Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8ce1aa62891fc99859da2a3cbee16509dd8b1d9fee1dc0cb2fd8a9f29f025d58N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
8ce1aa62891fc99859da2a3cbee16509dd8b1d9fee1dc0cb2fd8a9f29f025d58N.exe
-
Size
453KB
-
MD5
60f8f55ab89f2f9571ccebb27a8cf810
-
SHA1
8740a87159cd27eb92f0438fbe0a7612964afcd7
-
SHA256
8ce1aa62891fc99859da2a3cbee16509dd8b1d9fee1dc0cb2fd8a9f29f025d58
-
SHA512
0dfde2c88d36f86e6b93a8e8c83b00bb93a42fb4c3667700517a43baddb2a727ec25c4f5b62fb39c0c9e84b66dbe9f6ecbf5cc67012c5f9490581b20f712a7ee
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2400-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/628-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/552-220-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2412-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/464-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1012-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-741-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2076-743-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2380-782-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-832-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2720 fxlrlxr.exe 2728 tntthn.exe 2736 btntbn.exe 3036 vvppv.exe 2800 bhbbnh.exe 2648 7vpjp.exe 1660 bbtbnn.exe 480 vvppj.exe 580 btnthh.exe 336 pjppd.exe 2464 btnnbh.exe 1732 jvppj.exe 1748 hbnhht.exe 628 pdvvd.exe 1980 fxlrxxl.exe 2908 1nnthh.exe 2472 hbtbhh.exe 1736 7nnnnn.exe 3068 1bhhnn.exe 2232 5nhnbb.exe 2136 rfxxrxl.exe 2240 9tntth.exe 1412 rrflrxl.exe 552 httnhb.exe 2412 rlflfff.exe 1644 ffxfxfl.exe 1248 vvjpd.exe 1712 xxrxllx.exe 464 tnhthn.exe 868 9xllxrx.exe 2716 ntnbnb.exe 1524 rffrxxf.exe 2580 llflrlr.exe 2796 1thnhn.exe 2608 jvjdp.exe 2712 pjpvd.exe 3036 9xllrrf.exe 1532 tnbnhn.exe 2636 dvvvj.exe 3008 dvpjp.exe 636 xrxfxfr.exe 480 3bnhth.exe 576 9vjpv.exe 2204 djjdp.exe 2216 9fxfxff.exe 2820 hbntbh.exe 2544 vdddd.exe 1232 1rfrflf.exe 2560 3rrlffl.exe 628 3nbthb.exe 1980 ddvvv.exe 1272 9llrllf.exe 1372 rlrrxxx.exe 1868 bbtbhn.exe 2552 vppjp.exe 2456 lrxfllx.exe 2308 3ttbtb.exe 2448 ntthbh.exe 2428 pjdjd.exe 1132 1llrfxx.exe 1796 bbhtnn.exe 2096 1jdpj.exe 1652 flflffr.exe 1656 rlflrxr.exe -
resource yara_rule behavioral1/memory/2400-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/464-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-782-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-832-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2720 2400 8ce1aa62891fc99859da2a3cbee16509dd8b1d9fee1dc0cb2fd8a9f29f025d58N.exe 30 PID 2400 wrote to memory of 2720 2400 