Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2024, 18:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0bcd17c096666da4ec8286ecbcba0352530dc2bd9b343a8f95d1ce6038b42a37.exe
Resource
win7-20240704-en
6 signatures
150 seconds
General
-
Target
0bcd17c096666da4ec8286ecbcba0352530dc2bd9b343a8f95d1ce6038b42a37.exe
-
Size
75KB
-
MD5
d48b29e89d175510dd9d27a152c8bbba
-
SHA1
936a8da8edcad3cfd7ff13410300d6b173f08e0c
-
SHA256
0bcd17c096666da4ec8286ecbcba0352530dc2bd9b343a8f95d1ce6038b42a37
-
SHA512
3ed6aa1f25fcdda4609f999f14deb51276c9eb29db2cf1cb1ee8a598d50ff15425e7a94c43e399e8ccd0f554ee95bf2a8ad3649e24a4e3814092576b01ee44d9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73DQQNeOSTyb:ymb3NkkiQ3mdBjFo73DdoxGb
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/1152-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1284-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3804-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/556-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2528 rxrfxxx.exe 5088 hbhbnn.exe 4684 dvpjp.exe 4444 flrlfxr.exe 5048 3nnbtt.exe 3228 1pvvp.exe 2980 vddvp.exe 2084 llfffff.exe 3948 tnbtnb.exe 1284 dvddj.exe 2760 rllrlrr.exe 3804 5rfxfff.exe 1696 hbnhnh.exe 1636 nnthbb.exe 4564 xrrflff.exe 3544 nbhbnn.exe 3524 3nnbnh.exe 4316 jddvp.exe 556 vvpdp.exe 3408 lxrlffr.exe 888 jvvpd.exe 4620 3jpdp.exe 2908 xxxrfff.exe 2340 btbbtt.exe 4060 nntnhh.exe 1200 xlrxrlf.exe 4984 rlfxrll.exe 3080 bbnnhh.exe 4384 7btnhh.exe 4408 pvvvj.exe 2584 fxrxfxr.exe 2768 htnhtt.exe 4676 hbtnhh.exe 4928 dpppd.exe 2388 jpjjd.exe 1716 lflflfr.exe 1904 xfrlflf.exe 1740 nnhbtn.exe 2984 pdjvp.exe 4496 jdpjv.exe 880 fxllrrf.exe 4724 flllflf.exe 4556 tbnhbb.exe 2056 tnnhbb.exe 2296 jvdvv.exe 1260 pdddp.exe 868 xfrrffx.exe 2956 1rxrlfr.exe 4224 btntnb.exe 1016 htnhtn.exe 1220 5dvpd.exe 2316 pjpjv.exe 3000 rfxxrrl.exe 2080 hbbbtn.exe 1616 hbtnnn.exe 4360 vdvpj.exe 348 vvvdp.exe 3108 xlrlfff.exe 2968 fxlfxxx.exe 4216 bbbttb.exe 3180 1ntnhb.exe 3128 vjdpj.exe 4376 pjdpp.exe 708 fxfxxxr.exe -
resource yara_rule behavioral2/memory/1152-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3804-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1696-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1152 wrote to memory of 2528 1152 0bcd17c096666da4ec8286ecbcba0352530dc2bd9b343a8f95d1ce6038b42a37.exe 83 PID 1152 wrote to memory of 2528 1152 0bcd17c096666da4ec8286ecbcba0352530dc2bd9b343a8f95d1ce6038b42a37.exe 83 PID 1152 wrote to memory of 2528 1152 0bcd17c096666da4ec8286ecbcba0352530dc2bd9b343a8f95d1ce6038b42a37.exe 83 PID 2528 wrote to memory of 5088 2528 rxrfxxx.exe 84 