Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 13:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b2da9fc1d410876074784f886175152c92eed6409a2f6d6890ad88da52989430.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
b2da9fc1d410876074784f886175152c92eed6409a2f6d6890ad88da52989430.exe
-
Size
79KB
-
MD5
5ca31353af0df933ff43e4068224be68
-
SHA1
67a4c51abfa77f0d9809d5ceaa4f0f96ef707b6a
-
SHA256
b2da9fc1d410876074784f886175152c92eed6409a2f6d6890ad88da52989430
-
SHA512
2c7ff61d758c305cfac5a664f6786a7cca5423704b538bc463ff7ff2009ba01f31dedc1b782c470f3e4d9999c1266201d2faf0e71aa59b420b67cd2f6e0ff2f3
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5bx7DUQeDac7AkE:0cdpeeBSHHMHLf9Rybx7DYec7FE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3896-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4128-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3820-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2500-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2472-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/812-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/968-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/576-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/620-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/780-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-328-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-335-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-349-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-361-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-365-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2708-396-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3040-415-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-419-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-423-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-430-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-455-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-477-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3788-484-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-506-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-579-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-592-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-635-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-732-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2708-772-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-842-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-942-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-946-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-1295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-1573-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2664 vppdj.exe 4128 lrrfxfx.exe 1912 lxfrrlf.exe 3820 bbhttn.exe 1884 3bhttn.exe 2876 pvjpj.exe 2500 fxfrlfl.exe 1652 9hbnbn.exe 2696 vdvdv.exe 2704 lffflrf.exe 4004 5tbtth.exe 