Analysis
-
max time kernel
120s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 06:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
970771ff3538cc7439e6a1edaf6a9be0N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
970771ff3538cc7439e6a1edaf6a9be0N.exe
-
Size
76KB
-
MD5
970771ff3538cc7439e6a1edaf6a9be0
-
SHA1
758b92e2f78a46f21718204a2b81ddefa8acdfb0
-
SHA256
e1692cb6fb1024c9bdaad2296aefd6393ecb28bfdef7fc51823838acc510d0ac
-
SHA512
684b0d8b7329223927195cc181003e2c1af8bf0a19246e1b5d216b6b5e37153c033cde588ee37dcd2ba7ace82461e6b67124dfd4862aac0de8d6ae71dbbb8583
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJSsD+cGUFzJhB:ymb3NkkiQ3mdBjFIwsDhbN7B
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3564-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2860-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2568-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3404-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4584 pvvpd.exe 3264 vjjdv.exe 3016 lrflxll.exe 1864 frxxxxx.exe 2860 nhhbtb.exe 208 7jddv.exe 220 pjjdv.exe 116 lfllfff.exe 2372 thhtnt.exe 2940 jvvpj.exe 4936 lrrlfxx.exe 1696 hbtnhb.exe 2568 pjvdv.exe 2292 rlfrlxr.exe 2256 7rllxxx.exe 1544 1hbbtb.exe 2052 dpjjp.exe 3600 ntbttb.exe 3868 nbnhnn.exe 4900 dvpjv.exe 4872 7djdv.exe 4956 lxrlrrx.exe 3200 3nhhbt.exe 1156 5vjjd.exe 3044 pjvjj.exe 2968 xxrlffx.exe 4300 9hhbbt.exe 4880 pjjdd.exe 4640 ddvvv.exe 460 rflfffx.exe 3404 xfllrll.exe 1060 nhbbhh.exe 3084 jdvpd.exe 1164 xrlrxxx.exe 1460 fxllflf.exe 1872 hhbhbt.exe 4672 dvpjd.exe 4056 3ddvd.exe 3840 lflrlll.exe 376 llfxlfx.exe 3644 nnnbtn.exe 2904 bttnhh.exe 1548 ppppj.exe 4752 pdpjd.exe 1964 rrlfrrl.exe 3488 fxrlfxr.exe 2040 nhbtnn.exe 444 bntttb.exe 4952 pdvpj.exe 1980 xlrfrrl.exe 1592 rlxrllf.exe 2448 3nnhbt.exe 4588 ntnhbt.exe 4604 jjdvj.exe 220 jjddv.exe 928 xfxlfxr.exe 4976 nhhbtt.exe 1464 ntthhb.exe 3752 vvpjp.exe 4836 rrrlxxl.exe 468 frxlxrl.exe 3872 tnbhhn.exe 4340 btthbt.exe 1692 dvdvv.exe -
resource yara_rule behavioral2/memory/3564-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1696-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xffffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xffxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3564 wrote to memory of 4584 3564 970771ff3538cc7439e6a1edaf6a9be0N.exe 85 PID 3564 wrote to memory of 4584 3564 970771ff3538cc7439e6a1edaf6a9be0N.exe 85 PID 3564 wrote to memory of 4584 3564 970771ff3538cc7439e6a1edaf6a9be0N.exe 85 PID 4584 wrote to memory of 3264 4584 pvvpd.exe 86 PID 4584 wrote to memory of 3264 4584 pvvpd.exe 