Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 03:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9470bea50c62ee7f6a001a5b43c162dae9c1af6594cf12b8a541dc156b44d62eN.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
9470bea50c62ee7f6a001a5b43c162dae9c1af6594cf12b8a541dc156b44d62eN.exe
-
Size
67KB
-
MD5
3d7f150d61e1b668d68ef7f24d2dbb70
-
SHA1
41a1a1bec653332adf3d3f209ca2db80075e8198
-
SHA256
9470bea50c62ee7f6a001a5b43c162dae9c1af6594cf12b8a541dc156b44d62e
-
SHA512
55ebdcb87d2d6be2bfd5e608062f303fe0699a251864d696dc01f5186e08aa19d2cc4c8ff78d049f6e5db2862471bf9bed3401916636468ffc15f9dc515b33b4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27Bqfo4o:ymb3NkkiQ3mdBjFI9cqfVo
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/1612-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/820-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3844 jpvvv.exe 1072 xffrfxl.exe 736 lrrrrlf.exe 4384 bnnntb.exe 3112 7jdvp.exe 820 5ffrrll.exe 1460 fllxrfx.exe 4272 nhhbtn.exe 4824 jdvpj.exe 1416 9lfxllx.exe 1544 tthbth.exe 2388 pjdpj.exe 4492 rfflflx.exe 2072 thtbbn.exe 5076 hbbbth.exe 4852 djjdp.exe 1464 bbhbtb.exe 684 pdjdj.exe 5096 dvpdp.exe 1680 lxrxlfx.exe 1384 9hthbt.exe 2272 5jpjj.exe 1208 5ffrfxr.exe 2292 lxfrlfl.exe 2416 nhhtnh.exe 2572 ntnbhb.exe 1628 dpjvj.exe 456 frflfxf.exe 2912 tbbtnb.exe 4316 bnhnbt.exe 4960 vvpvp.exe 4532 ddpdv.exe 3932 9rfrxrf.exe 780 htbbbt.exe 4472 3bnbnh.exe 4120 jddpd.exe 2956 jdpjv.exe 2816 7rxllff.exe 1516 ffflxlf.exe 896 7hhbnh.exe 4480 bbnnnt.exe 4524 ddpvj.exe 3848 pvdjj.exe 2676 vdpvj.exe 1856 1rrlfxx.exe 3844 frxllff.exe 2532 nbhtbt.exe 4800 7bhthb.exe 4984 vjjpd.exe 3984 vdpdp.exe 2940 3ffrxrx.exe 3112 hnnbhb.exe 3116 vjpvv.exe 3020 ppppd.exe 1804 frrflfr.exe 1760 frxxfxl.exe 2016 tnthtb.exe 2900 bnhtbt.exe 4824 3jvvd.exe 5040 7pjvd.exe 1416 rxlxxrl.exe 4616 lxrxlfx.exe 4592 btbbtb.exe 212 nhhntn.exe -
resource yara_rule behavioral2/memory/1612-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3844-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/820-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrlrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1612 wrote to memory of 3844 1612 9470bea50c62ee7f6a001a5b43c162dae9c1af6594cf12b8a541dc156b44d62eN.exe 84 PID 1612 wrote to memory of 3844 1612 9470bea50c62ee7f6a001a5b43c162dae9c1af6594cf12b8a541dc156b44d62eN.exe 84 PID 1612 wrote to memory of 3844 1612 9470bea50c62ee7f6a001a5b43c162dae9c1af6594cf12b8a541dc156b44d62eN.exe 84 PID 3844 wrote to memory of 1072 3844 jpvvv.exe 85 PID 3844 wrote to memory of 1072 3844 jpvvv.exe 85 PID 3844 wrote