Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01-09-2024 22:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a6b47ad368d3b3c0a6af398ec4b06e0N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
0a6b47ad368d3b3c0a6af398ec4b06e0N.exe
-
Size
251KB
-
MD5
0a6b47ad368d3b3c0a6af398ec4b06e0
-
SHA1
fbfbabc1df20daa8650dc0dc6aa11c41f632b3eb
-
SHA256
333468817611142aed8e8cd759a8129ce4f4a57642728f65800655bc6c8538f9
-
SHA512
77e8ea50b9f22c89c2a9bd0e6833d6430f7221ab76c9f2cfaba76bde2bfb1e677073eca42bcd1913a4937ba3f65ee57e92e4e7602fde158b59e2c6c2ddf70ab9
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31oDvYLfJmQ9t:n3C9BRo7MlrWKo+lavWwKt
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/1964-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1964-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3932-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1500-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/696-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 764 pjpvj.exe 3872 rxffffx.exe 4856 jpvvd.exe 5112 tbhnhh.exe 2316 nthhhn.exe 4724 jpdpd.exe 2520 ffrrflr.exe 5080 hhbbtb.exe 3932 xfxxfll.exe 5012 bnbnbh.exe 2216 lfxrxxf.exe 3440 jvvpd.exe 2608 9hhtbb.exe 4608 jdjdd.exe 1500 rfflflr.exe 4912 3bbtnh.exe 3600 rlrlfff.exe 696 1vjpj.exe 1248 rllfrrl.exe 4324 hhbhtb.exe 2676 nnbtnn.exe 4804 xrrlrfr.exe 5064 pddpd.exe 4164 rflllll.exe 1640 nbtbhh.exe 1664 tbbtnh.exe 4224 nthtth.exe 2640 9fxffff.exe 1752 ttbnhh.exe 3020 xxfxrxx.exe 4732 bnbthb.exe 3688 vdvpp.exe 672 frffflf.exe 3520 7tnnnb.exe 956 pddvd.exe 4812 xrlllll.exe 4280 hbbhhb.exe 1636 dpvjv.exe 4192 ppjvd.exe 1628 lxrlxxx.exe 1968 tnnnnn.exe 2256 jpdjp.exe 452 rlxlffr.exe 3948 lxlxrrf.exe 5112 pdvvp.exe 2920 vvvpj.exe 2064 xrxrlrr.exe 4556 9tthnn.exe 2736 bhbbhh.exe 2420 7pvpp.exe 2160 xrfxlrr.exe 3932 3xffllf.exe 4656 tnnnnt.exe 2548 vvdvp.exe 1988 rrfxlxx.exe 348 nbnhbb.exe 4644 btbbtt.exe 212 jvpdj.exe 620 7lxrffl.exe 4008 nnhhhh.exe 4608 tthnbb.exe 3488 7ddvd.exe 2416 rxxrllf.exe 540 bnnnnn.exe -
resource yara_rule behavioral2/memory/1964-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1964-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3932-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3932-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3932-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1500-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvdd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1964 wrote to memory of 764 1964 0a6b47ad368d3b3c0a6af398ec4b06e0N.exe 82 PID 1964 wrote to memory of 764 1964 0a6b47ad368d3b3c0a6af398ec4b06e0N.exe 82 PID 1964 