Overview
overview
10Static
static
10Dropper/Berbew.exe
windows7-x64
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows7-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10RAT/31.exe
windows7-x64
10RAT/31.exe
windows10-2004-x64
10RAT/XClient.exe
windows7-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/file.exe
windows7-x64
7RAT/file.exe
windows10-2004-x64
7Ransomware...-2.exe
windows7-x64
10Ransomware...-2.exe
windows10-2004-x64
10Ransomware...01.exe
windows7-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...lt.exe
windows7-x64
10Ransomware...lt.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows7-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/B...on.exe
windows7-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/Dridex.dll
windows7-x64
10Stealers/Dridex.dll
windows10-2004-x64
10Stealers/M..._2.exe
windows7-x64
10Stealers/M..._2.exe
windows10-2004-x64
10Stealers/lumma.exe
windows7-x64
1Stealers/lumma.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows7-x64
10Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows7-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Resubmissions
03-09-2024 14:02
240903-rb57sazdqf 1003-09-2024 13:51
240903-q59avszclf 1002-09-2024 19:51
240902-yk8gtsxbpd 1002-09-2024 02:27
240902-cxh7tazflg 1002-09-2024 02:26
240902-cwxc2sygll 1021-06-2024 19:37
240621-yca7cszgnd 1009-06-2024 17:07
240609-vm7rjadd73 1013-05-2024 17:36
240513-v6qblafe3y 1012-05-2024 17:17
240512-vty3zafh5s 10Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12-05-2024 16:15
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
RAT/31.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
RAT/XClient.exe
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
RAT/XClient.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
RAT/file.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
RAT/file.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Ransomware/Client-2.exe
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Ransomware/criticalupdate01.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Ransomware/default.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Ransomware/default.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Stealers/Azorult.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
Stealers/Azorult.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Stealers/BlackMoon.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
Stealers/Dridex.dll
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
Stealers/Dridex.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
Stealers/lumma.exe
Resource
win7-20240419-en
Behavioral task
behavioral26
Sample
Stealers/lumma.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Trojan/BetaBot.exe
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
Trojan/SmokeLoader.exe
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20240508-en
General
-
Target
Stealers/BlackMoon.exe
-
Size
387KB
-
MD5
336efa7460c08e3d47f29121742eb010
-
SHA1
f41c36cd83879d170309dede056563d35741b87b
-
SHA256
e6dd3fa33ad938b07c8978691f86b73e9f6fd84104b92f42566498bdb6b2930e
-
SHA512
e8d118fbe907a00d89c2514af4de475a0ea54943076bf90174234f77f2ec093a1246a0d4e78d1104a0dcda150b5441d28f4f3d1e768ecb20ae86383a99863c14
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfN:SgdnJVU4TlnwJ6Goo
Malware Config
