Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 06:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7b63e53c280d1763322945a29893bb80N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
7b63e53c280d1763322945a29893bb80N.exe
-
Size
82KB
-
MD5
7b63e53c280d1763322945a29893bb80
-
SHA1
62f5466b0239996e593b8a730470e670703d2825
-
SHA256
de4661141a9a61af2334e3baec54daf76f62b5d4331b4bbc0671dbd4ac609f18
-
SHA512
0a199c3eb6f497f56673d9169594e48476e0d16ab31014196b38eff38e1c800d4314ab25f28937eb3ec910c81c5eaa2b75b2cedb164b2024dcd6fab21ec0c167
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QD:ymb3NkkiQ3mdBjFIIp9L9QrrA8I
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/4400-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2092-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/756-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2972-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2512-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2372 hhbtnn.exe 3844 vvpjv.exe 2248 lffffff.exe 3924 5tnhnh.exe 1152 vjvpj.exe 4512 5pddv.exe 4180 xrfxfff.exe 2092 httntn.exe 3216 3hhhbb.exe 1380 pjpvp.exe 1536 bttnnn.exe 2984 tnhbhb.exe 3532 ppjdj.exe 3200 lllfxxr.exe 3824 nbtbth.exe 2616 7tbthh.exe 3920 9dppd.exe 756 rflfffl.exe 4068 xrfffff.exe 3456 7djjd.exe 2996 1vjjj.exe 3972 fxxrxxx.exe 548 xxxfxxr.exe 2972 bbbbbt.exe 4232 btbtnn.exe 2692 jddvp.exe 4756 lllfrll.exe 1528 htthth.exe 4788 hbbntn.exe 2512 ppvjv.exe 5044 3rrfxrl.exe 2040 7nthbt.exe 4464 nhbtbb.exe 4740 jvvdj.exe 4836 dvpjp.exe 2924 1rxrfrl.exe 4332 rffrlrl.exe 3320 tthbnh.exe 1116 dvdvd.exe 2416 vjdpj.exe 2060 xrlfrlx.exe 1968 rllfxfr.exe 3536 thtnhb.exe 4084 dppjv.exe 1136 7ddpd.exe 1152 xrrfxrl.exe 924 fxlfrrl.exe 2768 bhnhbh.exe 4180 pdvpd.exe 5032 jvvjv.exe 3140 fxrrfxl.exe 3800 1xxxrrl.exe 3216 5bbthb.exe 3932 1vpjp.exe 4860 ddpjp.exe 4228 dpdvj.exe 2508 fllxlfx.exe 3156 9bhbnn.exe 4800 9tthbt.exe 2304 dvpdp.exe 5104 djpdv.exe 3824 xlfrfxl.exe 424 rrrflfr.exe 4948 9nhbnh.exe -
resource yara_rule behavioral2/memory/4400-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3844-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3532-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/756-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2972-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2512-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlllllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4400 wrote to memory of 2372 4400 7b63e53c280d1763322945a29893bb80N.exe 83 PID 4400 wrote to memory of 2372 4400 7b63e53c280d1763322945a29893bb80N.exe 83 PID 4400 wrote to memory of 2372 4400 7b63e53c280d1763322945a29893bb80N.exe 83 PID 2372 wrote to memory of 3844 2372 hhbtnn.exe 84 PID 2372 wrote to memory of 3844 2372 hhbtnn.exe 84 PID 2372 wrote to memory of 3844 2372 hhbtnn.exe 84 PID 3844 wrote to memory of 2248 3844 vvpjv.exe 85 PID 3844 wrote to memory of 2248 3844 vvpjv.exe 85 PID 3844 wrote to memory of 2248 3844 vvpjv.exe 85 PID 2248 wrote to memory of 3924 2248 lffffff.exe 86 PID 2248 wrote to memory of 3924 2248 lffffff.exe 86 PID 2248 wrote to memory of 3924 2248 lffffff.exe 86 PID 3924 wrote to memory of 1152 3924 5tnhnh.exe 87 PID 3924 wrote to memory of 1152 3924 5tnhnh.exe 87 PID 3924 wrote to memory