86 PID 4584 wrote to memory of 3264 4584 pvvpd.exe 86 PID 3264 wrote to memory of 3016 3264 vjjdv.exe 87 PID 3264 wrote to memory of 3016 3264 vjjdv.exe 87 PID 3264 wrote to memory of 3016 3264 vjjdv.exe 87 PID 3016 wrote to memory of 1864 3016 lrflxll.exe 88 PID 3016 wrote to memory of 1864 3016 lrflxll.exe 88 PID 3016 wrote to memory of 1864 3016 lrflxll.exe 88 PID 1864 wrote to memory of 2860 1864 frxxxxx.exe 89 PID 1864 wrote to memory of 2860 1864 frxxxxx.exe 89 PID 1864 wrote to memory of 2860 1864 frxxxxx.exe 89 PID 2860 wrote to memory of 208 2860 nhhbtb.exe 90 PID 2860 wrote to memory of 208 2860 nhhbtb.exe 90 PID 2860 wrote to memory of 208 2860 nhhbtb.exe 90 PID 208 wrote to memory of 220 208 7jddv.exe 91 PID 208 wrote to memory of 220 208 7jddv.exe 91 PID 208 wrote to memory of 220 208 7jddv.exe 91 PID 220 wrote to memory of 116 220 pjjdv.exe 92 PID 220 wrote to memory of 116 220 pjjdv.exe 92 PID 220 wrote to memory of 116 220 pjjdv.exe 92 PID 116 wrote to memory of 2372 116 lfllfff.exe 93 PID 116 wrote to memory of 2372 116 lfllfff.exe 93 PID 116 wrote to memory of 2372 116 lfllfff.exe 93 PID 2372 wrote to memory of 2940 2372 thhtnt.exe 94 PID 2372 wrote to memory of 2940 2372 thhtnt.exe 94 PID 2372 wrote to memory of 2940 2372 thhtnt.exe 94 PID 2940 wrote to memory of 4936 2940 jvvpj.exe 95 PID 2940 wrote to memory of 4936 2940 jvvpj.exe 95 PID 2940 wrote to memory of 4936 2940 jvvpj.exe 95 PID 4936 wrote to memory of 1696 4936 lrrlfxx.exe 96 PID 4936 wrote to memory of 1696 4936 lrrlfxx.exe 96 PID 4936 wrote to memory of 1696 4936 lrrlfxx.exe 96 PID 1696 wrote to memory of 2568 1696 hbtnhb.exe 97 PID 1696 wrote to memory of 2568 1696 hbtnhb.exe 97 PID 1696 wrote to memory of 2568 1696 hbtnhb.exe 97 PID 2568 wrote to memory of 2292 2568 pjvdv.exe 98 PID 2568 wrote to memory of 2292 2568 pjvdv.exe 98 PID 2568 wrote to memory of 2292 2568 pjvdv.exe 98 PID 2292 wrote to memory of 2256 2292 rlfrlxr.exe 99 PID 2292 wrote to memory of 2256 2292 rlfrlxr.exe 99 PID 2292 wrote to memory of 2256 2292 rlfrlxr.exe 99 PID 2256 wrote to memory of 1544 2256 7rllxxx.exe 100 PID 2256 wrote to memory of 1544 2256 7rllxxx.exe 100 PID 2256 wrote to memory of 1544 2256 7rllxxx.exe 100 PID 1544 wrote to memory of 2052 1544 1hbbtb.exe 101 PID 1544 wrote to memory of 2052 1544 1hbbtb.exe 101 PID 1544 wrote to memory of 2052 1544 1hbbtb.exe 101 PID 2052 wrote to memory of 3600 2052 dpjjp.exe 102 PID 2052 wrote to memory of 3600 2052 dpjjp.exe 102 PID 2052 wrote to memory of 3600 2052 dpjjp.exe 102 PID 3600 wrote to memory of 3868 3600 