Overview
overview
10Static
static
10Dropper/Berbew.exe
windows10-1703-x64
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows10-1703-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10RAT/31.exe
windows10-1703-x64
10RAT/31.exe
windows10-2004-x64
10RAT/XClient.exe
windows10-1703-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/file.exe
windows10-1703-x64
7RAT/file.exe
windows10-2004-x64
7Ransomware...-2.exe
windows10-1703-x64
10Ransomware...-2.exe
windows10-2004-x64
10Ransomware...01.exe
windows10-1703-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...lt.exe
windows10-1703-x64
10Ransomware...lt.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows10-1703-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/B...on.exe
windows10-1703-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/Dridex.dll
windows10-1703-x64
10Stealers/Dridex.dll
windows10-2004-x64
10Stealers/M..._2.exe
windows10-1703-x64
10Stealers/M..._2.exe
windows10-2004-x64
10Stealers/lumma.exe
windows10-1703-x64
10Stealers/lumma.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows10-1703-x64
10Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows10-1703-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Resubmissions
03-09-2024 14:02
240903-rb57sazdqf 1003-09-2024 13:51
240903-q59avszclf 1002-09-2024 19:51
240902-yk8gtsxbpd 1002-09-2024 02:27
240902-cxh7tazflg 1002-09-2024 02:26
240902-cwxc2sygll 1021-06-2024 19:37
240621-yca7cszgnd 1009-06-2024 17:07
240609-vm7rjadd73 1013-05-2024 17:36
240513-v6qblafe3y 1012-05-2024 17:17
240512-vty3zafh5s 10Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
09-06-2024 17:07
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
RAT/31.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
RAT/XClient.exe
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
RAT/XClient.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
RAT/file.exe
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
RAT/file.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
Ransomware/Client-2.exe
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Ransomware/criticalupdate01.exe
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Ransomware/default.exe
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
Ransomware/default.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Stealers/Azorult.exe
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
Stealers/Azorult.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
Stealers/BlackMoon.exe
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
Stealers/Dridex.dll
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
Stealers/Dridex.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10-20240404-en
Behavioral task
behavioral24
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
Stealers/lumma.exe
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
Stealers/lumma.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
Trojan/BetaBot.exe
Resource
win10-20240404-en
Behavioral task
behavioral28
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
Trojan/SmokeLoader.exe
Resource
win10-20240404-en
Behavioral task
behavioral30
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20240508-en
General
-
Target
Stealers/BlackMoon.exe
-
Size
387KB
-
MD5
336efa7460c08e3d47f29121742eb010
-
SHA1
f41c36cd83879d170309dede056563d35741b87b
-
SHA256
e6dd3fa33ad938b07c8978691f86b73e9f6fd84104b92f42566498bdb6b2930e
