Overview
overview
10Static
static
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10out.exe
windows10-2004-x64
3RAT/31.exe
windows10-2004-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/file.exe
windows10-2004-x64
7Ransomware...-2.exe
windows10-2004-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...lt.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/Dridex.dll
windows10-2004-x64
10Stealers/M..._2.exe
windows10-2004-x64
10Stealers/lumma.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Resubmissions
03-09-2024 14:02
240903-rb57sazdqf 1003-09-2024 13:51
240903-q59avszclf 1002-09-2024 19:51
240902-yk8gtsxbpd 1002-09-2024 02:27
240902-cxh7tazflg 1002-09-2024 02:26
240902-cwxc2sygll 1021-06-2024 19:37
240621-yca7cszgnd 1009-06-2024 17:07
240609-vm7rjadd73 1013-05-2024 17:36
240513-v6qblafe3y 1012-05-2024 17:17
240512-vty3zafh5s 10Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-09-2024 02:26
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
out.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
RAT/31.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
RAT/XClient.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral6
Sample
RAT/file.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Ransomware/default.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
Stealers/Azorult.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
Stealers/Dridex.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
Stealers/lumma.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20240802-en
General
-
Target
Stealers/BlackMoon.exe
-
Size
387KB
-
MD5
336efa7460c08e3d47f29121742eb010
-
SHA1
f41c36cd83879d170309dede056563d35741b87b
-
SHA256
e6dd3fa33ad938b07c8978691f86b73e9f6fd84104b92f42566498bdb6b2930e
-
SHA512
e8d118fbe907a00d89c2514af4de475a0ea54943076bf90174234f77f2ec093a1246a0d4e78d1104a0dcda150b5441d28f4f3d1e768ecb20ae86383a99863c14
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfN:SgdnJVU4TlnwJ6Goo
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral11/memory/2412-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/4212-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/4380-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/968-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/3248-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/2880-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/1700-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/2880-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/3528-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/4700-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/468-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/1968-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/1200-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/4604-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/1576-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/1612-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/2948-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/2792-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/1620-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/1104-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/4116-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/5008-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/116-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral11/memory/1560-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4212 