Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2024 19:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
611add48cf659fa4a6b087e5e24760c0N.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
120 seconds
General
-
Target
611add48cf659fa4a6b087e5e24760c0N.exe
-
Size
74KB
-
MD5
611add48cf659fa4a6b087e5e24760c0
-
SHA1
08234f9d305a7e7901b5b91c0d72d816713d8476
-
SHA256
b99adcc758adb65c1a32f4b55473160a24699c7e631aea031f16faf428d5347d
-
SHA512
d048599818e5819e6b73561383cd7f27ea2aa477ce0474159a61c41a6628d054300d1bf11c996f722deec75b7388572bf19c1580dd6ce06a441d78ea193649a6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmPS:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHv
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/2740-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1240-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2536-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/804-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4188-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1856 5ppdj.exe 1240 pjjvp.exe 4356 lfrrlrl.exe 4308 nhbhbt.exe 4324 tnnthn.exe 2944 rffxrrl.exe 2320 ththhb.exe 4548 nbbnnt.exe 4248 vjvjv.exe 4060 rlrfffx.exe 3096 tbnhtn.exe 3088 ddpvd.exe 2536 9dvvj.exe 4476 rrrfrlr.exe 4616 thhbtb.exe 4804 dvvdd.exe 628 flrfxrr.exe 468 lfxrffx.exe 5100 bnnbth.exe 4040 1ppjd.exe 4528 1jvjv.exe 964 flfrfxl.exe 2836 nbbnhh.exe 464 hththn.exe 2960 rffrlrf.exe 804 lxxrxxr.exe 2284 9nhbtn.exe 4532 pjjvd.exe 4188 xrfxrrl.exe 2572 lxxrllf.exe 2388 7tnnnn.exe 4392 vpjjd.exe 1060 frfrrlf.exe 2024 bnhtnn.exe 3152 thnhtb.exe 4620 jpdpv.exe 2276 vjdvj.exe 3968 fxrffxf.exe 4400 lxrxlfr.exe 4940 tthnhn.exe 100 vvjvp.exe 4980 7vjdp.exe 5060 lfxlfxr.exe 1052 lfxrffx.exe 456 bnnhtn.exe 4996 ttnnht.exe 3024 dpdpd.exe 1496 lfxrfxx.exe 2592 xflfrrf.exe 1368 httnbb.exe 3804 tthttn.exe 1572 pddpp.exe 3820 flrfxrf.exe 4432 rxrfxrl.exe 3308 hbbnnh.exe 4820 bbnbnh.exe 1752 jppjv.exe 4888 vjjvd.exe 2536 7flxrrl.exe 4236 lxrfrlx.exe 3412 bbhbnn.exe 908 nhbnbt.exe 2476 vpdpd.exe 2920 jppjd.exe -
resource yara_rule behavioral2/memory/2740-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1856-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2536-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/804-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4188-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2740 wrote to memory of 1856 2740 611add48cf659fa4a6b087e5e24760c0N.exe 85 PID 2740 wrote to memory of 1856 2740 611add48cf659fa4a6b087e5e24760c0N.exe 85 PID 2740 wrote to memory of 1856 2740 611add48cf659fa4a6b087e5e24760c0N.exe 