Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 04:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20195c446f196b9c432711fd9a43afa030d6fef2592c118a917263a837a5f90dN.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
20195c446f196b9c432711fd9a43afa030d6fef2592c118a917263a837a5f90dN.exe
-
Size
58KB
-
MD5
3ba6e13019fc9c7e00737011b0121900
-
SHA1
5bc364daad008097fd6e7fec5696b61e792fca30
-
SHA256
20195c446f196b9c432711fd9a43afa030d6fef2592c118a917263a837a5f90d
-
SHA512
75cd641f503c5ab2654104089815354bce0e84c5bfa1dc272ffa5c62bf90920f5242453741800395872ffcc98208b87d55f533353da12241347fc0ee798f0f70
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFY3k:ymb3NkkiQ3mdBjFIFWk
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/1604-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/848-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3800-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4536 pddvp.exe 848 xflfxxx.exe 2104 hbtnhb.exe 2528 djdvj.exe 3452 ppjvp.exe 1432 htbbhb.exe 2272 jvpjv.exe 4948 pjpvj.exe 3968 lflfffx.exe 2416 vpdvp.exe 3144 ppvpv.exe 4400 lxrlffx.exe 3700 nhbnbb.exe 4088 5ntnnn.exe 4852 dvvpj.exe 3924 9llfxxr.exe 3272 bbtnbt.exe 4720 hbnthb.exe 3256 pjdvj.exe 3800 rllfxrx.exe 4372 9btnbt.exe 212 dvvpj.exe 4596 dpvpd.exe 4532 5rxlxrx.exe 316 1hbtnn.exe 4704 5dvjv.exe 392 jppdp.exe 1816 frlfffx.exe 3672 btbtnh.exe 4872 7jpjj.exe 2880 flrfrlx.exe 540 rffxlrf.exe 3676 tbtnhb.exe 3876 7jjdv.exe 2068 pdjdd.exe 4216 rlfxrlf.exe 1028 9rrlfxr.exe 1740 3hnhnh.exe 4556 vvvpv.exe 4132 jdvvd.exe 1604 rrrrlfx.exe 3904 hthhhh.exe 4020 thnbhh.exe 4512 pjdvj.exe 2104 jdjdv.exe 1724 xlllfxr.exe 1016 9hhbtt.exe 4528 bhnttn.exe 2552 jdjjv.exe 2192 xlffxlf.exe 2704 nbbtnh.exe 1940 bbbnnn.exe 4572 vvdpd.exe 3344 lxfxrrr.exe 3144 tntttn.exe 3120 bbhtbt.exe 2144 dvpjj.exe 4088 rrlfffr.exe 1348 bnhbtt.exe 804 hbtntt.exe 2760 vjjdd.exe 4324 xxfrlfx.exe 4868 rfrxxlf.exe 3528 9bbtnn.exe -
resource yara_rule behavioral2/memory/1604-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/848-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3800-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1604 wrote to memory of 4536 1604 20195c446f196b9c432711fd9a43afa030d6fef2592c118a917263a837a5f90dN.exe 83 PID 1604 wrote to memory of 4536 1604 20195c446f196b9c432711fd9a43afa030d6fef2592c118a917263a837a5f90dN.exe 83 PID 1604 wrote to memory of 4536 1604 20195c446f196b9c432711fd9a43afa030d6fef2592c118a917263a837a5f90dN.exe 83 PID 4536 wrote to memory of 848 4536 pddvp.exe 84 PID 4536 wrote to memory of 848 4536 pddvp.exe 84 PID 4536 wrote to memory of 848 4536 pddvp.exe 84 PID 848 wrote to memory of 2104 848 xflfxxx.exe 85 PID 848 wrote to memory of 2104 848 xflfxxx.exe 85 PID 848 wrote to memory of 2104 848 xflfxxx.exe 85 PID 2104 wrote to memory of 2528 2104 hbtnhb.exe 86 PID 2104 wrote to memory of 2528 2104 hbtnhb.exe 86 PID 2104 wrote to memory of 2528 2104 hbtnhb.exe 86 PID 2528 wrote to memory of 3452 2528 djdvj.exe 88 PID 2528 wrote to memory of 3452 2528 djdvj.exe 88 PID 2528 wrote to memory of 3452 2528 djdvj.exe 88 PID 3452 wrote to memory of 1432 3452 ppjvp.exe 89 PID 3452 wrote to memory of 1432 3452 ppjvp.exe 89 PID 3452 wrote to memory of 1432 3452 ppjvp.exe 89 PID 1432 wrote to memory of 2272 1432 htbbhb.exe 90 PID 1432 wrote to memory of 2272 1432 htbbhb.exe 90 PID 1432 wrote to memory of 2272 1432 htbbhb.exe 90 PID 2272 wrote to memory of 4948 2272 jvpjv.exe 91 PID 2272 wrote to memory of 4948 2272 jvpjv.exe 91 PID 2272 wrote to memory of 4948 2272 jvpjv.exe 91 PID 4948 wrote to memory of 3968 4948 pjpvj.exe 