Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-09-2024 18:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
55d6b6925120b116003fc18a8322f100N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
55d6b6925120b116003fc18a8322f100N.exe
-
Size
82KB
-
MD5
55d6b6925120b116003fc18a8322f100
-
SHA1
84e585a2b0fe8c17336ebeaff5a608cfa69ba42d
-
SHA256
1958a150d822437e5e69d40abe790b33afa692bb572b26fe511ce022723fa8c9
-
SHA512
706c797b500d162f6e4b94d3fc2f47c1aa1c22e0ffa951757790c984a7b417e71a4f337d09ff27231b07f3f1c6dbf93e1a1e9a2ee9315f26841fc6f2dd575e25
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Q+:ymb3NkkiQ3mdBjFIIp9L9QrrA8/
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4824-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2480-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2404 hnhtbb.exe 768 hhnnbh.exe 2480 3pvvd.exe 4860 3rfxllf.exe 2616 tnbttn.exe 4400 ddppj.exe 1168 7rxrxfl.exe 2936 hhthtn.exe 1216 ppjdd.exe 2444 pjdvv.exe 2980 jjjdv.exe 5068 7frlrrx.exe 2848 hbttnn.exe 3724 vpjjv.exe 2992 jdjvp.exe 2340 rxfxllr.exe 1104 9tttbb.exe 2332 ddpjp.exe 3448 jddvv.exe 2188 xllfxxx.exe 1664 tnbnbb.exe 2692 bntnhn.exe 4956 7vvvv.exe 2940 frxrlff.exe 940 tnnnnn.exe 2328 tnbbtt.exe 3940 pjvvv.exe 4404 dpjpv.exe 1260 xrrlfff.exe 4620 hntbbh.exe 4920 1vvpj.exe 468 rrfxffl.exe 4380 ntnnhn.exe 2200 bhtttt.exe 2528 jvdjd.exe 4740 3dddp.exe 1480 rlxxxrr.exe 228 3bhhbb.exe 4524 bnbttt.exe 4276 3pjdv.exe 3432 vjdvp.exe 4824 7xrxlxr.exe 5104 fxxxxxf.exe 2756 3bhhbb.exe 3440 hbnbbh.exe 2480 ppjjp.exe 3496 vddvp.exe 3340 9frlxxr.exe 1252 3fxxffx.exe 1932 hntthn.exe 3572 nhbhnn.exe 764 5dddv.exe 4436 pdjdd.exe 5052 lxlxrxx.exe 2056 rrfxrrl.exe 2444 btntnt.exe 1884 hbnhbb.exe 5036 djppp.exe 3764 vpjdd.exe 1820 rxxxxxx.exe 636 hthbbb.exe 1756 hbhhhh.exe 2992 vjvvp.exe 4352 jvdvj.exe -
resource yara_rule behavioral2/memory/4824-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2404-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/768-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2480-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4824 wrote to memory of 2404 4824 55d6b6925120b116003fc18a8322f100N.exe 83 PID 4824 wrote to memory of 2404 4824 55d6b6925120b116003fc18a8322f100N.exe 83 PID 4824 wrote to memory of 2404 4824 55d6b6925120b116003fc18a8322f100N.exe 83 PID 2404 wrote to memory of 768 2404 hnhtbb.exe 84 PID 2404 wrote to memory of 768 2404 hnhtbb.exe 84 PID 2404 wrote to memory of 768 2404 hnhtbb.exe 84 PID 768 wrote to memory of 2480 768 hhnnbh.exe 85 PID 768 wrote to memory