Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 07:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f3050556116b8a99d1fbde889088978c47303b6e625d9c31cb22f1bcb4095615N.exe
Resource
win7-20240729-en
6 signatures
120 seconds
General
-
Target
f3050556116b8a99d1fbde889088978c47303b6e625d9c31cb22f1bcb4095615N.exe
-
Size
71KB
-
MD5
55096184828f3eed2f75fa05d41decd0
-
SHA1
a1ecd7da441e09e9ae04d933c32a6904f6143be9
-
SHA256
f3050556116b8a99d1fbde889088978c47303b6e625d9c31cb22f1bcb4095615
-
SHA512
7aaf51ebcb372889a80ad0d41d415294177a25814cd6baca5dbcdf960fe066e7f47f46c5584ce9c01d45a0dea3986119910e966b8d43ea494cb89c2fca4b567a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjX:ymb3NkkiQ3mdBjFI4Vn
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/1668-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1868-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/916-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3804-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2252-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1672-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1912 ntnhbb.exe 3012 dpvdd.exe 1868 1xrffxl.exe 3028 nbhbbt.exe 624 djvvj.exe 4528 lrlfxrl.exe 2308 tnhhbn.exe 4912 djvpd.exe 376 rrxrxxl.exe 4664 rxlrlfr.exe 3892 ntbtht.exe 916 ppjpd.exe 728 lxlfxrf.exe 3804 xrxlfxr.exe 4964 9tnhtn.exe 2236 vpdvp.exe 2252 jpjvp.exe 2644 flrrxrx.exe 1064 nhnbnh.exe 1136 1ffflfr.exe 2260 nbnbtn.exe 3068 dvjdv.exe 3812 frfxfxf.exe 2900 9hhhnh.exe 872 hbhtbt.exe 4768 dddpj.exe 3936 rxxllfx.exe 2256 rllfxrr.exe 1672 nhhhbt.exe 1988 hbnhtn.exe 2928 jpdjp.exe 3400 dpppd.exe 5092 xlfrfxr.exe 5024 tthhhb.exe 3900 jppdp.exe 4524 vdjjj.exe 4692 fxfrffx.exe 1092 fxlffxx.exe 4824 pjddd.exe 3288 dvdvp.exe 1852 5rrlffx.exe 4000 nbhbbb.exe 2360 hntnnn.exe 4920 ddpvv.exe 3300 pjvpj.exe 1504 xllflfl.exe 2672 hbnnhb.exe 3780 htbttt.exe 4396 dvdvp.exe 3744 vpjjd.exe 1416 flrlfff.exe 2716 lfxxllx.exe 3948 bbnnhh.exe 1164 dvvpp.exe 1772 vjjpj.exe 2308 5xrxlxr.exe 1796 xrxxxxr.exe 4404 hthbbt.exe 4760 hhhbtn.exe 3776 djvdp.exe 4780 dppdd.exe 4632 xflfrrl.exe 3020 lfllrxf.exe 1780 ntnbtt.exe -
resource yara_rule behavioral2/memory/1668-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1868-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/916-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3804-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1136-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-215-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tbhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1668 wrote to memory of 1912 1668 f3050556116b8a99d1fbde889088978c47303b6e625d9c31cb22f1bcb4095615N.exe 85 PID 