2472 hhhhhn.exe 812 pjdpd.exe 2324 9pjdj.exe 4848 frxlxlf.exe 2412 3bthbt.exe 5100 3ttnnn.exe 4988 ppjdp.exe 968 jjdpv.exe 3844 ffxrxrl.exe 2272 jjdvv.exe 576 flllxrl.exe 3748 bthbnh.exe 4948 pdpdv.exe 1388 vdpvj.exe 3648 xrrlrlf.exe 620 5thtnb.exe 4052 ntnhnh.exe 3136 dpjvv.exe 1684 7vvpj.exe 3680 lflxrll.exe 780 9nhthn.exe 3024 nnhtth.exe 2340 ddvjv.exe 1688 1ddpd.exe 748 ffxrxrl.exe 4556 ntbntt.exe 2456 bhnhtn.exe 2016 pjpjd.exe 4116 9djdp.exe 4024 1frfrlf.exe 1400 7bnhhb.exe 1052 nthnnn.exe 2520 dpvpp.exe 3768 7ppjv.exe 4388 fxffxxx.exe 3608 bntttb.exe 1352 9pjdp.exe 1640 dpdvd.exe 3912 1xfrlxr.exe 928 bnbbbh.exe 4924 hthbtn.exe 2364 dddvv.exe 1544 llrrlff.exe 4148 frfflll.exe 2376 nbnnbn.exe 2820 nhtnbb.exe 408 pdvdd.exe 2380 ppdpd.exe 4692 rfffffx.exe 2576 rrrffll.exe 540 nbbthb.exe 3036 hbnhtn.exe 2668 7vjdp.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffffrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3896 wrote to memory of 2664 3896 b2da9fc1d410876074784f886175152c92eed6409a2f6d6890ad88da52989430.exe 82 PID 3896 wrote to memory of 2664 3896 b2da9fc1d410876074784f886175152c92eed6409a2f6d6890ad88da52989430.exe 82 PID 3896 wrote to memory of 2664 3896 b2da9fc1d410876074784f886175152c92eed6409a2f6d6890ad88da52989430.exe 82 PID 2664 wrote to memory of 4128 2664 vppdj.exe 83 PID 2664 wrote to memory of 4128 2664 vppdj.exe 83 PID 2664 wrote to memory of 4128 2664 vppdj.exe 83 PID 4128 wrote to memory of 1912 4128 lrrfxfx.exe 84 PID 4128 wrote to memory of 1912 4128 lrrfxfx.exe 84 PID 4128 wrote to memory of 1912 4128 lrrfxfx.exe 84 PID 1912 wrote to memory of 3820 1912 lxfrrlf.exe 85 PID 1912 wrote to memory of 3820 1912 lxfrrlf.exe 85 PID 1912 wrote to memory of 3820 1912 lxfrrlf.exe 85 PID 3820 wrote to memory of 1884 3820 bbhttn.exe 86 PID 3820 wrote to memory of 1884 3820 bbhttn.exe 86 PID 3820 wrote to memory of 1884 3820 bbhttn.exe 86 PID 1884 wrote to memory of 2876 1884 3bhttn.exe 87 PID 1884 wrote to memory of 2876 1884 3bhttn.exe 87 PID 1884 wrote to memory of 2876 1884 3bhttn.exe 87 PID 2876 wrote to memory of 2500 2876 pvjpj.exe 88 PID 2876 wrote to memory of 2500 2876 pvjpj.exe 88 PID 2876 wrote to memory of 2500 2876 pvjpj.exe 88 PID 2500 wrote to memory of 1652 2500 fxfrlfl.exe 89 PID 2500 wrote to memory of 1652 2500 fxfrlfl.exe 89 PID 2500 wrote to memory of 1652 2500 fxfrlfl.exe 89 PID 1652 wrote to memory of 2696 1652 9hbnbn.exe 90 PID 1652 wrote to memory of 2696 1652 9hbnbn.exe 90 PID 1652 wrote to memory of 2696 1652 9hbnbn.exe 90 PID 2696 wrote to memory of 2704 2696 vdvdv.exe 91 PID 2696 wrote to memory of 2704 2696 vdvdv.exe 91 PID 2696 wrote to memory of 2704 2696 vdvdv.exe 91 PID 2704 wrote to memory of 4004 2704 lffflrf.exe 92 PID 2704 wrote to memory of 4004 2704 lffflrf.exe 92 PID 2704 wrote to memory of 4004 2704 lffflrf.exe 92 PID 4004 wrote to memory of 2472 4004 5tbtth.exe 93 PID 4004 wrote to memory of 2472 4004 5tbtth.exe 