Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28-08-2024 19:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
23ff36c6b75556404a078fbc1f1ad24375bbfd85113a765f67606c26080d1e8f.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
General
-
Target
23ff36c6b75556404a078fbc1f1ad24375bbfd85113a765f67606c26080d1e8f.exe
-
Size
67KB
-
MD5
1a4da2ba9f5b2b15ab3de99e89333d9f
-
SHA1
db7776e58f808c76ccf76f8738251f41ea990bdd
-
SHA256
23ff36c6b75556404a078fbc1f1ad24375bbfd85113a765f67606c26080d1e8f
-
SHA512
cdadea79c73fa43fe0c2bf106be3dac42079a54abe04da3a3749bb132607f0ce680fb8a33d2725922ae5907351de6ac1d3d35fcc551363ddad1cc92d258a24a1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAcp:ymb3NkkiQ3mdBjFIsIVcp
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/1768-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/552-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/800-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2596-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/836-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1076-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/664-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 552 frllfrr.exe 3364 xlfxlfx.exe 3968 ththtb.exe 60 vjjdj.exe 2236 jpdpd.exe 1464 fxlfrrr.exe 4732 9bbbtn.exe 2556 7bhbhh.exe 3468 vddvp.exe 212 dppdp.exe 4292 fxfxrrl.exe 800 hhthhh.exe 4468 ttnnbb.exe 5016 3pddv.exe 2968 vpvdd.exe 4368 3xxrllf.exe 4816 nbnbtn.exe 3736 tnhbhb.exe 2224 jpjdd.exe 664 5jddp.exe 4596 xffxlfx.exe 1076 3rlxrlx.exe 2768 frlrxxr.exe 2596 hhbtnt.exe 5092 dpjdd.exe 836 xlxrrrx.exe 3240 9fllffx.exe 4956 nbbtnh.exe 4492 7ttnbb.exe 4568 1jpjd.exe 1916 ffrllrr.exe 3944 httnbb.exe 4716 3nhtnt.exe 1676 jjjdp.exe 4580 dppjj.exe 4324 jvpjp.exe 3024 xlffxxr.exe 3472 rrlxfrr.exe 4476 bnhhbb.exe 3364 bnbtnh.exe 1968 9vdvp.exe 3968 pjjvv.exe 3640 1rxlfxl.exe 1876 bttnhb.exe 4240 7vpjv.exe 3344 dvvpj.exe 668 xxxrfff.exe 4656 7nbbhn.exe 4852 vpppd.exe 1816 lrrrrrx.exe 2228 rxfrrlf.exe 1996 5rxrlll.exe 4832 nhhhbb.exe 4468 pjdvj.exe 5048 5vvpj.exe 4788 xlrlrfr.exe 4084 tbtnbt.exe 5088 5thtbn.exe 3080 3dpjd.exe 4560 jdddj.exe 3628 7llfffr.exe 1212 ntnbbt.exe 3668 9bnhth.exe 4596 vjdvj.exe -
resource yara_rule behavioral2/memory/1768-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/800-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2596-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/836-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1076-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-56-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1768 wrote to memory of 552 1768 