wrote to memory of 764 1964 0a6b47ad368d3b3c0a6af398ec4b06e0N.exe 82 PID 764 wrote to memory of 3872 764 pjpvj.exe 83 PID 764 wrote to memory of 3872 764 pjpvj.exe 83 PID 764 wrote to memory of 3872 764 pjpvj.exe 83 PID 3872 wrote to memory of 4856 3872 rxffffx.exe 84 PID 3872 wrote to memory of 4856 3872 rxffffx.exe 84 PID 3872 wrote to memory of 4856 3872 rxffffx.exe 84 PID 4856 wrote to memory of 5112 4856 jpvvd.exe 85 PID 4856 wrote to memory of 5112 4856 jpvvd.exe 85 PID 4856 wrote to memory of 5112 4856 jpvvd.exe 85 PID 5112 wrote to memory of 2316 5112 tbhnhh.exe 87 PID 5112 wrote to memory of 2316 5112 tbhnhh.exe 87 PID 5112 wrote to memory of 2316 5112 tbhnhh.exe 87 PID 2316 wrote to memory of 4724 2316 nthhhn.exe 88 PID 2316 wrote to memory of 4724 2316 nthhhn.exe 88 PID 2316 wrote to memory of 4724 2316 nthhhn.exe 88 PID 4724 wrote to memory of 2520 4724 jpdpd.exe 89 PID 4724 wrote to memory of 2520 4724 jpdpd.exe 89 PID 4724 wrote to memory of 2520 4724 jpdpd.exe 89 PID 2520 wrote to memory of 5080 2520 ffrrflr.exe 91 PID 2520 wrote to memory of 5080 2520 ffrrflr.exe 91 PID 2520 wrote to memory of 5080 2520 ffrrflr.exe 91 PID 5080 wrote to memory of 3932 5080 hhbbtb.exe 92 PID 5080 wrote to memory of 3932 5080 hhbbtb.exe 92 PID 5080 wrote to memory of 3932 5080 hhbbtb.exe 92 PID 3932 wrote to memory of 5012 3932 xfxxfll.exe 93 PID 3932 wrote to memory of 5012 3932 xfxxfll.exe 93 PID 3932 wrote to memory of 5012 3932 xfxxfll.exe 93 PID 5012 wrote to memory of 2216 5012 bnbnbh.exe 95 PID 5012 wrote to memory of 2216 5012 bnbnbh.exe 95 PID 5012 wrote to memory of 2216 5012 bnbnbh.exe 95 PID 2216 wrote to memory of 3440 2216 lfxrxxf.exe 96 PID 2216 wrote to memory of 3440 2216 lfxrxxf.exe 96 PID 2216 wrote to memory of 3440 2216 lfxrxxf.exe 96 PID 3440 wrote to memory of 2608 3440 jvvpd.exe 97 PID 3440 wrote to memory of 2608 3440 jvvpd.exe 97 PID 3440 wrote to memory of 2608 3440 jvvpd.exe 97 PID 2608 wrote to memory of 4608 2608 9hhtbb.exe 98 PID 2608 wrote to memory of 4608 2608 9hhtbb.exe 98 PID 2608 wrote to memory of 4608 2608 9hhtbb.exe 98 PID 4608 wrote to memory of 1500 4608 jdjdd.exe 99 PID 4608 wrote to memory of 1500 4608 jdjdd.exe 99 PID 4608 wrote to memory of 1500 4608 jdjdd.exe 99 PID 1500 wrote to memory of 4912 1500 rfflflr.exe 100 PID 1500 wrote to memory of 4912 1500 rfflflr.exe 100 PID 1500 wrote to memory of 4912 1500 rfflflr.exe 100 PID 4912 wrote to memory of 3600 4912 3bbtnh.exe 101 PID 4912 wrote to memory of 3600 4912 3bbtnh.exe 101 PID 4912 wrote to memory of 3600 4912 3bbtnh.exe 101 PID 3600 wrote to memory of 696 3600 rlrlfff.exe 