Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22-08-2024 08:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
052f1eea85c007c3f129a809eb0dcab0N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
052f1eea85c007c3f129a809eb0dcab0N.exe
-
Size
60KB
-
MD5
052f1eea85c007c3f129a809eb0dcab0
-
SHA1
265564970d8779b66e1c8ee0c3e5ac1065c16823
-
SHA256
271abccc17419155d43b8111b7125dedc0b45d03f12fb8acc2a35511df9682a6
-
SHA512
cf84aa1ee3b46089cf9b7406e76115a666f74d40117e0ec915279d9f5273d62f991401a3f627686283c86b08d6104b8b1c4bb264b07f37224103014562e6fa84
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsP34i43:ymb3NkkiQ3mdBjFIsP/43
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral1/memory/2280-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2376-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2212-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/236-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2356-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/632-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2528-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1052-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2404-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1480-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1312-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3028-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1520-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2376 pjjvd.exe 2416 fflrffx.exe 2856 hbtnht.exe 2212 dvpdj.exe 2600 rrrxrfl.exe 2868 nhbhht.exe 2640 vpdjd.exe 236 dvddj.exe 2160 rlrrxff.exe 592 rlxrxlf.exe 1772 bnnhtb.exe 2356 vpjpd.exe 2632 pjvdv.exe 632 fxffxfr.exe 2940 nbtnbh.exe 2664 7bthtt.exe 2528 vpjpd.exe 3008 jdpvp.exe 808 5rlffrf.exe 1052 bhbnbh.exe 2404 tttbbn.exe 832 btnbtt.exe 1480 jdppv.exe 1984 rlxlrfl.exe 1312 llrflxr.exe 3028 tnbntt.exe 2100 5tbhnt.exe 2884 pjpvd.exe 2296 7fxrxrx.exe 1520 rrrlxrx.exe 2264 bbnbhb.exe 2668 5tthnt.exe 2772 pppvd.exe 2716 vpjpd.exe 2680 llfrrxr.exe 2880 lllxllf.exe 3060 bhnttb.exe 2676 nhbnbh.exe 2596 7vdpd.exe 1896 jdpdp.exe 1136 pjddj.exe 856 rlfflrf.exe 2920 lxlxrfl.exe 2532 nnhttn.exe 592 hthhtb.exe 2300 hbtnbh.exe 2800 jjdpj.exe 1548 vpjpd.exe 1676 llflxrf.exe 2976 lrffflf.exe 1684 7xxxlrx.exe 2944 hhhbtb.exe 2528 7tnhbh.exe 1784 1vvjj.exe 1744 jdjdp.exe 3004 xlxxllr.exe 1140 xllfrfr.exe 952 hhthnt.exe 832 nttnth.exe 2540 vdpvj.exe 3064 pjvdj.exe 1568 llfllrf.exe 544 lfrrfrf.exe 2504 tnbnbn.exe -