8ce1aa62891fc99859da2a3cbee16509dd8b1d9fee1dc0cb2fd8a9f29f025d58N.exe 30 PID 2400 wrote to memory of 2720 2400 8ce1aa62891fc99859da2a3cbee16509dd8b1d9fee1dc0cb2fd8a9f29f025d58N.exe 30 PID 2400 wrote to memory of 2720 2400 8ce1aa62891fc99859da2a3cbee16509dd8b1d9fee1dc0cb2fd8a9f29f025d58N.exe 30 PID 2720 wrote to memory of 2728 2720 fxlrlxr.exe 31 PID 2720 wrote to memory of 2728 2720 fxlrlxr.exe 31 PID 2720 wrote to memory of 2728 2720 fxlrlxr.exe 31 PID 2720 wrote to memory of 2728 2720 fxlrlxr.exe 31 PID 2728 wrote to memory of 2736 2728 tntthn.exe 32 PID 2728 wrote to memory of 2736 2728 tntthn.exe 32 PID 2728 wrote to memory of 2736 2728 tntthn.exe 32 PID 2728 wrote to memory of 2736 2728 tntthn.exe 32 PID 2736 wrote to memory of 3036 2736 btntbn.exe 33 PID 2736 wrote to memory of 3036 2736 btntbn.exe 33 PID 2736 wrote to memory of 3036 2736 btntbn.exe 33 PID 2736 wrote to memory of 3036 2736 btntbn.exe 33 PID 3036 wrote to memory of 2800 3036 vvppv.exe 34 PID 3036 wrote to memory of 2800 3036 vvppv.exe 34 PID 3036 wrote to memory of 2800 3036 vvppv.exe 34 PID 3036 wrote to memory of 2800 3036 vvppv.exe 34 PID 2800 wrote to memory of 2648 2800 bhbbnh.exe 35 PID 2800 wrote to memory of 2648 2800 bhbbnh.exe 35 PID 2800 wrote to memory of 2648 2800 bhbbnh.exe 35 PID 2800 wrote to memory of 2648 2800 bhbbnh.exe 35 PID 2648 wrote to memory of 1660 2648 7vpjp.exe 36 PID 2648 wrote to memory of 1660 2648 7vpjp.exe 36 PID 2648 wrote to memory of 1660 2648 7vpjp.exe 36 PID 2648 wrote to memory of 1660 2648 7vpjp.exe 36 PID 1660 wrote to memory of 480 1660 bbtbnn.exe 37 PID 1660 wrote to memory of 480 1660 bbtbnn.exe 37 PID 1660 wrote to memory of 480 1660 bbtbnn.exe 37 PID 1660 wrote to memory of 480 1660 bbtbnn.exe 37 PID 480 wrote to memory of 580 480 vvppj.exe 38 PID 480 wrote to memory of 580 480 vvppj.exe 38 PID 480 wrote to memory of 580 480 vvppj.exe 38 PID 480 wrote to memory of 580 480 vvppj.exe 38 PID 580 wrote to memory of 336 580 btnthh.exe 39 PID 580 wrote to memory of 336 580 btnthh.exe 39 PID 580 wrote to memory of 336 580 btnthh.exe 39 PID 580 wrote to memory of 336 580 btnthh.exe 39 PID 336 wrote to memory of 2464 336 pjppd.exe 40 PID 336 wrote to memory of 2464 336 pjppd.exe 40 PID 336 wrote to memory of 2464 336 pjppd.exe 40 PID 336 wrote to memory of 2464 336 pjppd.exe 40 PID 2464 wrote to memory of 1732 2464 btnnbh.exe 41 PID 2464 wrote to memory of 1732 2464 btnnbh.exe 41 PID 2464 wrote to memory of 1732 2464 btnnbh.exe 41 PID 2464 wrote to memory of 1732 2464 btnnbh.exe 41 PID 1732 wrote to memory of 1748 1732 jvppj.exe 42 PID 1732 wrote to memory of 1748 1732 jvppj.exe 42 PID 1732 wrote to memory