PID 2528 wrote to memory of 5088 2528 rxrfxxx.exe 84 PID 2528 wrote to memory of 5088 2528 rxrfxxx.exe 84 PID 5088 wrote to memory of 4684 5088 hbhbnn.exe 85 PID 5088 wrote to memory of 4684 5088 hbhbnn.exe 85 PID 5088 wrote to memory of 4684 5088 hbhbnn.exe 85 PID 4684 wrote to memory of 4444 4684 dvpjp.exe 86 PID 4684 wrote to memory of 4444 4684 dvpjp.exe 86 PID 4684 wrote to memory of 4444 4684 dvpjp.exe 86 PID 4444 wrote to memory of 5048 4444 flrlfxr.exe 87 PID 4444 wrote to memory of 5048 4444 flrlfxr.exe 87 PID 4444 wrote to memory of 5048 4444 flrlfxr.exe 87 PID 5048 wrote to memory of 3228 5048 3nnbtt.exe 88 PID 5048 wrote to memory of 3228 5048 3nnbtt.exe 88 PID 5048 wrote to memory of 3228 5048 3nnbtt.exe 88 PID 3228 wrote to memory of 2980 3228 1pvvp.exe 89 PID 3228 wrote to memory of 2980 3228 1pvvp.exe 89 PID 3228 wrote to memory of 2980 3228 1pvvp.exe 89 PID 2980 wrote to memory of 2084 2980 vddvp.exe 90 PID 2980 wrote to memory of 2084 2980 vddvp.exe 90 PID 2980 wrote to memory of 2084 2980 vddvp.exe 90 PID 2084 wrote to memory of 3948 2084 llfffff.exe 92 PID 2084 wrote to memory of 3948 2084 llfffff.exe 92 PID 2084 wrote to memory of 3948 2084 llfffff.exe 92 PID 3948 wrote to memory of 1284 3948 tnbtnb.exe 93 PID 3948 wrote to memory of 1284 3948 tnbtnb.exe 93 PID 3948 wrote to memory of 1284 3948 tnbtnb.exe 93 PID 1284 wrote to memory of 2760 1284 dvddj.exe 94 PID 1284 wrote to memory of 2760 1284 dvddj.exe 94 PID 1284 wrote to memory of 2760 1284 dvddj.exe 94 PID 2760 wrote to memory of 3804 2760 rllrlrr.exe 95 PID 2760 wrote to memory of 3804 2760 rllrlrr.exe 95 PID 2760 wrote to memory of 3804 2760 rllrlrr.exe 95 PID 3804 wrote to memory of 1696 3804 5rfxfff.exe 96 PID 3804 wrote to memory of 1696 3804 5rfxfff.exe 96 PID 3804 wrote to memory of 1696 3804 5rfxfff.exe 96 PID 1696 wrote to memory of 1636 1696 hbnhnh.exe 97 PID 1696 wrote to memory of 1636 1696 hbnhnh.exe 97 PID 1696 wrote to memory of 1636 1696 hbnhnh.exe 97 PID 1636 wrote to memory of 4564 1636 nnthbb.exe 98 PID 1636 wrote to memory of 4564 1636 nnthbb.exe 98 PID 1636 wrote to memory of 4564 1636 nnthbb.exe 98 PID 4564 wrote to memory of 3544 4564 xrrflff.exe 99 PID 4564 wrote to memory of 3544 4564 xrrflff.exe 99 PID 4564 wrote to memory of 3544 4564 xrrflff.exe 99 PID 3544 wrote to memory of 3524 3544 nbhbnn.exe 101 PID 3544 wrote to memory of 3524 3544 nbhbnn.exe 101 PID 3544 wrote to memory of 3524 3544 nbhbnn.exe 101 PID 3524 wrote to memory of 4316 3524 3nnbnh.exe 102 PID 3524 wrote to memory of 4316 3524 3nnbnh.exe 102 PID 3524 wrote to memory of 4316 3524 3nnbnh.exe 102 PID 4316 