Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 05:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1b9d0c86b1cde64867c7df8a6c29a92cdcfb86d85ceba3a39008597efbb01bbbN.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
1b9d0c86b1cde64867c7df8a6c29a92cdcfb86d85ceba3a39008597efbb01bbbN.exe
-
Size
106KB
-
MD5
e6dceb99941d34b31538573e996a3800
-
SHA1
103ebedecf007811cfd6dc15fc61ac336d4dff97
-
SHA256
1b9d0c86b1cde64867c7df8a6c29a92cdcfb86d85ceba3a39008597efbb01bbb
-
SHA512
e6178bc236ee33c28ccf036323635f05602f2a89da47037cab06fe0c13dc79be521f4c3f2f0160ba38778195d2ecac512ebff47718cb94ef80e90f875a6e2b41
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+buwUGu3P3Cml:n3C9BRo7MlrWKVT+buBGu3PHl
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2708-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2708-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/992-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2916-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/612-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4164 frlxrlx.exe 220 nbthtn.exe 2356 htbnbt.exe 1820 lxrfxrf.exe 4980 1frlxrf.exe 3036 bbtnbt.exe 992 rffrlfx.exe 2916 bbbnhb.exe 4500 jvvjd.exe 768 llrfrlx.exe 3584 lrlfrlx.exe 4984 bnhtht.exe 1752 5ddvd.exe 4036 ppjdj.exe 612 vdjvj.exe 3768 dpdpd.exe 3308 xfrlxlx.exe 4404 1nhbnn.exe 3240 nntnhb.exe 2692 vvdpv.exe 4884 xfrlxlx.exe 4680 frxxlfr.exe 1952 7bbnbt.exe 3616 pvpjv.exe 4800 xxxlxrl.exe 1508 ntttnn.exe 4064 9hthbt.exe 4380 3dvpd.exe 3500 7xrlrlx.exe 2344 3nhbnh.exe 3452 jvpdp.exe 4908 vppdj.exe 1144 fxlxrlx.exe 1088 lxrlrlx.exe 4176 btbbbh.exe 1408 vdjvj.exe 2308 9pjdp.exe 4688 ffxflxf.exe 4316 1xlffxx.exe 428 nhbbnn.exe 4544 nnhbth.exe 468 jjvvj.exe 3720 pvvvj.exe 860 rllxrrl.exe 5016 nbntnn.exe 3352 bttnhh.exe 4420 jdjdp.exe 2136 7rxrlfx.exe 732 bhnnnn.exe 1552 pvvjj.exe 112 rrlxfxf.exe 1772 lrrfrfr.exe 1460 bntttt.exe 4916 nhnhtt.exe 4004 vvppj.exe 1056 xlrrxxr.exe 1004 tbnnnn.exe 808 htbbnb.exe 968 9jdvd.exe 4424 jvvjv.exe 2916 rlfrrlf.exe 4988 3hbnbt.exe 3920 hbthbt.exe 1392 vpvpd.exe -
resource yara_rule behavioral2/memory/2708-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2708-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/992-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/992-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2916-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2916-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2916-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2916-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/768-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/612-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-217-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfffrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlxrf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 