85 PID 1856 wrote to memory of 1240 1856 5ppdj.exe 86 PID 1856 wrote to memory of 1240 1856 5ppdj.exe 86 PID 1856 wrote to memory of 1240 1856 5ppdj.exe 86 PID 1240 wrote to memory of 4356 1240 pjjvp.exe 87 PID 1240 wrote to memory of 4356 1240 pjjvp.exe 87 PID 1240 wrote to memory of 4356 1240 pjjvp.exe 87 PID 4356 wrote to memory of 4308 4356 lfrrlrl.exe 88 PID 4356 wrote to memory of 4308 4356 lfrrlrl.exe 88 PID 4356 wrote to memory of 4308 4356 lfrrlrl.exe 88 PID 4308 wrote to memory of 4324 4308 nhbhbt.exe 89 PID 4308 wrote to memory of 4324 4308 nhbhbt.exe 89 PID 4308 wrote to memory of 4324 4308 nhbhbt.exe 89 PID 4324 wrote to memory of 2944 4324 tnnthn.exe 90 PID 4324 wrote to memory of 2944 4324 tnnthn.exe 90 PID 4324 wrote to memory of 2944 4324 tnnthn.exe 90 PID 2944 wrote to memory of 2320 2944 rffxrrl.exe 91 PID 2944 wrote to memory of 2320 2944 rffxrrl.exe 91 PID 2944 wrote to memory of 2320 2944 rffxrrl.exe 91 PID 2320 wrote to memory of 4548 2320 ththhb.exe 92 PID 2320 wrote to memory of 4548 2320 ththhb.exe 92 PID 2320 wrote to memory of 4548 2320 ththhb.exe 92 PID 4548 wrote to memory of 4248 4548 nbbnnt.exe 93 PID 4548 wrote to memory of 4248 4548 nbbnnt.exe 93 PID 4548 wrote to memory of 4248 4548 nbbnnt.exe 93 PID 4248 wrote to memory of 4060 4248 vjvjv.exe 94 PID 4248 wrote to memory of 4060 4248 vjvjv.exe 94 PID 4248 wrote to memory of 4060 4248 vjvjv.exe 94 PID 4060 wrote to memory of 3096 4060 rlrfffx.exe 96 PID 4060 wrote to memory of 3096 4060 rlrfffx.exe 96 PID 4060 wrote to memory of 3096 4060 rlrfffx.exe 96 PID 3096 wrote to memory of 3088 3096 tbnhtn.exe 97 PID 3096 wrote to memory of 3088 3096 tbnhtn.exe 97 PID 3096 wrote to memory of 3088 3096 tbnhtn.exe 97 PID 3088 wrote to memory of 2536 3088 ddpvd.exe 98 PID 3088 wrote to memory of 2536 3088 ddpvd.exe 98 PID 3088 wrote to memory of 2536 3088 ddpvd.exe 98 PID 2536 wrote to memory of 4476 2536 9dvvj.exe 99 PID 2536 wrote to memory of 4476 2536 9dvvj.exe 99 PID 2536 wrote to memory of 4476 2536 9dvvj.exe 99 PID 4476 wrote to memory of 4616 4476 rrrfrlr.exe 100 PID 4476 wrote to memory of 4616 4476 rrrfrlr.exe 100 PID 4476 wrote to memory of 4616 4476 rrrfrlr.exe 100 PID 4616 wrote to memory of 4804 4616 thhbtb.exe 101 PID 4616 wrote to memory of 4804 4616 thhbtb.exe 101 PID 4616 wrote to memory of 4804 4616 thhbtb.exe 101 PID 4804 wrote to memory of 628 4804 dvvdd.exe 102 PID 4804 wrote to memory of 628 4804 dvvdd.exe 102 PID 4804 wrote to memory of 628 4804 dvvdd.exe 102 PID 628 wrote to memory of 468 628 flrfxrr.exe 104 PID 628 wrote to memory of 468 628 flrfxrr.exe 104 PID 628 