djvvp.exe 4380 7bhhhh.exe 968 jjppp.exe 1560 1hbnnt.exe 3248 djvpj.exe 116 xxrrlrx.exe 2880 hntbbh.exe 1700 fxlfxff.exe 5008 ffxxffx.exe 3196 nbnthn.exe 4116 hhhbth.exe 1020 vvvjd.exe 1596 rrxrrrl.exe 1704 hhnnnn.exe 3528 dvddd.exe 1104 lrrfxxf.exe 1620 vdpjv.exe 2792 jddpp.exe 4700 1lfxxfx.exe 2948 hnnhhh.exe 1252 ttbtbb.exe 1612 bnnntb.exe 468 llfffff.exe 1576 nnthht.exe 1968 frxrxlx.exe 1200 nbnhhh.exe 5064 rxxxrrf.exe 4604 nthbnb.exe 3156 ddvpv.exe 3424 xrfxxfx.exe 4992 bhhtbb.exe 3200 vvjvp.exe 1040 9frlrrr.exe 3664 btbttn.exe 4996 ddppp.exe 3852 lxxrrff.exe 1468 bbnnbh.exe 544 tbbbtt.exe 2412 dpjjj.exe 2376 llllllr.exe 3756 btnnnn.exe 3624 tnbnhh.exe 4916 jjvvv.exe 3104 rfxrlrr.exe 1904 xrlrlxr.exe 748 bbbbbb.exe 3248 vjvvv.exe 1688 ddjjj.exe 1372 5flffff.exe 1816 bbhttn.exe 3004 jjjvp.exe 2116 dpjpv.exe 2996 xxxxllf.exe 2876 bbbbbb.exe 640 7bnnnt.exe 3980 dpddj.exe 452 lffffxx.exe 712 xlfxrrl.exe 4456 nbthnh.exe 3296 5djpj.exe 4500 ddvvv.exe 1932 xlffxxx.exe 1912 nnbbhh.exe 4636 thhnhb.exe -
resource yara_rule behavioral11/memory/2412-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/2412-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/4212-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/4380-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/4380-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/4380-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/4380-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/968-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/968-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/3248-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/2880-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/2880-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/1700-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/2880-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/3196-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/3528-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/4700-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/468-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/1968-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/1200-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/4604-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/1576-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/1612-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/2948-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/2792-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/1620-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/1104-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/4116-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/5008-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/116-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral11/memory/1560-37-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbttb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 4212 2412 BlackMoon.exe 83 PID 2412 wrote to memory of 4212 2412 BlackMoon.exe 83 PID 2412 wrote to memory of 4212 2412 BlackMoon.exe 83 PID 4212 wrote to memory of 4380 4212 djvvp.exe 85 PID 4212 wrote to memory of 4380 4212 djvvp.exe 85 PID 4212 wrote to memory of 4380 4212 djvvp.exe 85 PID 4380 wrote to memory