resource yara_rule behavioral1/memory/2280-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2376-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2212-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/236-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/236-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/236-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1772-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2356-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2632-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/632-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1052-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2404-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1480-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1312-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3028-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1520-297-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2376 2280 052f1eea85c007c3f129a809eb0dcab0N.exe 31 PID 2280 wrote to memory of 2376 2280 052f1eea85c007c3f129a809eb0dcab0N.exe 31 PID 2280 wrote to memory of 2376 2280 052f1eea85c007c3f129a809eb0dcab0N.exe 31 PID 2280 wrote to memory of 2376 2280 052f1eea85c007c3f129a809eb0dcab0N.exe 31 PID 2376 wrote to memory of 2416 2376 pjjvd.exe 32 PID 2376 wrote to memory of 2416 2376 pjjvd.exe 32 PID 2376 wrote to memory of 2416 2376 pjjvd.exe 32 PID 2376 wrote to memory of 2416 2376 pjjvd.exe 32 PID 2416 wrote to memory of 2856 2416 fflrffx.exe 33 PID 2416 wrote to memory of 2856 2416 fflrffx.exe 33 PID 2416 wrote to memory of 2856 2416 fflrffx.exe 33 PID 2416 wrote to memory of 2856 2416 fflrffx.exe 33 PID 2856 wrote to memory of 2212 2856 hbtnht.exe 34 PID 2856 wrote to memory of 2212 2856 hbtnht.exe 34 PID 2856 wrote to memory of 2212 2856 hbtnht.exe 34 PID 2856 wrote to memory of 2212 2856 hbtnht.exe 34 PID 2212 wrote to memory of 2600 2212 dvpdj.exe 35 PID 2212 wrote to memory of 2600 2212 dvpdj.exe 35 PID 2212 wrote to memory of 2600 2212 dvpdj.exe 35 PID 2212 wrote to memory of 2600 2212 dvpdj.exe 35 PID 2600 wrote to memory of 2868 2600 rrrxrfl.exe 36 PID 2600 wrote to memory of 2868 2600 rrrxrfl.exe 36 PID 2600 wrote to memory of 2868 2600 rrrxrfl.exe 36 PID 2600 wrote to memory of 2868 2600 rrrxrfl.exe 36 PID 2868 wrote to memory of 2640 2868 nhbhht.exe 37 PID 2868 wrote to memory of 2640 2868 nhbhht.exe 37 PID 2868 wrote to memory of 2640 2868 nhbhht.exe 37 PID 2868 wrote to memory of 2640 2868 nhbhht.exe 37 PID 2640 wrote to memory of 236 2640 vpdjd.exe 38 PID 2640 wrote to memory of 236 2640 vpdjd.exe 38 PID 2640 wrote to memory of 236 2640 vpdjd.exe 38 PID 2640 wrote to memory of 236 2640 vpdjd.exe 38 PID 236 wrote to memory of 2160 236 dvddj.exe 39 PID 236 wrote to memory of 2160 236 dvddj.exe 39 PID 236 wrote to memory of 2160 236 dvddj.exe 39 PID 236 wrote to memory of 2160 236 dvddj.exe 39 PID 2160 wrote to memory of 592 2160 rlrrxff.exe 40 PID 2160 wrote to memory of 592 2160 rlrrxff.exe 40 PID 2160 wrote to memory of 592 2160 rlrrxff.exe 40 PID 2160 wrote to memory of 592 2160 rlrrxff.exe 40 PID 592 wrote to memory of 1772 592 rlxrxlf.exe 41 