4164 2708 1b9d0c86b1cde64867c7df8a6c29a92cdcfb86d85ceba3a39008597efbb01bbbN.exe 84 PID 2708 wrote to memory of 4164 2708 1b9d0c86b1cde64867c7df8a6c29a92cdcfb86d85ceba3a39008597efbb01bbbN.exe 84 PID 2708 wrote to memory of 4164 2708 1b9d0c86b1cde64867c7df8a6c29a92cdcfb86d85ceba3a39008597efbb01bbbN.exe 84 PID 4164 wrote to memory of 220 4164 frlxrlx.exe 85 PID 4164 wrote to memory of 220 4164 frlxrlx.exe 85 PID 4164 wrote to memory of 220 4164 frlxrlx.exe 85 PID 220 wrote to memory of 2356 220 nbthtn.exe 86 PID 220 wrote to memory of 2356 220 nbthtn.exe 86 PID 220 wrote to memory of 2356 220 nbthtn.exe 86 PID 2356 wrote to memory of 1820 2356 htbnbt.exe 87 PID 2356 wrote to memory of 1820 2356 htbnbt.exe 87 PID 2356 wrote to memory of 1820 2356 htbnbt.exe 87 PID 1820 wrote to memory of 4980 1820 lxrfxrf.exe 88 PID 1820 wrote to memory of 4980 1820 lxrfxrf.exe 88 PID 1820 wrote to memory of 4980 1820 lxrfxrf.exe 88 PID 4980 wrote to memory of 3036 4980 1frlxrf.exe 89 PID 4980 wrote to memory of 3036 4980 1frlxrf.exe 89 PID 4980 wrote to memory of 3036 4980 1frlxrf.exe 89 PID 3036 wrote to memory of 992 3036 bbtnbt.exe 90 PID 3036 wrote to memory of 992 3036 bbtnbt.exe 90 PID 3036 wrote to memory of 992 3036 bbtnbt.exe 90 PID 992 wrote to memory of 2916 992 rffrlfx.exe 91 PID 992 wrote to memory of 2916 992 rffrlfx.exe 91 PID 992 wrote to memory of 2916 992 rffrlfx.exe 91 PID 2916 wrote to memory of 4500 2916 bbbnhb.exe 92 PID 2916 wrote to memory of 4500 2916 bbbnhb.exe 92 PID 2916 wrote to memory of 4500 2916 bbbnhb.exe 92 PID 4500 wrote to memory of 768 4500 jvvjd.exe 93 PID 4500 wrote to memory of 768 4500 jvvjd.exe 93 PID 4500 wrote to memory of 768 4500 jvvjd.exe 93 PID 768 wrote to memory of 3584 768 llrfrlx.exe 94 PID 768 wrote to memory of 3584 768 llrfrlx.exe 94 PID 768 wrote to memory of 3584 768 llrfrlx.exe 94 PID 3584 wrote to memory of 4984 3584 lrlfrlx.exe 95 PID 3584 wrote to memory of 4984 3584 lrlfrlx.exe 95 PID 3584 wrote to memory of 4984 3584 lrlfrlx.exe 95 PID 4984 wrote to memory of 1752 4984 bnhtht.exe 96 PID 4984 wrote to memory of 1752 4984 bnhtht.exe 96 PID 4984 wrote to memory of 1752 4984 bnhtht.exe 96 PID 1752 wrote to memory of 4036 1752 5ddvd.exe 97 PID 1752 wrote to memory of 4036 1752 5ddvd.exe 97 PID 1752 wrote to memory of 4036 1752 5ddvd.exe 97 PID 4036 wrote to memory of 612 4036 ppjdj.exe 98 PID 4036 wrote to memory of 612 4036 ppjdj.exe 98 PID 4036 wrote to memory of 612 4036 ppjdj.exe 98 PID 612 wrote to memory of 3768 612 vdjvj.exe 99 PID 612 wrote to memory of 3768 612 vdjvj.exe 99 PID 612 wrote to memory of 3768 