Signatures
-
Detect Blackmoon payload 32 IoCs
Processes:
resource yara_rule behavioral20/memory/4372-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/5064-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4080-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4080-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/916-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3288-56-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral20/memory/3372-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3868-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2312-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4640-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4976-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3504-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3632-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2444-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4856-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3980-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4844-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2388-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4992-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3364-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2588-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4788-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1156-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/5048-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2320-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2040-70-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral20/memory/2040-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2664-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3288-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2848-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1616-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/616-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
frrrlfx.exerxllfff.exehbhbbt.exe1bttbh.exenntbnb.exevpvpp.exellxrrrx.exenhhbbb.exebhhbtn.exelxxrfff.exetnnbtt.exepvpjj.exefrxrllf.exehhhhbb.exenhnntt.exejjpjp.exejvjdd.exe5ffffxx.exebhnntn.exevvppj.exe9vppj.exerflfxfx.exehbtnhb.exe5jjjd.exepjjvj.exevjpjd.exe9dvvp.exe9rrrlxr.exennnhbn.exehhbbtt.exeffxxfff.exefflllff.exebhnnhh.exe3vjvj.exedjjvp.exelffxrlf.exe5nbbtt.exetnhhhb.exe5jjjd.exerffxllf.exerlffxxx.exehtttnn.exenhtntt.exepjvpv.exenbhnht.exepjjdd.exefrrrlll.exetnbtnn.exennhnht.exevjppd.exevpppj.exelxfxrxx.exexffffll.exebbhhnn.exejjpjp.exejpjpv.exerlxxfxf.exerflfxfr.exebtbbhh.exehntbtt.exejjvdv.exerxfxrlf.exe3lrlfxx.exenhbtth.exepid process 5064 frrrlfx.exe 4080 rxllfff.exe 916 hbhbbt.exe 616 1bttbh.exe 1616 nntbnb.exe 2848 vpvpp.exe 3288 llxrrrx.exe 2664 nhhbbb.exe 2040 bhhbtn.exe 3372 lxxrfff.exe 2320 tnnbtt.exe 8 pvpjj.exe 5048 frxrllf.exe 3868 hhhhbb.exe 3900 nhnntt.exe 1156 jjpjp.exe 4788 jvjdd.exe 2588 5ffffxx.exe 3364 bhnntn.exe 4992 vvppj.exe 2388 9vppj.exe 4844 rflfxfx.exe 3980 hbtnhb.exe 4856 5jjjd.exe 2444 pjjvj.exe 3632 vjpjd.exe 3504 9dvvp.exe 4976 9rrrlxr.exe 2076 nnnhbn.exe 4640 hhbbtt.exe 2312 ffxxfff.exe 396 fflllff.exe 1716 bhnnhh.exe 1352 3vjvj.exe 4280 djjvp.exe 2240 lffxrlf.exe 4372 5nbbtt.exe 2816 tnhhhb.exe 4080 5jjjd.exe 3624 rffxllf.exe 800 rlffxxx.exe 3480 htttnn.exe 4792 nhtntt.exe 1012 pjvpv.exe 1396 nbhnht.exe 3064 pjjdd.exe 4652 frrrlll.exe 2320 tnbtnn.exe 4268 nnhnht.exe 4192 vjppd.exe 2256 vpppj.exe 3404 lxfxrxx.exe 1340 xffffll.exe 4804 bbhhnn.exe 1620 jjpjp.exe 2588 jpjpv.exe 1208 rlxxfxf.exe 1184 rflfxfr.exe 1960 btbbhh.exe 2720 hntbtt.exe 1656 jjvdv.exe 4952 rxfxrlf.exe 3568 3lrlfxx.exe 3588 nhbtth.exe -
