Analysis
-
max time kernel
120s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 07:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8f9e02b011583abd9e934a552224d0d0N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
8f9e02b011583abd9e934a552224d0d0N.exe
-
Size
72KB
-
MD5
8f9e02b011583abd9e934a552224d0d0
-
SHA1
cb37fff0c3ca91df4a5042167f19f01768b27d32
-
SHA256
a0c0134c1663dc7814e4178fea8987327a784dfffd499e2ec442bbbc091f51e9
-
SHA512
33c629c9f68be9abbd5d405e626d13891779e4acc0920edc8c5573a4529b725ec4fa1ffc812ed4fbfa6de0c26809ff500ca62fe968094fb1ccbd043c1cec6cf1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIYgC/KSLJUu:ymb3NkkiQ3mdBjFI3eF7
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/1776-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3932-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/556-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 824 1httnn.exe 3668 fxrlrlr.exe 4372 tnnbtb.exe 1416 bbhnnh.exe 1460 dvpjp.exe 2752 7lrrrrl.exe 2180 thnhtn.exe 1908 jvvjv.exe 220 lllfrlr.exe 3932 tnhbtt.exe 4276 ppvpv.exe 1864 fxlfxfx.exe 3200 hthbbh.exe 3824 9vjjv.exe 3476 rxxxlff.exe 556 nhhhnb.exe 4920 vjpjj.exe 3564 rxxxllx.exe 1952 nnhhhn.exe 1172 1djpv.exe 4060 flxlxrf.exe 1752 7tnbnb.exe 4224 tnbhhb.exe 2548 rxflffx.exe 1204 rflfxxr.exe 2528 hbhntn.exe 1372 vpddd.exe 3420 ffrfrrl.exe 1088 3xrrxxf.exe 3004 thtnnn.exe 4688 tnbtbh.exe 632 7lrxrrr.exe 3696 hntnhh.exe 4320 hntnnt.exe 1776 jjvvv.exe 3536 rflrllx.exe 3648 7bttnn.exe 1664 pdvpj.exe 4372 pdpjv.exe 1244 7xxlllr.exe 1800 flrlfxl.exe 2908 thtnhb.exe 3720 7jvjv.exe 1508 jpppp.exe 964 lrlxlfx.exe 4956 rxrfrlx.exe 5084 9bbbtt.exe 1536 nhhhtb.exe 4196 jdvjd.exe 3076 vpdvd.exe 4276 rlrxrrr.exe 2556 btbbtt.exe 3152 nbnhhh.exe 1032 vpppv.exe 4684 5jjdp.exe 1448 xfllrrx.exe 5060 thbthb.exe 1620 bttntn.exe 4920 vpppd.exe 4896 pvdvv.exe 2376 rlfxrlf.exe 2996 htbhhn.exe 4828 tthbtn.exe 4804 dvpdj.exe -
resource yara_rule behavioral2/memory/1776-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3932-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1776 wrote to memory of 824 1776 8f9e02b011583abd9e934a552224d0d0N.exe 84 PID 1776 wrote to memory of 824 1776 8f9e02b011583abd9e934a552224d0d0N.exe 84 PID 1776 wrote to memory of 824 1776 8f9e02b011583abd9e934a552224d0d0N.exe 84 PID 824 wrote to memory of 3668 824 1httnn.exe 85 PID 824 wrote to memory of 3668 824 1httnn.exe 85 PID 824 wrote to memory of 3668 824 1httnn.exe 85 PID 3668 wrote to memory of 4372 3668 fxrlrlr.exe 86 PID 3668 wrote to memory of 4372 3668 