23ff36c6b75556404a078fbc1f1ad24375bbfd85113a765f67606c26080d1e8f.exe 84 PID 1768 wrote to memory of 552 1768 23ff36c6b75556404a078fbc1f1ad24375bbfd85113a765f67606c26080d1e8f.exe 84 PID 1768 wrote to memory of 552 1768 23ff36c6b75556404a078fbc1f1ad24375bbfd85113a765f67606c26080d1e8f.exe 84 PID 552 wrote to memory of 3364 552 frllfrr.exe 125 PID 552 wrote to memory of 3364 552 frllfrr.exe 125 PID 552 wrote to memory of 3364 552 frllfrr.exe 125 PID 3364 wrote to memory of 3968 3364 xlfxlfx.exe 127 PID 3364 wrote to memory of 3968 3364 xlfxlfx.exe 127 PID 3364 wrote to memory of 3968 3364 xlfxlfx.exe 127 PID 3968 wrote to memory of 60 3968 ththtb.exe 87 PID 3968 wrote to memory of 60 3968 ththtb.exe 87 PID 3968 wrote to memory of 60 3968 ththtb.exe 87 PID 60 wrote to memory of 2236 60 vjjdj.exe 88 PID 60 wrote to memory of 2236 60 vjjdj.exe 88 PID 60 wrote to memory of 2236 60 vjjdj.exe 88 PID 2236 wrote to memory of 1464 2236 jpdpd.exe 89 PID 2236 wrote to memory of 1464 2236 jpdpd.exe 89 PID 2236 wrote to memory of 1464 2236 jpdpd.exe 89 PID 1464 wrote to memory of 4732 1464 fxlfrrr.exe 90 PID 1464 wrote to memory of 4732 1464 fxlfrrr.exe 90 PID 1464 wrote to memory of 4732 1464 fxlfrrr.exe 90 PID 4732 wrote to memory of 2556 4732 9bbbtn.exe 91 PID 4732 wrote to memory of 2556 4732 9bbbtn.exe 91 PID 4732 wrote to memory of 2556 4732 9bbbtn.exe 91 PID 2556 wrote to memory of 3468 2556 7bhbhh.exe 92 PID 2556 wrote to memory of 3468 2556 7bhbhh.exe 92 PID 2556 wrote to memory of 3468 2556 7bhbhh.exe 92 PID 3468 wrote to memory of 212 3468 vddvp.exe 93 PID 3468 wrote to memory of 212 3468 vddvp.exe 93 PID 3468 wrote to memory of 212 3468 vddvp.exe 93 PID 212 wrote to memory of 4292 212 dppdp.exe 94 PID 212 wrote to memory of 4292 212 dppdp.exe 94 PID 212 wrote to memory of 4292 212 dppdp.exe 94 PID 4292 wrote to memory of 800 4292 fxfxrrl.exe 95 PID 4292 wrote to memory of 800 4292 fxfxrrl.exe 95 PID 4292 wrote to memory of 800 4292 fxfxrrl.exe 95 PID 800 wrote to memory of 4468 800 hhthhh.exe 140 PID 800 wrote to memory of 4468 800 hhthhh.exe 140 PID 800 wrote to memory of 4468 800 hhthhh.exe 140 PID 4468 wrote to memory of 5016 4468 ttnnbb.exe 97 PID 4468 wrote to memory of 5016 4468 ttnnbb.exe 97 PID 4468 wrote to memory of 5016 4468 ttnnbb.exe 97 PID 5016 wrote to memory of 2968 5016 3pddv.exe 98 PID 5016 wrote to memory of 2968 5016 3pddv.exe 98 PID 5016 wrote to memory of 2968 5016 3pddv.exe 98 PID 2968 wrote to memory of 4368 2968 vpvdd.exe 99 PID 2968 wrote to memory of 4368 2968 vpvdd.exe 99 PID 2968 wrote to memory of 4368 2968 vpvdd.exe 99 PID 4368 wrote to memory of 4816 4368 3xxrllf.exe 100 PID 4368 wrote to memory of 4816 