612 vdjvj.exe 99 PID 3768 wrote to memory of 3308 3768 dpdpd.exe 100 PID 3768 wrote to memory of 3308 3768 dpdpd.exe 100 PID 3768 wrote to memory of 3308 3768 dpdpd.exe 100 PID 3308 wrote to memory of 4404 3308 xfrlxlx.exe 101 PID 3308 wrote to memory of 4404 3308 xfrlxlx.exe 101 PID 3308 wrote to memory of 4404 3308 xfrlxlx.exe 101 PID 4404 wrote to memory of 3240 4404 1nhbnn.exe 102 PID 4404 wrote to memory of 3240 4404 1nhbnn.exe 102 PID 4404 wrote to memory of 3240 4404 1nhbnn.exe 102 PID 3240 wrote to memory of 2692 3240 nntnhb.exe 103 PID 3240 wrote to memory of 2692 3240 nntnhb.exe 103 PID 3240 wrote to memory of 2692 3240 nntnhb.exe 103 PID 2692 wrote to memory of 4884 2692 vvdpv.exe 104 PID 2692 wrote to memory of 4884 2692 vvdpv.exe 104 PID 2692 wrote to memory of 4884 2692 vvdpv.exe 104 PID 4884 wrote to memory of 4680 4884 xfrlxlx.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b9d0c86b1cde64867c7df8a6c29a92cdcfb86d85ceba3a39008597efbb01bbbN.exe"C:\Users\Admin\AppData\Local\Temp\1b9d0c86b1cde64867c7df8a6c29a92cdcfb86d85ceba3a39008597efbb01bbbN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\frlxrlx.exec:\frlxrlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\nbthtn.exec:\nbthtn.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\htbnbt.exec:\htbnbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\lxrfxrf.exec:\lxrfxrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\1frlxrf.exec:\1frlxrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\bbtnbt.exec:\bbtnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\rffrlfx.exec:\rffrlfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\bbbnhb.exec:\bbbnhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\jvvjd.exec:\jvvjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\llrfrlx.exec:\llrfrlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\lrlfrlx.exec:\lrlfrlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\bnhtht.exec:\bnhtht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\5ddvd.exec:\5ddvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\ppjdj.exec:\ppjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\vdjvj.exec:\vdjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\dpdpd.exec:\dpdpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\xfrlxlx.exec:\xfrlxlx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\1nhbnn.exec:\1nhbnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\nntnhb.exec:\nntnhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\vvdpv.exec:\vvdpv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\xfrlxlx.exec:\xfrlxlx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\frxxlfr.exec:\frxxlfr.exe23⤵
- Executes dropped EXE
PID:4680 -