wrote to memory of 468 628 flrfxrr.exe 104 PID 468 wrote to memory of 5100 468 lfxrffx.exe 105 PID 468 wrote to memory of 5100 468 lfxrffx.exe 105 PID 468 wrote to memory of 5100 468 lfxrffx.exe 105 PID 5100 wrote to memory of 4040 5100 bnnbth.exe 106 PID 5100 wrote to memory of 4040 5100 bnnbth.exe 106 PID 5100 wrote to memory of 4040 5100 bnnbth.exe 106 PID 4040 wrote to memory of 4528 4040 1ppjd.exe 107 PID 4040 wrote to memory of 4528 4040 1ppjd.exe 107 PID 4040 wrote to memory of 4528 4040 1ppjd.exe 107 PID 4528 wrote to memory of 964 4528 1jvjv.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\611add48cf659fa4a6b087e5e24760c0N.exe"C:\Users\Admin\AppData\Local\Temp\611add48cf659fa4a6b087e5e24760c0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\5ppdj.exec:\5ppdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\pjjvp.exec:\pjjvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\lfrrlrl.exec:\lfrrlrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\nhbhbt.exec:\nhbhbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\tnnthn.exec:\tnnthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\rffxrrl.exec:\rffxrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\ththhb.exec:\ththhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\nbbnnt.exec:\nbbnnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\vjvjv.exec:\vjvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\rlrfffx.exec:\rlrfffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\tbnhtn.exec:\tbnhtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\ddpvd.exec:\ddpvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\9dvvj.exec:\9dvvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\rrrfrlr.exec:\rrrfrlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\thhbtb.exec:\thhbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\dvvdd.exec:\dvvdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\flrfxrr.exec:\flrfxrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\lfxrffx.exec:\lfxrffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\bnnbth.exec:\bnnbth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\1ppjd.exec:\1ppjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\1jvjv.exec:\1jvjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\flfrfxl.exec:\flfrfxl.exe23⤵
- Executes dropped EXE
PID:964 -
\??\c:\nbbnhh.exec:\nbbnhh.exe24⤵
- Executes dropped EXE
PID:2836 -
\??\c:\hththn.exec:\hththn.exe25⤵
- Executes dropped EXE
PID:464 -
\??\c:\rffrlrf.exec:\rffrlrf.exe26⤵
- Executes dropped EXE
PID:2960 -
\??\c:\lxxrxxr.exec:\lxxrxxr.exe27⤵
- Executes dropped EXE
PID:804 -