1668 wrote to memory of 1912 1668 f3050556116b8a99d1fbde889088978c47303b6e625d9c31cb22f1bcb4095615N.exe 85 PID 1668 wrote to memory of 1912 1668 f3050556116b8a99d1fbde889088978c47303b6e625d9c31cb22f1bcb4095615N.exe 85 PID 1912 wrote to memory of 3012 1912 ntnhbb.exe 86 PID 1912 wrote to memory of 3012 1912 ntnhbb.exe 86 PID 1912 wrote to memory of 3012 1912 ntnhbb.exe 86 PID 3012 wrote to memory of 1868 3012 dpvdd.exe 87 PID 3012 wrote to memory of 1868 3012 dpvdd.exe 87 PID 3012 wrote to memory of 1868 3012 dpvdd.exe 87 PID 1868 wrote to memory of 3028 1868 1xrffxl.exe 88 PID 1868 wrote to memory of 3028 1868 1xrffxl.exe 88 PID 1868 wrote to memory of 3028 1868 1xrffxl.exe 88 PID 3028 wrote to memory of 624 3028 nbhbbt.exe 89 PID 3028 wrote to memory of 624 3028 nbhbbt.exe 89 PID 3028 wrote to memory of 624 3028 nbhbbt.exe 89 PID 624 wrote to memory of 4528 624 djvvj.exe 90 PID 624 wrote to memory of 4528 624 djvvj.exe 90 PID 624 wrote to memory of 4528 624 djvvj.exe 90 PID 4528 wrote to memory of 2308 4528 lrlfxrl.exe 91 PID 4528 wrote to memory of 2308 4528 lrlfxrl.exe 91 PID 4528 wrote to memory of 2308 4528 lrlfxrl.exe 91 PID 2308 wrote to memory of 4912 2308 tnhhbn.exe 92 PID 2308 wrote to memory of 4912 2308 tnhhbn.exe 92 PID 2308 wrote to memory of 4912 2308 tnhhbn.exe 92 PID 4912 wrote to memory of 376 4912 djvpd.exe 93 PID 4912 wrote to memory of 376 4912 djvpd.exe 93 PID 4912 wrote to memory of 376 4912 djvpd.exe 93 PID 376 wrote to memory of 4664 376 rrxrxxl.exe 94 PID 376 wrote to memory of 4664 376 rrxrxxl.exe 94 PID 376 wrote to memory of 4664 376 rrxrxxl.exe 94 PID 4664 wrote to memory of 3892 4664 rxlrlfr.exe 95 PID 4664 wrote to memory of 3892 4664 rxlrlfr.exe 95 PID 4664 wrote to memory of 3892 4664 rxlrlfr.exe 95 PID 3892 wrote to memory of 916 3892 ntbtht.exe 96 PID 3892 wrote to memory of 916 3892 ntbtht.exe 96 PID 3892 wrote to memory of 916 3892 ntbtht.exe 96 PID 916 wrote to memory of 728 916 ppjpd.exe 97 PID 916 wrote to memory of 728 916 ppjpd.exe 97 PID 916 wrote to memory of 728 916 ppjpd.exe 97 PID 728 wrote to memory of 3804 728 lxlfxrf.exe 98 PID 728 wrote to memory of 3804 728 lxlfxrf.exe 98 PID 728 wrote to memory of 3804 728 lxlfxrf.exe 98 PID 3804 wrote to memory of 4964 3804 xrxlfxr.exe 99 PID 3804 wrote to memory of 4964 3804 xrxlfxr.exe 99 PID 3804 wrote to memory of 4964 3804 xrxlfxr.exe 99 PID 4964 wrote to memory of 2236 4964 9tnhtn.exe 100 PID 4964 wrote to memory of 2236 4964 9tnhtn.exe 100 PID 4964 wrote to memory of 2236 4964 9tnhtn.exe 100 PID 2236 wrote to memory of 2252 2236 vpdvp.exe 101 PID 2236 wrote to memory of 2252 2236 vpdvp.exe 101 PID 2236 wrote to memory of 2252 2236 vpdvp.exe 