wrote to memory of 556 4316 jddvp.exe 103 PID 4316 wrote to memory of 556 4316 jddvp.exe 103 PID 4316 wrote to memory of 556 4316 jddvp.exe 103 PID 556 wrote to memory of 3408 556 vvpdp.exe 104 PID 556 wrote to memory of 3408 556 vvpdp.exe 104 PID 556 wrote to memory of 3408 556 vvpdp.exe 104 PID 3408 wrote to memory of 888 3408 lxrlffr.exe 106 PID 3408 wrote to memory of 888 3408 lxrlffr.exe 106 PID 3408 wrote to memory of 888 3408 lxrlffr.exe 106 PID 888 wrote to memory of 4620 888 jvvpd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bcd17c096666da4ec8286ecbcba0352530dc2bd9b343a8f95d1ce6038b42a37.exe"C:\Users\Admin\AppData\Local\Temp\0bcd17c096666da4ec8286ecbcba0352530dc2bd9b343a8f95d1ce6038b42a37.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\rxrfxxx.exec:\rxrfxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\hbhbnn.exec:\hbhbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\dvpjp.exec:\dvpjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\flrlfxr.exec:\flrlfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\3nnbtt.exec:\3nnbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\1pvvp.exec:\1pvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\vddvp.exec:\vddvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\llfffff.exec:\llfffff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\tnbtnb.exec:\tnbtnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\dvddj.exec:\dvddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\rllrlrr.exec:\rllrlrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\5rfxfff.exec:\5rfxfff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\hbnhnh.exec:\hbnhnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\nnthbb.exec:\nnthbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\xrrflff.exec:\xrrflff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\nbhbnn.exec:\nbhbnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\3nnbnh.exec:\3nnbnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\jddvp.exec:\jddvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\vvpdp.exec:\vvpdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\lxrlffr.exec:\lxrlffr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\jvvpd.exec:\jvvpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\3jpdp.exec:\3jpdp.exe23⤵
- Executes dropped EXE
PID:4620 -
\??\c:\xxxrfff.exec:\xxxrfff.exe24⤵
- Executes dropped EXE
PID:2908 -
\??\c:\btbbtt.exec:\btbbtt.exe25⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nntnhh.exec:\nntnhh.exe26⤵
- Executes dropped EXE
PID:4060 -
\??\c:\xlrxrlf.exec:\xlrxrlf.exe27⤵
- Executes dropped EXE
PID:1200 -