93 PID 4004 wrote to memory of 2472 4004 5tbtth.exe 93 PID 2472 wrote to memory of 812 2472 hhhhhn.exe 94 PID 2472 wrote to memory of 812 2472 hhhhhn.exe 94 PID 2472 wrote to memory of 812 2472 hhhhhn.exe 94 PID 812 wrote to memory of 2324 812 pjdpd.exe 95 PID 812 wrote to memory of 2324 812 pjdpd.exe 95 PID 812 wrote to memory of 2324 812 pjdpd.exe 95 PID 2324 wrote to memory of 4848 2324 9pjdj.exe 96 PID 2324 wrote to memory of 4848 2324 9pjdj.exe 96 PID 2324 wrote to memory of 4848 2324 9pjdj.exe 96 PID 4848 wrote to memory of 2412 4848 frxlxlf.exe 97 PID 4848 wrote to memory of 2412 4848 frxlxlf.exe 97 PID 4848 wrote to memory of 2412 4848 frxlxlf.exe 97 PID 2412 wrote to memory of 5100 2412 3bthbt.exe 98 PID 2412 wrote to memory of 5100 2412 3bthbt.exe 98 PID 2412 wrote to memory of 5100 2412 3bthbt.exe 98 PID 5100 wrote to memory of 4988 5100 3ttnnn.exe 99 PID 5100 wrote to memory of 4988 5100 3ttnnn.exe 99 PID 5100 wrote to memory of 4988 5100 3ttnnn.exe 99 PID 4988 wrote to memory of 968 4988 ppjdp.exe 100 PID 4988 wrote to memory of 968 4988 ppjdp.exe 100 PID 4988 wrote to memory of 968 4988 ppjdp.exe 100 PID 968 wrote to memory of 3844 968 jjdpv.exe 101 PID 968 wrote to memory of 3844 968 jjdpv.exe 101 PID 968 wrote to memory of 3844 968 jjdpv.exe 101 PID 3844 wrote to memory of 2272 3844 ffxrxrl.exe 102 PID 3844 wrote to memory of 2272 3844 ffxrxrl.exe 102 PID 3844 wrote to memory of 2272 3844 ffxrxrl.exe 102 PID 2272 wrote to memory of 576 2272 jjdvv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2da9fc1d410876074784f886175152c92eed6409a2f6d6890ad88da52989430.exe"C:\Users\Admin\AppData\Local\Temp\b2da9fc1d410876074784f886175152c92eed6409a2f6d6890ad88da52989430.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\vppdj.exec:\vppdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\lrrfxfx.exec:\lrrfxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\lxfrrlf.exec:\lxfrrlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\bbhttn.exec:\bbhttn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\3bhttn.exec:\3bhttn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\pvjpj.exec:\pvjpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\fxfrlfl.exec:\fxfrlfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\9hbnbn.exec:\9hbnbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\vdvdv.exec:\vdvdv.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\lffflrf.exec:\lffflrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\5tbtth.exec:\5tbtth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\hhhhhn.exec:\hhhhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\pjdpd.exec:\pjdpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\9pjdj.exec:\9pjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\frxlxlf.exec:\frxlxlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\3bthbt.exec:\3bthbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\3ttnnn.exec:\3ttnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\ppjdp.exec:\ppjdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\jjdpv.exec:\jjdpv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\ffxrxrl.exec:\ffxrxrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\jjdvv.exec:\jjdvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\flllxrl.exec:\flllxrl.exe23⤵