\??\c:\9nhbtn.exec:\9nhbtn.exe28⤵
- Executes dropped EXE
PID:2284 -
\??\c:\pjjvd.exec:\pjjvd.exe29⤵
- Executes dropped EXE
PID:4532 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe30⤵
- Executes dropped EXE
PID:4188 -
\??\c:\lxxrllf.exec:\lxxrllf.exe31⤵
- Executes dropped EXE
PID:2572 -
\??\c:\7tnnnn.exec:\7tnnnn.exe32⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vpjjd.exec:\vpjjd.exe33⤵
- Executes dropped EXE
PID:4392 -
\??\c:\frfrrlf.exec:\frfrrlf.exe34⤵
- Executes dropped EXE
PID:1060 -
\??\c:\bnhtnn.exec:\bnhtnn.exe35⤵
- Executes dropped EXE
PID:2024 -
\??\c:\thnhtb.exec:\thnhtb.exe36⤵
- Executes dropped EXE
PID:3152 -
\??\c:\jpdpv.exec:\jpdpv.exe37⤵
- Executes dropped EXE
PID:4620 -
\??\c:\vjdvj.exec:\vjdvj.exe38⤵
- Executes dropped EXE
PID:2276 -
\??\c:\fxrffxf.exec:\fxrffxf.exe39⤵
- Executes dropped EXE
PID:3968 -
\??\c:\lxrxlfr.exec:\lxrxlfr.exe40⤵
- Executes dropped EXE
PID:4400 -
\??\c:\tthnhn.exec:\tthnhn.exe41⤵
- Executes dropped EXE
PID:4940 -
\??\c:\vvjvp.exec:\vvjvp.exe42⤵
- Executes dropped EXE
PID:100 -
\??\c:\7vjdp.exec:\7vjdp.exe43⤵
- Executes dropped EXE
PID:4980 -
\??\c:\lfxlfxr.exec:\lfxlfxr.exe44⤵
- Executes dropped EXE
PID:5060 -
\??\c:\lfxrffx.exec:\lfxrffx.exe45⤵
- Executes dropped EXE
PID:1052 -
\??\c:\bnnhtn.exec:\bnnhtn.exe46⤵
- Executes dropped EXE
PID:456 -
\??\c:\ttnnht.exec:\ttnnht.exe47⤵
- Executes dropped EXE
PID:4996 -
\??\c:\dpdpd.exec:\dpdpd.exe48⤵
- Executes dropped EXE
PID:3024 -
\??\c:\lfxrfxx.exec:\lfxrfxx.exe49⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xflfrrf.exec:\xflfrrf.exe50⤵
- Executes dropped EXE
PID:2592 -
\??\c:\httnbb.exec:\httnbb.exe51⤵
- Executes dropped EXE
PID:1368 -
\??\c:\tthttn.exec:\tthttn.exe52⤵
- Executes dropped EXE
PID:3804 -
\??\c:\pddpp.exec:\pddpp.exe53⤵
- Executes dropped EXE
PID:1572 -
\??\c:\flrfxrf.exec:\flrfxrf.exe54⤵
- Executes dropped EXE
PID:3820 -
\??\c:\rxrfxrl.exec:\rxrfxrl.exe55⤵
- Executes dropped EXE
PID:4432 -
\??\c:\hbbnnh.exec:\hbbnnh.exe56⤵
- Executes dropped EXE
PID:3308 -
\??\c:\bbnbnh.exec:\bbnbnh.exe57⤵
- Executes dropped EXE
PID:4820 -
\??\c:\jppjv.exec:\jppjv.exe58⤵
- Executes dropped EXE
PID:1752 -
\??\c:\vjjvd.exec:\vjjvd.exe59⤵
- Executes dropped EXE
PID:4888 -
\??\c:\7flxrrl.exec:\7flxrrl.exe60⤵
- Executes dropped EXE
PID:2536 -
\??\c:\lxrfrlx.exec:\lxrfrlx.exe61⤵
- Executes dropped EXE
PID:4236 -
\??\c:\bbhbnn.exec:\bbhbnn.exe62⤵
- Executes dropped EXE
PID:3412 -
\??\c:\nhbnbt.exec:\nhbnbt.exe63⤵
- Executes dropped EXE
PID:908 -
\??\c:\vpdpd.exec:\vpdpd.exe64⤵
- Executes dropped EXE
PID:2476 -