\??\c:\7bbnbt.exec:\7bbnbt.exe24⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pvpjv.exec:\pvpjv.exe25⤵
- Executes dropped EXE
PID:3616 -
\??\c:\xxxlxrl.exec:\xxxlxrl.exe26⤵
- Executes dropped EXE
PID:4800 -
\??\c:\ntttnn.exec:\ntttnn.exe27⤵
- Executes dropped EXE
PID:1508 -
\??\c:\9hthbt.exec:\9hthbt.exe28⤵
- Executes dropped EXE
PID:4064 -
\??\c:\3dvpd.exec:\3dvpd.exe29⤵
- Executes dropped EXE
PID:4380 -
\??\c:\7xrlrlx.exec:\7xrlrlx.exe30⤵
- Executes dropped EXE
PID:3500 -
\??\c:\3nhbnh.exec:\3nhbnh.exe31⤵
- Executes dropped EXE
PID:2344 -
\??\c:\jvpdp.exec:\jvpdp.exe32⤵
- Executes dropped EXE
PID:3452 -
\??\c:\vppdj.exec:\vppdj.exe33⤵
- Executes dropped EXE
PID:4908 -
\??\c:\fxlxrlx.exec:\fxlxrlx.exe34⤵
- Executes dropped EXE
PID:1144 -
\??\c:\lxrlrlx.exec:\lxrlrlx.exe35⤵
- Executes dropped EXE
PID:1088 -
\??\c:\btbbbh.exec:\btbbbh.exe36⤵
- Executes dropped EXE
PID:4176 -
\??\c:\vdjvj.exec:\vdjvj.exe37⤵
- Executes dropped EXE
PID:1408 -
\??\c:\9pjdp.exec:\9pjdp.exe38⤵
- Executes dropped EXE
PID:2308 -
\??\c:\ffxflxf.exec:\ffxflxf.exe39⤵
- Executes dropped EXE
PID:4688 -
\??\c:\1xlffxx.exec:\1xlffxx.exe40⤵
- Executes dropped EXE
PID:4316 -
\??\c:\nhbbnn.exec:\nhbbnn.exe41⤵
- Executes dropped EXE
PID:428 -
\??\c:\nnhbth.exec:\nnhbth.exe42⤵
- Executes dropped EXE
PID:4544 -
\??\c:\jjvvj.exec:\jjvvj.exe43⤵
- Executes dropped EXE
PID:468 -
\??\c:\pvvvj.exec:\pvvvj.exe44⤵
- Executes dropped EXE
PID:3720 -
\??\c:\rllxrrl.exec:\rllxrrl.exe45⤵
- Executes dropped EXE
PID:860 -
\??\c:\nbntnn.exec:\nbntnn.exe46⤵
- Executes dropped EXE
PID:5016 -
\??\c:\bttnhh.exec:\bttnhh.exe47⤵
- Executes dropped EXE
PID:3352 -
\??\c:\jdjdp.exec:\jdjdp.exe48⤵
- Executes dropped EXE
PID:4420 -
\??\c:\7rxrlfx.exec:\7rxrlfx.exe49⤵
- Executes dropped EXE
PID:2136 -
\??\c:\bhnnnn.exec:\bhnnnn.exe50⤵
- Executes dropped EXE
PID:732 -
\??\c:\pvvjj.exec:\pvvjj.exe51⤵
- Executes dropped EXE
PID:1552 -
\??\c:\rrlxfxf.exec:\rrlxfxf.exe52⤵
- Executes dropped EXE
PID:112 -
\??\c:\lrrfrfr.exec:\lrrfrfr.exe53⤵
- Executes dropped EXE
PID:1772 -
\??\c:\bntttt.exec:\bntttt.exe54⤵
- Executes dropped EXE
PID:1460 -
\??\c:\nhnhtt.exec:\nhnhtt.exe55⤵
- Executes dropped EXE
PID:4916 -
\??\c:\vvppj.exec:\vvppj.exe56⤵
- Executes dropped EXE
PID:4004 -
\??\c:\xlrrxxr.exec:\xlrrxxr.exe57⤵
- Executes dropped EXE
PID:1056 -
\??\c:\tbnnnn.exec:\tbnnnn.exe58⤵
- Executes dropped EXE
PID:1004 -
\??\c:\htbbnb.exec:\htbbnb.exe59⤵
- Executes dropped EXE
PID:808 -
\??\c:\9jdvd.exec:\9jdvd.exe60⤵
- Executes dropped EXE
PID:968 -
\??\c:\jvvjv.exec:\jvvjv.exe61⤵
- Executes dropped EXE
PID:4424 -
\??\c:\rlfrrlf.exec:\rlfrrlf.exe62⤵
- Executes dropped EXE
PID:2916 -
\??\c:\3hbnbt.exec:\3hbnbt.exe63⤵
- Executes dropped EXE
PID:4988 -