of 1152 3924 5tnhnh.exe 87 PID 1152 wrote to memory of 4512 1152 vjvpj.exe 88 PID 1152 wrote to memory of 4512 1152 vjvpj.exe 88 PID 1152 wrote to memory of 4512 1152 vjvpj.exe 88 PID 4512 wrote to memory of 4180 4512 5pddv.exe 89 PID 4512 wrote to memory of 4180 4512 5pddv.exe 89 PID 4512 wrote to memory of 4180 4512 5pddv.exe 89 PID 4180 wrote to memory of 2092 4180 xrfxfff.exe 90 PID 4180 wrote to memory of 2092 4180 xrfxfff.exe 90 PID 4180 wrote to memory of 2092 4180 xrfxfff.exe 90 PID 2092 wrote to memory of 3216 2092 httntn.exe 92 PID 2092 wrote to memory of 3216 2092 httntn.exe 92 PID 2092 wrote to memory of 3216 2092 httntn.exe 92 PID 3216 wrote to memory of 1380 3216 3hhhbb.exe 93 PID 3216 wrote to memory of 1380 3216 3hhhbb.exe 93 PID 3216 wrote to memory of 1380 3216 3hhhbb.exe 93 PID 1380 wrote to memory of 1536 1380 pjpvp.exe 94 PID 1380 wrote to memory of 1536 1380 pjpvp.exe 94 PID 1380 wrote to memory of 1536 1380 pjpvp.exe 94 PID 1536 wrote to memory of 2984 1536 bttnnn.exe 96 PID 1536 wrote to memory of 2984 1536 bttnnn.exe 96 PID 1536 wrote to memory of 2984 1536 bttnnn.exe 96 PID 2984 wrote to memory of 3532 2984 tnhbhb.exe 97 PID 2984 wrote to memory of 3532 2984 tnhbhb.exe 97 PID 2984 wrote to memory of 3532 2984 tnhbhb.exe 97 PID 3532 wrote to memory of 3200 3532 ppjdj.exe 98 PID 3532 wrote to memory of 3200 3532 ppjdj.exe 98 PID 3532 wrote to memory of 3200 3532 ppjdj.exe 98 PID 3200 wrote to memory of 3824 3200 lllfxxr.exe 99 PID 3200 wrote to memory of 3824 3200 lllfxxr.exe 99 PID 3200 wrote to memory of 3824 3200 lllfxxr.exe 99 PID 3824 wrote to memory of 2616 3824 nbtbth.exe 100 PID 3824 wrote to memory of 2616 3824 nbtbth.exe 100 PID 3824 wrote to memory of 2616 3824 nbtbth.exe 100 PID 2616 wrote to memory of 3920 2616 7tbthh.exe 101 PID 2616 wrote to memory of 3920 2616 7tbthh.exe 101 PID 2616 wrote to memory of 3920 2616 7tbthh.exe 101 PID 3920 wrote to memory of 756 3920 9dppd.exe 103 PID 3920 wrote to memory of 756 3920 9dppd.exe 103 PID 3920 wrote to memory of 756 3920 9dppd.exe 103 PID 756 wrote to memory of 4068 756 rflfffl.exe 104 PID 756 wrote to memory of 4068 756 rflfffl.exe 104 PID 756 wrote to memory of 4068 756 rflfffl.exe 104 PID 4068 wrote to memory of 3456 4068 xrfffff.exe 105 PID 4068 wrote to memory of 3456 4068 xrfffff.exe 105 PID 4068 wrote to memory of 3456 4068 xrfffff.exe 105 PID 3456 wrote to memory of 2996 3456 7djjd.exe 106 PID 3456 wrote to memory of 2996 3456 7djjd.exe 106 PID 3456 wrote to memory of 2996 3456 7djjd.exe 106 PID 2996 wrote to memory of 3972 2996 1vjjj.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b63e53c280d1763322945a29893bb80N.exe"C:\Users\Admin\AppData\Local\Temp\7b63e53c280d1763322945a29893bb80N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\hhbtnn.exec:\hhbtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\vvpjv.exec:\vvpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\lffffff.exec:\lffffff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\5tnhnh.exec:\5tnhnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\vjvpj.exec:\vjvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\5pddv.exec:\5pddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\xrfxfff.exec:\xrfxfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