-
SHA512
e8d118fbe907a00d89c2514af4de475a0ea54943076bf90174234f77f2ec093a1246a0d4e78d1104a0dcda150b5441d28f4f3d1e768ecb20ae86383a99863c14
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfN:SgdnJVU4TlnwJ6Goo
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral19/memory/4360-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/5028-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/4756-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/3900-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/3084-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/1276-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/4888-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2440-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/3576-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/824-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/3568-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/3684-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2916-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/508-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/3348-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/760-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/404-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/4804-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/996-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/5052-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/4032-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/4628-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/4452-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/564-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/1276-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/3048-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/3048-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/5028-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
fflrxxx.exehtttbh.exe7dpjp.exennbbhb.exepjdvj.exejjvpd.exentbhht.exenhnhtn.exetnnbnb.exedvpjj.exefxfflrx.exehtttnh.exepjjdd.exerflfxrr.exetbbtnh.exedjpjj.exevvjpj.exerffrlfx.exennnhtn.exe1vpdv.exerlxlllr.exe3ppjj.exejjpjp.exe7xxrllx.exenbnnhb.exefxxrlll.exerlllfrl.exehhhhhh.exerxfxlfx.exerxlrlrf.exebttnhb.exerxfxlfx.exefrrfrlf.exehhbbth.exe7vvvv.exeppjpp.exerfrrllr.exexxxxrfx.exehhhbbt.exedddvv.exedpppj.exelflflfx.exe5rlfrll.exennttnh.exejvjvj.exenbbthb.exe7vddd.exerllxxxf.exehtnbtn.exejvvvp.exerxxxrrl.exehttnnt.exexxlfxrl.exe1bbthh.exelxrllrr.exeppvvd.exe1nhntt.exejjdjd.exelrrlfxr.exe9frrlfx.exebtbbnn.exe9bbthh.exevjvjd.exexrlfxxx.exepid process 5028 fflrxxx.exe 4756 htttbh.exe 3048 7dpjp.exe 3084 nnbbhb.exe 3900 pjdvj.exe 1276 jjvpd.exe 564 ntbhht.exe 4888 nhnhtn.exe 2440 tnnbnb.exe 3576 dvpjj.exe 4452 fxfflrx.exe 3580 htttnh.exe 4628 pjjdd.exe 4544 rflfxrr.exe 4032 tbbtnh.exe 5052 djpjj.exe 2332 vvjpj.exe 824 rffrlfx.exe 3568 nnnhtn.exe 3684 1vpdv.exe 996 rlxlllr.exe 4804 3ppjj.exe 3348 jjpjp.exe 1568 7xxrllx.exe 508 nbnnhb.exe 2916 fxxrlll.exe 2288 rlllfrl.exe 760 hhhhhh.exe 404 rxfxlfx.exe 4796 rxlrlrf.exe 2248 bttnhb.exe 4764 rxfxlfx.exe 4272 frrfrlf.exe 4260 hhbbth.exe 1000 7vvvv.exe 316 ppjpp.exe 312 rfrrllr.exe 1744 xxxxrfx.exe 200 hhhbbt.exe 2184 dddvv.exe 1112 dpppj.exe 4256 lflflfx.exe 3340 5rlfrll.exe 3916 nnttnh.exe 600 jvjvj.exe 2384 nbbthb.exe 2704 7vddd.exe 4580 rllxxxf.exe 3896 htnbtn.exe 3596 jvvvp.exe 4388 rxxxrrl.exe 4452 httnnt.exe 3400 xxlfxrl.exe 4548 1bbthh.exe 420 lxrllrr.exe 4816 ppvvd.exe 3284 1nhntt.exe 2256 jjdjd.exe 4700 lrrlfxr.exe 1984 9frrlfx.exe 4144 btbbnn.exe 2004 9bbthh.exe 1176 vjvjd.exe 4372 xrlfxxx.exe -