to memory of 1072 3844 jpvvv.exe 85 PID 1072 wrote to memory of 736 1072 xffrfxl.exe 86 PID 1072 wrote to memory of 736 1072 xffrfxl.exe 86 PID 1072 wrote to memory of 736 1072 xffrfxl.exe 86 PID 736 wrote to memory of 4384 736 lrrrrlf.exe 87 PID 736 wrote to memory of 4384 736 lrrrrlf.exe 87 PID 736 wrote to memory of 4384 736 lrrrrlf.exe 87 PID 4384 wrote to memory of 3112 4384 bnnntb.exe 88 PID 4384 wrote to memory of 3112 4384 bnnntb.exe 88 PID 4384 wrote to memory of 3112 4384 bnnntb.exe 88 PID 3112 wrote to memory of 820 3112 7jdvp.exe 89 PID 3112 wrote to memory of 820 3112 7jdvp.exe 89 PID 3112 wrote to memory of 820 3112 7jdvp.exe 89 PID 820 wrote to memory of 1460 820 5ffrrll.exe 90 PID 820 wrote to memory of 1460 820 5ffrrll.exe 90 PID 820 wrote to memory of 1460 820 5ffrrll.exe 90 PID 1460 wrote to memory of 4272 1460 fllxrfx.exe 91 PID 1460 wrote to memory of 4272 1460 fllxrfx.exe 91 PID 1460 wrote to memory of 4272 1460 fllxrfx.exe 91 PID 4272 wrote to memory of 4824 4272 nhhbtn.exe 92 PID 4272 wrote to memory of 4824 4272 nhhbtn.exe 92 PID 4272 wrote to memory of 4824 4272 nhhbtn.exe 92 PID 4824 wrote to memory of 1416 4824 jdvpj.exe 93 PID 4824 wrote to memory of 1416 4824 jdvpj.exe 93 PID 4824 wrote to memory of 1416 4824 jdvpj.exe 93 PID 1416 wrote to memory of 1544 1416 9lfxllx.exe 94 PID 1416 wrote to memory of 1544 1416 9lfxllx.exe 94 PID 1416 wrote to memory of 1544 1416 9lfxllx.exe 94 PID 1544 wrote to memory of 2388 1544 tthbth.exe 95 PID 1544 wrote to memory of 2388 1544 tthbth.exe 95 PID 1544 wrote to memory of 2388 1544 tthbth.exe 95 PID 2388 wrote to memory of 4492 2388 pjdpj.exe 96 PID 2388 wrote to memory of 4492 2388 pjdpj.exe 96 PID 2388 wrote to memory of 4492 2388 pjdpj.exe 96 PID 4492 wrote to memory of 2072 4492 rfflflx.exe 97 PID 4492 wrote to memory of 2072 4492 rfflflx.exe 97 PID 4492 wrote to memory of 2072 4492 rfflflx.exe 97 PID 2072 wrote to memory of 5076 2072 thtbbn.exe 98 PID 2072 wrote to memory of 5076 2072 thtbbn.exe 98 PID 2072 wrote to memory of 5076 2072 thtbbn.exe 98 PID 5076 wrote to memory of 4852 5076 hbbbth.exe 99 PID 5076 wrote to memory of 4852 5076 hbbbth.exe 99 PID 5076 wrote to memory of 4852 5076 hbbbth.exe 99 PID 4852 wrote to memory of 1464 4852 djjdp.exe 100 PID 4852 wrote to memory of 1464 4852 djjdp.exe 100 PID 4852 wrote to memory of 1464 4852 djjdp.exe 100 PID 1464 wrote to memory of 684 1464 bbhbtb.exe 101 PID 1464 wrote to memory of 684 1464 bbhbtb.exe 101 PID 1464 wrote to memory of 684 1464 bbhbtb.exe 101 PID 684 wrote to memory of 5096 684 pdjdj.exe 102 PID 684 wrote to