fxrlrlr.exe 86 PID 3668 wrote to memory of 4372 3668 fxrlrlr.exe 86 PID 4372 wrote to memory of 1416 4372 tnnbtb.exe 87 PID 4372 wrote to memory of 1416 4372 tnnbtb.exe 87 PID 4372 wrote to memory of 1416 4372 tnnbtb.exe 87 PID 1416 wrote to memory of 1460 1416 bbhnnh.exe 88 PID 1416 wrote to memory of 1460 1416 bbhnnh.exe 88 PID 1416 wrote to memory of 1460 1416 bbhnnh.exe 88 PID 1460 wrote to memory of 2752 1460 dvpjp.exe 89 PID 1460 wrote to memory of 2752 1460 dvpjp.exe 89 PID 1460 wrote to memory of 2752 1460 dvpjp.exe 89 PID 2752 wrote to memory of 2180 2752 7lrrrrl.exe 90 PID 2752 wrote to memory of 2180 2752 7lrrrrl.exe 90 PID 2752 wrote to memory of 2180 2752 7lrrrrl.exe 90 PID 2180 wrote to memory of 1908 2180 thnhtn.exe 91 PID 2180 wrote to memory of 1908 2180 thnhtn.exe 91 PID 2180 wrote to memory of 1908 2180 thnhtn.exe 91 PID 1908 wrote to memory of 220 1908 jvvjv.exe 92 PID 1908 wrote to memory of 220 1908 jvvjv.exe 92 PID 1908 wrote to memory of 220 1908 jvvjv.exe 92 PID 220 wrote to memory of 3932 220 lllfrlr.exe 93 PID 220 wrote to memory of 3932 220 lllfrlr.exe 93 PID 220 wrote to memory of 3932 220 lllfrlr.exe 93 PID 3932 wrote to memory of 4276 3932 tnhbtt.exe 95 PID 3932 wrote to memory of 4276 3932 tnhbtt.exe 95 PID 3932 wrote to memory of 4276 3932 tnhbtt.exe 95 PID 4276 wrote to memory of 1864 4276 ppvpv.exe 96 PID 4276 wrote to memory of 1864 4276 ppvpv.exe 96 PID 4276 wrote to memory of 1864 4276 ppvpv.exe 96 PID 1864 wrote to memory of 3200 1864 fxlfxfx.exe 97 PID 1864 wrote to memory of 3200 1864 fxlfxfx.exe 97 PID 1864 wrote to memory of 3200 1864 fxlfxfx.exe 97 PID 3200 wrote to memory of 3824 3200 hthbbh.exe 98 PID 3200 wrote to memory of 3824 3200 hthbbh.exe 98 PID 3200 wrote to memory of 3824 3200 hthbbh.exe 98 PID 3824 wrote to memory of 3476 3824 9vjjv.exe 99 PID 3824 wrote to memory of 3476 3824 9vjjv.exe 99 PID 3824 wrote to memory of 3476 3824 9vjjv.exe 99 PID 3476 wrote to memory of 556 3476 rxxxlff.exe 100 PID 3476 wrote to memory of 556 3476 rxxxlff.exe 100 PID 3476 wrote to memory of 556 3476 rxxxlff.exe 100 PID 556 wrote to memory of 4920 556 nhhhnb.exe 101 PID 556 wrote to memory of 4920 556 nhhhnb.exe 101 PID 556 wrote to memory of 4920 556 nhhhnb.exe 101 PID 4920 wrote to memory of 3564 4920 vjpjj.exe 102 PID 4920 wrote to memory of 3564 4920 vjpjj.exe 102 PID 4920 wrote to memory of 3564 4920 vjpjj.exe 102 PID 3564 wrote to memory of 1952 3564 rxxxllx.exe 103 PID 3564 wrote to memory of 1952 3564 rxxxllx.exe 103 PID 3564 wrote to memory of 1952 3564 rxxxllx.exe 103 PID 1952 wrote to memory of 1172 1952 nnhhhn.exe 104 PID 1952 wrote to memory of 1172 1952 nnhhhn.exe 104 PID 1952 wrote to memory of 1172 1952 nnhhhn.exe 104 PID 1172 wrote to memory of 4060 1172 1djpv.exe 105 PID 1172 wrote to memory of 4060 1172 1djpv.exe 105 PID 1172 wrote to memory of 4060 1172 1djpv.exe 105 PID 4060 wrote to memory of 1752 4060 flxlxrf.