4368 3xxrllf.exe 100 PID 4368 wrote to memory of 4816 4368 3xxrllf.exe 100 PID 4816 wrote to memory of 3736 4816 nbnbtn.exe 101 PID 4816 wrote to memory of 3736 4816 nbnbtn.exe 101 PID 4816 wrote to memory of 3736 4816 nbnbtn.exe 101 PID 3736 wrote to memory of 2224 3736 tnhbhb.exe 102 PID 3736 wrote to memory of 2224 3736 tnhbhb.exe 102 PID 3736 wrote to memory of 2224 3736 tnhbhb.exe 102 PID 2224 wrote to memory of 664 2224 jpjdd.exe 103 PID 2224 wrote to memory of 664 2224 jpjdd.exe 103 PID 2224 wrote to memory of 664 2224 jpjdd.exe 103 PID 664 wrote to memory of 4596 664 5jddp.exe 104 PID 664 wrote to memory of 4596 664 5jddp.exe 104 PID 664 wrote to memory of 4596 664 5jddp.exe 104 PID 4596 wrote to memory of 1076 4596 xffxlfx.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\23ff36c6b75556404a078fbc1f1ad24375bbfd85113a765f67606c26080d1e8f.exe"C:\Users\Admin\AppData\Local\Temp\23ff36c6b75556404a078fbc1f1ad24375bbfd85113a765f67606c26080d1e8f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\frllfrr.exec:\frllfrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\xlfxlfx.exec:\xlfxlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\ththtb.exec:\ththtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\vjjdj.exec:\vjjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\jpdpd.exec:\jpdpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\fxlfrrr.exec:\fxlfrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\9bbbtn.exec:\9bbbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\7bhbhh.exec:\7bhbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\vddvp.exec:\vddvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\dppdp.exec:\dppdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\hhthhh.exec:\hhthhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\ttnnbb.exec:\ttnnbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\3pddv.exec:\3pddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\vpvdd.exec:\vpvdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\3xxrllf.exec:\3xxrllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\nbnbtn.exec:\nbnbtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\tnhbhb.exec:\tnhbhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\jpjdd.exec:\jpjdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\5jddp.exec:\5jddp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\xffxlfx.exec:\xffxlfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\3rlxrlx.exec:\3rlxrlx.exe23⤵
- Executes dropped EXE
PID:1076 -
\??\c:\frlrxxr.exec:\frlrxxr.exe24⤵
- Executes dropped EXE
PID:2768 -
\??\c:\hhbtnt.exec:\hhbtnt.exe25⤵
- Executes dropped EXE
