
-
\??\c:\vpppj.exec:\vpppj.exe92⤵PID:2824
-
\??\c:\5xllfff.exec:\5xllfff.exe93⤵PID:2884
-
\??\c:\rrxrlxf.exec:\rrxrlxf.exe94⤵PID:1608
-
\??\c:\nntbhh.exec:\nntbhh.exe95⤵PID:3308
-
\??\c:\ddjjv.exec:\ddjjv.exe96⤵PID:1268
-
\??\c:\vjpdv.exec:\vjpdv.exe97⤵PID:2928
-
\??\c:\rrrrfll.exec:\rrrrfll.exe98⤵PID:4272
-
\??\c:\hbntht.exec:\hbntht.exe99⤵PID:3400
-
\??\c:\hntbhh.exec:\hntbhh.exe100⤵PID:4904
-
\??\c:\9vvpj.exec:\9vvpj.exe101⤵PID:1616
-
\??\c:\3llfrlf.exec:\3llfrlf.exe102⤵PID:4328
-
\??\c:\frrrllr.exec:\frrrllr.exe103⤵PID:1056
-
\??\c:\bbbttn.exec:\bbbttn.exe104⤵PID:716
-
\??\c:\ddvpj.exec:\ddvpj.exe105⤵PID:3656
-
\??\c:\ddppd.exec:\ddppd.exe106⤵PID:2348
-
\??\c:\llfrfrl.exec:\llfrfrl.exe107⤵PID:1016
-
\??\c:\rlrlllf.exec:\rlrlllf.exe108⤵PID:2772
-
\??\c:\nbhbbt.exec:\nbhbbt.exe109⤵PID:2576
-
\??\c:\tnnbhb.exec:\tnnbhb.exe110⤵PID:2860
-
\??\c:\jjvvp.exec:\jjvvp.exe111⤵PID:4968
-
\??\c:\jpvjv.exec:\jpvjv.exe112⤵PID:2324
-
\??\c:\flrrffx.exec:\flrrffx.exe113⤵PID:4016
-
\??\c:\flllfxf.exec:\flllfxf.exe114⤵PID:3916
-
\??\c:\tntnnn.exec:\tntnnn.exe115⤵PID:4804
-
\??\c:\1vvvp.exec:\1vvvp.exe116⤵PID:4420
-
\??\c:\pppjv.exec:\pppjv.exe117⤵PID:4340
-
\??\c:\1lxrllf.exec:\1lxrllf.exe118⤵PID:3088
-
\??\c:\xlfrxlf.exec:\xlfrxlf.exe119⤵PID:428
-
\??\c:\nhnbbb.exec:\nhnbbb.exe120⤵PID:2360
-
\??\c:\dvpjv.exec:\dvpjv.exe121⤵PID:1264
-
\??\c:\vjvjd.exec:\vjvjd.exe122⤵PID:1452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-