Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 04:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b01d57fe9717c54fe9569c61416b7f90N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
b01d57fe9717c54fe9569c61416b7f90N.exe
-
Size
382KB
-
MD5
b01d57fe9717c54fe9569c61416b7f90
-
SHA1
ad05425e7a49946c0d21bea7632e2727d760873e
-
SHA256
d316ddc7d66a6b6371bce0453e68dc1414b62a2236598f4283b262d6e98ad461
-
SHA512
c2216c2a7e1219a0770e23ea011730e8d4937c2d95a7cadfecde42e4cde8430bb3ce79d78c3a503b1828b29712a3bdb20b53bbdd3e549e00a4e1b244e77d8c18
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHqL3yeHmlwe+axBcot39vUDbYhzod04:n3C9BRo7tvnJ99T/KZEL3c5BTkPXKpw
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/1056-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1552-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4084-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1056 ppjjv.exe 428 rxfxllx.exe 4004 xlfxfll.exe 5012 ttthbh.exe 5024 xlxrrxr.exe 1552 vjpdd.exe 2964 rfffrfx.exe 4464 jjjjj.exe 3948 hthnbh.exe 1620 ntbtnn.exe 364 vvvdv.exe 2604 rflxxxr.exe 4732 rrrrflx.exe 1020 tbbthb.exe 4756 rflfrxl.exe 1944 bnnbtn.exe 4348 hnthhb.exe 3308 fxffrfl.exe 1576 9hhbtb.exe 4000 dvvjv.exe 868 rxfllll.exe 1400 nhnhht.exe 4296 7hbnht.exe 4088 xrrlxrr.exe 2980 bnhbbt.exe 1948 9jjdp.exe 4548 fffrlxr.exe 4084 htthtn.exe 4504 vjjdp.exe 916 nhhbtn.exe 3980 5pjjd.exe 3168 nnbthh.exe 4452 hbhbbt.exe 3520 dpvdp.exe 772 lxxrlxr.exe 3904 5bbthb.exe 1300 dvpjv.exe 428 pjdpj.exe 3700 rlrlrlx.exe 1464 xrxrfxx.exe 4700 httnhh.exe 3720 vpvpv.exe 4844 9rfxllf.exe 2300 nhhtnh.exe 4524 nhbtnh.exe 1980 jvvjv.exe 4048 xffxrxf.exe 3948 xrrrlrf.exe 1620 nbtnhb.exe 3300 jjpjd.exe 4384 dppdp.exe 3312 xrrfxxr.exe 3820 bnhbbt.exe 1848 vvdpp.exe 4884 jdpdp.exe 4568 lxxxrrr.exe 1028 tbthbt.exe 1944 tbbtnh.exe 3256 vpjvj.exe 1716 xflxrll.exe 3308 hnnbtt.exe 1068 dddvd.exe 2168 3pjdv.exe 896 rrlxffx.exe -
resource yara_rule behavioral2/memory/1692-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1948-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4084-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbtn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1692 wrote to memory of 1056 1692 b01d57fe9717c54fe9569c61416b7f90N.exe 85 PID 1692 wrote to memory of 1056 1692 b01d57fe9717c54fe9569c61416b7f90N.exe 85 PID 1692 wrote to memory of 1056 1692 b01d57fe9717c54fe9569c61416b7f90N.exe 85 PID 1056 wrote to memory of 428 1056 ppjjv.exe 86 PID 1056 wrote to memory of 428 1056 ppjjv.exe 86 PID 1056 wrote to memory of 428 1056 ppjjv.exe 86 PID 