PID 592 wrote to memory of 1772 592 rlxrxlf.exe 41 PID 592 wrote to memory of 1772 592 rlxrxlf.exe 41 PID 592 wrote to memory of 1772 592 rlxrxlf.exe 41 PID 1772 wrote to memory of 2356 1772 bnnhtb.exe 42 PID 1772 wrote to memory of 2356 1772 bnnhtb.exe 42 PID 1772 wrote to memory of 2356 1772 bnnhtb.exe 42 PID 1772 wrote to memory of 2356 1772 bnnhtb.exe 42 PID 2356 wrote to memory of 2632 2356 vpjpd.exe 43 PID 2356 wrote to memory of 2632 2356 vpjpd.exe 43 PID 2356 wrote to memory of 2632 2356 vpjpd.exe 43 PID 2356 wrote to memory of 2632 2356 vpjpd.exe 43 PID 2632 wrote to memory of 632 2632 pjvdv.exe 44 PID 2632 wrote to memory of 632 2632 pjvdv.exe 44 PID 2632 wrote to memory of 632 2632 pjvdv.exe 44 PID 2632 wrote to memory of 632 2632 pjvdv.exe 44 PID 632 wrote to memory of 2940 632 fxffxfr.exe 45 PID 632 wrote to memory of 2940 632 fxffxfr.exe 45 PID 632 wrote to memory of 2940 632 fxffxfr.exe 45 PID 632 wrote to memory of 2940 632 fxffxfr.exe 45 PID 2940 wrote to memory of 2664 2940 nbtnbh.exe 46 PID 2940 wrote to memory of 2664 2940 nbtnbh.exe 46 PID 2940 wrote to memory of 2664 2940 nbtnbh.exe 46 PID 2940 wrote to memory of 2664 2940 nbtnbh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\052f1eea85c007c3f129a809eb0dcab0N.exe"C:\Users\Admin\AppData\Local\Temp\052f1eea85c007c3f129a809eb0dcab0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\pjjvd.exec:\pjjvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\fflrffx.exec:\fflrffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\hbtnht.exec:\hbtnht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\dvpdj.exec:\dvpdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\rrrxrfl.exec:\rrrxrfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\nhbhht.exec:\nhbhht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\vpdjd.exec:\vpdjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\dvddj.exec:\dvddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
\??\c:\rlrrxff.exec:\rlrrxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\rlxrxlf.exec:\rlxrxlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\bnnhtb.exec:\bnnhtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\vpjpd.exec:\vpjpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\pjvdv.exec:\pjvdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\fxffxfr.exec:\fxffxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\nbtnbh.exec:\nbtnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\7bthtt.exec:\7bthtt.exe17⤵
- Executes dropped EXE
PID:2664 -
\??\c:\vpjpd.exec:\vpjpd.exe18⤵
- Executes dropped EXE
PID:2528 -
\??\c:\jdpvp.exec:\jdpvp.exe19⤵
- Executes dropped EXE
PID:3008 -
\??\c:\5rlffrf.exec:\5rlffrf.exe20⤵
- Executes dropped EXE
PID:808 -
\??\c:\bhbnbh.exec:\bhbnbh.exe21⤵
- Executes dropped EXE
PID:1052 -
\??\c:\tttbbn.exec:\tttbbn.exe22⤵