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f9e02b011583abd9e934a552224d0d0N.exe"C:\Users\Admin\AppData\Local\Temp\8f9e02b011583abd9e934a552224d0d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\1httnn.exec:\1httnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\fxrlrlr.exec:\fxrlrlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\tnnbtb.exec:\tnnbtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\bbhnnh.exec:\bbhnnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\dvpjp.exec:\dvpjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\7lrrrrl.exec:\7lrrrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\thnhtn.exec:\thnhtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\jvvjv.exec:\jvvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\lllfrlr.exec:\lllfrlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\tnhbtt.exec:\tnhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\ppvpv.exec:\ppvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\fxlfxfx.exec:\fxlfxfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\hthbbh.exec:\hthbbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\9vjjv.exec:\9vjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\rxxxlff.exec:\rxxxlff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\nhhhnb.exec:\nhhhnb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\vjpjj.exec:\vjpjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\rxxxllx.exec:\rxxxllx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\nnhhhn.exec:\nnhhhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\1djpv.exec:\1djpv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\flxlxrf.exec:\flxlxrf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\7tnbnb.exec:\7tnbnb.exe23⤵
- Executes dropped EXE
PID:1752 -
\??\c:\tnbhhb.exec:\tnbhhb.exe24⤵
- Executes dropped EXE
PID:4224 -
\??\c:\rxflffx.exec:\rxflffx.exe25⤵
- Executes dropped EXE
PID:2548 -
\??\c:\rflfxxr.exec:\rflfxxr.exe26⤵
- Executes dropped EXE
PID:1204 -
\??\c:\hbhntn.exec:\hbhntn.exe27⤵
- Executes dropped EXE
PID:2528 -
\??\c:\vpddd.exec:\vpddd.exe28⤵
- Executes dropped EXE
PID:1372 -
\??\c:\ffrfrrl.exec:\ffrfrrl.exe29⤵