- Executes dropped EXE
PID:576 -
\??\c:\bthbnh.exec:\bthbnh.exe24⤵
- Executes dropped EXE
PID:3748 -
\??\c:\pdpdv.exec:\pdpdv.exe25⤵
- Executes dropped EXE
PID:4948 -
\??\c:\vdpvj.exec:\vdpvj.exe26⤵
- Executes dropped EXE
PID:1388 -
\??\c:\xrrlrlf.exec:\xrrlrlf.exe27⤵
- Executes dropped EXE
PID:3648 -
\??\c:\5thtnb.exec:\5thtnb.exe28⤵
- Executes dropped EXE
PID:620 -
\??\c:\ntnhnh.exec:\ntnhnh.exe29⤵
- Executes dropped EXE
PID:4052 -
\??\c:\dpjvv.exec:\dpjvv.exe30⤵
- Executes dropped EXE
PID:3136 -
\??\c:\7vvpj.exec:\7vvpj.exe31⤵
- Executes dropped EXE
PID:1684 -
\??\c:\lflxrll.exec:\lflxrll.exe32⤵
- Executes dropped EXE
PID:3680 -
\??\c:\9nhthn.exec:\9nhthn.exe33⤵
- Executes dropped EXE
PID:780 -
\??\c:\nnhtth.exec:\nnhtth.exe34⤵
- Executes dropped EXE
PID:3024 -
\??\c:\ddvjv.exec:\ddvjv.exe35⤵
- Executes dropped EXE
PID:2340 -
\??\c:\1ddpd.exec:\1ddpd.exe36⤵
- Executes dropped EXE
PID:1688 -
\??\c:\ffxrxrl.exec:\ffxrxrl.exe37⤵
- Executes dropped EXE
PID:748 -
\??\c:\ntbntt.exec:\ntbntt.exe38⤵
- Executes dropped EXE
PID:4556 -
\??\c:\bhnhtn.exec:\bhnhtn.exe39⤵
- Executes dropped EXE
PID:2456 -
\??\c:\pjpjd.exec:\pjpjd.exe40⤵
- Executes dropped EXE
PID:2016 -
\??\c:\9djdp.exec:\9djdp.exe41⤵
- Executes dropped EXE
PID:4116 -
\??\c:\1frfrlf.exec:\1frfrlf.exe42⤵
- Executes dropped EXE
PID:4024 -
\??\c:\7bnhhb.exec:\7bnhhb.exe43⤵
- Executes dropped EXE
PID:1400 -
\??\c:\nthnnn.exec:\nthnnn.exe44⤵
- Executes dropped EXE
PID:1052 -
\??\c:\dpvpp.exec:\dpvpp.exe45⤵
- Executes dropped EXE
PID:2520 -
\??\c:\7ppjv.exec:\7ppjv.exe46⤵
- Executes dropped EXE
PID:3768 -
\??\c:\fxffxxx.exec:\fxffxxx.exe47⤵
- Executes dropped EXE
PID:4388 -
\??\c:\bntttb.exec:\bntttb.exe48⤵
- Executes dropped EXE
PID:3608 -
\??\c:\9pjdp.exec:\9pjdp.exe49⤵
- Executes dropped EXE
PID:1352 -
\??\c:\dpdvd.exec:\dpdvd.exe50⤵
- Executes dropped EXE
PID:1640 -
\??\c:\1xfrlxr.exec:\1xfrlxr.exe51⤵
- Executes dropped EXE
PID:3912 -
\??\c:\bnbbbh.exec:\bnbbbh.exe52⤵
- Executes dropped EXE
PID:928 -
\??\c:\hthbtn.exec:\hthbtn.exe53⤵
- Executes dropped EXE
PID:4924 -
\??\c:\dddvv.exec:\dddvv.exe54⤵
- Executes dropped EXE
PID:2364 -
\??\c:\llrrlff.exec:\llrrlff.exe55⤵
- Executes dropped EXE
PID:1544 -
\??\c:\frfflll.exec:\frfflll.exe56⤵
- Executes dropped EXE
PID:4148 -
\??\c:\nbnnbn.exec:\nbnnbn.exe57⤵
- Executes dropped EXE
PID:2376 -
\??\c:\nhtnbb.exec:\nhtnbb.exe58⤵
- Executes dropped EXE
PID:2820 -
\??\c:\pdvdd.exec:\pdvdd.exe59⤵
- Executes dropped EXE
PID:408 -
\??\c:\ppdpd.exec:\ppdpd.exe60⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rfffffx.exec:\rfffffx.exe61⤵