- Executes dropped EXE
PID:2404 -
\??\c:\btnbtt.exec:\btnbtt.exe23⤵
- Executes dropped EXE
PID:832 -
\??\c:\jdppv.exec:\jdppv.exe24⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rlxlrfl.exec:\rlxlrfl.exe25⤵
- Executes dropped EXE
PID:1984 -
\??\c:\llrflxr.exec:\llrflxr.exe26⤵
- Executes dropped EXE
PID:1312 -
\??\c:\tnbntt.exec:\tnbntt.exe27⤵
- Executes dropped EXE
PID:3028 -
\??\c:\5tbhnt.exec:\5tbhnt.exe28⤵
- Executes dropped EXE
PID:2100 -
\??\c:\pjpvd.exec:\pjpvd.exe29⤵
- Executes dropped EXE
PID:2884 -
\??\c:\7fxrxrx.exec:\7fxrxrx.exe30⤵
- Executes dropped EXE
PID:2296 -
\??\c:\rrrlxrx.exec:\rrrlxrx.exe31⤵
- Executes dropped EXE
PID:1520 -
\??\c:\bbnbhb.exec:\bbnbhb.exe32⤵
- Executes dropped EXE
PID:2264 -
\??\c:\5tthnt.exec:\5tthnt.exe33⤵
- Executes dropped EXE
PID:2668 -
\??\c:\pppvd.exec:\pppvd.exe34⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vpjpd.exec:\vpjpd.exe35⤵
- Executes dropped EXE
PID:2716 -
\??\c:\llfrrxr.exec:\llfrrxr.exe36⤵
- Executes dropped EXE
PID:2680 -
\??\c:\lllxllf.exec:\lllxllf.exe37⤵
- Executes dropped EXE
PID:2880 -
\??\c:\bhnttb.exec:\bhnttb.exe38⤵
- Executes dropped EXE
PID:3060 -
\??\c:\nhbnbh.exec:\nhbnbh.exe39⤵
- Executes dropped EXE
PID:2676 -
\??\c:\7vdpd.exec:\7vdpd.exe40⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jdpdp.exec:\jdpdp.exe41⤵
- Executes dropped EXE
PID:1896 -
\??\c:\pjddj.exec:\pjddj.exe42⤵
- Executes dropped EXE
PID:1136 -
\??\c:\rlfflrf.exec:\rlfflrf.exe43⤵
- Executes dropped EXE
PID:856 -
\??\c:\lxlxrfl.exec:\lxlxrfl.exe44⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nnhttn.exec:\nnhttn.exe45⤵
- Executes dropped EXE
PID:2532 -
\??\c:\hthhtb.exec:\hthhtb.exe46⤵
- Executes dropped EXE
PID:592 -
\??\c:\hbtnbh.exec:\hbtnbh.exe47⤵
- Executes dropped EXE
PID:2300 -
\??\c:\jjdpj.exec:\jjdpj.exe48⤵
- Executes dropped EXE
PID:2800 -
\??\c:\vpjpd.exec:\vpjpd.exe49⤵
- Executes dropped EXE
PID:1548 -
\??\c:\llflxrf.exec:\llflxrf.exe50⤵
- Executes dropped EXE
PID:1676 -
\??\c:\lrffflf.exec:\lrffflf.exe51⤵
- Executes dropped EXE
PID:2976 -
\??\c:\7xxxlrx.exec:\7xxxlrx.exe52⤵
- Executes dropped EXE
PID:1684 -
\??\c:\hhhbtb.exec:\hhhbtb.exe53⤵
- Executes dropped EXE
PID:2944 -
\??\c:\7tnhbh.exec:\7tnhbh.exe54⤵
- Executes dropped EXE
PID:2528 -
\??\c:\1vvjj.exec:\1vvjj.exe55⤵
- Executes dropped EXE
PID:1784 -
\??\c:\jdjdp.exec:\jdjdp.exe56⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xlxxllr.exec:\xlxxllr.exe57⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xllfrfr.exec:\xllfrfr.exe58⤵
- Executes dropped EXE
PID:1140 -
\??\c:\hhthnt.exec:\hhthnt.exe59⤵
- Executes dropped EXE
PID:952 -
\??\c:\nttnth.exec:\nttnth.exe60⤵
- Executes dropped EXE
PID:832 -
\??\c:\vdpvj.exec:\vdpvj.exe61⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pjvdj.exec:\pjvdj.exe62⤵
- Executes dropped EXE