memory of 5096 684 pdjdj.exe 102 PID 684 wrote to memory of 5096 684 pdjdj.exe 102 PID 5096 wrote to memory of 1680 5096 dvpdp.exe 103 PID 5096 wrote to memory of 1680 5096 dvpdp.exe 103 PID 5096 wrote to memory of 1680 5096 dvpdp.exe 103 PID 1680 wrote to memory of 1384 1680 lxrxlfx.exe 104 PID 1680 wrote to memory of 1384 1680 lxrxlfx.exe 104 PID 1680 wrote to memory of 1384 1680 lxrxlfx.exe 104 PID 1384 wrote to memory of 2272 1384 9hthbt.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\9470bea50c62ee7f6a001a5b43c162dae9c1af6594cf12b8a541dc156b44d62eN.exe"C:\Users\Admin\AppData\Local\Temp\9470bea50c62ee7f6a001a5b43c162dae9c1af6594cf12b8a541dc156b44d62eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\jpvvv.exec:\jpvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\xffrfxl.exec:\xffrfxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\lrrrrlf.exec:\lrrrrlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\bnnntb.exec:\bnnntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\7jdvp.exec:\7jdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\5ffrrll.exec:\5ffrrll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\fllxrfx.exec:\fllxrfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\nhhbtn.exec:\nhhbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\jdvpj.exec:\jdvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\9lfxllx.exec:\9lfxllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\tthbth.exec:\tthbth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\pjdpj.exec:\pjdpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\rfflflx.exec:\rfflflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\thtbbn.exec:\thtbbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\hbbbth.exec:\hbbbth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\djjdp.exec:\djjdp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\bbhbtb.exec:\bbhbtb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\pdjdj.exec:\pdjdj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\dvpdp.exec:\dvpdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\lxrxlfx.exec:\lxrxlfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\9hthbt.exec:\9hthbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\5jpjj.exec:\5jpjj.exe23⤵
- Executes dropped EXE
PID:2272 -
\??\c:\5ffrfxr.exec:\5ffrfxr.exe24⤵
- Executes dropped EXE
PID:1208 -
\??\c:\lxfrlfl.exec:\lxfrlfl.exe25⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nhhtnh.exec:\nhhtnh.exe26⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ntnbhb.exec:\ntnbhb.exe27⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dpjvj.exec:\dpjvj.exe28⤵