428 wrote to memory of 4004 428 rxfxllx.exe 87 PID 428 wrote to memory of 4004 428 rxfxllx.exe 87 PID 428 wrote to memory of 4004 428 rxfxllx.exe 87 PID 4004 wrote to memory of 5012 4004 xlfxfll.exe 88 PID 4004 wrote to memory of 5012 4004 xlfxfll.exe 88 PID 4004 wrote to memory of 5012 4004 xlfxfll.exe 88 PID 5012 wrote to memory of 5024 5012 ttthbh.exe 89 PID 5012 wrote to memory of 5024 5012 ttthbh.exe 89 PID 5012 wrote to memory of 5024 5012 ttthbh.exe 89 PID 5024 wrote to memory of 1552 5024 xlxrrxr.exe 91 PID 5024 wrote to memory of 1552 5024 xlxrrxr.exe 91 PID 5024 wrote to memory of 1552 5024 xlxrrxr.exe 91 PID 1552 wrote to memory of 2964 1552 vjpdd.exe 93 PID 1552 wrote to memory of 2964 1552 vjpdd.exe 93 PID 1552 wrote to memory of 2964 1552 vjpdd.exe 93 PID 2964 wrote to memory of 4464 2964 rfffrfx.exe 94 PID 2964 wrote to memory of 4464 2964 rfffrfx.exe 94 PID 2964 wrote to memory of 4464 2964 rfffrfx.exe 94 PID 4464 wrote to memory of 3948 4464 jjjjj.exe 95 PID 4464 wrote to memory of 3948 4464 jjjjj.exe 95 PID 4464 wrote to memory of 3948 4464 jjjjj.exe 95 PID 3948 wrote to memory of 1620 3948 hthnbh.exe 96 PID 3948 wrote to memory of 1620 3948 hthnbh.exe 96 PID 3948 wrote to memory of 1620 3948 hthnbh.exe 96 PID 1620 wrote to memory of 364 1620 ntbtnn.exe 97 PID 1620 wrote to memory of 364 1620 ntbtnn.exe 97 PID 1620 wrote to memory of 364 1620 ntbtnn.exe 97 PID 364 wrote to memory of 2604 364 vvvdv.exe 98 PID 364 wrote to memory of 2604 364 vvvdv.exe 98 PID 364 wrote to memory of 2604 364 vvvdv.exe 98 PID 2604 wrote to memory of 4732 2604 rflxxxr.exe 99 PID 2604 wrote to memory of 4732 2604 rflxxxr.exe 99 PID 2604 wrote to memory of 4732 2604 rflxxxr.exe 99 PID 4732 wrote to memory of 1020 4732 rrrrflx.exe 100 PID 4732 wrote to memory of 1020 4732 rrrrflx.exe 100 PID 4732 wrote to memory of 1020 4732 rrrrflx.exe 100 PID 1020 wrote to memory of 4756 1020 tbbthb.exe 101 PID 1020 wrote to memory of 4756 1020 tbbthb.exe 101 PID 1020 wrote to memory of 4756 1020 tbbthb.exe 101 PID 4756 wrote to memory of 1944 4756 rflfrxl.exe 102 PID 4756 wrote to memory of 1944 4756 rflfrxl.exe 102 PID 4756 wrote to memory of 1944 4756 rflfrxl.exe 102 PID 1944 wrote to memory of 4348 1944 bnnbtn.exe 104 PID 1944 wrote to memory of 4348 1944 bnnbtn.exe 104 PID 1944 wrote to memory of 4348 1944 bnnbtn.exe 104 PID 4348 wrote to memory of 3308 4348 hnthhb.exe 105 PID 4348 wrote to memory of 3308 4348 hnthhb.exe 105 PID 4348 wrote to memory of 3308 4348 hnthhb.exe 105 PID 3308 wrote to memory of 1576 3308 fxffrfl.exe 106 PID 3308 