PID:3064 -
\??\c:\llfllrf.exec:\llfllrf.exe63⤵
- Executes dropped EXE
PID:1568 -
\??\c:\lfrrfrf.exec:\lfrrfrf.exe64⤵
- Executes dropped EXE
PID:544 -
\??\c:\tnbnbn.exec:\tnbnbn.exe65⤵
- Executes dropped EXE
PID:2504 -
\??\c:\7htnnb.exec:\7htnnb.exe66⤵PID:1756
-
\??\c:\hbhhnb.exec:\hbhhnb.exe67⤵PID:2320
-
\??\c:\5vpvj.exec:\5vpvj.exe68⤵PID:1824
-
\??\c:\3fxllrr.exec:\3fxllrr.exe69⤵PID:1524
-
\??\c:\fllrlrf.exec:\fllrlrf.exe70⤵PID:1620
-
\??\c:\tbbbhb.exec:\tbbbhb.exe71⤵PID:2268
-
\??\c:\hbhntb.exec:\hbhntb.exe72⤵PID:2668
-
\??\c:\jdpvd.exec:\jdpvd.exe73⤵PID:2780
-
\??\c:\ppdvp.exec:\ppdvp.exe74⤵PID:2788
-
\??\c:\xrrlrxl.exec:\xrrlrxl.exe75⤵PID:2756
-
\??\c:\rrxrxfl.exec:\rrxrxfl.exe76⤵PID:2212
-
\??\c:\bbhbhn.exec:\bbhbhn.exe77⤵PID:2700
-
\??\c:\ttbhbh.exec:\ttbhbh.exe78⤵PID:2576
-
\??\c:\dvpjd.exec:\dvpjd.exe79⤵PID:3068
-
\??\c:\3vjpj.exec:\3vjpj.exe80⤵PID:2104
-
\??\c:\lfffxxx.exec:\lfffxxx.exe81⤵PID:1144
-
\??\c:\xxlfxfr.exec:\xxlfxfr.exe82⤵PID:2828
-
\??\c:\tntntb.exec:\tntntb.exe83⤵PID:2652
-
\??\c:\bbtbhn.exec:\bbtbhn.exe84⤵PID:2004
-
\??\c:\pjdjv.exec:\pjdjv.exe85⤵PID:2084
-
\??\c:\djppv.exec:\djppv.exe86⤵PID:380
-
\??\c:\xxrrrlr.exec:\xxrrrlr.exe87⤵PID:1352
-
\??\c:\hhnhbb.exec:\hhnhbb.exe88⤵PID:2928
-
\??\c:\bththt.exec:\bththt.exe89⤵PID:2136
-
\??\c:\ppppv.exec:\ppppv.exe90⤵PID:2956
-
\??\c:\9vpdj.exec:\9vpdj.exe91⤵PID:348
-
\??\c:\llfrxxl.exec:\llfrxxl.exe92⤵PID:2316
-
\??\c:\3lxxffr.exec:\3lxxffr.exe93⤵PID:2660
-
\??\c:\btntnt.exec:\btntnt.exe94⤵PID:2036
-
\??\c:\hhtthn.exec:\hhtthn.exe95⤵PID:1400
-
\??\c:\dvdjd.exec:\dvdjd.exe96⤵PID:3012
-
\??\c:\dvjpv.exec:\dvjpv.exe97⤵PID:1912
-
\??\c:\ffflfrx.exec:\ffflfrx.exe98⤵PID:1792
-
\??\c:\rrxxffr.exec:\rrxxffr.exe99⤵PID:1992
-
\??\c:\bbbtbn.exec:\bbbtbn.exe100⤵PID:836
-
\??\c:\tthhnb.exec:\tthhnb.exe101⤵PID:1596
-
\??\c:\pppjd.exec:\pppjd.exe102⤵PID:3052
-
\??\c:\dvvjj.exec:\dvvjj.exe103⤵PID:1412
-
\??\c:\lxlrrrf.exec:\lxlrrrf.exe104⤵PID:1032
-
\??\c:\9xrlfrx.exec:\9xrlfrx.exe105⤵PID:2524
-
\??\c:\hbntnt.exec:\hbntnt.exe106⤵PID:828
-
\??\c:\nhtnnt.exec:\nhtnnt.exe107⤵PID:1644
-
\??\c:\dppdv.exec:\dppdv.exe108⤵PID:1532
-
\??\c:\jjdvv.exec:\jjdvv.exe109⤵PID:2264
-
\??\c:\llxxrxr.exec:\llxxrxr.exe110⤵PID:2872
-
\??\c:\rflxflf.exec:\rflxflf.exe111⤵PID:2992
-
\??\c:\btbntt.exec:\btbntt.exe112⤵PID:2688
-
\??\c:\hntbhh.exec:\hntbhh.exe113⤵PID:2860
-
\??\c:\vdjjd.exec:\vdjjd.exe114⤵PID:2436
-
\??\c:\vvpjp.exec:\vvpjp.exe115⤵PID:2848
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe116⤵PID:2568
-
\??\c:\lflfrlf.exec:\lflfrlf.exe117⤵PID:2868
-
\??\c:\lfxlxrf.exec:\lfxlxrf.exe118⤵PID:2640
-
\??\c:\7tnbnb.exec:\7tnbnb.exe119⤵PID:1176
-
\??\c:\vppdj.exec:\vppdj.exe120⤵PID:1136
-
\??\c:\jjjjj.exec:\jjjjj.exe121⤵PID:1448
-
\??\c:\vpvvp.exec:\vpvvp.exe122⤵PID:1672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-