- Executes dropped EXE
PID:1628 -
\??\c:\frflfxf.exec:\frflfxf.exe29⤵
- Executes dropped EXE
PID:456 -
\??\c:\tbbtnb.exec:\tbbtnb.exe30⤵
- Executes dropped EXE
PID:2912 -
\??\c:\bnhnbt.exec:\bnhnbt.exe31⤵
- Executes dropped EXE
PID:4316 -
\??\c:\vvpvp.exec:\vvpvp.exe32⤵
- Executes dropped EXE
PID:4960 -
\??\c:\ddpdv.exec:\ddpdv.exe33⤵
- Executes dropped EXE
PID:4532 -
\??\c:\9rfrxrf.exec:\9rfrxrf.exe34⤵
- Executes dropped EXE
PID:3932 -
\??\c:\htbbbt.exec:\htbbbt.exe35⤵
- Executes dropped EXE
PID:780 -
\??\c:\3bnbnh.exec:\3bnbnh.exe36⤵
- Executes dropped EXE
PID:4472 -
\??\c:\jddpd.exec:\jddpd.exe37⤵
- Executes dropped EXE
PID:4120 -
\??\c:\jdpjv.exec:\jdpjv.exe38⤵
- Executes dropped EXE
PID:2956 -
\??\c:\7rxllff.exec:\7rxllff.exe39⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ffflxlf.exec:\ffflxlf.exe40⤵
- Executes dropped EXE
PID:1516 -
\??\c:\7hhbnh.exec:\7hhbnh.exe41⤵
- Executes dropped EXE
PID:896 -
\??\c:\bbnnnt.exec:\bbnnnt.exe42⤵
- Executes dropped EXE
PID:4480 -
\??\c:\ddpvj.exec:\ddpvj.exe43⤵
- Executes dropped EXE
PID:4524 -
\??\c:\pvdjj.exec:\pvdjj.exe44⤵
- Executes dropped EXE
PID:3848 -
\??\c:\vdpvj.exec:\vdpvj.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\1rrlfxx.exec:\1rrlfxx.exe46⤵
- Executes dropped EXE
PID:1856 -
\??\c:\frxllff.exec:\frxllff.exe47⤵
- Executes dropped EXE
PID:3844 -
\??\c:\nbhtbt.exec:\nbhtbt.exe48⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7bhthb.exec:\7bhthb.exe49⤵
- Executes dropped EXE
PID:4800 -
\??\c:\vjjpd.exec:\vjjpd.exe50⤵
- Executes dropped EXE
PID:4984 -
\??\c:\vdpdp.exec:\vdpdp.exe51⤵
- Executes dropped EXE
PID:3984 -
\??\c:\3ffrxrx.exec:\3ffrxrx.exe52⤵
- Executes dropped EXE
PID:2940 -
\??\c:\hnnbhb.exec:\hnnbhb.exe53⤵
- Executes dropped EXE
PID:3112 -
\??\c:\vjpvv.exec:\vjpvv.exe54⤵
- Executes dropped EXE
PID:3116 -
\??\c:\ppppd.exec:\ppppd.exe55⤵
- Executes dropped EXE
PID:3020 -
\??\c:\frrflfr.exec:\frrflfr.exe56⤵
- Executes dropped EXE
PID:1804 -
\??\c:\frxxfxl.exec:\frxxfxl.exe57⤵
- Executes dropped EXE
PID:1760 -
\??\c:\tnthtb.exec:\tnthtb.exe58⤵
- Executes dropped EXE
PID:2016 -
\??\c:\bnhtbt.exec:\bnhtbt.exe59⤵
- Executes dropped EXE
PID:2900 -
\??\c:\3jvvd.exec:\3jvvd.exe60⤵
- Executes dropped EXE
PID:4824 -
\??\c:\7pjvd.exec:\7pjvd.exe61⤵
- Executes dropped EXE
PID:5040 -
\??\c:\rxlxxrl.exec:\rxlxxrl.exe62⤵
- Executes dropped EXE
PID:1416 -
\??\c:\lxrxlfx.exec:\lxrxlfx.exe63⤵
- Executes dropped EXE
PID:4616 -
\??\c:\btbbtb.exec:\btbbtb.exe64⤵
- Executes dropped EXE
PID:4592 -
\??\c:\nhhntn.exec:\nhhntn.exe65⤵
- Executes dropped EXE