102 PID 3600 wrote to memory of 696 3600 rlrlfff.exe 102 PID 3600 wrote to memory of 696 3600 rlrlfff.exe 102 PID 696 wrote to memory of 1248 696 1vjpj.exe 103 PID 696 wrote to memory of 1248 696 1vjpj.exe 103 PID 696 wrote to memory of 1248 696 1vjpj.exe 103 PID 1248 wrote to memory of 4324 1248 rllfrrl.exe 104 PID 1248 wrote to memory of 4324 1248 rllfrrl.exe 104 PID 1248 wrote to memory of 4324 1248 rllfrrl.exe 104 PID 4324 wrote to memory of 2676 4324 hhbhtb.exe 105 PID 4324 wrote to memory of 2676 4324 hhbhtb.exe 105 PID 4324 wrote to memory of 2676 4324 hhbhtb.exe 105 PID 2676 wrote to memory of 4804 2676 nnbtnn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a6b47ad368d3b3c0a6af398ec4b06e0N.exe"C:\Users\Admin\AppData\Local\Temp\0a6b47ad368d3b3c0a6af398ec4b06e0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\pjpvj.exec:\pjpvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\rxffffx.exec:\rxffffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\jpvvd.exec:\jpvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\tbhnhh.exec:\tbhnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\nthhhn.exec:\nthhhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\jpdpd.exec:\jpdpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\ffrrflr.exec:\ffrrflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\hhbbtb.exec:\hhbbtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\xfxxfll.exec:\xfxxfll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\bnbnbh.exec:\bnbnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\lfxrxxf.exec:\lfxrxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\jvvpd.exec:\jvvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\9hhtbb.exec:\9hhtbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\jdjdd.exec:\jdjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\rfflflr.exec:\rfflflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\3bbtnh.exec:\3bbtnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\rlrlfff.exec:\rlrlfff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\1vjpj.exec:\1vjpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\rllfrrl.exec:\rllfrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\hhbhtb.exec:\hhbhtb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\nnbtnn.exec:\nnbtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\xrrlrfr.exec:\xrrlrfr.exe23⤵
- Executes dropped EXE
PID:4804 -
\??\c:\pddpd.exec:\pddpd.exe24⤵
- Executes dropped EXE
PID:5064 -
\??\c:\rflllll.exec:\rflllll.exe25⤵
- Executes dropped EXE
PID:4164 -
\??\c:\nbtbhh.exec:\nbtbhh.exe26⤵
- Executes dropped EXE
PID:1640 -