\??\c:\jppjd.exec:\jppjd.exe65⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xrlxlfl.exec:\xrlxlfl.exe66⤵PID:1584
-
\??\c:\bhthth.exec:\bhthth.exe67⤵PID:3608
-
\??\c:\5nbhbt.exec:\5nbhbt.exe68⤵PID:5100
-
\??\c:\jpdpd.exec:\jpdpd.exe69⤵PID:2144
-
\??\c:\xlrlffx.exec:\xlrlffx.exe70⤵PID:536
-
\??\c:\bbtnnh.exec:\bbtnnh.exe71⤵PID:3016
-
\??\c:\bhhbnb.exec:\bhhbnb.exe72⤵PID:3104
-
\??\c:\vjvdv.exec:\vjvdv.exe73⤵PID:4780
-
\??\c:\9vvjv.exec:\9vvjv.exe74⤵PID:2012
-
\??\c:\xrfrxlf.exec:\xrfrxlf.exe75⤵PID:2540
-
\??\c:\flfxlfr.exec:\flfxlfr.exe76⤵PID:2308
-
\??\c:\nbnbtn.exec:\nbnbtn.exe77⤵PID:3252
-
\??\c:\tnthnn.exec:\tnthnn.exe78⤵PID:2576
-
\??\c:\9vddp.exec:\9vddp.exe79⤵PID:3480
-
\??\c:\xllxrlf.exec:\xllxrlf.exe80⤵PID:2284
-
\??\c:\3xrlxrl.exec:\3xrlxrl.exe81⤵PID:4532
-
\??\c:\7ttntn.exec:\7ttntn.exe82⤵PID:4332
-
\??\c:\3bhbnn.exec:\3bhbnn.exe83⤵PID:2448
-
\??\c:\llflxlx.exec:\llflxlx.exe84⤵PID:348
-
\??\c:\fxfxlfx.exec:\fxfxlfx.exe85⤵PID:2388
-
\??\c:\nnnhbt.exec:\nnnhbt.exe86⤵PID:4392
-
\??\c:\bhbthh.exec:\bhbthh.exe87⤵PID:1220
-
\??\c:\dddvp.exec:\dddvp.exe88⤵PID:3808
-
\??\c:\fxlxxrr.exec:\fxlxxrr.exe89⤵PID:1004
-
\??\c:\frxllff.exec:\frxllff.exe90⤵PID:4936
-
\??\c:\bbbhbn.exec:\bbbhbn.exe91⤵PID:3572
-
\??\c:\djdjj.exec:\djdjj.exe92⤵PID:4404
-
\??\c:\dppjd.exec:\dppjd.exe93⤵PID:2928
-
\??\c:\frrxlfx.exec:\frrxlfx.exe94⤵PID:2740
-
\??\c:\bnhtht.exec:\bnhtht.exe95⤵PID:2428
-
\??\c:\pjjdv.exec:\pjjdv.exe96⤵PID:1856
-
\??\c:\vjvjj.exec:\vjvjj.exe97⤵PID:3040
-
\??\c:\7rfxfxf.exec:\7rfxfxf.exe98⤵PID:2472
-
\??\c:\llxrxrx.exec:\llxrxrx.exe99⤵PID:1244
-
\??\c:\tbbnbb.exec:\tbbnbb.exe100⤵PID:1916
-
\??\c:\5nhtnh.exec:\5nhtnh.exe101⤵PID:4736
-
\??\c:\dvvpd.exec:\dvvpd.exe102⤵PID:4092
-
\??\c:\7vvjd.exec:\7vvjd.exe103⤵PID:5064
-
\??\c:\rrxlfff.exec:\rrxlfff.exe104⤵PID:2956
-
\??\c:\5rlfxrf.exec:\5rlfxrf.exe105⤵PID:2204
-
\??\c:\1tnhtn.exec:\1tnhtn.exe106⤵PID:4456
-
\??\c:\tthtnn.exec:\tthtnn.exe107⤵PID:1872
-
\??\c:\vvjjp.exec:\vvjjp.exe108⤵PID:1604
-
\??\c:\frrlllf.exec:\frrlllf.exe109⤵PID:4524
-
\??\c:\lxlffxx.exec:\lxlffxx.exe110⤵PID:1284
-
\??\c:\bbbhbh.exec:\bbbhbh.exe111⤵PID:3408
-
\??\c:\9hhtbn.exec:\9hhtbn.exe112⤵PID:3752
-
\??\c:\dpvdv.exec:\dpvdv.exe113⤵PID:640
-
\??\c:\pvjpv.exec:\pvjpv.exe114⤵PID:4616
-
\??\c:\7lxrllf.exec:\7lxrllf.exe115⤵PID:3928
-
\??\c:\nhnnnh.exec:\nhnnnh.exe116⤵PID:4284
-
\??\c:\pjdvp.exec:\pjdvp.exe117⤵PID:3448
-
\??\c:\5xrfxxl.exec:\5xrfxxl.exe118⤵PID:4916
-
\??\c:\rlfllfr.exec:\rlfllfr.exe119⤵PID:4104
-
\??\c:\hbbhtb.exec:\hbbhtb.exe120⤵PID:3044
-
\??\c:\pvpdd.exec:\pvpdd.exe121⤵PID:3640
-
\??\c:\dvvjp.exec:\dvvjp.exe122⤵PID:1956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-