\??\c:\hbthbt.exec:\hbthbt.exe64⤵
- Executes dropped EXE
PID:3920 -
\??\c:\vpvpd.exec:\vpvpd.exe65⤵
- Executes dropped EXE
PID:1392 -
\??\c:\frxxlrr.exec:\frxxlrr.exe66⤵PID:3584
-
\??\c:\xrrrlrl.exec:\xrrrlrl.exe67⤵PID:4808
-
\??\c:\3hhbbb.exec:\3hhbbb.exe68⤵PID:912
-
\??\c:\nbnnbb.exec:\nbnnbb.exe69⤵PID:1752
-
\??\c:\vpvpp.exec:\vpvpp.exe70⤵PID:3120
-
\??\c:\xrxfxff.exec:\xrxfxff.exe71⤵PID:4880
-
\??\c:\5fllfll.exec:\5fllfll.exe72⤵PID:2252
-
\??\c:\bhhthb.exec:\bhhthb.exe73⤵PID:1680
-
\??\c:\vpjdj.exec:\vpjdj.exe74⤵PID:4276
-
\??\c:\pdddd.exec:\pdddd.exe75⤵PID:4404
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe76⤵PID:2480
-
\??\c:\jpddj.exec:\jpddj.exe77⤵PID:1904
-
\??\c:\rffxrrl.exec:\rffxrrl.exe78⤵PID:4616
-
\??\c:\5tbttn.exec:\5tbttn.exe79⤵PID:3224
-
\??\c:\hhhntt.exec:\hhhntt.exe80⤵PID:2380
-
\??\c:\ppjvj.exec:\ppjvj.exe81⤵PID:388
-
\??\c:\dpjvj.exec:\dpjvj.exe82⤵PID:3572
-
\??\c:\5xrrfll.exec:\5xrrfll.exe83⤵PID:2804
-
\??\c:\lxxlfrl.exec:\lxxlfrl.exe84⤵PID:4060
-
\??\c:\bnnhnn.exec:\bnnhnn.exe85⤵PID:3228
-
\??\c:\djjvj.exec:\djjvj.exe86⤵PID:4032
-
\??\c:\pjjvd.exec:\pjjvd.exe87⤵PID:3140
-
\??\c:\lxllxxr.exec:\lxllxxr.exe88⤵PID:4664
-
\??\c:\rfrfrlx.exec:\rfrfrlx.exe89⤵PID:2376
-
\??\c:\9tttnt.exec:\9tttnt.exe90⤵PID:2668
-
\??\c:\htnbnh.exec:\htnbnh.exe91⤵PID:2344
-
\??\c:\vdjdj.exec:\vdjdj.exe92⤵PID:3452
-
\??\c:\5lxrxlx.exec:\5lxrxlx.exe93⤵PID:4908
-
\??\c:\rrlffxl.exec:\rrlffxl.exe94⤵PID:3696
-
\??\c:\3htnbt.exec:\3htnbt.exe95⤵PID:1088
-
\??\c:\1hnhbh.exec:\1hnhbh.exe96⤵PID:3844
-
\??\c:\7vvjv.exec:\7vvjv.exe97⤵PID:4928
-
\??\c:\9ffxxrl.exec:\9ffxxrl.exe98⤵PID:4300
-
\??\c:\fxffrrx.exec:\fxffrrx.exe99⤵PID:2980
-
\??\c:\1hhbtt.exec:\1hhbtt.exe100⤵PID:1400
-
\??\c:\djpjd.exec:\djpjd.exe101⤵PID:2264
-
\??\c:\9djdp.exec:\9djdp.exe102⤵PID:4544
-
\??\c:\rrffrff.exec:\rrffrff.exe103⤵PID:468
-
\??\c:\lflxxxx.exec:\lflxxxx.exe104⤵PID:3220
-
\??\c:\ttnbtb.exec:\ttnbtb.exe105⤵PID:860
-
\??\c:\hhhbtt.exec:\hhhbtt.exe106⤵PID:2100
-
\??\c:\pdjdv.exec:\pdjdv.exe107⤵PID:3712
-
\??\c:\lfrrxfr.exec:\lfrrxfr.exe108⤵PID:4164
-
\??\c:\flrrlll.exec:\flrrlll.exe109⤵PID:3552
-
\??\c:\nbttnb.exec:\nbttnb.exe110⤵PID:4048
-
\??\c:\dvjvd.exec:\dvjvd.exe111⤵PID:4480
-
\??\c:\pjpdp.exec:\pjpdp.exe112⤵PID:2356
-
\??\c:\fllllff.exec:\fllllff.exe113⤵PID:2736
-
\??\c:\lfllfff.exec:\lfllfff.exe114⤵PID:4936
-
\??\c:\7bttnh.exec:\7bttnh.exe115⤵PID:4004
-
\??\c:\nbnhhb.exec:\nbnhhb.exe116⤵PID:1056
-
\??\c:\dvvpp.exec:\dvvpp.exe117⤵PID:5028
-
\??\c:\xxxlxrl.exec:\xxxlxrl.exe118⤵PID:2108
-
\??\c:\lllrllr.exec:\lllrllr.exe119⤵PID:968
-
\??\c:\tnnhbt.exec:\tnnhbt.exe120⤵PID:4424
-
\??\c:\hnbnhn.exec:\hnbnhn.exe121⤵PID:2916
-
\??\c:\vjvpd.exec:\vjvpd.exe122⤵PID:4728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-