of 968 4380 7bhhhh.exe 178 PID 4380 wrote to memory of 968 4380 7bhhhh.exe 178 PID 4380 wrote to memory of 968 4380 7bhhhh.exe 178 PID 968 wrote to memory of 1560 968 jjppp.exe 88 PID 968 wrote to memory of 1560 968 jjppp.exe 88 PID 968 wrote to memory of 1560 968 jjppp.exe 88 PID 1560 wrote to memory of 3248 1560 1hbnnt.exe 570 PID 1560 wrote to memory of 3248 1560 1hbnnt.exe 570 PID 1560 wrote to memory of 3248 1560 1hbnnt.exe 570 PID 3248 wrote to memory of 116 3248 djvpj.exe 529 PID 3248 wrote to memory of 116 3248 djvpj.exe 529 PID 3248 wrote to memory of 116 3248 djvpj.exe 529 PID 116 wrote to memory of 2880 116 xxrrlrx.exe 527 PID 116 wrote to memory of 2880 116 xxrrlrx.exe 527 PID 116 wrote to memory of 2880 116 xxrrlrx.exe 527 PID 2880 wrote to memory of 1700 2880 hntbbh.exe 572 PID 2880 wrote to memory of 1700 2880 hntbbh.exe 572 PID 2880 wrote to memory of 1700 2880 hntbbh.exe 572 PID 1700 wrote to memory of 5008 1700 fxlfxff.exe 94 PID 1700 wrote to memory of 5008 1700 fxlfxff.exe 94 PID 1700 wrote to memory of 5008 1700 fxlfxff.exe 94 PID 5008 wrote to memory of 3196 5008 ffxxffx.exe 95 PID 5008 wrote to memory of 3196 5008 ffxxffx.exe 95 PID 5008 wrote to memory of 3196 5008 ffxxffx.exe 95 PID 3196 wrote to memory of 4116 3196 nbnthn.exe 533 PID 3196 wrote to memory of 4116 3196 nbnthn.exe 533 PID 3196 wrote to memory of 4116 3196 nbnthn.exe 533 PID 4116 wrote to memory of 1020 4116 hhhbth.exe 97 PID 4116 wrote to memory of 1020 4116 hhhbth.exe 97 PID 4116 wrote to memory of 1020 4116 hhhbth.exe 97 PID 1020 wrote to memory of 1596 1020 vvvjd.exe 98 PID 1020 wrote to memory of 1596 1020 vvvjd.exe 98 PID 1020 wrote to memory of 1596 1020 vvvjd.exe 98 PID 1596 wrote to memory of 1704 1596 rrxrrrl.exe 99 PID 1596 wrote to memory of 1704 1596 rrxrrrl.exe 99 PID 1596 wrote to memory of 1704 1596 rrxrrrl.exe 99 PID 1704 wrote to memory of 3528 1704 hhnnnn.exe 100 PID 1704 wrote to memory of 3528 1704 hhnnnn.exe 100 PID 1704 wrote to memory of 3528 1704 hhnnnn.exe 100 PID 3528 wrote to memory of 1104 3528 dvddd.exe 101 PID 3528 wrote to memory of 1104 3528 dvddd.exe 101 PID 3528 wrote to memory of 1104 3528 dvddd.exe 101 PID 1104 wrote to memory of 1620 1104 lrrfxxf.exe 580 PID 1104 wrote to memory of 1620 1104 lrrfxxf.exe 580 PID 1104 wrote to memory of 1620 1104 lrrfxxf.exe 580 PID 1620 wrote to memory of 2792 1620 vdpjv.exe 540 PID 1620 wrote to memory of 2792 1620 vdpjv.exe 540 PID 1620 wrote to memory of 2792 1620 vdpjv.exe 540 PID 2792 wrote to memory of 4700 2792 jddpp.exe 497 PID 2792 wrote to memory of 4700 2792 jddpp.exe 497 PID 2792 wrote to memory of 4700 2792 jddpp.exe 497 PID 4700 wrote to memory of 2948 4700 1lfxxfx.exe 542 PID 4700 wrote to memory of 2948 4700 1lfxxfx.exe 542 PID 4700 wrote to memory of 2948 4700 1lfxxfx.exe 542 PID 2948 wrote to memory of 1252 2948 hnnhhh.exe 583 PID 2948 wrote to memory of 1252 2948 hnnhhh.exe 583 PID 2948 wrote to memory of 1252 2948 hnnhhh.exe 583 PID 1252 wrote to memory of 1612 1252 ttbtbb.exe 464