of 1748 1732 jvppj.exe 42 PID 1732 wrote to memory of 1748 1732 jvppj.exe 42 PID 1748 wrote to memory of 628 1748 hbnhht.exe 43 PID 1748 wrote to memory of 628 1748 hbnhht.exe 43 PID 1748 wrote to memory of 628 1748 hbnhht.exe 43 PID 1748 wrote to memory of 628 1748 hbnhht.exe 43 PID 628 wrote to memory of 1980 628 pdvvd.exe 44 PID 628 wrote to memory of 1980 628 pdvvd.exe 44 PID 628 wrote to memory of 1980 628 pdvvd.exe 44 PID 628 wrote to memory of 1980 628 pdvvd.exe 44 PID 1980 wrote to memory of 2908 1980 fxlrxxl.exe 45 PID 1980 wrote to memory of 2908 1980 fxlrxxl.exe 45 PID 1980 wrote to memory of 2908 1980 fxlrxxl.exe 45 PID 1980 wrote to memory of 2908 1980 fxlrxxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ce1aa62891fc99859da2a3cbee16509dd8b1d9fee1dc0cb2fd8a9f29f025d58N.exe"C:\Users\Admin\AppData\Local\Temp\8ce1aa62891fc99859da2a3cbee16509dd8b1d9fee1dc0cb2fd8a9f29f025d58N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\fxlrlxr.exec:\fxlrlxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\tntthn.exec:\tntthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\btntbn.exec:\btntbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\vvppv.exec:\vvppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\bhbbnh.exec:\bhbbnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\7vpjp.exec:\7vpjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\bbtbnn.exec:\bbtbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\vvppj.exec:\vvppj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
\??\c:\btnthh.exec:\btnthh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\pjppd.exec:\pjppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\btnnbh.exec:\btnnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\jvppj.exec:\jvppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\hbnhht.exec:\hbnhht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\pdvvd.exec:\pdvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\1nnthh.exec:\1nnthh.exe17⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hbtbhh.exec:\hbtbhh.exe18⤵
- Executes dropped EXE
PID:2472 -
\??\c:\7nnnnn.exec:\7nnnnn.exe19⤵
- Executes dropped EXE
PID:1736 -
\??\c:\1bhhnn.exec:\1bhhnn.exe20⤵
- Executes dropped EXE
PID:3068 -
\??\c:\5nhnbb.exec:\5nhnbb.exe21⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rfxxrxl.exec:\rfxxrxl.exe22⤵
- Executes dropped EXE
PID:2136 -
\??\c:\9tntth.exec:\9tntth.exe23⤵
- Executes dropped EXE
PID:2240 -
\??\c:\rrflrxl.exec:\rrflrxl.exe24⤵
- Executes dropped EXE
PID:1412 -
\??\c:\httnhb.exec:\httnhb.exe25⤵
- Executes dropped EXE
PID:552 -
\??\c:\rlflfff.exec:\rlflfff.exe26⤵