ntbttb.exe 103 PID 3600 wrote to memory of 3868 3600 ntbttb.exe 103 PID 3600 wrote to memory of 3868 3600 ntbttb.exe 103 PID 3868 wrote to memory of 4900 3868 nbnhnn.exe 104 PID 3868 wrote to memory of 4900 3868 nbnhnn.exe 104 PID 3868 wrote to memory of 4900 3868 nbnhnn.exe 104 PID 4900 wrote to memory of 4872 4900 dvpjv.exe 105 PID 4900 wrote to memory of 4872 4900 dvpjv.exe 105 PID 4900 wrote to memory of 4872 4900 dvpjv.exe 105 PID 4872 wrote to memory of 4956 4872 7djdv.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\970771ff3538cc7439e6a1edaf6a9be0N.exe"C:\Users\Admin\AppData\Local\Temp\970771ff3538cc7439e6a1edaf6a9be0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\pvvpd.exec:\pvvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\vjjdv.exec:\vjjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\lrflxll.exec:\lrflxll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\frxxxxx.exec:\frxxxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\nhhbtb.exec:\nhhbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\7jddv.exec:\7jddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\pjjdv.exec:\pjjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\lfllfff.exec:\lfllfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\thhtnt.exec:\thhtnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\jvvpj.exec:\jvvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\lrrlfxx.exec:\lrrlfxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\hbtnhb.exec:\hbtnhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\pjvdv.exec:\pjvdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\rlfrlxr.exec:\rlfrlxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\7rllxxx.exec:\7rllxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\1hbbtb.exec:\1hbbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\dpjjp.exec:\dpjjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\ntbttb.exec:\ntbttb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\nbnhnn.exec:\nbnhnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\dvpjv.exec:\dvpjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\7djdv.exec:\7djdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\lxrlrrx.exec:\lxrlrrx.exe23⤵
- Executes dropped EXE
PID:4956 -
\??\c:\3nhhbt.exec:\3nhhbt.exe24⤵
- Executes dropped EXE
PID:3200 -
\??\c:\5vjjd.exec:\5vjjd.exe25⤵
- Executes dropped EXE
PID:1156 -
\??\c:\pjvjj.exec:\pjvjj.exe26⤵
- Executes dropped EXE
PID:3044 -
\??\c:\xxrlffx.exec:\xxrlffx.exe27⤵
- Executes dropped EXE
PID:2968 -
\??\c:\9hhbbt.exec:\9hhbbt.exe28⤵
- Executes dropped EXE