wrote to memory of 1576 3308 fxffrfl.exe 106 PID 3308 wrote to memory of 1576 3308 fxffrfl.exe 106 PID 1576 wrote to memory of 4000 1576 9hhbtb.exe 107 PID 1576 wrote to memory of 4000 1576 9hhbtb.exe 107 PID 1576 wrote to memory of 4000 1576 9hhbtb.exe 107 PID 4000 wrote to memory of 868 4000 dvvjv.exe 108 PID 4000 wrote to memory of 868 4000 dvvjv.exe 108 PID 4000 wrote to memory of 868 4000 dvvjv.exe 108 PID 868 wrote to memory of 1400 868 rxfllll.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\b01d57fe9717c54fe9569c61416b7f90N.exe"C:\Users\Admin\AppData\Local\Temp\b01d57fe9717c54fe9569c61416b7f90N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\ppjjv.exec:\ppjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\rxfxllx.exec:\rxfxllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\xlfxfll.exec:\xlfxfll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\ttthbh.exec:\ttthbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\xlxrrxr.exec:\xlxrrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\vjpdd.exec:\vjpdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\rfffrfx.exec:\rfffrfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\jjjjj.exec:\jjjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\hthnbh.exec:\hthnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\ntbtnn.exec:\ntbtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\vvvdv.exec:\vvvdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
\??\c:\rflxxxr.exec:\rflxxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\rrrrflx.exec:\rrrrflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\tbbthb.exec:\tbbthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\rflfrxl.exec:\rflfrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\bnnbtn.exec:\bnnbtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\hnthhb.exec:\hnthhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\fxffrfl.exec:\fxffrfl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\9hhbtb.exec:\9hhbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\dvvjv.exec:\dvvjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\rxfllll.exec:\rxfllll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\nhnhht.exec:\nhnhht.exe23⤵
- Executes dropped EXE
PID:1400 -
\??\c:\7hbnht.exec:\7hbnht.exe24⤵
- Executes dropped EXE
PID:4296 -
\??\c:\xrrlxrr.exec:\xrrlxrr.exe25⤵
- Executes dropped EXE
PID:4088 -
\??\c:\bnhbbt.exec:\bnhbbt.exe26⤵
- Executes dropped EXE
PID:2980 -
\??\c:\9jjdp.exec:\9jjdp.exe27⤵
- Executes dropped EXE
PID:1948 -
\??\c:\fffrlxr.exec:\fffrlxr.exe28⤵