- Executes dropped EXE
PID:2412 -
\??\c:\ffxfxfl.exec:\ffxfxfl.exe27⤵
- Executes dropped EXE
PID:1644 -
\??\c:\vvjpd.exec:\vvjpd.exe28⤵
- Executes dropped EXE
PID:1248 -
\??\c:\xxrxllx.exec:\xxrxllx.exe29⤵
- Executes dropped EXE
PID:1712 -
\??\c:\tnhthn.exec:\tnhthn.exe30⤵
- Executes dropped EXE
PID:464 -
\??\c:\9xllxrx.exec:\9xllxrx.exe31⤵
- Executes dropped EXE
PID:868 -
\??\c:\ntnbnb.exec:\ntnbnb.exe32⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rffrxxf.exec:\rffrxxf.exe33⤵
- Executes dropped EXE
PID:1524 -
\??\c:\llflrlr.exec:\llflrlr.exe34⤵
- Executes dropped EXE
PID:2580 -
\??\c:\1thnhn.exec:\1thnhn.exe35⤵
- Executes dropped EXE
PID:2796 -
\??\c:\jvjdp.exec:\jvjdp.exe36⤵
- Executes dropped EXE
PID:2608 -
\??\c:\pjpvd.exec:\pjpvd.exe37⤵
- Executes dropped EXE
PID:2712 -
\??\c:\9xllrrf.exec:\9xllrrf.exe38⤵
- Executes dropped EXE
PID:3036 -
\??\c:\tnbnhn.exec:\tnbnhn.exe39⤵
- Executes dropped EXE
PID:1532 -
\??\c:\dvvvj.exec:\dvvvj.exe40⤵
- Executes dropped EXE
PID:2636 -
\??\c:\dvpjp.exec:\dvpjp.exe41⤵
- Executes dropped EXE
PID:3008 -
\??\c:\xrxfxfr.exec:\xrxfxfr.exe42⤵
- Executes dropped EXE
PID:636 -
\??\c:\3bnhth.exec:\3bnhth.exe43⤵
- Executes dropped EXE
PID:480 -
\??\c:\9vjpv.exec:\9vjpv.exe44⤵
- Executes dropped EXE
PID:576 -
\??\c:\djjdp.exec:\djjdp.exe45⤵
- Executes dropped EXE
PID:2204 -
\??\c:\9fxfxff.exec:\9fxfxff.exe46⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hbntbh.exec:\hbntbh.exe47⤵
- Executes dropped EXE
PID:2820 -
\??\c:\vdddd.exec:\vdddd.exe48⤵
- Executes dropped EXE
PID:2544 -
\??\c:\1rfrflf.exec:\1rfrflf.exe49⤵
- Executes dropped EXE
PID:1232 -
\??\c:\3rrlffl.exec:\3rrlffl.exe50⤵
- Executes dropped EXE
PID:2560 -
\??\c:\3nbthb.exec:\3nbthb.exe51⤵
- Executes dropped EXE
PID:628 -
\??\c:\ddvvv.exec:\ddvvv.exe52⤵
- Executes dropped EXE
PID:1980 -
\??\c:\9llrllf.exec:\9llrllf.exe53⤵
- Executes dropped EXE
PID:1272 -
\??\c:\rlrrxxx.exec:\rlrrxxx.exe54⤵
- Executes dropped EXE
PID:1372 -
\??\c:\bbtbhn.exec:\bbtbhn.exe55⤵
- Executes dropped EXE
PID:1868 -
\??\c:\vppjp.exec:\vppjp.exe56⤵
- Executes dropped EXE
PID:2552 -
\??\c:\lrxfllx.exec:\lrxfllx.exe57⤵
- Executes dropped EXE
PID:2456 -
\??\c:\3ttbtb.exec:\3ttbtb.exe58⤵
- Executes dropped EXE
PID:2308 -
\??\c:\ntthbh.exec:\ntthbh.exe59⤵
- Executes dropped EXE
PID:2448 -
\??\c:\pjdjd.exec:\pjdjd.exe60⤵
- Executes dropped EXE
PID:2428 -
\??\c:\1llrfxx.exec:\1llrfxx.exe61⤵
- Executes dropped EXE
PID:1132 -
\??\c:\bbhtnn.exec:\bbhtnn.exe62⤵
- Executes dropped EXE
PID:1796 -
\??\c:\1jdpj.exec:\1jdpj.exe63⤵
- Executes dropped EXE
PID:2096 -
\??\c:\flflffr.exec:\flflffr.exe64⤵
- Executes dropped EXE
PID:1652 -