PID:2596 -
\??\c:\dpjdd.exec:\dpjdd.exe26⤵
- Executes dropped EXE
PID:5092 -
\??\c:\xlxrrrx.exec:\xlxrrrx.exe27⤵
- Executes dropped EXE
PID:836 -
\??\c:\9fllffx.exec:\9fllffx.exe28⤵
- Executes dropped EXE
PID:3240 -
\??\c:\nbbtnh.exec:\nbbtnh.exe29⤵
- Executes dropped EXE
PID:4956 -
\??\c:\7ttnbb.exec:\7ttnbb.exe30⤵
- Executes dropped EXE
PID:4492 -
\??\c:\1jpjd.exec:\1jpjd.exe31⤵
- Executes dropped EXE
PID:4568 -
\??\c:\ffrllrr.exec:\ffrllrr.exe32⤵
- Executes dropped EXE
PID:1916 -
\??\c:\httnbb.exec:\httnbb.exe33⤵
- Executes dropped EXE
PID:3944 -
\??\c:\3nhtnt.exec:\3nhtnt.exe34⤵
- Executes dropped EXE
PID:4716 -
\??\c:\jjjdp.exec:\jjjdp.exe35⤵
- Executes dropped EXE
PID:1676 -
\??\c:\dppjj.exec:\dppjj.exe36⤵
- Executes dropped EXE
PID:4580 -
\??\c:\jvpjp.exec:\jvpjp.exe37⤵
- Executes dropped EXE
PID:4324 -
\??\c:\xlffxxr.exec:\xlffxxr.exe38⤵
- Executes dropped EXE
PID:3024 -
\??\c:\rrlxfrr.exec:\rrlxfrr.exe39⤵
- Executes dropped EXE
PID:3472 -
\??\c:\bnhhbb.exec:\bnhhbb.exe40⤵
- Executes dropped EXE
PID:4476 -
\??\c:\bnbtnh.exec:\bnbtnh.exe41⤵
- Executes dropped EXE
PID:3364 -
\??\c:\9vdvp.exec:\9vdvp.exe42⤵
- Executes dropped EXE
PID:1968 -
\??\c:\pjjvv.exec:\pjjvv.exe43⤵
- Executes dropped EXE
PID:3968 -
\??\c:\1rxlfxl.exec:\1rxlfxl.exe44⤵
- Executes dropped EXE
PID:3640 -
\??\c:\bttnhb.exec:\bttnhb.exe45⤵
- Executes dropped EXE
PID:1876 -
\??\c:\7vpjv.exec:\7vpjv.exe46⤵
- Executes dropped EXE
PID:4240 -
\??\c:\dvvpj.exec:\dvvpj.exe47⤵
- Executes dropped EXE
PID:3344 -
\??\c:\xxxrfff.exec:\xxxrfff.exe48⤵
- Executes dropped EXE
PID:668 -
\??\c:\7nbbhn.exec:\7nbbhn.exe49⤵
- Executes dropped EXE
PID:4656 -
\??\c:\vpppd.exec:\vpppd.exe50⤵
- Executes dropped EXE
PID:4852 -
\??\c:\lrrrrrx.exec:\lrrrrrx.exe51⤵
- Executes dropped EXE
PID:1816 -
\??\c:\rxfrrlf.exec:\rxfrrlf.exe52⤵
- Executes dropped EXE
PID:2228 -
\??\c:\5rxrlll.exec:\5rxrlll.exe53⤵
- Executes dropped EXE
PID:1996 -
\??\c:\nhhhbb.exec:\nhhhbb.exe54⤵
- Executes dropped EXE
PID:4832 -
\??\c:\pjdvj.exec:\pjdvj.exe55⤵
- Executes dropped EXE
PID:4468 -
\??\c:\5vvpj.exec:\5vvpj.exe56⤵
- Executes dropped EXE
PID:5048 -
\??\c:\xlrlrfr.exec:\xlrlrfr.exe57⤵
- Executes dropped EXE
PID:4788 -
\??\c:\tbtnbt.exec:\tbtnbt.exe58⤵
- Executes dropped EXE
PID:4084 -
\??\c:\5thtbn.exec:\5thtbn.exe59⤵
- Executes dropped EXE
PID:5088 -
\??\c:\3dpjd.exec:\3dpjd.exe60⤵
- Executes dropped EXE
PID:3080 -
\??\c:\jdddj.exec:\jdddj.exe61⤵
- Executes dropped EXE
PID:4560 -
\??\c:\7llfffr.exec:\7llfffr.exe62⤵
- Executes dropped EXE
PID:3628 -
\??\c:\ntnbbt.exec:\ntnbbt.exe63⤵
- Executes dropped EXE
PID:1212 -
\??\c:\9bnhth.exec:\9bnhth.exe64⤵
- Executes dropped EXE