Processes:
resource yara_rule behavioral20/memory/4372-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/5064-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4080-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4080-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/916-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3372-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3868-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2312-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4640-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4976-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3504-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3632-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2444-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4856-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3980-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4844-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2388-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4992-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3364-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2588-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4788-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1156-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/5048-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2320-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2040-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2664-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3288-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2848-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1616-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/616-33-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
BlackMoon.exefrrrlfx.exerxllfff.exehbhbbt.exe1bttbh.exenntbnb.exevpvpp.exellxrrrx.exenhhbbb.exebhhbtn.exelxxrfff.exetnnbtt.exepvpjj.exefrxrllf.exehhhhbb.exenhnntt.exejjpjp.exejvjdd.exe5ffffxx.exebhnntn.exevvppj.exe9vppj.exedescription pid process target process PID 4372 wrote to memory of 5064 4372 BlackMoon.exe xffrffx.exe PID 4372 wrote to memory of 5064 4372 BlackMoon.exe xffrffx.exe PID 4372 wrote to memory of 5064 4372 BlackMoon.exe xffrffx.exe PID 5064 wrote to memory of 4080 5064 frrrlfx.exe 5jjjd.exe PID 5064 wrote to memory of 4080 5064 frrrlfx.exe 5jjjd.exe PID 5064 wrote to memory of 4080 5064 frrrlfx.exe 5jjjd.exe PID 4080 wrote to memory of 916 4080 rxllfff.exe jddvp.exe PID 4080 wrote to memory of 916 4080 rxllfff.exe jddvp.exe PID 4080 wrote to memory of 916 4080 rxllfff.exe jddvp.exe PID 916 wrote to memory of 616 916 hbhbbt.exe 7bbtnn.exe PID 916 wrote to memory of 616 916 hbhbbt.exe 7bbtnn.exe PID 916 wrote to memory of 616 916 hbhbbt.exe 7bbtnn.exe PID 616 wrote to memory of 1616 616 1bttbh.exe rrlfxrl.exe PID 616 wrote to memory of 1616 616 1bttbh.exe rrlfxrl.exe PID 616 wrote to memory of 1616 616 1bttbh.exe rrlfxrl.exe PID 1616 wrote to memory of 2848 1616 nntbnb.exe