- Executes dropped EXE
PID:3420 -
\??\c:\3xrrxxf.exec:\3xrrxxf.exe30⤵
- Executes dropped EXE
PID:1088 -
\??\c:\thtnnn.exec:\thtnnn.exe31⤵
- Executes dropped EXE
PID:3004 -
\??\c:\tnbtbh.exec:\tnbtbh.exe32⤵
- Executes dropped EXE
PID:4688 -
\??\c:\7lrxrrr.exec:\7lrxrrr.exe33⤵
- Executes dropped EXE
PID:632 -
\??\c:\hntnhh.exec:\hntnhh.exe34⤵
- Executes dropped EXE
PID:3696 -
\??\c:\hntnnt.exec:\hntnnt.exe35⤵
- Executes dropped EXE
PID:4320 -
\??\c:\jjvvv.exec:\jjvvv.exe36⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rflrllx.exec:\rflrllx.exe37⤵
- Executes dropped EXE
PID:3536 -
\??\c:\7bttnn.exec:\7bttnn.exe38⤵
- Executes dropped EXE
PID:3648 -
\??\c:\pdvpj.exec:\pdvpj.exe39⤵
- Executes dropped EXE
PID:1664 -
\??\c:\pdpjv.exec:\pdpjv.exe40⤵
- Executes dropped EXE
PID:4372 -
\??\c:\7xxlllr.exec:\7xxlllr.exe41⤵
- Executes dropped EXE
PID:1244 -
\??\c:\flrlfxl.exec:\flrlfxl.exe42⤵
- Executes dropped EXE
PID:1800 -
\??\c:\thtnhb.exec:\thtnhb.exe43⤵
- Executes dropped EXE
PID:2908 -
\??\c:\7jvjv.exec:\7jvjv.exe44⤵
- Executes dropped EXE
PID:3720 -
\??\c:\jpppp.exec:\jpppp.exe45⤵
- Executes dropped EXE
PID:1508 -
\??\c:\lrlxlfx.exec:\lrlxlfx.exe46⤵
- Executes dropped EXE
PID:964 -
\??\c:\rxrfrlx.exec:\rxrfrlx.exe47⤵
- Executes dropped EXE
PID:4956 -
\??\c:\9bbbtt.exec:\9bbbtt.exe48⤵
- Executes dropped EXE
PID:5084 -
\??\c:\nhhhtb.exec:\nhhhtb.exe49⤵
- Executes dropped EXE
PID:1536 -
\??\c:\jdvjd.exec:\jdvjd.exe50⤵
- Executes dropped EXE
PID:4196 -
\??\c:\vpdvd.exec:\vpdvd.exe51⤵
- Executes dropped EXE
PID:3076 -
\??\c:\rlrxrrr.exec:\rlrxrrr.exe52⤵
- Executes dropped EXE
PID:4276 -
\??\c:\btbbtt.exec:\btbbtt.exe53⤵
- Executes dropped EXE
PID:2556 -
\??\c:\nbnhhh.exec:\nbnhhh.exe54⤵
- Executes dropped EXE
PID:3152 -
\??\c:\vpppv.exec:\vpppv.exe55⤵
- Executes dropped EXE
PID:1032 -
\??\c:\5jjdp.exec:\5jjdp.exe56⤵
- Executes dropped EXE
PID:4684 -
\??\c:\xfllrrx.exec:\xfllrrx.exe57⤵
- Executes dropped EXE
PID:1448 -
\??\c:\thbthb.exec:\thbthb.exe58⤵
- Executes dropped EXE
PID:5060 -
\??\c:\bttntn.exec:\bttntn.exe59⤵
- Executes dropped EXE
PID:1620 -
\??\c:\vpppd.exec:\vpppd.exe60⤵
- Executes dropped EXE
PID:4920 -
\??\c:\pvdvv.exec:\pvdvv.exe61⤵
- Executes dropped EXE
PID:4896 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe62⤵
- Executes dropped EXE
PID:2376 -
\??\c:\htbhhn.exec:\htbhhn.exe63⤵
- Executes dropped EXE
PID:2996 -
\??\c:\tthbtn.exec:\tthbtn.exe64⤵
- Executes dropped EXE
PID:4828 -
\??\c:\dvpdj.exec:\dvpdj.exe65⤵
- Executes dropped EXE
PID:4804 -
\??\c:\djjvp.exec:\djjvp.exe66⤵PID:3272