- Executes dropped EXE
PID:4548 -
\??\c:\htthtn.exec:\htthtn.exe29⤵
- Executes dropped EXE
PID:4084 -
\??\c:\vjjdp.exec:\vjjdp.exe30⤵
- Executes dropped EXE
PID:4504 -
\??\c:\nhhbtn.exec:\nhhbtn.exe31⤵
- Executes dropped EXE
PID:916 -
\??\c:\5pjjd.exec:\5pjjd.exe32⤵
- Executes dropped EXE
PID:3980 -
\??\c:\nnbthh.exec:\nnbthh.exe33⤵
- Executes dropped EXE
PID:3168 -
\??\c:\hbhbbt.exec:\hbhbbt.exe34⤵
- Executes dropped EXE
PID:4452 -
\??\c:\dpvdp.exec:\dpvdp.exe35⤵
- Executes dropped EXE
PID:3520 -
\??\c:\lxxrlxr.exec:\lxxrlxr.exe36⤵
- Executes dropped EXE
PID:772 -
\??\c:\5bbthb.exec:\5bbthb.exe37⤵
- Executes dropped EXE
PID:3904 -
\??\c:\dvpjv.exec:\dvpjv.exe38⤵
- Executes dropped EXE
PID:1300 -
\??\c:\pjdpj.exec:\pjdpj.exe39⤵
- Executes dropped EXE
PID:428 -
\??\c:\rlrlrlx.exec:\rlrlrlx.exe40⤵
- Executes dropped EXE
PID:3700 -
\??\c:\xrxrfxx.exec:\xrxrfxx.exe41⤵
- Executes dropped EXE
PID:1464 -
\??\c:\httnhh.exec:\httnhh.exe42⤵
- Executes dropped EXE
PID:4700 -
\??\c:\vpvpv.exec:\vpvpv.exe43⤵
- Executes dropped EXE
PID:3720 -
\??\c:\9rfxllf.exec:\9rfxllf.exe44⤵
- Executes dropped EXE
PID:4844 -
\??\c:\nhhtnh.exec:\nhhtnh.exe45⤵
- Executes dropped EXE
PID:2300 -
\??\c:\nhbtnh.exec:\nhbtnh.exe46⤵
- Executes dropped EXE
PID:4524 -
\??\c:\jvvjv.exec:\jvvjv.exe47⤵
- Executes dropped EXE
PID:1980 -
\??\c:\xffxrxf.exec:\xffxrxf.exe48⤵
- Executes dropped EXE
PID:4048 -
\??\c:\xrrrlrf.exec:\xrrrlrf.exe49⤵
- Executes dropped EXE
PID:3948 -
\??\c:\nbtnhb.exec:\nbtnhb.exe50⤵
- Executes dropped EXE
PID:1620 -
\??\c:\jjpjd.exec:\jjpjd.exe51⤵
- Executes dropped EXE
PID:3300 -
\??\c:\dppdp.exec:\dppdp.exe52⤵
- Executes dropped EXE
PID:4384 -
\??\c:\xrrfxxr.exec:\xrrfxxr.exe53⤵
- Executes dropped EXE
PID:3312 -
\??\c:\bnhbbt.exec:\bnhbbt.exe54⤵
- Executes dropped EXE
PID:3820 -
\??\c:\vvdpp.exec:\vvdpp.exe55⤵
- Executes dropped EXE
PID:1848 -
\??\c:\jdpdp.exec:\jdpdp.exe56⤵
- Executes dropped EXE
PID:4884 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe57⤵
- Executes dropped EXE
PID:4568 -
\??\c:\tbthbt.exec:\tbthbt.exe58⤵
- Executes dropped EXE
PID:1028 -
\??\c:\tbbtnh.exec:\tbbtnh.exe59⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vpjvj.exec:\vpjvj.exe60⤵
- Executes dropped EXE
PID:3256 -
\??\c:\xflxrll.exec:\xflxrll.exe61⤵
- Executes dropped EXE
PID:1716 -
\??\c:\hnnbtt.exec:\hnnbtt.exe62⤵
- Executes dropped EXE
PID:3308 -
\??\c:\dddvd.exec:\dddvd.exe63⤵
- Executes dropped EXE
PID:1068 -
\??\c:\3pjdv.exec:\3pjdv.exe64⤵
- Executes dropped EXE
PID:2168 -
\??\c:\rrlxffx.exec:\rrlxffx.exe65⤵
- Executes dropped EXE
PID:896 -