vpvpp.exe PID 1616 wrote to memory of 2848 1616 nntbnb.exe vpvpp.exe PID 1616 wrote to memory of 2848 1616 nntbnb.exe vpvpp.exe PID 2848 wrote to memory of 3288 2848 vpvpp.exe llxrrrx.exe PID 2848 wrote to memory of 3288 2848 vpvpp.exe llxrrrx.exe PID 2848 wrote to memory of 3288 2848 vpvpp.exe llxrrrx.exe PID 3288 wrote to memory of 2664 3288 llxrrrx.exe nhhbbb.exe PID 3288 wrote to memory of 2664 3288 llxrrrx.exe nhhbbb.exe PID 3288 wrote to memory of 2664 3288 llxrrrx.exe nhhbbb.exe PID 2664 wrote to memory of 2040 2664 nhhbbb.exe bhhbtn.exe PID 2664 wrote to memory of 2040 2664 nhhbbb.exe bhhbtn.exe PID 2664 wrote to memory of 2040 2664 nhhbbb.exe bhhbtn.exe PID 2040 wrote to memory of 3372 2040 bhhbtn.exe lxxrfff.exe PID 2040 wrote to memory of 3372 2040 bhhbtn.exe lxxrfff.exe PID 2040 wrote to memory of 3372 2040 bhhbtn.exe lxxrfff.exe PID 3372 wrote to memory of 2320 3372 lxxrfff.exe tnnbtt.exe PID 3372 wrote to memory of 2320 3372 lxxrfff.exe tnnbtt.exe PID 3372 wrote to memory of 2320 3372 lxxrfff.exe tnnbtt.exe PID 2320 wrote to memory of 8 2320 tnnbtt.exe dvjdj.exe PID 2320 wrote to memory of 8 2320 tnnbtt.exe dvjdj.exe PID 2320 wrote to memory of 8 2320 tnnbtt.exe dvjdj.exe PID 8 wrote to memory of 5048 8 pvpjj.exe frxrllf.exe PID 8 wrote to memory of 5048 8 pvpjj.exe frxrllf.exe PID 8 wrote to memory of 5048 8 pvpjj.exe frxrllf.exe PID 5048 wrote to memory of 3868 5048 frxrllf.exe hhhhbb.exe PID 5048 wrote to memory of 3868 5048 frxrllf.exe hhhhbb.exe PID 5048 wrote to memory of 3868 5048 frxrllf.exe hhhhbb.exe PID 3868 wrote to memory of 3900 3868 hhhhbb.exe nhnntt.exe PID 3868 wrote to memory of 3900 3868 hhhhbb.exe nhnntt.exe PID 3868 wrote to memory of 3900 3868 hhhhbb.exe nhnntt.exe PID 3900 wrote to memory of 1156 3900 nhnntt.exe jjpjp.exe PID 3900 wrote to memory of 1156 3900 nhnntt.exe jjpjp.exe PID 3900 wrote to memory of 1156 3900 nhnntt.exe jjpjp.exe PID 1156 wrote to memory of 4788 1156 jjpjp.exe jvjdd.exe PID 1156 wrote to memory of 4788 1156 jjpjp.exe jvjdd.exe PID 1156 wrote to memory of 4788 1156 jjpjp.exe jvjdd.exe PID 4788 wrote to memory of 2588 4788 jvjdd.exe 5ffffxx.exe PID 4788 wrote to memory of 2588 4788 jvjdd.exe 5ffffxx.exe PID 4788 wrote to memory of 2588 4788 jvjdd.exe 5ffffxx.exe PID 2588 wrote to memory of 3364 2588 5ffffxx.exe rxrrllf.exe PID 2588 wrote to memory of 3364 2588 5ffffxx.exe rxrrllf.exe PID 2588 wrote to memory of 3364 2588 5ffffxx.exe rxrrllf.exe PID 3364 wrote to memory of 4992 3364 bhnntn.exe vvppj.exe PID 3364 wrote to memory of 4992 3364 bhnntn.exe vvppj.exe PID 3364 wrote to memory of 4992 3364 bhnntn.exe vvppj.exe PID 4992 wrote to memory of 2388 4992 vvppj.exe 9vppj.exe PID 4992 wrote to memory of 2388 4992 vvppj.exe 9vppj.exe PID 4992 wrote to memory of 2388 4992 vvppj.exe 9vppj.exe PID 2388 wrote to memory of 4844 2388 9vppj.exe rflfxfx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\frrrlfx.exec:\frrrlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\rxllfff.exec:\rxllfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\hbhbbt.exec:\hbhbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\1bttbh.exec:\1bttbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