PID:212 -
\??\c:\3pjdv.exec:\3pjdv.exe66⤵PID:2428
-
\??\c:\3jpjv.exec:\3jpjv.exe67⤵PID:3752
-
\??\c:\1xxlxrl.exec:\1xxlxrl.exe68⤵PID:1864
-
\??\c:\xrlflfr.exec:\xrlflfr.exe69⤵PID:2980
-
\??\c:\bnhnht.exec:\bnhnht.exe70⤵PID:5084
-
\??\c:\thhbth.exec:\thhbth.exe71⤵PID:4504
-
\??\c:\3vpjp.exec:\3vpjp.exe72⤵PID:1400
-
\??\c:\jddpj.exec:\jddpj.exe73⤵PID:4724
-
\??\c:\rfrflfr.exec:\rfrflfr.exe74⤵PID:4776
-
\??\c:\htbnnh.exec:\htbnnh.exe75⤵PID:804
-
\??\c:\thbtbt.exec:\thbtbt.exe76⤵PID:1680
-
\??\c:\hbtnbt.exec:\hbtnbt.exe77⤵PID:4160
-
\??\c:\dpjvj.exec:\dpjvj.exe78⤵PID:3748
-
\??\c:\pjvvj.exec:\pjvvj.exe79⤵PID:3472
-
\??\c:\xxrxlfr.exec:\xxrxlfr.exe80⤵PID:1740
-
\??\c:\frflrlx.exec:\frflrlx.exe81⤵PID:2024
-
\??\c:\hbtnht.exec:\hbtnht.exe82⤵PID:1392
-
\??\c:\thbtbb.exec:\thbtbb.exe83⤵PID:2320
-
\??\c:\djdpd.exec:\djdpd.exe84⤵PID:3264
-
\??\c:\ffflfll.exec:\ffflfll.exe85⤵PID:5044
-
\??\c:\frlxrlx.exec:\frlxrlx.exe86⤵PID:1628
-
\??\c:\lllxllx.exec:\lllxllx.exe87⤵PID:3328
-
\??\c:\hbttbh.exec:\hbttbh.exe88⤵PID:2912
-
\??\c:\9jdvj.exec:\9jdvj.exe89⤵PID:4496
-
\??\c:\dpjvd.exec:\dpjvd.exe90⤵PID:3968
-
\??\c:\rlxrxxl.exec:\rlxrxxl.exe91⤵PID:544
-
\??\c:\djvvv.exec:\djvvv.exe92⤵PID:4532
-
\??\c:\xlflxfx.exec:\xlflxfx.exe93⤵PID:5036
-
\??\c:\tnbhnb.exec:\tnbhnb.exe94⤵PID:3772
-
\??\c:\7hnhhb.exec:\7hnhhb.exe95⤵PID:64
-
\??\c:\ppjdv.exec:\ppjdv.exe96⤵PID:3088
-
\??\c:\vvjdp.exec:\vvjdp.exe97⤵PID:2336
-
\??\c:\xllxxll.exec:\xllxxll.exe98⤵PID:5060
-
\??\c:\3xfxflx.exec:\3xfxflx.exe99⤵PID:764
-
\??\c:\tbbtht.exec:\tbbtht.exe100⤵PID:1412
-
\??\c:\thhbtt.exec:\thhbtt.exe101⤵PID:728
-
\??\c:\ppvpv.exec:\ppvpv.exe102⤵PID:3964
-
\??\c:\5xrlxrl.exec:\5xrlxrl.exe103⤵PID:4464
-
\??\c:\rxrrffx.exec:\rxrrffx.exe104⤵PID:1284
-
\??\c:\5rffrrx.exec:\5rffrrx.exe105⤵PID:2028
-
\??\c:\thnttt.exec:\thnttt.exe106⤵PID:220
-
\??\c:\pvvvp.exec:\pvvvp.exe107⤵PID:4988
-
\??\c:\djpvv.exec:\djpvv.exe108⤵PID:3928
-
\??\c:\rffrlfr.exec:\rffrlfr.exe109⤵PID:4800
-
\??\c:\rlflfll.exec:\rlflfll.exe110⤵PID:4984
-
\??\c:\ntnbth.exec:\ntnbth.exe111⤵PID:3148
-
\??\c:\9hhbtt.exec:\9hhbtt.exe112⤵PID:3936
-
\??\c:\5jpdv.exec:\5jpdv.exe113⤵PID:1276
-
\??\c:\dvvpd.exec:\dvvpd.exe114⤵PID:3028
-
\??\c:\rlrlllr.exec:\rlrlllr.exe115⤵PID:3188
-
\??\c:\nhbbhh.exec:\nhbbhh.exe116⤵PID:1804
-
\??\c:\bthnht.exec:\bthnht.exe117⤵PID:3612
-
\??\c:\jdjdp.exec:\jdjdp.exe118⤵PID:1500
-
\??\c:\djvvv.exec:\djvvv.exe119⤵PID:2140
-
\??\c:\lrfrxrx.exec:\lrfrxrx.exe120⤵PID:4124
-
\??\c:\tbbhhb.exec:\tbbhhb.exe121⤵PID:3232
-
\??\c:\tntnhb.exec:\tntnhb.exe122⤵PID:1544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-