101 PID 2252 wrote to memory of 2644 2252 jpjvp.exe 102 PID 2252 wrote to memory of 2644 2252 jpjvp.exe 102 PID 2252 wrote to memory of 2644 2252 jpjvp.exe 102 PID 2644 wrote to memory of 1064 2644 flrrxrx.exe 103 PID 2644 wrote to memory of 1064 2644 flrrxrx.exe 103 PID 2644 wrote to memory of 1064 2644 flrrxrx.exe 103 PID 1064 wrote to memory of 1136 1064 nhnbnh.exe 104 PID 1064 wrote to memory of 1136 1064 nhnbnh.exe 104 PID 1064 wrote to memory of 1136 1064 nhnbnh.exe 104 PID 1136 wrote to memory of 2260 1136 1ffflfr.exe 105 PID 1136 wrote to memory of 2260 1136 1ffflfr.exe 105 PID 1136 wrote to memory of 2260 1136 1ffflfr.exe 105 PID 2260 wrote to memory of 3068 2260 nbnbtn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3050556116b8a99d1fbde889088978c47303b6e625d9c31cb22f1bcb4095615N.exe"C:\Users\Admin\AppData\Local\Temp\f3050556116b8a99d1fbde889088978c47303b6e625d9c31cb22f1bcb4095615N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\ntnhbb.exec:\ntnhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\dpvdd.exec:\dpvdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\1xrffxl.exec:\1xrffxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\nbhbbt.exec:\nbhbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\djvvj.exec:\djvvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\lrlfxrl.exec:\lrlfxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\tnhhbn.exec:\tnhhbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\djvpd.exec:\djvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\rrxrxxl.exec:\rrxrxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\rxlrlfr.exec:\rxlrlfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\ntbtht.exec:\ntbtht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\ppjpd.exec:\ppjpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\lxlfxrf.exec:\lxlfxrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\xrxlfxr.exec:\xrxlfxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\9tnhtn.exec:\9tnhtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\vpdvp.exec:\vpdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\jpjvp.exec:\jpjvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\flrrxrx.exec:\flrrxrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\nhnbnh.exec:\nhnbnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\1ffflfr.exec:\1ffflfr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\nbnbtn.exec:\nbnbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\dvjdv.exec:\dvjdv.exe23⤵
- Executes dropped EXE
PID:3068 -
\??\c:\frfxfxf.exec:\frfxfxf.exe24⤵
- Executes dropped EXE
PID:3812 -
\??\c:\9hhhnh.exec:\9hhhnh.exe25⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hbhtbt.exec:\hbhtbt.exe26⤵