\??\c:\nntbnb.exec:\nntbnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\vpvpp.exec:\vpvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\llxrrrx.exec:\llxrrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\nhhbbb.exec:\nhhbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\bhhbtn.exec:\bhhbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\lxxrfff.exec:\lxxrfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\tnnbtt.exec:\tnnbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\pvpjj.exec:\pvpjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\frxrllf.exec:\frxrllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\hhhhbb.exec:\hhhhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\nhnntt.exec:\nhnntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\jjpjp.exec:\jjpjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\jvjdd.exec:\jvjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\5ffffxx.exec:\5ffffxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\bhnntn.exec:\bhnntn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\vvppj.exec:\vvppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\9vppj.exec:\9vppj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\rflfxfx.exec:\rflfxfx.exe23⤵
- Executes dropped EXE
PID:4844 -
\??\c:\hbtnhb.exec:\hbtnhb.exe24⤵
- Executes dropped EXE
PID:3980 -
\??\c:\5jjjd.exec:\5jjjd.exe25⤵
- Executes dropped EXE
PID:4856 -
\??\c:\pjjvj.exec:\pjjvj.exe26⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vjpjd.exec:\vjpjd.exe27⤵
- Executes dropped EXE
PID:3632 -
\??\c:\9dvvp.exec:\9dvvp.exe28⤵
- Executes dropped EXE
PID:3504 -
\??\c:\9rrrlxr.exec:\9rrrlxr.exe29⤵
- Executes dropped EXE
PID:4976 -
\??\c:\nnnhbn.exec:\nnnhbn.exe30⤵
- Executes dropped EXE
PID:2076 -
\??\c:\hhbbtt.exec:\hhbbtt.exe31⤵
- Executes dropped EXE
PID:4640 -
\??\c:\ffxxfff.exec:\ffxxfff.exe32⤵
- Executes dropped EXE
PID:2312 -
\??\c:\fflllff.exec:\fflllff.exe33⤵
- Executes dropped EXE
PID:396 -
\??\c:\bhnnhh.exec:\bhnnhh.exe34⤵
- Executes dropped EXE
PID:1716 -
\??\c:\3vjvj.exec:\3vjvj.exe35⤵
- Executes dropped EXE
PID:1352 -
\??\c:\djjvp.exec:\djjvp.exe36⤵
- Executes dropped EXE
PID:4280 -
\??\c:\lffxrlf.exec:\lffxrlf.exe37⤵
- Executes dropped EXE
PID:2240 -
\??\c:\5nbbtt.exec:\5nbbtt.exe38⤵
- Executes dropped EXE
PID:4372 -
\??\c:\tnhhhb.exec:\tnhhhb.exe39⤵
- Executes dropped EXE
PID:2816 -
\??\c:\5jjjd.exec:\5jjjd.exe40⤵
- Executes dropped EXE
PID:4080 -
\??\c:\rffxllf.exec:\rffxllf.exe41⤵
- Executes dropped EXE
PID:3624 -
\??\c:\rlffxxx.exec:\rlffxxx.exe42⤵
- Executes dropped EXE
PID:800 -
\??\c:\htttnn.exec:\htttnn.exe43⤵
- Executes dropped EXE
PID:3480 -
\??\c:\nhtntt.exec:\nhtntt.exe44⤵
- Executes dropped EXE
PID:4792 -
\??\c:\pjvpv.exec:\pjvpv.exe45⤵
- Executes dropped EXE
PID:1012 -
\??\c:\nbhnht.exec:\nbhnht.exe46⤵
- Executes dropped EXE
PID:1396 -
\??\c:\pjjdd.exec:\pjjdd.exe47⤵
- Executes dropped EXE
PID:3064 -
\??\c:\frrrlll.exec:\frrrlll.exe48⤵
- Executes dropped EXE
PID:4652 -
\??\c:\tnbtnn.exec:\tnbtnn.exe49⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nnhnht.exec:\nnhnht.exe50⤵
- Executes dropped EXE
PID:4268 -
\??\c:\vjppd.exec:\vjppd.exe51⤵
- Executes dropped EXE
PID:4192 -
\??\c:\vpppj.exec:\vpppj.exe52⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lxfxrxx.exec:\lxfxrxx.exe53⤵
- Executes dropped EXE
PID:3404 -
\??\c:\xffffll.exec:\xffffll.exe54⤵
- Executes dropped EXE
PID:1340 -
\??\c:\bbhhnn.exec:\bbhhnn.exe55⤵