PID:4300 -
\??\c:\pjjdd.exec:\pjjdd.exe29⤵
- Executes dropped EXE
PID:4880 -
\??\c:\ddvvv.exec:\ddvvv.exe30⤵
- Executes dropped EXE
PID:4640 -
\??\c:\rflfffx.exec:\rflfffx.exe31⤵
- Executes dropped EXE
PID:460 -
\??\c:\xfllrll.exec:\xfllrll.exe32⤵
- Executes dropped EXE
PID:3404 -
\??\c:\nhbbhh.exec:\nhbbhh.exe33⤵
- Executes dropped EXE
PID:1060 -
\??\c:\jdvpd.exec:\jdvpd.exe34⤵
- Executes dropped EXE
PID:3084 -
\??\c:\xrlrxxx.exec:\xrlrxxx.exe35⤵
- Executes dropped EXE
PID:1164 -
\??\c:\fxllflf.exec:\fxllflf.exe36⤵
- Executes dropped EXE
PID:1460 -
\??\c:\hhbhbt.exec:\hhbhbt.exe37⤵
- Executes dropped EXE
PID:1872 -
\??\c:\dvpjd.exec:\dvpjd.exe38⤵
- Executes dropped EXE
PID:4672 -
\??\c:\3ddvd.exec:\3ddvd.exe39⤵
- Executes dropped EXE
PID:4056 -
\??\c:\lflrlll.exec:\lflrlll.exe40⤵
- Executes dropped EXE
PID:3840 -
\??\c:\llfxlfx.exec:\llfxlfx.exe41⤵
- Executes dropped EXE
PID:376 -
\??\c:\nnnbtn.exec:\nnnbtn.exe42⤵
- Executes dropped EXE
PID:3644 -
\??\c:\bttnhh.exec:\bttnhh.exe43⤵
- Executes dropped EXE
PID:2904 -
\??\c:\ppppj.exec:\ppppj.exe44⤵
- Executes dropped EXE
PID:1548 -
\??\c:\pdpjd.exec:\pdpjd.exe45⤵
- Executes dropped EXE
PID:4752 -
\??\c:\rrlfrrl.exec:\rrlfrrl.exe46⤵
- Executes dropped EXE
PID:1964 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe47⤵
- Executes dropped EXE
PID:3488 -
\??\c:\nhbtnn.exec:\nhbtnn.exe48⤵
- Executes dropped EXE
PID:2040 -
\??\c:\bntttb.exec:\bntttb.exe49⤵
- Executes dropped EXE
PID:444 -
\??\c:\pdvpj.exec:\pdvpj.exe50⤵
- Executes dropped EXE
PID:4952 -
\??\c:\xlrfrrl.exec:\xlrfrrl.exe51⤵
- Executes dropped EXE
PID:1980 -
\??\c:\rlxrllf.exec:\rlxrllf.exe52⤵
- Executes dropped EXE
PID:1592 -
\??\c:\3nnhbt.exec:\3nnhbt.exe53⤵
- Executes dropped EXE
PID:2448 -
\??\c:\ntnhbt.exec:\ntnhbt.exe54⤵
- Executes dropped EXE
PID:4588 -
\??\c:\jjdvj.exec:\jjdvj.exe55⤵
- Executes dropped EXE
PID:4604 -
\??\c:\jjddv.exec:\jjddv.exe56⤵
- Executes dropped EXE
PID:220 -
\??\c:\xfxlfxr.exec:\xfxlfxr.exe57⤵
- Executes dropped EXE
PID:928 -
\??\c:\nhhbtt.exec:\nhhbtt.exe58⤵
- Executes dropped EXE
PID:4976 -
\??\c:\ntthhb.exec:\ntthhb.exe59⤵
- Executes dropped EXE
PID:1464 -
\??\c:\vvpjp.exec:\vvpjp.exe60⤵
- Executes dropped EXE
PID:3752 -
\??\c:\rrrlxxl.exec:\rrrlxxl.exe61⤵
- Executes dropped EXE
PID:4836 -
\??\c:\frxlxrl.exec:\frxlxrl.exe62⤵
- Executes dropped EXE
PID:468 -
\??\c:\tnbhhn.exec:\tnbhhn.exe63⤵
- Executes dropped EXE
PID:3872 -
\??\c:\btthbt.exec:\btthbt.exe64⤵
- Executes dropped EXE
PID:4340 -
\??\c:\dvdvv.exec:\dvdvv.exe65⤵
- Executes dropped EXE
PID:1692 -