\httntn.exec:\httntn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\3hhhbb.exec:\3hhhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\pjpvp.exec:\pjpvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\bttnnn.exec:\bttnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\tnhbhb.exec:\tnhbhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\ppjdj.exec:\ppjdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\lllfxxr.exec:\lllfxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\nbtbth.exec:\nbtbth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\7tbthh.exec:\7tbthh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\9dppd.exec:\9dppd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\rflfffl.exec:\rflfffl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\xrfffff.exec:\xrfffff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\7djjd.exec:\7djjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\1vjjj.exec:\1vjjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\fxxrxxx.exec:\fxxrxxx.exe23⤵
- Executes dropped EXE
PID:3972 -
\??\c:\xxxfxxr.exec:\xxxfxxr.exe24⤵
- Executes dropped EXE
PID:548 -
\??\c:\bbbbbt.exec:\bbbbbt.exe25⤵
- Executes dropped EXE
PID:2972 -
\??\c:\btbtnn.exec:\btbtnn.exe26⤵
- Executes dropped EXE
PID:4232 -
\??\c:\jddvp.exec:\jddvp.exe27⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lllfrll.exec:\lllfrll.exe28⤵
- Executes dropped EXE
PID:4756 -
\??\c:\htthth.exec:\htthth.exe29⤵
- Executes dropped EXE
PID:1528 -
\??\c:\hbbntn.exec:\hbbntn.exe30⤵
- Executes dropped EXE
PID:4788 -
\??\c:\ppvjv.exec:\ppvjv.exe31⤵
- Executes dropped EXE
PID:2512 -
\??\c:\3rrfxrl.exec:\3rrfxrl.exe32⤵
- Executes dropped EXE
PID:5044 -
\??\c:\7nthbt.exec:\7nthbt.exe33⤵
- Executes dropped EXE
PID:2040 -
\??\c:\nhbtbb.exec:\nhbtbb.exe34⤵
- Executes dropped EXE
PID:4464 -
\??\c:\jvvdj.exec:\jvvdj.exe35⤵
- Executes dropped EXE
PID:4740 -
\??\c:\dvpjp.exec:\dvpjp.exe36⤵
- Executes dropped EXE
PID:4836 -
\??\c:\1rxrfrl.exec:\1rxrfrl.exe37⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rffrlrl.exec:\rffrlrl.exe38⤵
- Executes dropped EXE
PID:4332 -
\??\c:\tthbnh.exec:\tthbnh.exe39⤵
- Executes dropped EXE
PID:3320 -
\??\c:\dvdvd.exec:\dvdvd.exe40⤵
- Executes dropped EXE
PID:1116 -
\??\c:\vjdpj.exec:\vjdpj.exe41⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xrlfrlx.exec:\xrlfrlx.exe42⤵
- Executes dropped EXE
PID:2060 -
\??\c:\rllfxfr.exec:\rllfxfr.exe43⤵
- Executes dropped EXE
PID:1968 -
\??\c:\thtnhb.exec:\thtnhb.exe44⤵
- Executes dropped EXE
PID:3536 -
\??\c:\dppjv.exec:\dppjv.exe45⤵
- Executes dropped EXE
PID:4084 -
\??\c:\7ddpd.exec:\7ddpd.exe46⤵
- Executes dropped EXE
PID:1136 -
\??\c:\xrrfxrl.exec:\xrrfxrl.exe47⤵
- Executes dropped EXE
PID:1152 -
\??\c:\fxlfrrl.exec:\fxlfrrl.exe48⤵
- Executes dropped EXE
PID:924 -
\??\c:\bhnhbh.exec:\bhnhbh.exe49⤵
- Executes dropped EXE
PID:2768 -
\??\c:\pdvpd.exec:\pdvpd.exe50⤵
- Executes dropped EXE
PID:4180 -
\??\c:\jvvjv.exec:\jvvjv.exe51⤵
- Executes dropped EXE
PID:5032 -
\??\c:\fxrrfxl.exec:\fxrrfxl.exe52⤵
- Executes dropped EXE
PID:3140 -
\??\c:\1xxxrrl.exec:\1xxxrrl.exe53⤵
- Executes dropped EXE
PID:3800 -
\??\c:\5bbthb.exec:\5bbthb.exe54⤵
- Executes dropped EXE
PID:3216 -
\??\c:\1vpjp.exec:\1vpjp.exe55⤵
- Executes dropped EXE