\??\c:\tbbtnh.exec:\tbbtnh.exe27⤵
- Executes dropped EXE
PID:1664 -
\??\c:\nthtth.exec:\nthtth.exe28⤵
- Executes dropped EXE
PID:4224 -
\??\c:\9fxffff.exec:\9fxffff.exe29⤵
- Executes dropped EXE
PID:2640 -
\??\c:\ttbnhh.exec:\ttbnhh.exe30⤵
- Executes dropped EXE
PID:1752 -
\??\c:\xxfxrxx.exec:\xxfxrxx.exe31⤵
- Executes dropped EXE
PID:3020 -
\??\c:\bnbthb.exec:\bnbthb.exe32⤵
- Executes dropped EXE
PID:4732 -
\??\c:\vdvpp.exec:\vdvpp.exe33⤵
- Executes dropped EXE
PID:3688 -
\??\c:\frffflf.exec:\frffflf.exe34⤵
- Executes dropped EXE
PID:672 -
\??\c:\7tnnnb.exec:\7tnnnb.exe35⤵
- Executes dropped EXE
PID:3520 -
\??\c:\pddvd.exec:\pddvd.exe36⤵
- Executes dropped EXE
PID:956 -
\??\c:\xrlllll.exec:\xrlllll.exe37⤵
- Executes dropped EXE
PID:4812 -
\??\c:\hbbhhb.exec:\hbbhhb.exe38⤵
- Executes dropped EXE
PID:4280 -
\??\c:\dpvjv.exec:\dpvjv.exe39⤵
- Executes dropped EXE
PID:1636 -
\??\c:\ppjvd.exec:\ppjvd.exe40⤵
- Executes dropped EXE
PID:4192 -
\??\c:\lxrlxxx.exec:\lxrlxxx.exe41⤵
- Executes dropped EXE
PID:1628 -
\??\c:\tnnnnn.exec:\tnnnnn.exe42⤵
- Executes dropped EXE
PID:1968 -
\??\c:\jpdjp.exec:\jpdjp.exe43⤵
- Executes dropped EXE
PID:2256 -
\??\c:\rlxlffr.exec:\rlxlffr.exe44⤵
- Executes dropped EXE
PID:452 -
\??\c:\lxlxrrf.exec:\lxlxrrf.exe45⤵
- Executes dropped EXE
PID:3948 -
\??\c:\pdvvp.exec:\pdvvp.exe46⤵
- Executes dropped EXE
PID:5112 -
\??\c:\vvvpj.exec:\vvvpj.exe47⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xrxrlrr.exec:\xrxrlrr.exe48⤵
- Executes dropped EXE
PID:2064 -
\??\c:\9tthnn.exec:\9tthnn.exe49⤵
- Executes dropped EXE
PID:4556 -
\??\c:\bhbbhh.exec:\bhbbhh.exe50⤵
- Executes dropped EXE
PID:2736 -
\??\c:\7pvpp.exec:\7pvpp.exe51⤵
- Executes dropped EXE
PID:2420 -
\??\c:\xrfxlrr.exec:\xrfxlrr.exe52⤵
- Executes dropped EXE
PID:2160 -
\??\c:\3xffllf.exec:\3xffllf.exe53⤵
- Executes dropped EXE
PID:3932 -
\??\c:\tnnnnt.exec:\tnnnnt.exe54⤵
- Executes dropped EXE
PID:4656 -
\??\c:\vvdvp.exec:\vvdvp.exe55⤵
- Executes dropped EXE
PID:2548 -
\??\c:\rrfxlxx.exec:\rrfxlxx.exe56⤵
- Executes dropped EXE
PID:1988 -
\??\c:\nbnhbb.exec:\nbnhbb.exe57⤵
- Executes dropped EXE
PID:348 -
\??\c:\btbbtt.exec:\btbbtt.exe58⤵
- Executes dropped EXE
PID:4644 -
\??\c:\jvpdj.exec:\jvpdj.exe59⤵
- Executes dropped EXE
PID:212 -
\??\c:\7lxrffl.exec:\7lxrffl.exe60⤵
- Executes dropped EXE
PID:620 -
\??\c:\nnhhhh.exec:\nnhhhh.exe61⤵
- Executes dropped EXE
PID:4008 -
\??\c:\tthnbb.exec:\tthnbb.exe62⤵
- Executes dropped EXE
PID:4608 -
\??\c:\7ddvd.exec:\7ddvd.exe63⤵
- Executes dropped EXE
PID:3488 -
\??\c:\rxxrllf.exec:\rxxrllf.exe64⤵
- Executes dropped EXE
PID:2416 -
\??\c:\bnnnnn.exec:\bnnnnn.exe65⤵