of 2480 768 hhnnbh.exe 85 PID 768 wrote to memory of 2480 768 hhnnbh.exe 85 PID 2480 wrote to memory of 4860 2480 3pvvd.exe 86 PID 2480 wrote to memory of 4860 2480 3pvvd.exe 86 PID 2480 wrote to memory of 4860 2480 3pvvd.exe 86 PID 4860 wrote to memory of 2616 4860 3rfxllf.exe 87 PID 4860 wrote to memory of 2616 4860 3rfxllf.exe 87 PID 4860 wrote to memory of 2616 4860 3rfxllf.exe 87 PID 2616 wrote to memory of 4400 2616 tnbttn.exe 88 PID 2616 wrote to memory of 4400 2616 tnbttn.exe 88 PID 2616 wrote to memory of 4400 2616 tnbttn.exe 88 PID 4400 wrote to memory of 1168 4400 ddppj.exe 89 PID 4400 wrote to memory of 1168 4400 ddppj.exe 89 PID 4400 wrote to memory of 1168 4400 ddppj.exe 89 PID 1168 wrote to memory of 2936 1168 7rxrxfl.exe 90 PID 1168 wrote to memory of 2936 1168 7rxrxfl.exe 90 PID 1168 wrote to memory of 2936 1168 7rxrxfl.exe 90 PID 2936 wrote to memory of 1216 2936 hhthtn.exe 91 PID 2936 wrote to memory of 1216 2936 hhthtn.exe 91 PID 2936 wrote to memory of 1216 2936 hhthtn.exe 91 PID 1216 wrote to memory of 2444 1216 ppjdd.exe 92 PID 1216 wrote to memory of 2444 1216 ppjdd.exe 92 PID 1216 wrote to memory of 2444 1216 ppjdd.exe 92 PID 2444 wrote to memory of 2980 2444 pjdvv.exe 94 PID 2444 wrote to memory of 2980 2444 pjdvv.exe 94 PID 2444 wrote to memory of 2980 2444 pjdvv.exe 94 PID 2980 wrote to memory of 5068 2980 jjjdv.exe 95 PID 2980 wrote to memory of 5068 2980 jjjdv.exe 95 PID 2980 wrote to memory of 5068 2980 jjjdv.exe 95 PID 5068 wrote to memory of 2848 5068 7frlrrx.exe 97 PID 5068 wrote to memory of 2848 5068 7frlrrx.exe 97 PID 5068 wrote to memory of 2848 5068 7frlrrx.exe 97 PID 2848 wrote to memory of 3724 2848 hbttnn.exe 98 PID 2848 wrote to memory of 3724 2848 hbttnn.exe 98 PID 2848 wrote to memory of 3724 2848 hbttnn.exe 98 PID 3724 wrote to memory of 2992 3724 vpjjv.exe 99 PID 3724 wrote to memory of 2992 3724 vpjjv.exe 99 PID 3724 wrote to memory of 2992 3724 vpjjv.exe 99 PID 2992 wrote to memory of 2340 2992 jdjvp.exe 100 PID 2992 wrote to memory of 2340 2992 jdjvp.exe 100 PID 2992 wrote to memory of 2340 2992 jdjvp.exe 100 PID 2340 wrote to memory of 1104 2340 rxfxllr.exe 101 PID 2340 wrote to memory of 1104 2340 rxfxllr.exe 101 PID 2340 wrote to memory of 1104 2340 rxfxllr.exe 101 PID 1104 wrote to memory of 2332 1104 9tttbb.exe 102 PID 1104 wrote to memory of 2332 1104 9tttbb.exe 102 PID 1104 wrote to memory of 2332 1104 9tttbb.exe 102 PID 2332 wrote to memory of 3448 2332 ddpjp.exe 104 PID 2332 wrote to memory of 3448 2332 ddpjp.exe 104 PID 2332 wrote to memory