PID:3932 -
\??\c:\ddpjp.exec:\ddpjp.exe56⤵
- Executes dropped EXE
PID:4860 -
\??\c:\dpdvj.exec:\dpdvj.exe57⤵
- Executes dropped EXE
PID:4228 -
\??\c:\fllxlfx.exec:\fllxlfx.exe58⤵
- Executes dropped EXE
PID:2508 -
\??\c:\9bhbnn.exec:\9bhbnn.exe59⤵
- Executes dropped EXE
PID:3156 -
\??\c:\9tthbt.exec:\9tthbt.exe60⤵
- Executes dropped EXE
PID:4800 -
\??\c:\dvpdp.exec:\dvpdp.exe61⤵
- Executes dropped EXE
PID:2304 -
\??\c:\djpdv.exec:\djpdv.exe62⤵
- Executes dropped EXE
PID:5104 -
\??\c:\xlfrfxl.exec:\xlfrfxl.exe63⤵
- Executes dropped EXE
PID:3824 -
\??\c:\rrrflfr.exec:\rrrflfr.exe64⤵
- Executes dropped EXE
PID:424 -
\??\c:\9nhbnh.exec:\9nhbnh.exe65⤵
- Executes dropped EXE
PID:4948 -
\??\c:\jdjdd.exec:\jdjdd.exe66⤵PID:3564
-
\??\c:\dpvjd.exec:\dpvjd.exe67⤵PID:756
-
\??\c:\frxfrll.exec:\frxfrll.exe68⤵PID:2056
-
\??\c:\lffrxrf.exec:\lffrxrf.exe69⤵PID:2476
-
\??\c:\3bthtt.exec:\3bthtt.exe70⤵PID:4828
-
\??\c:\3hnhnh.exec:\3hnhnh.exe71⤵PID:4572
-
\??\c:\pvvjd.exec:\pvvjd.exe72⤵PID:3568
-
\??\c:\vvjdj.exec:\vvjdj.exe73⤵PID:2756
-
\??\c:\rfllrxl.exec:\rfllrxl.exe74⤵PID:4588
-
\??\c:\frlfxrl.exec:\frlfxrl.exe75⤵PID:4224
-
\??\c:\btthhb.exec:\btthhb.exe76⤵PID:3744
-
\??\c:\nbhtbt.exec:\nbhtbt.exe77⤵PID:3752
-
\??\c:\xflfxxx.exec:\xflfxxx.exe78⤵PID:5076
-
\??\c:\frxllll.exec:\frxllll.exe79⤵PID:5024
-
\??\c:\hhbtnn.exec:\hhbtnn.exe80⤵PID:4108
-
\??\c:\3bttnt.exec:\3bttnt.exe81⤵PID:2576
-
\??\c:\jjvpj.exec:\jjvpj.exe82⤵PID:1580
-
\??\c:\pdjdv.exec:\pdjdv.exe83⤵PID:3696
-
\??\c:\xrrlfrr.exec:\xrrlfrr.exe84⤵PID:3988
-
\??\c:\5rllfff.exec:\5rllfff.exe85⤵PID:4176
-
\??\c:\nnhhbb.exec:\nnhhbb.exe86⤵PID:3284
-
\??\c:\vddjj.exec:\vddjj.exe87⤵PID:4364
-
\??\c:\pjdvv.exec:\pjdvv.exe88⤵PID:1052
-
\??\c:\fflfrrl.exec:\fflfrrl.exe89⤵PID:4880
-
\??\c:\hbnnhh.exec:\hbnnhh.exe90⤵PID:4976
-
\??\c:\bnhbhh.exec:\bnhbhh.exe91⤵PID:332
-
\??\c:\vvddd.exec:\vvddd.exe92⤵PID:1664
-
\??\c:\1vpjd.exec:\1vpjd.exe93⤵PID:1700
-
\??\c:\5pjdp.exec:\5pjdp.exe94⤵PID:2824
-
\??\c:\lxxlxxr.exec:\lxxlxxr.exe95⤵PID:5116
-
\??\c:\tnnhbb.exec:\tnnhbb.exe96⤵PID:2904
-
\??\c:\nhttnn.exec:\nhttnn.exe97⤵PID:1228
-
\??\c:\vdjdp.exec:\vdjdp.exe98⤵PID:1660
-
\??\c:\dpvpd.exec:\dpvpd.exe99⤵PID:1060
-
\??\c:\xlffxxx.exec:\xlffxxx.exe100⤵PID:2844
-
\??\c:\xrxrllf.exec:\xrxrllf.exe101⤵PID:3264
-
\??\c:\tntntt.exec:\tntntt.exe102⤵PID:2280
-
\??\c:\tnnhtt.exec:\tnnhtt.exe103⤵PID:4396
-
\??\c:\ddvpj.exec:\ddvpj.exe104⤵PID:2984
-
\??\c:\jdvjj.exec:\jdvjj.exe105⤵PID:4980
-
\??\c:\rllfrrl.exec:\rllfrrl.exe106⤵PID:4996
-
\??\c:\rxrlfxr.exec:\rxrlfxr.exe107⤵PID:2656
-
\??\c:\nhbbbh.exec:\nhbbbh.exe108⤵PID:4344
-
\??\c:\vjjdj.exec:\vjjdj.exe109⤵PID:820
-
\??\c:\vpdvv.exec:\vpdvv.exe110⤵PID:2616
-
\??\c:\vdjdv.exec:\vdjdv.exe111⤵PID:3920
-
\??\c:\llrlxxr.exec:\llrlxxr.exe112⤵PID:2460
-
\??\c:\lfffrxl.exec:\lfffrxl.exe113⤵PID:2208
-
\??\c:\btttbt.exec:\btttbt.exe114⤵PID:5000
-
\??\c:\hnhbhh.exec:\hnhbhh.exe115⤵PID:788
-
\??\c:\vjjdv.exec:\vjjdv.exe116⤵PID:3760
-
\??\c:\fxxxlxx.exec:\fxxxlxx.exe117⤵PID:224
-
\??\c:\ffxxrlf.exec:\ffxxrlf.exe118⤵PID:1764
-
\??\c:\rxflffl.exec:\rxflffl.exe119⤵PID:4164
-
\??\c:\7btnhh.exec:\7btnhh.exe120⤵PID:1240
-
\??\c:\pvjdp.exec:\pvjdp.exe121⤵PID:1148
-
\??\c:\jvppj.exec:\jvppj.exe122⤵PID:1028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-