\??\c:\dvddv.exec:\dvddv.exe66⤵PID:2000
-
\??\c:\rffxxrf.exec:\rffxxrf.exe67⤵PID:3868
-
\??\c:\bbhbnn.exec:\bbhbnn.exe68⤵PID:3208
-
\??\c:\thnnhh.exec:\thnnhh.exe69⤵PID:3244
-
\??\c:\vppjv.exec:\vppjv.exe70⤵PID:2856
-
\??\c:\1vvvp.exec:\1vvvp.exe71⤵PID:2208
-
\??\c:\rffxxxf.exec:\rffxxxf.exe72⤵PID:2656
-
\??\c:\9bhhnn.exec:\9bhhnn.exe73⤵PID:1332
-
\??\c:\9tbttt.exec:\9tbttt.exe74⤵PID:3212
-
\??\c:\pvpvp.exec:\pvpvp.exe75⤵PID:8
-
\??\c:\vpvjd.exec:\vpvjd.exe76⤵PID:1264
-
\??\c:\flrlfxr.exec:\flrlfxr.exe77⤵PID:2136
-
\??\c:\9hhbtt.exec:\9hhbtt.exe78⤵PID:4568
-
\??\c:\1hnhhb.exec:\1hnhhb.exe79⤵PID:3676
-
\??\c:\pjpjv.exec:\pjpjv.exe80⤵PID:4860
-
\??\c:\3rfxrfr.exec:\3rfxrfr.exe81⤵PID:460
-
\??\c:\xflrrrx.exec:\xflrrrx.exe82⤵PID:3404
-
\??\c:\htttnn.exec:\htttnn.exe83⤵PID:4052
-
\??\c:\thnhtt.exec:\thnhtt.exe84⤵PID:1660
-
\??\c:\rlrrllf.exec:\rlrrllf.exe85⤵PID:4024
-
\??\c:\3lllxxx.exec:\3lllxxx.exe86⤵PID:5060
-
\??\c:\7bhhtn.exec:\7bhhtn.exe87⤵PID:3156
-
\??\c:\ppdpd.exec:\ppdpd.exe88⤵PID:3668
-
\??\c:\3vjdv.exec:\3vjdv.exe89⤵PID:724
-
\??\c:\7ffxllr.exec:\7ffxllr.exe90⤵PID:2596
-
\??\c:\lxfxfxf.exec:\lxfxfxf.exe91⤵PID:3176
-
\??\c:\1hhbtn.exec:\1hhbtn.exe92⤵PID:3784
-
\??\c:\htbtnn.exec:\htbtnn.exe93⤵PID:4812
-
\??\c:\vpvpp.exec:\vpvpp.exe94⤵PID:860
-
\??\c:\dddvp.exec:\dddvp.exe95⤵PID:3968
-
\??\c:\frfxffr.exec:\frfxffr.exe96⤵PID:5032
-
\??\c:\rlfxlll.exec:\rlfxlll.exe97⤵PID:324
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe98⤵PID:264
-
\??\c:\5hhbtb.exec:\5hhbtb.exe99⤵PID:1340
-
\??\c:\dvvvj.exec:\dvvvj.exe100⤵PID:4952
-
\??\c:\pdvpd.exec:\pdvpd.exe101⤵PID:1980
-
\??\c:\fxfxfxx.exec:\fxfxfxx.exe102⤵PID:3976
-
\??\c:\xllfxxr.exec:\xllfxxr.exe103⤵PID:2448
-
\??\c:\vpdvv.exec:\vpdvv.exe104⤵PID:2376
-
\??\c:\pdvvj.exec:\pdvvj.exe105⤵PID:4604
-
\??\c:\7frlfxf.exec:\7frlfxf.exe106⤵PID:220
-
\??\c:\bbhbnn.exec:\bbhbnn.exe107⤵PID:1756
-
\??\c:\hbhbnh.exec:\hbhbnh.exe108⤵PID:4976
-
\??\c:\djjdv.exec:\djjdv.exe109⤵PID:1464
-
\??\c:\5pdvj.exec:\5pdvj.exe110⤵PID:2256
-
\??\c:\lrfffrx.exec:\lrfffrx.exe111⤵PID:1544
-
\??\c:\htbhhn.exec:\htbhhn.exe112⤵PID:468
-
\??\c:\bthbnn.exec:\bthbnn.exe113⤵PID:736
-
\??\c:\vdvdv.exec:\vdvdv.exe114⤵PID:712
-
\??\c:\rflllff.exec:\rflllff.exe115⤵PID:700
-
\??\c:\xrxrxrl.exec:\xrxrxrl.exe116⤵PID:2616
-
\??\c:\bthbtn.exec:\bthbtn.exe117⤵PID:4120
-
\??\c:\5hbtnh.exec:\5hbtnh.exe118⤵PID:2080
-
\??\c:\dpvvp.exec:\dpvvp.exe119⤵PID:1636
-
\??\c:\pjvpp.exec:\pjvpp.exe120⤵PID:1788
-
\??\c:\rrxrrrl.exec:\rrxrrrl.exe121⤵PID:1332
-
\??\c:\hbtbhb.exec:\hbtbhb.exe122⤵PID:404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-