of 3448 2332 ddpjp.exe 104 PID 3448 wrote to memory of 2188 3448 jddvv.exe 105 PID 3448 wrote to memory of 2188 3448 jddvv.exe 105 PID 3448 wrote to memory of 2188 3448 jddvv.exe 105 PID 2188 wrote to memory of 1664 2188 xllfxxx.exe 106 PID 2188 wrote to memory of 1664 2188 xllfxxx.exe 106 PID 2188 wrote to memory of 1664 2188 xllfxxx.exe 106 PID 1664 wrote to memory of 2692 1664 tnbnbb.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\55d6b6925120b116003fc18a8322f100N.exe"C:\Users\Admin\AppData\Local\Temp\55d6b6925120b116003fc18a8322f100N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\hnhtbb.exec:\hnhtbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\hhnnbh.exec:\hhnnbh.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\3pvvd.exec:\3pvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\3rfxllf.exec:\3rfxllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\tnbttn.exec:\tnbttn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\ddppj.exec:\ddppj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\7rxrxfl.exec:\7rxrxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\hhthtn.exec:\hhthtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\ppjdd.exec:\ppjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\pjdvv.exec:\pjdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\jjjdv.exec:\jjjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\7frlrrx.exec:\7frlrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\hbttnn.exec:\hbttnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\vpjjv.exec:\vpjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\jdjvp.exec:\jdjvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\rxfxllr.exec:\rxfxllr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\9tttbb.exec:\9tttbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\ddpjp.exec:\ddpjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\jddvv.exec:\jddvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\xllfxxx.exec:\xllfxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\tnbnbb.exec:\tnbnbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\bntnhn.exec:\bntnhn.exe23⤵
- Executes dropped EXE
PID:2692 -
\??\c:\7vvvv.exec:\7vvvv.exe24⤵
- Executes dropped EXE
PID:4956 -
\??\c:\frxrlff.exec:\frxrlff.exe25⤵
- Executes dropped EXE
PID:2940 -
\??\c:\tnnnnn.exec:\tnnnnn.exe26⤵
- Executes dropped EXE
PID:940 -
\??\c:\tnbbtt.exec:\tnbbtt.exe27⤵
- Executes dropped EXE
PID:2328 -
\??\c:\pjvvv.exec:\pjvvv.exe28⤵
- Executes dropped EXE
PID:3940 -
\??\c:\dpjpv.exec:\dpjpv.exe29⤵