- Executes dropped EXE
PID:4804 -
\??\c:\jjpjp.exec:\jjpjp.exe56⤵
- Executes dropped EXE
PID:1620 -
\??\c:\jpjpv.exec:\jpjpv.exe57⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rlxxfxf.exec:\rlxxfxf.exe58⤵
- Executes dropped EXE
PID:1208 -
\??\c:\rflfxfr.exec:\rflfxfr.exe59⤵
- Executes dropped EXE
PID:1184 -
\??\c:\btbbhh.exec:\btbbhh.exe60⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hntbtt.exec:\hntbtt.exe61⤵
- Executes dropped EXE
PID:2720 -
\??\c:\jjvdv.exec:\jjvdv.exe62⤵
- Executes dropped EXE
PID:1656 -
\??\c:\rxfxrlf.exec:\rxfxrlf.exe63⤵
- Executes dropped EXE
PID:4952 -
\??\c:\3lrlfxx.exec:\3lrlfxx.exe64⤵
- Executes dropped EXE
PID:3568 -
\??\c:\nhbtth.exec:\nhbtth.exe65⤵
- Executes dropped EXE
PID:3588 -
\??\c:\1nnhbb.exec:\1nnhbb.exe66⤵PID:2148
-
\??\c:\ppvpv.exec:\ppvpv.exe67⤵PID:2564
-
\??\c:\dddjj.exec:\dddjj.exe68⤵PID:2264
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe69⤵PID:4936
-
\??\c:\nhhbbb.exec:\nhhbbb.exe70⤵PID:4052
-
\??\c:\hhbbtb.exec:\hhbbtb.exe71⤵PID:4352
-
\??\c:\vpdvd.exec:\vpdvd.exe72⤵PID:4348
-
\??\c:\ddjdd.exec:\ddjdd.exe73⤵PID:2312
-
\??\c:\xllfxrl.exec:\xllfxrl.exe74⤵PID:4684
-
\??\c:\fxxrlff.exec:\fxxrlff.exe75⤵PID:1272
-
\??\c:\nnhnhh.exec:\nnhnhh.exe76⤵PID:896
-
\??\c:\ddvpp.exec:\ddvpp.exe77⤵PID:1200
-
\??\c:\pvvjv.exec:\pvvjv.exe78⤵PID:4492
-
\??\c:\lflfllr.exec:\lflfllr.exe79⤵PID:3388
-
\??\c:\rxrrrll.exec:\rxrrrll.exe80⤵PID:4372
-
\??\c:\ttnhnn.exec:\ttnhnn.exe81⤵PID:5104
-
\??\c:\httnhh.exec:\httnhh.exe82⤵PID:1644
-
\??\c:\jdpjv.exec:\jdpjv.exe83⤵PID:1540
-
\??\c:\rflfxxr.exec:\rflfxxr.exe84⤵PID:4388
-
\??\c:\5lfxrrf.exec:\5lfxrrf.exe85⤵PID:1616
-
\??\c:\hnbtnh.exec:\hnbtnh.exe86⤵PID:3480
-
\??\c:\bnttnn.exec:\bnttnn.exe87⤵PID:2792
-
\??\c:\pjjdp.exec:\pjjdp.exe88⤵PID:3248
-
\??\c:\vppjv.exec:\vppjv.exe89⤵PID:2328
-
\??\c:\9xrllfx.exec:\9xrllfx.exe90⤵PID:3904
-
\??\c:\thbhnh.exec:\thbhnh.exe91⤵PID:4568
-
\??\c:\ntthtb.exec:\ntthtb.exe92⤵PID:3748
-
\??\c:\jdvvd.exec:\jdvvd.exe93⤵PID:2676
-
\??\c:\pjpjd.exec:\pjpjd.exe94⤵PID:3840
-
\??\c:\rlfrrlf.exec:\rlfrrlf.exe95⤵PID:4940
-
\??\c:\hbtbnh.exec:\hbtbnh.exe96⤵PID:4796
-
\??\c:\nhhbnb.exec:\nhhbnb.exe97⤵PID:1864
-
\??\c:\vvjvj.exec:\vvjvj.exe98⤵PID:3776
-
\??\c:\jdpdd.exec:\jdpdd.exe99⤵PID:5112
-
\??\c:\fxxlfrl.exec:\fxxlfrl.exe100⤵PID:4788
-
\??\c:\fflxfxl.exec:\fflxfxl.exe101⤵PID:3152
-
\??\c:\nhbnht.exec:\nhbnht.exe102⤵PID:2924
-
\??\c:\ttthnh.exec:\ttthnh.exe103⤵PID:4436
-
\??\c:\ddjvd.exec:\ddjvd.exe104⤵PID:3188
-
\??\c:\lxrxlfx.exec:\lxrxlfx.exe105⤵PID:1776
-
\??\c:\3fxlxfr.exec:\3fxlxfr.exe106⤵PID:2388
-
\??\c:\tntnbt.exec:\tntnbt.exe107⤵PID:2740
-
\??\c:\3nthtn.exec:\3nthtn.exe108⤵PID:3932
-
\??\c:\vdjdp.exec:\vdjdp.exe109⤵PID:3588
-
\??\c:\rxfrxlx.exec:\rxfrxlx.exe110⤵PID:2148
-
\??\c:\lxllrfr.exec:\lxllrfr.exe111⤵PID:2264
-
\??\c:\1bhthn.exec:\1bhthn.exe112⤵PID:4968
-
\??\c:\7dvvv.exec:\7dvvv.exe113⤵PID:2668
-
\??\c:\ppvpd.exec:\ppvpd.exe114⤵PID:1952
-
\??\c:\xrlfxrx.exec:\xrlfxrx.exe115⤵PID:2308
-
\??\c:\fxrxxfr.exec:\fxrxxfr.exe116⤵PID:1352
-
\??\c:\hnnhtn.exec:\hnnhtn.exe117⤵PID:4264
-
\??\c:\dvjdv.exec:\dvjdv.exe118⤵PID:2340
-
\??\c:\xrrlxxl.exec:\xrrlxxl.exe119⤵PID:1752
-
\??\c:\9xxlxrf.exec:\9xxlxrf.exe120⤵PID:2816
-
\??\c:\thhhbt.exec:\thhhbt.exe121⤵PID:4140
-
\??\c:\bthbth.exec:\bthbth.exe122⤵PID:4596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-