- Executes dropped EXE
PID:540 -
\??\c:\dvppj.exec:\dvppj.exe66⤵PID:4816
-
\??\c:\jvvpd.exec:\jvvpd.exe67⤵PID:3612
-
\??\c:\xflfxff.exec:\xflfxff.exe68⤵PID:2544
-
\??\c:\bthbbt.exec:\bthbbt.exe69⤵PID:3152
-
\??\c:\pjdvd.exec:\pjdvd.exe70⤵PID:2624
-
\??\c:\fxrlrxx.exec:\fxrlrxx.exe71⤵PID:3924
-
\??\c:\tthbbb.exec:\tthbbb.exe72⤵PID:5064
-
\??\c:\vjjjj.exec:\vjjjj.exe73⤵PID:1340
-
\??\c:\jdjjd.exec:\jdjjd.exe74⤵PID:1708
-
\??\c:\rrxfxxf.exec:\rrxfxxf.exe75⤵PID:512
-
\??\c:\hhbtnn.exec:\hhbtnn.exe76⤵PID:1664
-
\??\c:\vdvpj.exec:\vdvpj.exe77⤵PID:4224
-
\??\c:\lxlfxxf.exec:\lxlfxxf.exe78⤵PID:2124
-
\??\c:\xxxxxlx.exec:\xxxxxlx.exe79⤵PID:1936
-
\??\c:\7htntt.exec:\7htntt.exe80⤵PID:1012
-
\??\c:\vpdvj.exec:\vpdvj.exe81⤵PID:3476
-
\??\c:\vpjvj.exec:\vpjvj.exe82⤵PID:4932
-
\??\c:\lfrxrxf.exec:\lfrxrxf.exe83⤵PID:3164
-
\??\c:\7ntnhn.exec:\7ntnhn.exe84⤵PID:3052
-
\??\c:\ppddp.exec:\ppddp.exe85⤵PID:5100
-
\??\c:\5xllrxr.exec:\5xllrxr.exe86⤵PID:3860
-
\??\c:\xlxrrxl.exec:\xlxrrxl.exe87⤵PID:4296
-
\??\c:\tbhnhn.exec:\tbhnhn.exe88⤵PID:1580
-
\??\c:\pjjdp.exec:\pjjdp.exe89⤵PID:1620
-
\??\c:\xrxrxrx.exec:\xrxrxrx.exe90⤵PID:5048
-
\??\c:\xrfrlxr.exec:\xrfrlxr.exe91⤵PID:4336
-
\??\c:\tbhbbb.exec:\tbhbbb.exe92⤵PID:8
-
\??\c:\vppjd.exec:\vppjd.exe93⤵PID:2900
-
\??\c:\rfrllfx.exec:\rfrllfx.exe94⤵PID:4820
-
\??\c:\7lrlffr.exec:\7lrlffr.exe95⤵PID:3956
-
\??\c:\tbbbtb.exec:\tbbbtb.exe96⤵PID:1916
-
\??\c:\dvpdp.exec:\dvpdp.exe97⤵PID:3328
-
\??\c:\jddvd.exec:\jddvd.exe98⤵PID:1588
-
\??\c:\1ffrllx.exec:\1ffrllx.exe99⤵PID:5072
-
\??\c:\nbtnnh.exec:\nbtnnh.exe100⤵PID:2908
-
\??\c:\nhnhnb.exec:\nhnhnb.exe101⤵PID:1556
-
\??\c:\dpdpp.exec:\dpdpp.exe102⤵PID:3432
-
\??\c:\9jjvv.exec:\9jjvv.exe103⤵PID:220
-
\??\c:\xffxflx.exec:\xffxflx.exe104⤵PID:1540
-
\??\c:\nhhbnh.exec:\nhhbnh.exe105⤵PID:3440
-
\??\c:\hnnhbt.exec:\hnnhbt.exe106⤵PID:2304
-
\??\c:\jpjpj.exec:\jpjpj.exe107⤵PID:4412
-
\??\c:\nhhhbb.exec:\nhhhbb.exe108⤵PID:456
-
\??\c:\vpdpj.exec:\vpdpj.exe109⤵PID:3176
-
\??\c:\rxlxfrr.exec:\rxlxfrr.exe110⤵PID:540
-
\??\c:\3nhhnt.exec:\3nhhnt.exe111⤵PID:2820
-
\??\c:\ddjvv.exec:\ddjvv.exe112⤵PID:3612
-
\??\c:\xrllflf.exec:\xrllflf.exe113⤵PID:4980
-
\??\c:\hnhtnn.exec:\hnhtnn.exe114⤵PID:3152
-
\??\c:\hththb.exec:\hththb.exe115⤵PID:1844
-
\??\c:\3vvpd.exec:\3vvpd.exe116⤵PID:4564
-
\??\c:\frrfxxl.exec:\frrfxxl.exe117⤵PID:2284
-
\??\c:\3thhth.exec:\3thhth.exe118⤵PID:556
-
\??\c:\pjjjd.exec:\pjjjd.exe119⤵PID:2320
-
\??\c:\vdddd.exec:\vdddd.exe120⤵PID:4904
-
\??\c:\fxfrlll.exec:\fxfrlll.exe121⤵PID:3788
-
\??\c:\3bhhtb.exec:\3bhhtb.exe122⤵PID:1848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-