- Executes dropped EXE
PID:4404 -
\??\c:\xrrlfff.exec:\xrrlfff.exe30⤵
- Executes dropped EXE
PID:1260 -
\??\c:\hntbbh.exec:\hntbbh.exe31⤵
- Executes dropped EXE
PID:4620 -
\??\c:\1vvpj.exec:\1vvpj.exe32⤵
- Executes dropped EXE
PID:4920 -
\??\c:\rrfxffl.exec:\rrfxffl.exe33⤵
- Executes dropped EXE
PID:468 -
\??\c:\ntnnhn.exec:\ntnnhn.exe34⤵
- Executes dropped EXE
PID:4380 -
\??\c:\bhtttt.exec:\bhtttt.exe35⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jvdjd.exec:\jvdjd.exe36⤵
- Executes dropped EXE
PID:2528 -
\??\c:\3dddp.exec:\3dddp.exe37⤵
- Executes dropped EXE
PID:4740 -
\??\c:\rlxxxrr.exec:\rlxxxrr.exe38⤵
- Executes dropped EXE
PID:1480 -
\??\c:\3bhhbb.exec:\3bhhbb.exe39⤵
- Executes dropped EXE
PID:228 -
\??\c:\bnbttt.exec:\bnbttt.exe40⤵
- Executes dropped EXE
PID:4524 -
\??\c:\3pjdv.exec:\3pjdv.exe41⤵
- Executes dropped EXE
PID:4276 -
\??\c:\vjdvp.exec:\vjdvp.exe42⤵
- Executes dropped EXE
PID:3432 -
\??\c:\7xrxlxr.exec:\7xrxlxr.exe43⤵
- Executes dropped EXE
PID:4824 -
\??\c:\fxxxxxf.exec:\fxxxxxf.exe44⤵
- Executes dropped EXE
PID:5104 -
\??\c:\3bhhbb.exec:\3bhhbb.exe45⤵
- Executes dropped EXE
PID:2756 -
\??\c:\hbnbbh.exec:\hbnbbh.exe46⤵
- Executes dropped EXE
PID:3440 -
\??\c:\ppjjp.exec:\ppjjp.exe47⤵
- Executes dropped EXE
PID:2480 -
\??\c:\vddvp.exec:\vddvp.exe48⤵
- Executes dropped EXE
PID:3496 -
\??\c:\9frlxxr.exec:\9frlxxr.exe49⤵
- Executes dropped EXE
PID:3340 -
\??\c:\3fxxffx.exec:\3fxxffx.exe50⤵
- Executes dropped EXE
PID:1252 -
\??\c:\hntthn.exec:\hntthn.exe51⤵
- Executes dropped EXE
PID:1932 -
\??\c:\nhbhnn.exec:\nhbhnn.exe52⤵
- Executes dropped EXE
PID:3572 -
\??\c:\5dddv.exec:\5dddv.exe53⤵
- Executes dropped EXE
PID:764 -
\??\c:\pdjdd.exec:\pdjdd.exe54⤵
- Executes dropped EXE
PID:4436 -
\??\c:\lxlxrxx.exec:\lxlxrxx.exe55⤵
- Executes dropped EXE
PID:5052 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe56⤵
- Executes dropped EXE
PID:2056 -
\??\c:\btntnt.exec:\btntnt.exe57⤵
- Executes dropped EXE
PID:2444 -
\??\c:\hbnhbb.exec:\hbnhbb.exe58⤵
- Executes dropped EXE
PID:1884 -
\??\c:\djppp.exec:\djppp.exe59⤵
- Executes dropped EXE
PID:5036 -
\??\c:\vpjdd.exec:\vpjdd.exe60⤵
- Executes dropped EXE
PID:3764 -
\??\c:\rxxxxxx.exec:\rxxxxxx.exe61⤵
- Executes dropped EXE
PID:1820 -
\??\c:\hthbbb.exec:\hthbbb.exe62⤵
- Executes dropped EXE
PID:636 -
\??\c:\hbhhhh.exec:\hbhhhh.exe63⤵
- Executes dropped EXE
PID:1756 -
\??\c:\vjvvp.exec:\vjvvp.exe64⤵
- Executes dropped EXE
PID:2992 -
\??\c:\jvdvj.exec:\jvdvj.exe65⤵
- Executes dropped EXE
PID:4352 -
\??\c:\xrfxrxx.exec:\xrfxrxx.exe66⤵PID:5072
-