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\djvvp.exec:\djvvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\7bhhhh.exec:\7bhhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\jjppp.exec:\jjppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\1hbnnt.exec:\1hbnnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\djvpj.exec:\djvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\xxrrlrx.exec:\xxrrlrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\hntbbh.exec:\hntbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\fxlfxff.exec:\fxlfxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\ffxxffx.exec:\ffxxffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\nbnthn.exec:\nbnthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\hhhbth.exec:\hhhbth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\vvvjd.exec:\vvvjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\rrxrrrl.exec:\rrxrrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\hhnnnn.exec:\hhnnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\dvddd.exec:\dvddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\lrrfxxf.exec:\lrrfxxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\vdpjv.exec:\vdpjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\jddpp.exec:\jddpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\1lfxxfx.exec:\1lfxxfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\hnnhhh.exec:\hnnhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\ttbtbb.exec:\ttbtbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\bnnntb.exec:\bnnntb.exe23⤵
- Executes dropped EXE
PID:1612 -
\??\c:\llfffff.exec:\llfffff.exe24⤵
- Executes dropped EXE
PID:468 -
\??\c:\nnthht.exec:\nnthht.exe25⤵
- Executes dropped EXE
PID:1576 -
\??\c:\frxrxlx.exec:\frxrxlx.exe26⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nbnhhh.exec:\nbnhhh.exe27⤵
- Executes dropped EXE
PID:1200 -
\??\c:\rxxxrrf.exec:\rxxxrrf.exe28⤵
- Executes dropped EXE
PID:5064 -
\??\c:\nthbnb.exec:\nthbnb.exe29⤵
- Executes dropped EXE
PID:4604 -
\??\c:\ddvpv.exec:\ddvpv.exe30⤵
- Executes dropped EXE
PID:3156 -
\??\c:\xrfxxfx.exec:\xrfxxfx.exe31⤵
- Executes dropped EXE
PID:3424 -
\??\c:\bhhtbb.exec:\bhhtbb.exe32⤵
- Executes dropped EXE
PID:4992 -
\??\c:\vvjvp.exec:\vvjvp.exe33⤵
- Executes dropped EXE
PID:3200 -
\??\c:\9frlrrr.exec:\9frlrrr.exe34⤵
- Executes dropped EXE
PID:1040 -
\??\c:\btbttn.exec:\btbttn.exe35⤵
- Executes dropped EXE
PID:3664 -
\??\c:\ddppp.exec:\ddppp.exe36⤵
- Executes dropped EXE
PID:4996 -
\??\c:\lxxrrff.exec:\lxxrrff.exe37⤵
- Executes dropped EXE
PID:3852 -
\??\c:\bbnnbh.exec:\bbnnbh.exe38⤵
- Executes dropped EXE
PID:1468 -
\??\c:\tbbbtt.exec:\tbbbtt.exe39⤵
- Executes dropped EXE
PID:544 -
\??\c:\dpjjj.exec:\dpjjj.exe40⤵
- Executes dropped EXE
PID:2412 -
\??\c:\llllllr.exec:\llllllr.exe41⤵
- Executes dropped EXE
PID:2376 -
\??\c:\btnnnn.exec:\btnnnn.exe42⤵
- Executes dropped EXE
PID:3756 -
\??\c:\tnbnhh.exec:\tnbnhh.exe43⤵
- Executes dropped EXE
PID:3624 -
\??\c:\jjvvv.exec:\jjvvv.exe44⤵
- Executes dropped EXE
PID:4916 -
\??\c:\rfxrlrr.exec:\rfxrlrr.exe45⤵
- Executes dropped EXE
PID:3104 -
\??\c:\xrlrlxr.exec:\xrlrlxr.exe46⤵
- Executes dropped EXE
PID:1904 -
\??\c:\bbbbbb.exec:\bbbbbb.exe47⤵
- Executes dropped EXE
PID:748 -
\??\c:\vjvvv.exec:\vjvvv.exe48⤵
- Executes dropped EXE
PID:3248 -
\??\c:\ddjjj.exec:\ddjjj.exe49⤵
- Executes dropped EXE
PID:1688 -
\??\c:\5flffff.exec:\5flffff.exe50⤵
- Executes dropped EXE
PID:1372 -
\??\c:\bbhttn.exec:\bbhttn.exe51⤵
- Executes dropped EXE
PID:1816 -
\??\c:\jjjvp.exec:\jjjvp.exe52⤵
- Executes dropped EXE
PID:3004 -
\??\c:\dpjpv.exec:\dpjpv.exe53⤵
- Executes dropped EXE
PID:2116 -
\??\c:\xxxxllf.exec:\xxxxllf.exe54⤵