- Executes dropped EXE
PID:872 -
\??\c:\dddpj.exec:\dddpj.exe27⤵
- Executes dropped EXE
PID:4768 -
\??\c:\rxxllfx.exec:\rxxllfx.exe28⤵
- Executes dropped EXE
PID:3936 -
\??\c:\rllfxrr.exec:\rllfxrr.exe29⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nhhhbt.exec:\nhhhbt.exe30⤵
- Executes dropped EXE
PID:1672 -
\??\c:\hbnhtn.exec:\hbnhtn.exe31⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jpdjp.exec:\jpdjp.exe32⤵
- Executes dropped EXE
PID:2928 -
\??\c:\dpppd.exec:\dpppd.exe33⤵
- Executes dropped EXE
PID:3400 -
\??\c:\xlfrfxr.exec:\xlfrfxr.exe34⤵
- Executes dropped EXE
PID:5092 -
\??\c:\tthhhb.exec:\tthhhb.exe35⤵
- Executes dropped EXE
PID:5024 -
\??\c:\jppdp.exec:\jppdp.exe36⤵
- Executes dropped EXE
PID:3900 -
\??\c:\vdjjj.exec:\vdjjj.exe37⤵
- Executes dropped EXE
PID:4524 -
\??\c:\fxfrffx.exec:\fxfrffx.exe38⤵
- Executes dropped EXE
PID:4692 -
\??\c:\fxlffxx.exec:\fxlffxx.exe39⤵
- Executes dropped EXE
PID:1092 -
\??\c:\pjddd.exec:\pjddd.exe40⤵
- Executes dropped EXE
PID:4824 -
\??\c:\dvdvp.exec:\dvdvp.exe41⤵
- Executes dropped EXE
PID:3288 -
\??\c:\5rrlffx.exec:\5rrlffx.exe42⤵
- Executes dropped EXE
PID:1852 -
\??\c:\nbhbbb.exec:\nbhbbb.exe43⤵
- Executes dropped EXE
PID:4000 -
\??\c:\hntnnn.exec:\hntnnn.exe44⤵
- Executes dropped EXE
PID:2360 -
\??\c:\ddpvv.exec:\ddpvv.exe45⤵
- Executes dropped EXE
PID:4920 -
\??\c:\pjvpj.exec:\pjvpj.exe46⤵
- Executes dropped EXE
PID:3300 -
\??\c:\xllflfl.exec:\xllflfl.exe47⤵
- Executes dropped EXE
PID:1504 -
\??\c:\hbnnhb.exec:\hbnnhb.exe48⤵
- Executes dropped EXE
PID:2672 -
\??\c:\htbttt.exec:\htbttt.exe49⤵
- Executes dropped EXE
PID:3780 -
\??\c:\dvdvp.exec:\dvdvp.exe50⤵
- Executes dropped EXE
PID:4396 -
\??\c:\vpjjd.exec:\vpjjd.exe51⤵
- Executes dropped EXE
PID:3744 -
\??\c:\flrlfff.exec:\flrlfff.exe52⤵
- Executes dropped EXE
PID:1416 -
\??\c:\lfxxllx.exec:\lfxxllx.exe53⤵
- Executes dropped EXE
PID:2716 -
\??\c:\bbnnhh.exec:\bbnnhh.exe54⤵
- Executes dropped EXE
PID:3948 -
\??\c:\dvvpp.exec:\dvvpp.exe55⤵
- Executes dropped EXE
PID:1164 -
\??\c:\vjjpj.exec:\vjjpj.exe56⤵
- Executes dropped EXE
PID:1772 -
\??\c:\5xrxlxr.exec:\5xrxlxr.exe57⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xrxxxxr.exec:\xrxxxxr.exe58⤵
- Executes dropped EXE
PID:1796 -
\??\c:\hthbbt.exec:\hthbbt.exe59⤵
- Executes dropped EXE
PID:4404 -
\??\c:\hhhbtn.exec:\hhhbtn.exe60⤵
- Executes dropped EXE
PID:4760 -
\??\c:\djvdp.exec:\djvdp.exe61⤵
- Executes dropped EXE
PID:3776 -
\??\c:\dppdd.exec:\dppdd.exe62⤵
- Executes dropped EXE
PID:4780 -
\??\c:\xflfrrl.exec:\xflfrrl.exe63⤵
- Executes dropped EXE
PID:4632 -
\??\c:\lfllrxf.exec:\lfllrxf.exe64⤵
- Executes dropped EXE
PID:3020 -