\??\c:\9ffrrrl.exec:\9ffrrrl.exe66⤵PID:2512
-
\??\c:\nhnbnh.exec:\nhnbnh.exe67⤵PID:4712
-
\??\c:\pvvpd.exec:\pvvpd.exe68⤵PID:4296
-
\??\c:\xllrlrf.exec:\xllrlrf.exe69⤵PID:2720
-
\??\c:\nbttbb.exec:\nbttbb.exe70⤵PID:1580
-
\??\c:\5jpjv.exec:\5jpjv.exe71⤵PID:2980
-
\??\c:\ppdpj.exec:\ppdpj.exe72⤵PID:2488
-
\??\c:\llrrxrf.exec:\llrrxrf.exe73⤵PID:2328
-
\??\c:\frrlxrl.exec:\frrlxrl.exe74⤵PID:4064
-
\??\c:\bthbbt.exec:\bthbbt.exe75⤵PID:696
-
\??\c:\pjjvj.exec:\pjjvj.exe76⤵PID:840
-
\??\c:\vvdpj.exec:\vvdpj.exe77⤵PID:916
-
\??\c:\9lfrllf.exec:\9lfrllf.exe78⤵PID:4636
-
\??\c:\hbhthb.exec:\hbhthb.exe79⤵PID:1804
-
\??\c:\7nbnhb.exec:\7nbnhb.exe80⤵PID:4496
-
\??\c:\dpdpp.exec:\dpdpp.exe81⤵PID:4576
-
\??\c:\rrrlfxl.exec:\rrrlfxl.exe82⤵PID:4720
-
\??\c:\lxrrrrr.exec:\lxrrrrr.exe83⤵PID:4852
-
\??\c:\nntbhh.exec:\nntbhh.exe84⤵PID:4916
-
\??\c:\3vvjv.exec:\3vvjv.exe85⤵PID:428
-
\??\c:\5lfrxrl.exec:\5lfrxrl.exe86⤵PID:5012
-
\??\c:\xfllxrl.exec:\xfllxrl.exe87⤵PID:2164
-
\??\c:\nnnhbn.exec:\nnnhbn.exe88⤵PID:1184
-
\??\c:\pvjdp.exec:\pvjdp.exe89⤵PID:3848
-
\??\c:\jddvp.exec:\jddvp.exe90⤵PID:700
-
\??\c:\fxrfrll.exec:\fxrfrll.exe91⤵PID:2300
-
\??\c:\bhhbnh.exec:\bhhbnh.exe92⤵PID:1532
-
\??\c:\dppjd.exec:\dppjd.exe93⤵PID:1980
-
\??\c:\pdpjd.exec:\pdpjd.exe94⤵PID:4580
-
\??\c:\lxfrfxx.exec:\lxfrfxx.exe95⤵PID:3948
-
\??\c:\pvjdj.exec:\pvjdj.exe96⤵PID:364
-
\??\c:\llflfxr.exec:\llflfxr.exe97⤵PID:2084
-
\??\c:\frfxrxl.exec:\frfxrxl.exe98⤵PID:2852
-
\??\c:\htttnn.exec:\htttnn.exe99⤵PID:2604
-
\??\c:\dpjdj.exec:\dpjdj.exe100⤵PID:4280
-
\??\c:\vjjdp.exec:\vjjdp.exe101⤵PID:2708
-
\??\c:\rlfxllx.exec:\rlfxllx.exe102⤵PID:2728
-
\??\c:\tbbtnn.exec:\tbbtnn.exe103⤵PID:4756
-
\??\c:\dpdvj.exec:\dpdvj.exe104⤵PID:2492
-
\??\c:\jvpdj.exec:\jvpdj.exe105⤵PID:764
-
\??\c:\9lfxllf.exec:\9lfxllf.exe106⤵PID:2608
-
\??\c:\nbbhtt.exec:\nbbhtt.exe107⤵PID:1140
-
\??\c:\jpddp.exec:\jpddp.exe108⤵PID:4728
-
\??\c:\vpjdv.exec:\vpjdv.exe109⤵PID:3304
-
\??\c:\xxxrfxr.exec:\xxxrfxr.exe110⤵PID:3852
-
\??\c:\nbbtnh.exec:\nbbtnh.exe111⤵PID:2144
-
\??\c:\pvvpd.exec:\pvvpd.exe112⤵PID:3012
-
\??\c:\ddvpd.exec:\ddvpd.exe113⤵PID:4364
-
\??\c:\rlrfrfr.exec:\rlrfrfr.exe114⤵PID:1320
-
\??\c:\9nhbnn.exec:\9nhbnn.exe115⤵PID:2480
-
\??\c:\jddvp.exec:\jddvp.exe116⤵PID:3524
-
\??\c:\rrxxrrl.exec:\rrxxrrl.exe117⤵PID:4296
-
\??\c:\fllfxrl.exec:\fllfxrl.exe118⤵PID:4872
-
\??\c:\nhbtnb.exec:\nhbtnb.exe119⤵PID:2980
-
\??\c:\vjdpd.exec:\vjdpd.exe120⤵PID:532
-
\??\c:\rfrlxlf.exec:\rfrlxlf.exe121⤵PID:4508
-
\??\c:\9xfrfxf.exec:\9xfrfxf.exe122⤵PID:4184
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-