\??\c:\rlflrxr.exec:\rlflrxr.exe65⤵
- Executes dropped EXE
PID:1656 -
\??\c:\hnntnn.exec:\hnntnn.exe66⤵PID:2924
-
\??\c:\vppjv.exec:\vppjv.exe67⤵PID:1300
-
\??\c:\djdjv.exec:\djdjv.exe68⤵PID:2536
-
\??\c:\fxlxflr.exec:\fxlxflr.exe69⤵PID:1712
-
\??\c:\bthtnt.exec:\bthtnt.exe70⤵PID:872
-
\??\c:\tnhnnb.exec:\tnhnnb.exe71⤵PID:1900
-
\??\c:\vjjjv.exec:\vjjjv.exe72⤵PID:2684
-
\??\c:\7frfxxl.exec:\7frfxxl.exe73⤵PID:2196
-
\??\c:\3tnbnn.exec:\3tnbnn.exe74⤵PID:2444
-
\??\c:\nnhhbh.exec:\nnhhbh.exe75⤵PID:2580
-
\??\c:\ppvjv.exec:\ppvjv.exe76⤵PID:2796
-
\??\c:\rlfrrll.exec:\rlfrrll.exe77⤵PID:2600
-
\??\c:\hbthtb.exec:\hbthtb.exe78⤵PID:1012
-
\??\c:\hhbhbh.exec:\hhbhbh.exe79⤵PID:2640
-
\??\c:\vpvpd.exec:\vpvpd.exe80⤵PID:304
-
\??\c:\rxfxrlr.exec:\rxfxrlr.exe81⤵PID:2636
-
\??\c:\3btntt.exec:\3btntt.exe82⤵PID:2744
-
\??\c:\jpdjd.exec:\jpdjd.exe83⤵PID:568
-
\??\c:\pdvvd.exec:\pdvvd.exe84⤵PID:2272
-
\??\c:\xrxrrrx.exec:\xrxrrrx.exe85⤵PID:2160
-
\??\c:\tnbbhn.exec:\tnbbhn.exe86⤵PID:2204
-
\??\c:\bbntnn.exec:\bbntnn.exe87⤵PID:2884
-
\??\c:\pvvpp.exec:\pvvpp.exe88⤵PID:1580
-
\??\c:\xxxlffl.exec:\xxxlffl.exe89⤵PID:2012
-
\??\c:\tnbbhh.exec:\tnbbhh.exe90⤵PID:1612
-
\??\c:\bbhbht.exec:\bbhbht.exe91⤵PID:1044
-
\??\c:\jjvvj.exec:\jjvvj.exe92⤵PID:852
-
\??\c:\ffrfffr.exec:\ffrfffr.exe93⤵PID:1720
-
\??\c:\bbntbn.exec:\bbntbn.exe94⤵PID:1940
-
\??\c:\tthhbh.exec:\tthhbh.exe95⤵PID:2752
-
\??\c:\5vjjd.exec:\5vjjd.exe96⤵PID:2408
-
\??\c:\7ffxfrl.exec:\7ffxfrl.exe97⤵PID:2324
-
\??\c:\ntnbtb.exec:\ntnbtb.exe98⤵PID:2232
-
\??\c:\dddjv.exec:\dddjv.exe99⤵PID:2076
-
\??\c:\pjvdp.exec:\pjvdp.exe100⤵PID:2032
-
\??\c:\lfxfflf.exec:\lfxfflf.exe101⤵PID:1412
-
\??\c:\9nnthn.exec:\9nnthn.exe102⤵PID:916
-
\??\c:\3pjpd.exec:\3pjpd.exe103⤵PID:1860
-
\??\c:\llfrxfl.exec:\llfrxfl.exe104⤵PID:2412
-
\??\c:\1xlxrxx.exec:\1xlxrxx.exe105⤵PID:608
-
\??\c:\nbntbb.exec:\nbntbb.exe106⤵PID:2380
-
\??\c:\jjdpj.exec:\jjdpj.exe107⤵PID:572
-
\??\c:\xfrrlrf.exec:\xfrrlrf.exe108⤵PID:1728
-
\??\c:\rrlrlrf.exec:\rrlrlrf.exe109⤵PID:2348
-
\??\c:\7thbhh.exec:\7thbhh.exe110⤵PID:2680
-
\??\c:\jvjjd.exec:\jvjjd.exe111⤵PID:2856
-
\??\c:\pdjjv.exec:\pdjjv.exe112⤵PID:1528
-
\??\c:\rrlxlrf.exec:\rrlxlrf.exe113⤵PID:2784
-
\??\c:\nnbbhn.exec:\nnbbhn.exe114⤵PID:1524
-
\??\c:\dpddp.exec:\dpddp.exe115⤵PID:2840
-
\??\c:\1rflllx.exec:\1rflllx.exe116⤵PID:2580
-
\??\c:\nnbhtt.exec:\nnbhtt.exe117⤵PID:2608
-
\??\c:\7vpdv.exec:\7vpdv.exe118⤵PID:2600
-
\??\c:\5pjvp.exec:\5pjvp.exe119⤵PID:2572
-
\??\c:\fxllxfl.exec:\fxllxfl.exe120⤵PID:2640
-
\??\c:\3thhtt.exec:\3thhtt.exe121⤵PID:696
-
\??\c:\pvvdv.exec:\pvvdv.exe122⤵PID:1308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-