\??\c:\rlfxrll.exec:\rlfxrll.exe28⤵
- Executes dropped EXE
PID:4984 -
\??\c:\bbnnhh.exec:\bbnnhh.exe29⤵
- Executes dropped EXE
PID:3080 -
\??\c:\7btnhh.exec:\7btnhh.exe30⤵
- Executes dropped EXE
PID:4384 -
\??\c:\pvvvj.exec:\pvvvj.exe31⤵
- Executes dropped EXE
PID:4408 -
\??\c:\fxrxfxr.exec:\fxrxfxr.exe32⤵
- Executes dropped EXE
PID:2584 -
\??\c:\htnhtt.exec:\htnhtt.exe33⤵
- Executes dropped EXE
PID:2768 -
\??\c:\hbtnhh.exec:\hbtnhh.exe34⤵
- Executes dropped EXE
PID:4676 -
\??\c:\dpppd.exec:\dpppd.exe35⤵
- Executes dropped EXE
PID:4928 -
\??\c:\jpjjd.exec:\jpjjd.exe36⤵
- Executes dropped EXE
PID:2388 -
\??\c:\lflflfr.exec:\lflflfr.exe37⤵
- Executes dropped EXE
PID:1716 -
\??\c:\xfrlflf.exec:\xfrlflf.exe38⤵
- Executes dropped EXE
PID:1904 -
\??\c:\nnhbtn.exec:\nnhbtn.exe39⤵
- Executes dropped EXE
PID:1740 -
\??\c:\pdjvp.exec:\pdjvp.exe40⤵
- Executes dropped EXE
PID:2984 -
\??\c:\jdpjv.exec:\jdpjv.exe41⤵
- Executes dropped EXE
PID:4496 -
\??\c:\fxllrrf.exec:\fxllrrf.exe42⤵
- Executes dropped EXE
PID:880 -
\??\c:\flllflf.exec:\flllflf.exe43⤵
- Executes dropped EXE
PID:4724 -
\??\c:\tbnhbb.exec:\tbnhbb.exe44⤵
- Executes dropped EXE
PID:4556 -
\??\c:\tnnhbb.exec:\tnnhbb.exe45⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jvdvv.exec:\jvdvv.exe46⤵
- Executes dropped EXE
PID:2296 -
\??\c:\pdddp.exec:\pdddp.exe47⤵
- Executes dropped EXE
PID:1260 -
\??\c:\xfrrffx.exec:\xfrrffx.exe48⤵
- Executes dropped EXE
PID:868 -
\??\c:\1rxrlfr.exec:\1rxrlfr.exe49⤵
- Executes dropped EXE
PID:2956 -
\??\c:\btntnb.exec:\btntnb.exe50⤵
- Executes dropped EXE
PID:4224 -
\??\c:\htnhtn.exec:\htnhtn.exe51⤵
- Executes dropped EXE
PID:1016 -
\??\c:\5dvpd.exec:\5dvpd.exe52⤵
- Executes dropped EXE
PID:1220 -
\??\c:\pjpjv.exec:\pjpjv.exe53⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rfxxrrl.exec:\rfxxrrl.exe54⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hbbbtn.exec:\hbbbtn.exe55⤵
- Executes dropped EXE
PID:2080 -
\??\c:\hbtnnn.exec:\hbtnnn.exe56⤵
- Executes dropped EXE
PID:1616 -
\??\c:\vdvpj.exec:\vdvpj.exe57⤵
- Executes dropped EXE
PID:4360 -
\??\c:\vvvdp.exec:\vvvdp.exe58⤵
- Executes dropped EXE
PID:348 -
\??\c:\xlrlfff.exec:\xlrlfff.exe59⤵
- Executes dropped EXE
PID:3108 -
\??\c:\fxlfxxx.exec:\fxlfxxx.exe60⤵
- Executes dropped EXE
PID:2968 -
\??\c:\bbbttb.exec:\bbbttb.exe61⤵
- Executes dropped EXE
PID:4216 -
\??\c:\1ntnhb.exec:\1ntnhb.exe62⤵
- Executes dropped EXE
PID:3180 -
\??\c:\vjdpj.exec:\vjdpj.exe63⤵
- Executes dropped EXE
PID:3128 -
\??\c:\pjdpp.exec:\pjdpp.exe64⤵
- Executes dropped EXE
PID:4376 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe65⤵
- Executes dropped EXE