\??\c:\lrlfrfr.exec:\lrlfrfr.exe67⤵PID:4496
-
\??\c:\tnbbtt.exec:\tnbbtt.exe68⤵PID:2276
-
\??\c:\nbhbtn.exec:\nbhbtn.exe69⤵PID:2332
-
\??\c:\3vvpp.exec:\3vvpp.exe70⤵PID:4776
-
\??\c:\dvjpp.exec:\dvjpp.exe71⤵PID:4416
-
\??\c:\rxfxxrr.exec:\rxfxxrr.exe72⤵PID:1748
-
\??\c:\1lfrlxx.exec:\1lfrlxx.exe73⤵PID:1664
-
\??\c:\btnhhh.exec:\btnhhh.exe74⤵PID:3728
-
\??\c:\3httbb.exec:\3httbb.exe75⤵PID:3640
-
\??\c:\dpjpp.exec:\dpjpp.exe76⤵PID:2816
-
\??\c:\dpvpj.exec:\dpvpj.exe77⤵PID:2940
-
\??\c:\xxfxrfx.exec:\xxfxrfx.exe78⤵PID:4728
-
\??\c:\lflfxxx.exec:\lflfxxx.exe79⤵PID:2328
-
\??\c:\7bbbtt.exec:\7bbbtt.exe80⤵PID:2972
-
\??\c:\tbnhtt.exec:\tbnhtt.exe81⤵PID:2132
-
\??\c:\dpdvv.exec:\dpdvv.exe82⤵PID:2932
-
\??\c:\9rxrlll.exec:\9rxrlll.exe83⤵PID:3800
-
\??\c:\tbhhhh.exec:\tbhhhh.exe84⤵PID:1296
-
\??\c:\btnhhn.exec:\btnhhn.exe85⤵PID:1060
-
\??\c:\dpppp.exec:\dpppp.exe86⤵PID:4676
-
\??\c:\vjddp.exec:\vjddp.exe87⤵PID:4640
-
\??\c:\llflfrf.exec:\llflfrf.exe88⤵PID:2900
-
\??\c:\flfllrx.exec:\flfllrx.exe89⤵PID:2800
-
\??\c:\nhbnhb.exec:\nhbnhb.exe90⤵PID:4664
-
\??\c:\btbttt.exec:\btbttt.exe91⤵PID:4324
-
\??\c:\jvpjj.exec:\jvpjj.exe92⤵PID:4532
-
\??\c:\vvjjv.exec:\vvjjv.exe93⤵PID:4332
-
\??\c:\frrrlll.exec:\frrrlll.exe94⤵PID:3880
-
\??\c:\nbhbbb.exec:\nbhbbb.exe95⤵PID:2584
-
\??\c:\bbbttt.exec:\bbbttt.exe96⤵PID:2404
-
\??\c:\ddpjp.exec:\ddpjp.exe97⤵PID:3120
-
\??\c:\jjvvd.exec:\jjvvd.exe98⤵PID:4100
-
\??\c:\lfffrrl.exec:\lfffrrl.exe99⤵PID:4068
-
\??\c:\thbbnt.exec:\thbbnt.exe100⤵PID:4072
-
\??\c:\jdddv.exec:\jdddv.exe101⤵PID:1464
-
\??\c:\vjvpj.exec:\vjvpj.exe102⤵PID:4400
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe103⤵PID:1852
-
\??\c:\9rfxfxx.exec:\9rfxfxx.exe104⤵PID:612
-
\??\c:\lffxrff.exec:\lffxrff.exe105⤵PID:1620
-
\??\c:\5nhhhh.exec:\5nhhhh.exe106⤵PID:2228
-
\??\c:\9nnhbh.exec:\9nnhbh.exe107⤵PID:4436
-
\??\c:\jjddp.exec:\jjddp.exe108⤵PID:5024
-
\??\c:\vpjdp.exec:\vpjdp.exe109⤵PID:2056
-
\??\c:\fxfxrxr.exec:\fxfxrxr.exe110⤵PID:2444
-
\??\c:\rlxrrfl.exec:\rlxrrfl.exe111⤵PID:1884
-
\??\c:\nnbtnn.exec:\nnbtnn.exe112⤵PID:2344
-
\??\c:\nnnhhh.exec:\nnnhhh.exe113⤵PID:3764
-
\??\c:\7jdvv.exec:\7jdvv.exe114⤵PID:1820
-
\??\c:\pjjjd.exec:\pjjjd.exe115⤵PID:636
-
\??\c:\xllxxrx.exec:\xllxxrx.exe116⤵PID:1756
-
\??\c:\htbnbb.exec:\htbnbb.exe117⤵PID:1328
-
\??\c:\jjvpj.exec:\jjvpj.exe118⤵PID:1232
-
\??\c:\pvvpj.exec:\pvvpj.exe119⤵PID:1180
-
\??\c:\fxffrrr.exec:\fxffrrr.exe120⤵PID:4496
-
\??\c:\fflfllr.exec:\fflfllr.exe121⤵PID:2276
-
\??\c:\3nbbbb.exec:\3nbbbb.exe122⤵PID:2332
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-