- Executes dropped EXE
PID:4692 -
\??\c:\rrrffll.exec:\rrrffll.exe62⤵
- Executes dropped EXE
PID:2576 -
\??\c:\nbbthb.exec:\nbbthb.exe63⤵
- Executes dropped EXE
PID:540 -
\??\c:\hbnhtn.exec:\hbnhtn.exe64⤵
- Executes dropped EXE
PID:3036 -
\??\c:\7vjdp.exec:\7vjdp.exe65⤵
- Executes dropped EXE
PID:2668 -
\??\c:\jvvpv.exec:\jvvpv.exe66⤵PID:812
-
\??\c:\lffxffl.exec:\lffxffl.exe67⤵PID:1256
-
\??\c:\xffrfrf.exec:\xffrfrf.exe68⤵PID:1004
-
\??\c:\7bhhhb.exec:\7bhhhb.exe69⤵PID:1996
-
\??\c:\hnhthb.exec:\hnhthb.exe70⤵PID:3972
-
\??\c:\dppdp.exec:\dppdp.exe71⤵PID:4100
-
\??\c:\jvpdd.exec:\jvpdd.exe72⤵PID:5100
-
\??\c:\llfrlxr.exec:\llfrlxr.exe73⤵PID:2156
-
\??\c:\bhbttt.exec:\bhbttt.exe74⤵PID:2288
-
\??\c:\bttnbt.exec:\bttnbt.exe75⤵PID:4816
-
\??\c:\vvvjv.exec:\vvvjv.exe76⤵PID:3604
-
\??\c:\7pdvv.exec:\7pdvv.exe77⤵PID:3532
-
\??\c:\rrrrfxr.exec:\rrrrfxr.exe78⤵PID:3584
-
\??\c:\rfrrxrr.exec:\rfrrxrr.exe79⤵PID:1428
-
\??\c:\thtthb.exec:\thtthb.exe80⤵PID:3748
-
\??\c:\nbhhtt.exec:\nbhhtt.exe81⤵PID:4652
-
\??\c:\5jvjp.exec:\5jvjp.exe82⤵PID:3508
-
\??\c:\5ddjv.exec:\5ddjv.exe83⤵PID:3848
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe84⤵PID:2336
-
\??\c:\hbhtbt.exec:\hbhtbt.exe85⤵PID:1724
-
\??\c:\3nnhbt.exec:\3nnhbt.exe86⤵PID:1916
-
\??\c:\tbhhbh.exec:\tbhhbh.exe87⤵PID:4504
-
\??\c:\jjjdv.exec:\jjjdv.exe88⤵PID:3512
-
\??\c:\vvppj.exec:\vvppj.exe89⤵PID:3344
-
\??\c:\5fllfff.exec:\5fllfff.exe90⤵PID:956
-
\??\c:\lfllffx.exec:\lfllffx.exe91⤵PID:1012
-
\??\c:\tnttnh.exec:\tnttnh.exe92⤵PID:3272
-
\??\c:\pjvdp.exec:\pjvdp.exe93⤵PID:1900
-
\??\c:\jppjv.exec:\jppjv.exe94⤵PID:3736
-
\??\c:\dppjp.exec:\dppjp.exe95⤵PID:3332
-
\??\c:\rlfrxfx.exec:\rlfrxfx.exe96⤵PID:2708
-
\??\c:\xflfrrf.exec:\xflfrrf.exe97⤵PID:4340
-
\??\c:\nbbbtt.exec:\nbbbtt.exe98⤵PID:2200
-
\??\c:\pjpjv.exec:\pjpjv.exe99⤵PID:220
-
\??\c:\ppjvj.exec:\ppjvj.exe100⤵PID:4116
-
\??\c:\5llflfl.exec:\5llflfl.exe101⤵PID:4024
-
\??\c:\fxxxrlf.exec:\fxxxrlf.exe102⤵PID:3040
-
\??\c:\hnhnbb.exec:\hnhnbb.exe103⤵PID:1052
-
\??\c:\hnnhth.exec:\hnnhth.exe104⤵PID:2968
-
\??\c:\pvvpj.exec:\pvvpj.exe105⤵PID:4528
-
\??\c:\fxxlxrl.exec:\fxxlxrl.exe106⤵PID:4176
-
\??\c:\3lffxxx.exec:\3lffxxx.exe107⤵PID:2648
-
\??\c:\tnnbhn.exec:\tnnbhn.exe108⤵PID:396
-
\??\c:\nnbttt.exec:\nnbttt.exe109⤵PID:4668
-
\??\c:\9dpdp.exec:\9dpdp.exe110⤵PID:1892
-
\??\c:\jjvpv.exec:\jjvpv.exe111⤵PID:2112
-
\??\c:\lfxlrrx.exec:\lfxlrrx.exe112⤵PID:3100
-
\??\c:\3hhhtb.exec:\3hhhtb.exe113⤵PID:4016
-
\??\c:\nhnhbh.exec:\nhnhbh.exe114⤵PID:4092
-
\??\c:\vpdvd.exec:\vpdvd.exe115⤵PID:2256
-
\??\c:\ppjjp.exec:\ppjjp.exe116⤵PID:32
-
\??\c:\lxrrfxr.exec:\lxrrfxr.exe117⤵PID:1652
-
\??\c:\9llllrx.exec:\9llllrx.exe118⤵PID:3568
-
\??\c:\3bthhb.exec:\3bthhb.exe119⤵PID:1000
-
\??\c:\nnnbnh.exec:\nnnbnh.exe120⤵PID:2508
-
\??\c:\vdpdp.exec:\vdpdp.exe121⤵PID:5064
-
\??\c:\lxxrrlf.exec:\lxxrrlf.exe122⤵PID:8
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-