-
\??\c:\lllxlxr.exec:\lllxlxr.exe67⤵PID:4872
-
\??\c:\hntnbt.exec:\hntnbt.exe68⤵PID:4292
-
\??\c:\ddpdp.exec:\ddpdp.exe69⤵PID:2040
-
\??\c:\7vvvd.exec:\7vvvd.exe70⤵PID:3344
-
\??\c:\rrxrllf.exec:\rrxrllf.exe71⤵PID:4988
-
\??\c:\5hbbtt.exec:\5hbbtt.exe72⤵PID:1084
-
\??\c:\9bbtnh.exec:\9bbtnh.exe73⤵PID:632
-
\??\c:\7ppjv.exec:\7ppjv.exe74⤵PID:3988
-
\??\c:\ppdpv.exec:\ppdpv.exe75⤵PID:4320
-
\??\c:\llllffx.exec:\llllffx.exe76⤵PID:1776
-
\??\c:\3nthbb.exec:\3nthbb.exe77⤵PID:1152
-
\??\c:\nbbthh.exec:\nbbthh.exe78⤵PID:2824
-
\??\c:\3ppjv.exec:\3ppjv.exe79⤵PID:4180
-
\??\c:\jvdpd.exec:\jvdpd.exe80⤵PID:2092
-
\??\c:\ffrfllf.exec:\ffrfllf.exe81⤵PID:5032
-
\??\c:\fxrlrrl.exec:\fxrlrrl.exe82⤵PID:1660
-
\??\c:\hthbtn.exec:\hthbtn.exe83⤵PID:2104
-
\??\c:\bthhbb.exec:\bthhbb.exe84⤵PID:4568
-
\??\c:\dvvjj.exec:\dvvjj.exe85⤵PID:2332
-
\??\c:\xllfrrf.exec:\xllfrrf.exe86⤵PID:388
-
\??\c:\lllxrlf.exec:\lllxrlf.exe87⤵PID:4676
-
\??\c:\ntbthn.exec:\ntbthn.exe88⤵PID:2264
-
\??\c:\7jjdp.exec:\7jjdp.exe89⤵PID:1040
-
\??\c:\9vvvj.exec:\9vvvj.exe90⤵PID:3312
-
\??\c:\frrxlfr.exec:\frrxlfr.exe91⤵PID:1232
-
\??\c:\ttbttn.exec:\ttbttn.exe92⤵PID:3480
-
\??\c:\thnhtt.exec:\thnhtt.exe93⤵PID:2612
-
\??\c:\djjjd.exec:\djjjd.exe94⤵PID:720
-
\??\c:\xxfflrr.exec:\xxfflrr.exe95⤵PID:4548
-
\??\c:\rlfffll.exec:\rlfffll.exe96⤵PID:556
-
\??\c:\btbtnh.exec:\btbtnh.exe97⤵PID:2460
-
\??\c:\htbhhh.exec:\htbhhh.exe98⤵PID:5040
-
\??\c:\jjvjp.exec:\jjvjp.exe99⤵PID:5000
-
\??\c:\fxxlflf.exec:\fxxlflf.exe100⤵PID:2056
-
\??\c:\rrlrlxf.exec:\rrlrlxf.exe101⤵PID:3760
-
\??\c:\htnhtb.exec:\htnhtb.exe102⤵PID:224
-
\??\c:\9tbthh.exec:\9tbthh.exe103⤵PID:4804
-
\??\c:\pdppj.exec:\pdppj.exe104⤵PID:3096
-
\??\c:\lxlxxfx.exec:\lxlxxfx.exe105⤵PID:4248
-
\??\c:\lflllff.exec:\lflllff.exe106⤵PID:2692
-
\??\c:\nnttbt.exec:\nnttbt.exe107⤵PID:3516
-
\??\c:\htbnhb.exec:\htbnhb.exe108⤵PID:1796
-
\??\c:\vdjjd.exec:\vdjjd.exe109⤵PID:3164
-
\??\c:\rlrrxlf.exec:\rlrrxlf.exe110⤵PID:912
-
\??\c:\1lllffx.exec:\1lllffx.exe111⤵PID:4820
-
\??\c:\tbbbtn.exec:\tbbbtn.exe112⤵PID:3400
-
\??\c:\btbtnh.exec:\btbtnh.exe113⤵PID:1212
-
\??\c:\jjdvp.exec:\jjdvp.exe114⤵PID:1880
-
\??\c:\1dvvv.exec:\1dvvv.exe115⤵PID:1900
-
\??\c:\7lfrrlf.exec:\7lfrrlf.exe116⤵PID:2316
-
\??\c:\llrrxff.exec:\llrrxff.exe117⤵PID:4976
-
\??\c:\btnnnn.exec:\btnnnn.exe118⤵PID:1236
-
\??\c:\tthbnn.exec:\tthbnn.exe119⤵PID:924
-
\??\c:\dddjv.exec:\dddjv.exe120⤵PID:1008
-
\??\c:\pdjdp.exec:\pdjdp.exe121⤵PID:4824
-
\??\c:\lfrxrrl.exec:\lfrxrrl.exe122⤵PID:2980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-