Processes:
resource yara_rule behavioral19/memory/4360-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/5028-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/5028-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/5028-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/4756-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/3900-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/3084-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/1276-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/564-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/564-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/564-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/4888-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2440-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/3576-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/824-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/3568-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/3684-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2916-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/508-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/3348-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/760-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/404-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/4804-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/996-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/5052-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/4032-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/4628-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/4452-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/564-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/1276-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/1276-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/3048-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/3048-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/3048-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/4756-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/4756-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/5028-19-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
BlackMoon.exefflrxxx.exehtttbh.exe7dpjp.exennbbhb.exepjdvj.exejjvpd.exentbhht.exenhnhtn.exetnnbnb.exedvpjj.exefxfflrx.exehtttnh.exepjjdd.exerflfxrr.exetbbtnh.exedjpjj.exevvjpj.exerffrlfx.exennnhtn.exe1vpdv.exerlxlllr.exedescription pid process target process PID 4360 wrote to memory of 5028 4360 BlackMoon.exe fflrxxx.exe PID 4360 wrote to memory of 5028 4360 BlackMoon.exe fflrxxx.exe PID 4360 wrote to memory of 5028 4360 BlackMoon.exe fflrxxx.exe PID 5028 wrote to memory of 4756 5028 fflrxxx.exe htttbh.exe PID 5028 wrote to memory of 4756 5028 fflrxxx.exe htttbh.exe PID 5028 wrote to memory of 4756 5028 fflrxxx.exe htttbh.exe PID 4756 wrote to memory of 3048 4756 htttbh.exe 7dpjp.exe PID 4756 wrote to memory of 3048 4756 htttbh.exe 7dpjp.exe PID 4756 wrote to memory of 3048 4756 htttbh.exe 7dpjp.exe PID 3048 wrote to memory of 3084 3048 7dpjp.exe nnbbhb.exe PID 3048 wrote to memory of 3084 3048 7dpjp.exe nnbbhb.exe PID 3048 wrote to memory of 3084 3048 