\??\c:\ntnbtt.exec:\ntnbtt.exe65⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nnhhbb.exec:\nnhhbb.exe66⤵PID:220
-
\??\c:\pvdvj.exec:\pvdvj.exe67⤵PID:1320
-
\??\c:\9jpjp.exec:\9jpjp.exe68⤵PID:848
-
\??\c:\9xxlxrl.exec:\9xxlxrl.exe69⤵PID:4484
-
\??\c:\3xrlrrl.exec:\3xrlrrl.exe70⤵PID:116
-
\??\c:\tntnbb.exec:\tntnbb.exe71⤵PID:3252
-
\??\c:\tnbbbb.exec:\tnbbbb.exe72⤵PID:2252
-
\??\c:\vpvpd.exec:\vpvpd.exe73⤵PID:2424
-
\??\c:\lrfffrx.exec:\lrfffrx.exe74⤵PID:3308
-
\??\c:\3fllrrf.exec:\3fllrrf.exe75⤵PID:1192
-
\??\c:\nhttbb.exec:\nhttbb.exe76⤵PID:4300
-
\??\c:\btbbhb.exec:\btbbhb.exe77⤵PID:2260
-
\??\c:\9ppdp.exec:\9ppdp.exe78⤵PID:3268
-
\??\c:\pjjvp.exec:\pjjvp.exe79⤵PID:3812
-
\??\c:\flrlxxr.exec:\flrlxxr.exe80⤵PID:4068
-
\??\c:\nbbtbn.exec:\nbbtbn.exe81⤵PID:2108
-
\??\c:\hbhbnt.exec:\hbhbnt.exe82⤵PID:2216
-
\??\c:\dvpvd.exec:\dvpvd.exe83⤵PID:2512
-
\??\c:\nhbthh.exec:\nhbthh.exe84⤵PID:4224
-
\??\c:\jjdvp.exec:\jjdvp.exe85⤵PID:1344
-
\??\c:\jdvvp.exec:\jdvvp.exe86⤵PID:1080
-
\??\c:\lxxlxxr.exec:\lxxlxxr.exe87⤵PID:4120
-
\??\c:\hnnnbn.exec:\hnnnbn.exe88⤵PID:1988
-
\??\c:\9bttht.exec:\9bttht.exe89⤵PID:1596
-
\??\c:\5djjp.exec:\5djjp.exe90⤵PID:2312
-
\??\c:\llfxffl.exec:\llfxffl.exe91⤵PID:2204
-
\??\c:\llfxrll.exec:\llfxrll.exe92⤵PID:5024
-
\??\c:\ntbtnn.exec:\ntbtnn.exe93⤵PID:4868
-
\??\c:\tnbthh.exec:\tnbthh.exe94⤵PID:4056
-
\??\c:\9dvvp.exec:\9dvvp.exe95⤵PID:3820
-
\??\c:\djvpd.exec:\djvpd.exe96⤵PID:1092
-
\??\c:\xrxrflf.exec:\xrxrflf.exe97⤵PID:1784
-
\??\c:\xffrrll.exec:\xffrrll.exe98⤵PID:3288
-
\??\c:\tbhbtn.exec:\tbhbtn.exe99⤵PID:1852
-
\??\c:\btnnbb.exec:\btnnbb.exe100⤵PID:716
-
\??\c:\pjjdd.exec:\pjjdd.exe101⤵PID:1036
-
\??\c:\jdddp.exec:\jdddp.exe102⤵PID:3296
-
\??\c:\xrllxxf.exec:\xrllxxf.exe103⤵PID:1844
-
\??\c:\tnbnbn.exec:\tnbnbn.exe104⤵PID:1504
-
\??\c:\tntnbb.exec:\tntnbb.exe105⤵PID:2516
-
\??\c:\jdddv.exec:\jdddv.exe106⤵PID:1868
-
\??\c:\fxxrxxf.exec:\fxxrxxf.exe107⤵PID:1272
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe108⤵PID:3028
-
\??\c:\nbbnhn.exec:\nbbnhn.exe109⤵PID:4192
-
\??\c:\vdpdv.exec:\vdpdv.exe110⤵PID:2588
-
\??\c:\5pvvj.exec:\5pvvj.exe111⤵PID:1464
-
\??\c:\frrrlff.exec:\frrrlff.exe112⤵PID:2068
-
\??\c:\lfxrllf.exec:\lfxrllf.exe113⤵PID:4840
-
\??\c:\bnttnn.exec:\bnttnn.exe114⤵PID:3848
-
\??\c:\tbbnhh.exec:\tbbnhh.exe115⤵PID:4912
-
\??\c:\dvvvj.exec:\dvvvj.exe116⤵PID:4584
-
\??\c:\1lrlxff.exec:\1lrlxff.exe117⤵PID:3808
-
\??\c:\xrlrrrl.exec:\xrlrrrl.exe118⤵PID:4664
-
\??\c:\tnhhbb.exec:\tnhhbb.exe119⤵PID:4520
-
\??\c:\pdjjd.exec:\pdjjd.exe120⤵PID:4872
-
\??\c:\9pjjv.exec:\9pjjv.exe121⤵PID:4140
-
\??\c:\rfxrfff.exec:\rfxrfff.exe122⤵PID:4880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-