- Executes dropped EXE
PID:2996 -
\??\c:\bbbbbb.exec:\bbbbbb.exe55⤵
- Executes dropped EXE
PID:2876 -
\??\c:\7bnnnt.exec:\7bnnnt.exe56⤵
- Executes dropped EXE
PID:640 -
\??\c:\dpddj.exec:\dpddj.exe57⤵
- Executes dropped EXE
PID:3980 -
\??\c:\lffffxx.exec:\lffffxx.exe58⤵
- Executes dropped EXE
PID:452 -
\??\c:\xlfxrrl.exec:\xlfxrrl.exe59⤵
- Executes dropped EXE
PID:712 -
\??\c:\nbthnh.exec:\nbthnh.exe60⤵
- Executes dropped EXE
PID:4456 -
\??\c:\5djpj.exec:\5djpj.exe61⤵
- Executes dropped EXE
PID:3296 -
\??\c:\ddvvv.exec:\ddvvv.exe62⤵
- Executes dropped EXE
PID:4500 -
\??\c:\xlffxxx.exec:\xlffxxx.exe63⤵
- Executes dropped EXE
PID:1932 -
\??\c:\nnbbhh.exec:\nnbbhh.exe64⤵
- Executes dropped EXE
PID:1912 -
\??\c:\thhnhb.exec:\thhnhb.exe65⤵
- Executes dropped EXE
PID:4636 -
\??\c:\vjjvp.exec:\vjjvp.exe66⤵PID:4608
-
\??\c:\xxflffl.exec:\xxflffl.exe67⤵PID:2488
-
\??\c:\xxrlrrf.exec:\xxrlrrf.exe68⤵PID:732
-
\??\c:\nnnnhn.exec:\nnnnhn.exe69⤵PID:4356
-
\??\c:\hhnnth.exec:\hhnnth.exe70⤵PID:692
-
\??\c:\jjjdp.exec:\jjjdp.exe71⤵PID:2984
-
\??\c:\rrxllfx.exec:\rrxllfx.exe72⤵PID:2708
-
\??\c:\rlrrxxl.exec:\rlrrxxl.exe73⤵PID:1824
-
\??\c:\bbhhhb.exec:\bbhhhb.exe74⤵PID:3088
-
\??\c:\3ttthn.exec:\3ttthn.exe75⤵PID:1532
-
\??\c:\pjddd.exec:\pjddd.exe76⤵PID:1060
-
\??\c:\rxlrfrx.exec:\rxlrfrx.exe77⤵PID:3960
-
\??\c:\xffxxxx.exec:\xffxxxx.exe78⤵PID:4744
-
\??\c:\7bbhbb.exec:\7bbhbb.exe79⤵PID:1336
-
\??\c:\vpjpp.exec:\vpjpp.exe80⤵PID:3480
-
\??\c:\ffflrlf.exec:\ffflrlf.exe81⤵PID:2228
-
\??\c:\xxfxrxx.exec:\xxfxrxx.exe82⤵PID:3752
-
\??\c:\3hbbhh.exec:\3hbbhh.exe83⤵PID:1140
-
\??\c:\thnnhh.exec:\thnnhh.exe84⤵PID:3688
-
\??\c:\jjvvj.exec:\jjvvj.exe85⤵PID:4288
-
\??\c:\pjjjd.exec:\pjjjd.exe86⤵PID:1632
-
\??\c:\1flfxxl.exec:\1flfxxl.exe87⤵PID:1468
-
\??\c:\tthbtt.exec:\tthbtt.exe88⤵PID:4600
-
\??\c:\hbthnh.exec:\hbthnh.exe89⤵PID:4628
-
\??\c:\pjppj.exec:\pjppj.exe90⤵PID:4560
-
\??\c:\lllxrlf.exec:\lllxrlf.exe91⤵PID:4916
-
\??\c:\llrlffx.exec:\llrlffx.exe92⤵PID:1084
-
\??\c:\bbnnnn.exec:\bbnnnn.exe93⤵PID:208
-
\??\c:\jdjjd.exec:\jdjjd.exe94⤵PID:3248
-
\??\c:\jpjjj.exec:\jpjjj.exe95⤵PID:4200
-
\??\c:\lxxxrxx.exec:\lxxxrxx.exe96⤵PID:2016
-
\??\c:\bthbnh.exec:\bthbnh.exe97⤵PID:4928
-
\??\c:\httthn.exec:\httthn.exe98⤵PID:3140
-
\??\c:\5vppj.exec:\5vppj.exe99⤵PID:912
-
\??\c:\rllffff.exec:\rllffff.exe100⤵PID:112
-
\??\c:\pjdpd.exec:\pjdpd.exe101⤵PID:2876
-
\??\c:\jvddd.exec:\jvddd.exe102⤵PID:1596
-
\??\c:\1rfxllr.exec:\1rfxllr.exe103⤵PID:3620
-
\??\c:\3ntnnn.exec:\3ntnnn.exe104⤵PID:452
-
\??\c:\bhnnth.exec:\bhnnth.exe105⤵PID:2324
-
\??\c:\3pdvd.exec:\3pdvd.exe106⤵PID:1104
-
\??\c:\7rflllf.exec:\7rflllf.exe107⤵PID:3296
-
\??\c:\ffxxrxx.exec:\ffxxrxx.exe108⤵PID:1368
-
\??\c:\tnttbh.exec:\tnttbh.exe109⤵PID:4508
-
\??\c:\pdjpp.exec:\pdjpp.exe110⤵PID:2948
-
\??\c:\jvjpp.exec:\jvjpp.exe111⤵PID:4636
-
\??\c:\lxlfxxf.exec:\lxlfxxf.exe112⤵PID:4608
-
\??\c:\lfrxxff.exec:\lfrxxff.exe113⤵PID:1480
-
\??\c:\hntnnn.exec:\hntnnn.exe114⤵PID:1844
-
\??\c:\djjjv.exec:\djjjv.exe115⤵PID:4356
-
\??\c:\9vvvp.exec:\9vvvp.exe116⤵PID:4348
-
\??\c:\fffxxxx.exec:\fffxxxx.exe117⤵PID:512
-
\??\c:\nthhbb.exec:\nthhbb.exe118⤵PID:2372
-
\??\c:\bnbbtt.exec:\bnbbtt.exe119⤵PID:1824
-
\??\c:\jpddp.exec:\jpddp.exe120⤵PID:2012
-
\??\c:\7xxrlll.exec:\7xxrlll.exe121⤵PID:5016
-
\??\c:\flxxrrr.exec:\flxxrrr.exe122⤵PID:4012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-