7dpjp.exe nnbbhb.exe PID 3084 wrote to memory of 3900 3084 nnbbhb.exe pjdvj.exe PID 3084 wrote to memory of 3900 3084 nnbbhb.exe pjdvj.exe PID 3084 wrote to memory of 3900 3084 nnbbhb.exe pjdvj.exe PID 3900 wrote to memory of 1276 3900 pjdvj.exe jjvpd.exe PID 3900 wrote to memory of 1276 3900 pjdvj.exe jjvpd.exe PID 3900 wrote to memory of 1276 3900 pjdvj.exe jjvpd.exe PID 1276 wrote to memory of 564 1276 jjvpd.exe ntbhht.exe PID 1276 wrote to memory of 564 1276 jjvpd.exe ntbhht.exe PID 1276 wrote to memory of 564 1276 jjvpd.exe ntbhht.exe PID 564 wrote to memory of 4888 564 ntbhht.exe nhnhtn.exe PID 564 wrote to memory of 4888 564 ntbhht.exe nhnhtn.exe PID 564 wrote to memory of 4888 564 ntbhht.exe nhnhtn.exe PID 4888 wrote to memory of 2440 4888 nhnhtn.exe tnnbnb.exe PID 4888 wrote to memory of 2440 4888 nhnhtn.exe tnnbnb.exe PID 4888 wrote to memory of 2440 4888 nhnhtn.exe tnnbnb.exe PID 2440 wrote to memory of 3576 2440 tnnbnb.exe dvpjj.exe PID 2440 wrote to memory of 3576 2440 tnnbnb.exe dvpjj.exe PID 2440 wrote to memory of 3576 2440 tnnbnb.exe dvpjj.exe PID 3576 wrote to memory of 4452 3576 dvpjj.exe fxfflrx.exe PID 3576 wrote to memory of 4452 3576 dvpjj.exe fxfflrx.exe PID 3576 wrote to memory of 4452 3576 dvpjj.exe fxfflrx.exe PID 4452 wrote to memory of 3580 4452 fxfflrx.exe htttnh.exe PID 4452 wrote to memory of 3580 4452 fxfflrx.exe htttnh.exe PID 4452 wrote to memory of 3580 4452 fxfflrx.exe htttnh.exe PID 3580 wrote to memory of 4628 3580 htttnh.exe pjjdd.exe PID 3580 wrote to memory of 4628 3580 htttnh.exe pjjdd.exe PID 3580 wrote to memory of 4628 3580 htttnh.exe pjjdd.exe PID 4628 wrote to memory of 4544 4628 pjjdd.exe rflfxrr.exe PID 4628 wrote to memory of 4544 4628 pjjdd.exe rflfxrr.exe PID 4628 wrote to memory of 4544 4628 pjjdd.exe rflfxrr.exe PID 4544 wrote to memory of 4032 4544 rflfxrr.exe tbbtnh.exe PID 4544 wrote to memory of 4032 4544 rflfxrr.exe tbbtnh.exe PID 4544 wrote to memory of 4032 4544 rflfxrr.exe tbbtnh.exe PID 4032 wrote to memory of 5052 4032 tbbtnh.exe djpjj.exe PID 4032 wrote to memory of 5052 4032 tbbtnh.exe djpjj.exe PID 4032 wrote to memory of 5052 4032 tbbtnh.exe djpjj.exe PID 5052 wrote to memory of 2332 5052 djpjj.exe vvjpj.exe PID 5052 wrote to memory of 2332 5052 djpjj.exe vvjpj.exe PID 5052 wrote to memory of 2332 5052 djpjj.exe vvjpj.exe PID 2332 wrote to memory of 824 2332 vvjpj.exe rffrlfx.exe PID 2332 wrote to memory of 824 2332 vvjpj.exe rffrlfx.exe PID 2332 wrote to memory of 824 2332 vvjpj.exe rffrlfx.exe PID 824 wrote to memory of 3568 824 rffrlfx.exe nnnhtn.exe PID 824 wrote to memory of 3568 824 rffrlfx.exe nnnhtn.exe PID 824 wrote to memory of 3568 824 rffrlfx.exe nnnhtn.exe PID 3568 wrote to memory of 3684 3568 nnnhtn.exe 1vpdv.exe PID 3568 wrote to memory of 3684 3568 nnnhtn.exe 1vpdv.exe PID 3568 wrote to memory of 3684 3568 nnnhtn.exe 1vpdv.exe PID 3684 wrote to memory of 996 3684 1vpdv.exe rlxlllr.exe PID 3684 wrote to memory of 996 3684 1vpdv.exe rlxlllr.exe PID 3684 wrote to memory of 996 3684 1vpdv.exe rlxlllr.exe PID 996 wrote to memory of 4804 996 rlxlllr.exe 3ppjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\fflrxxx.exec:\fflrxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\htttbh.exec:\htttbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\7dpjp.exec:\7dpjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\nnbbhb.exec:\nnbbhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\pjdvj.exec:\pjdvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\jjvpd.exec:\jjvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\ntbhht.exec:\ntbhht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\nhnhtn.exec:\nhnhtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\tnnbnb.exec:\tnnbnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\dvpjj.exec:\dvpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\fxfflrx.exec:\fxfflrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\htttnh.exec:\htttnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\pjjdd.exec:\pjjdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\rflfxrr.exec:\rflfxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\tbbtnh.exec:\tbbtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\djpjj.exec:\djpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\vvjpj.exec:\vvjpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\rffrlfx.exec:\rffrlfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\nnnhtn.exec:\nnnhtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\1vpdv.exec:\1vpdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\rlxlllr.exec:\rlxlllr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\3ppjj.exec:\3ppjj.exe23⤵
- Executes dropped EXE
PID:4804 -
\??\c:\jjpjp.exec:\jjpjp.exe24⤵
- Executes dropped EXE
PID:3348 -
\??\c:\7xxrllx.exec:\7xxrllx.exe25⤵
- Executes dropped EXE
PID:1568 -
\??\c:\nbnnhb.exec:\nbnnhb.exe26⤵
- Executes dropped EXE
PID:508 -
\??\c:\fxxrlll.exec:\fxxrlll.exe27⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rlllfrl.exec:\rlllfrl.exe28⤵
- Executes dropped EXE
PID:2288 -
\??\c:\hhhhhh.exec:\hhhhhh.exe29⤵
- Executes dropped EXE
PID:760 -
\??\c:\rxfxlfx.exec:\rxfxlfx.exe30⤵
- Executes dropped EXE
PID:404 -
\??\c:\rxlrlrf.exec:\rxlrlrf.exe31⤵
- Executes dropped EXE
PID:4796 -
\??\c:\bttnhb.exec:\bttnhb.exe32⤵
- Executes dropped EXE
PID:2248 -
\??\c:\rxfxlfx.exec:\rxfxlfx.exe33⤵
- Executes dropped EXE
PID:4764 -
\??\c:\frrfrlf.exec:\frrfrlf.exe34⤵
- Executes dropped EXE
PID:4272 -
\??\c:\hhbbth.exec:\hhbbth.exe35⤵
- Executes dropped EXE
PID:4260 -
\??\c:\7vvvv.exec:\7vvvv.exe36⤵
- Executes dropped EXE
PID:1000 -
\??\c:\ppjpp.exec:\ppjpp.exe37⤵
- Executes dropped EXE
PID:316 -
\??\c:\rfrrllr.exec:\rfrrllr.exe38⤵
- Executes dropped EXE
PID:312 -
\??\c:\xxxxrfx.exec:\xxxxrfx.exe39⤵
- Executes dropped EXE
PID:1744 -
\??\c:\hhhbbt.exec:\hhhbbt.exe40⤵
- Executes dropped EXE
PID:200 -
\??\c:\dddvv.exec:\dddvv.exe41⤵
- Executes dropped EXE
PID:2184 -
\??\c:\dpppj.exec:\dpppj.exe42⤵
- Executes dropped EXE
PID:1112 -
\??\c:\lflflfx.exec:\lflflfx.exe43⤵
- Executes dropped EXE
PID:4256 -
\??\c:\5rlfrll.exec:\5rlfrll.exe44⤵
- Executes dropped EXE
PID:3340 -
\??\c:\nnttnh.exec:\nnttnh.exe45⤵
- Executes dropped EXE
PID:3916 -
\??\c:\jvjvj.exec:\jvjvj.exe46⤵
- Executes dropped EXE
PID:600 -
\??\c:\nbbthb.exec:\nbbthb.exe47⤵
- Executes dropped EXE
PID:2384 -
\??\c:\7vddd.exec:\7vddd.exe48⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rllxxxf.exec:\rllxxxf.exe49⤵
- Executes dropped EXE
PID:4580 -
\??\c:\htnbtn.exec:\htnbtn.exe50⤵
- Executes dropped EXE
PID:3896 -
\??\c:\jvvvp.exec:\jvvvp.exe51⤵
- Executes dropped EXE
PID:3596 -
\??\c:\rxxxrrl.exec:\rxxxrrl.exe52⤵
- Executes dropped EXE
PID:4388 -
\??\c:\httnnt.exec:\httnnt.exe53⤵
- Executes dropped EXE
PID:4452 -
\??\c:\xxlfxrl.exec:\xxlfxrl.exe54⤵