PID:708 -
\??\c:\tnnnhh.exec:\tnnnhh.exe66⤵PID:4316
-
\??\c:\nhhhtt.exec:\nhhhtt.exe67⤵PID:3284
-
\??\c:\dpvpj.exec:\dpvpj.exe68⤵PID:3540
-
\??\c:\3xfxxxf.exec:\3xfxxxf.exe69⤵PID:4908
-
\??\c:\nttbht.exec:\nttbht.exe70⤵PID:4656
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe71⤵PID:1936
-
\??\c:\bnthnb.exec:\bnthnb.exe72⤵PID:4620
-
\??\c:\nbnbtt.exec:\nbnbtt.exe73⤵PID:4532
-
\??\c:\ddjvd.exec:\ddjvd.exe74⤵PID:2784
-
\??\c:\frrrfxr.exec:\frrrfxr.exe75⤵PID:2820
-
\??\c:\ffrrllf.exec:\ffrrllf.exe76⤵PID:2944
-
\??\c:\hbhhbh.exec:\hbhhbh.exe77⤵PID:1364
-
\??\c:\tthhtt.exec:\tthhtt.exe78⤵PID:1500
-
\??\c:\jddvj.exec:\jddvj.exe79⤵PID:3080
-
\??\c:\rfxrffr.exec:\rfxrffr.exe80⤵PID:116
-
\??\c:\tnbntb.exec:\tnbntb.exe81⤵PID:3644
-
\??\c:\vpppj.exec:\vpppj.exe82⤵PID:2584
-
\??\c:\ppjjv.exec:\ppjjv.exe83⤵PID:2500
-
\??\c:\xxrffxf.exec:\xxrffxf.exe84⤵PID:4676
-
\??\c:\3thnnb.exec:\3thnnb.exe85⤵PID:4928
-
\??\c:\nbnhbh.exec:\nbnhbh.exe86⤵PID:8
-
\??\c:\7pvpj.exec:\7pvpj.exe87⤵PID:920
-
\??\c:\vpvpd.exec:\vpvpd.exe88⤵PID:1904
-
\??\c:\rlfxllf.exec:\rlfxllf.exe89⤵PID:1740
-
\??\c:\thnnnh.exec:\thnnnh.exe90⤵PID:2984
-
\??\c:\bhbhhh.exec:\bhbhhh.exe91⤵PID:2020
-
\??\c:\dpvpj.exec:\dpvpj.exe92⤵PID:2716
-
\??\c:\vjpjj.exec:\vjpjj.exe93⤵PID:4724
-
\??\c:\pddvj.exec:\pddvj.exe94⤵PID:4556
-
\??\c:\flrrrlr.exec:\flrrrlr.exe95⤵PID:3368
-
\??\c:\hnhhhn.exec:\hnhhhn.exe96⤵PID:1948
-
\??\c:\9bbnhb.exec:\9bbnhb.exe97⤵PID:5076
-
\??\c:\1ddvj.exec:\1ddvj.exe98⤵PID:5048
-
\??\c:\pvvpd.exec:\pvvpd.exe99⤵PID:4524
-
\??\c:\xxxlfxx.exec:\xxxlfxx.exe100⤵PID:1944
-
\??\c:\xxxfflx.exec:\xxxfflx.exe101⤵PID:2312
-
\??\c:\hhhbbb.exec:\hhhbbb.exe102⤵PID:812
-
\??\c:\nttnhh.exec:\nttnhh.exe103⤵PID:4668
-
\??\c:\jdvpd.exec:\jdvpd.exe104⤵PID:1712
-
\??\c:\vjjdp.exec:\vjjdp.exe105⤵PID:4032
-
\??\c:\xlfxllr.exec:\xlfxllr.exe106⤵PID:552
-
\??\c:\hnhbtt.exec:\hnhbtt.exe107⤵PID:2092
-
\??\c:\hnnhbt.exec:\hnnhbt.exe108⤵PID:4464
-
\??\c:\1dpdd.exec:\1dpdd.exe109⤵PID:3912
-
\??\c:\vjjdp.exec:\vjjdp.exe110⤵PID:2404
-
\??\c:\xrrlllf.exec:\xrrlllf.exe111⤵PID:3904
-
\??\c:\9xfxfxf.exec:\9xfxfxf.exe112⤵PID:3212
-
\??\c:\bhnhbh.exec:\bhnhbh.exe113⤵PID:3832
-
\??\c:\thtnnn.exec:\thtnnn.exe114⤵PID:3524
-
\??\c:\ppdvv.exec:\ppdvv.exe115⤵PID:1888
-
\??\c:\jdvvj.exec:\jdvvj.exe116⤵PID:1940
-
\??\c:\rxxrffx.exec:\rxxrffx.exe117⤵PID:3256
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe118⤵PID:4072
-
\??\c:\hbbbbt.exec:\hbbbbt.exe119⤵PID:2868
-
\??\c:\nbbbhh.exec:\nbbbhh.exe120⤵PID:3792
-
\??\c:\jjvpv.exec:\jjvpv.exe121⤵PID:2908
-
\??\c:\dppdv.exec:\dppdv.exe122⤵PID:3784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-