PID:3668 -
\??\c:\vjdvj.exec:\vjdvj.exe65⤵
- Executes dropped EXE
PID:4596 -
\??\c:\dvvpj.exec:\dvvpj.exe66⤵PID:1608
-
\??\c:\3vjdp.exec:\3vjdp.exe67⤵PID:3964
-
\??\c:\lffrlfx.exec:\lffrlfx.exe68⤵PID:4312
-
\??\c:\3rfxxfx.exec:\3rfxxfx.exe69⤵PID:1524
-
\??\c:\bhhbtb.exec:\bhhbtb.exe70⤵PID:5092
-
\??\c:\bnnbbb.exec:\bnnbbb.exe71⤵PID:3444
-
\??\c:\jjjdv.exec:\jjjdv.exe72⤵PID:3236
-
\??\c:\pddjd.exec:\pddjd.exe73⤵PID:524
-
\??\c:\5rrlxfx.exec:\5rrlxfx.exe74⤵PID:1988
-
\??\c:\fxxrllf.exec:\fxxrllf.exe75⤵PID:4492
-
\??\c:\7bthbt.exec:\7bthbt.exe76⤵PID:2620
-
\??\c:\7btnhh.exec:\7btnhh.exe77⤵PID:4528
-
\??\c:\vdvvj.exec:\vdvvj.exe78⤵PID:392
-
\??\c:\pdjjd.exec:\pdjjd.exe79⤵PID:3924
-
\??\c:\fllfrrl.exec:\fllfrrl.exe80⤵PID:2896
-
\??\c:\ffllfff.exec:\ffllfff.exe81⤵PID:1676
-
\??\c:\9hbbtt.exec:\9hbbtt.exe82⤵PID:3192
-
\??\c:\7bthtn.exec:\7bthtn.exe83⤵PID:4792
-
\??\c:\9jjjv.exec:\9jjjv.exe84⤵PID:388
-
\??\c:\pvdpv.exec:\pvdpv.exe85⤵PID:4760
-
\??\c:\1llxlxr.exec:\1llxlxr.exe86⤵PID:4752
-
\??\c:\llxrrlf.exec:\llxrrlf.exe87⤵PID:764
-
\??\c:\7tttnh.exec:\7tttnh.exe88⤵PID:1420
-
\??\c:\1bbtnh.exec:\1bbtnh.exe89⤵PID:2776
-
\??\c:\dppjv.exec:\dppjv.exe90⤵PID:1136
-
\??\c:\1djdd.exec:\1djdd.exe91⤵PID:3648
-
\??\c:\llrlxrx.exec:\llrlxrx.exe92⤵PID:2236
-
\??\c:\lxxllll.exec:\lxxllll.exe93⤵PID:3180
-
\??\c:\thbttn.exec:\thbttn.exe94⤵PID:2904
-
\??\c:\jdvpj.exec:\jdvpj.exe95⤵PID:2556
-
\??\c:\3ddvp.exec:\3ddvp.exe96⤵PID:2360
-
\??\c:\7xfxffl.exec:\7xfxffl.exe97⤵PID:3660
-
\??\c:\lllrllf.exec:\lllrllf.exe98⤵PID:4484
-
\??\c:\hbbbtb.exec:\hbbbtb.exe99⤵PID:3852
-
\??\c:\bntnbb.exec:\bntnbb.exe100⤵PID:2492
-
\??\c:\5jjpj.exec:\5jjpj.exe101⤵PID:1996
-
\??\c:\vvdjd.exec:\vvdjd.exe102⤵PID:864
-
\??\c:\fxffxxr.exec:\fxffxxr.exe103⤵PID:4952
-
\??\c:\rlxxrrl.exec:\rlxxrrl.exe104⤵PID:64
-
\??\c:\tnhhnn.exec:\tnhhnn.exe105⤵PID:2880
-
\??\c:\nbthtn.exec:\nbthtn.exe106⤵PID:4084
-
\??\c:\pjvvd.exec:\pjvvd.exe107⤵PID:2404
-
\??\c:\9jpvj.exec:\9jpvj.exe108⤵PID:3304
-
\??\c:\fxxlffx.exec:\fxxlffx.exe109⤵PID:2080
-
\??\c:\9ttthh.exec:\9ttthh.exe110⤵PID:1208
-
\??\c:\nntbbb.exec:\nntbbb.exe111⤵PID:1212
-
\??\c:\pjdvv.exec:\pjdvv.exe112⤵PID:2716
-
\??\c:\rfflffx.exec:\rfflffx.exe113⤵PID:1076
-
\??\c:\fxllrxf.exec:\fxllrxf.exe114⤵PID:3356
-
\??\c:\tnbtnt.exec:\tnbtnt.exe115⤵PID:1728
-
\??\c:\vpjdd.exec:\vpjdd.exe116⤵PID:372
-
\??\c:\pdjdj.exec:\pdjdj.exe117⤵PID:1524
-
\??\c:\rrxlxff.exec:\rrxlxff.exe118⤵PID:4828
-
\??\c:\9nbtnn.exec:\9nbtnn.exe119⤵PID:5076
-
\??\c:\thnntt.exec:\thnntt.exe120⤵PID:3460
-
\??\c:\jpjpp.exec:\jpjpp.exe121⤵PID:1780
-
\??\c:\pvvvp.exec:\pvvvp.exe122⤵PID:5036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-