- Executes dropped EXE
PID:3400 -
\??\c:\1bbthh.exec:\1bbthh.exe55⤵
- Executes dropped EXE
PID:4548 -
\??\c:\lxrllrr.exec:\lxrllrr.exe56⤵
- Executes dropped EXE
PID:420 -
\??\c:\ppvvd.exec:\ppvvd.exe57⤵
- Executes dropped EXE
PID:4816 -
\??\c:\1nhntt.exec:\1nhntt.exe58⤵
- Executes dropped EXE
PID:3284 -
\??\c:\jjdjd.exec:\jjdjd.exe59⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lrrlfxr.exec:\lrrlfxr.exe60⤵
- Executes dropped EXE
PID:4700 -
\??\c:\9frrlfx.exec:\9frrlfx.exe61⤵
- Executes dropped EXE
PID:1984 -
\??\c:\btbbnn.exec:\btbbnn.exe62⤵
- Executes dropped EXE
PID:4144 -
\??\c:\9bbthh.exec:\9bbthh.exe63⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vjvjd.exec:\vjvjd.exe64⤵
- Executes dropped EXE
PID:1176 -
\??\c:\xrlfxxx.exec:\xrlfxxx.exe65⤵
- Executes dropped EXE
PID:4372 -
\??\c:\lfrrlxr.exec:\lfrrlxr.exe66⤵PID:3332
-
\??\c:\hthttt.exec:\hthttt.exe67⤵PID:4408
-
\??\c:\jjpjp.exec:\jjpjp.exe68⤵PID:1824
-
\??\c:\xfffxxl.exec:\xfffxxl.exe69⤵PID:4828
-
\??\c:\3llfxxf.exec:\3llfxxf.exe70⤵PID:508
-
\??\c:\1bbthn.exec:\1bbthn.exe71⤵PID:2276
-
\??\c:\pjdpj.exec:\pjdpj.exe72⤵PID:380
-
\??\c:\lllxfxr.exec:\lllxfxr.exe73⤵PID:424
-
\??\c:\htntbn.exec:\htntbn.exe74⤵PID:1388
-
\??\c:\djjdv.exec:\djjdv.exe75⤵PID:960
-
\??\c:\ddddv.exec:\ddddv.exe76⤵PID:4596
-
\??\c:\xfrrxfl.exec:\xfrrxfl.exe77⤵PID:4284
-
\??\c:\nhhhbb.exec:\nhhhbb.exe78⤵PID:3024
-
\??\c:\5jddp.exec:\5jddp.exe79⤵PID:3196
-
\??\c:\5fxlrlf.exec:\5fxlrlf.exe80⤵PID:4400
-
\??\c:\rflfxfx.exec:\rflfxfx.exe81⤵PID:4272
-
\??\c:\ttbhht.exec:\ttbhht.exe82⤵PID:292
-
\??\c:\7jjdv.exec:\7jjdv.exe83⤵PID:3276
-
\??\c:\3pvpp.exec:\3pvpp.exe84⤵PID:316
-
\??\c:\lflxlxr.exec:\lflxlxr.exe85⤵PID:312
-
\??\c:\hbbtnt.exec:\hbbtnt.exe86⤵PID:4756
-
\??\c:\ppjdp.exec:\ppjdp.exe87⤵PID:200
-
\??\c:\jpppv.exec:\jpppv.exe88⤵PID:5024
-
\??\c:\llxrlfx.exec:\llxrlfx.exe89⤵PID:3328
-
\??\c:\nnhnth.exec:\nnhnth.exe90⤵PID:4992
-
\??\c:\bhhhhb.exec:\bhhhhb.exe91⤵PID:3340
-
\??\c:\vvvvp.exec:\vvvvp.exe92⤵PID:3916
-
\??\c:\xxxrlff.exec:\xxxrlff.exe93⤵PID:600
-
\??\c:\1ffxxfr.exec:\1ffxxfr.exe94⤵PID:1716
-
\??\c:\bttnnh.exec:\bttnnh.exe95⤵PID:2704
-
\??\c:\vdjdv.exec:\vdjdv.exe96⤵PID:4580
-
\??\c:\jdjjj.exec:\jdjjj.exe97⤵PID:3896
-
\??\c:\fxxfxlx.exec:\fxxfxlx.exe98⤵PID:3596
-
\??\c:\1nnhhb.exec:\1nnhhb.exe99⤵PID:2560
-
\??\c:\tntbbh.exec:\tntbbh.exe100⤵PID:4184
-
\??\c:\dppvv.exec:\dppvv.exe101⤵PID:3400
-
\??\c:\fxlfffl.exec:\fxlfffl.exe102⤵PID:4548
-
\??\c:\xxrrxrr.exec:\xxrrxrr.exe103⤵PID:420
-
\??\c:\nthbhb.exec:\nthbhb.exe104⤵PID:4816
-
\??\c:\dvvjv.exec:\dvvjv.exe105⤵PID:3284
-
\??\c:\rffrlrl.exec:\rffrlrl.exe106⤵PID:2256
-
\??\c:\xlfrllf.exec:\xlfrllf.exe107⤵PID:4700
-
\??\c:\hhbtnn.exec:\hhbtnn.exe108⤵PID:1984
-
\??\c:\flrxfxx.exec:\flrxfxx.exe109⤵PID:2136
-
\??\c:\5lfxxxr.exec:\5lfxxxr.exe110⤵PID:3808
-
\??\c:\9tthbn.exec:\9tthbn.exe111⤵PID:1868
-
\??\c:\1jjjj.exec:\1jjjj.exe112⤵PID:2920
-
\??\c:\pvjjd.exec:\pvjjd.exe113⤵PID:3332
-
\??\c:\xrfxxrx.exec:\xrfxxrx.exe114⤵PID:4408
-
\??\c:\ffffxrr.exec:\ffffxrr.exe115⤵PID:1400
-
\??\c:\9htnhn.exec:\9htnhn.exe116⤵PID:4524
-
\??\c:\ddvdv.exec:\ddvdv.exe117⤵PID:508
-
\??\c:\1jppv.exec:\1jppv.exe118⤵PID:2916
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe119⤵PID:2288
-
\??\c:\flrlfll.exec:\flrlfll.exe120⤵PID:424
-
\??\c:\ttbbnh.exec:\ttbbnh.exe121⤵PID:3792
-
\??\c:\pddvv.exec:\pddvv.exe122⤵PID:4156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-