92 PID 4948 wrote to memory of 3968 4948 pjpvj.exe 92 PID 4948 wrote to memory of 3968 4948 pjpvj.exe 92 PID 3968 wrote to memory of 2416 3968 lflfffx.exe 94 PID 3968 wrote to memory of 2416 3968 lflfffx.exe 94 PID 3968 wrote to memory of 2416 3968 lflfffx.exe 94 PID 2416 wrote to memory of 3144 2416 vpdvp.exe 95 PID 2416 wrote to memory of 3144 2416 vpdvp.exe 95 PID 2416 wrote to memory of 3144 2416 vpdvp.exe 95 PID 3144 wrote to memory of 4400 3144 ppvpv.exe 96 PID 3144 wrote to memory of 4400 3144 ppvpv.exe 96 PID 3144 wrote to memory of 4400 3144 ppvpv.exe 96 PID 4400 wrote to memory of 3700 4400 lxrlffx.exe 97 PID 4400 wrote to memory of 3700 4400 lxrlffx.exe 97 PID 4400 wrote to memory of 3700 4400 lxrlffx.exe 97 PID 3700 wrote to memory of 4088 3700 nhbnbb.exe 98 PID 3700 wrote to memory of 4088 3700 nhbnbb.exe 98 PID 3700 wrote to memory of 4088 3700 nhbnbb.exe 98 PID 4088 wrote to memory of 4852 4088 5ntnnn.exe 99 PID 4088 wrote to memory of 4852 4088 5ntnnn.exe 99 PID 4088 wrote to memory of 4852 4088 5ntnnn.exe 99 PID 4852 wrote to memory of 3924 4852 dvvpj.exe 100 PID 4852 wrote to memory of 3924 4852 dvvpj.exe 100 PID 4852 wrote to memory of 3924 4852 dvvpj.exe 100 PID 3924 wrote to memory of 3272 3924 9llfxxr.exe 101 PID 3924 wrote to memory of 3272 3924 9llfxxr.exe 101 PID 3924 wrote to memory of 3272 3924 9llfxxr.exe 101 PID 3272 wrote to memory of 4720 3272 bbtnbt.exe 102 PID 3272 wrote to memory of 4720 3272 bbtnbt.exe 102 PID 3272 wrote to memory of 4720 3272 bbtnbt.exe 102 PID 4720 wrote to memory of 3256 4720 hbnthb.exe 103 PID 4720 wrote to memory of 3256 4720 hbnthb.exe 103 PID 4720 wrote to memory of 3256 4720 hbnthb.exe 103 PID 3256 wrote to memory of 3800 3256 pjdvj.exe 105 PID 3256 wrote to memory of 3800 3256 pjdvj.exe 105 PID 3256 wrote to memory of 3800 3256 pjdvj.exe 105 PID 3800 wrote to memory of 4372 3800 rllfxrx.exe 106 PID 3800 wrote to memory of 4372 3800 rllfxrx.exe 106 PID 3800 wrote to memory of 4372 3800 rllfxrx.exe 106 PID 4372 wrote to memory of 212 4372 9btnbt.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\20195c446f196b9c432711fd9a43afa030d6fef2592c118a917263a837a5f90dN.exe"C:\Users\Admin\AppData\Local\Temp\20195c446f196b9c432711fd9a43afa030d6fef2592c118a917263a837a5f90dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\pddvp.exec:\pddvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\xflfxxx.exec:\xflfxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\hbtnhb.exec:\hbtnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\djdvj.exec:\djdvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\ppjvp.exec:\ppjvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\htbbhb.exec:\htbbhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\jvpjv.exec:\jvpjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\pjpvj.exec:\pjpvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\lflfffx.exec:\lflfffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\vpdvp.exec:\vpdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\ppvpv.exec:\ppvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\lxrlffx.exec:\lxrlffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\nhbnbb.exec:\nhbnbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\5ntnnn.exec:\5ntnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\dvvpj.exec:\dvvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\9llfxxr.exec:\9llfxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\bbtnbt.exec:\bbtnbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\hbnthb.exec:\hbnthb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\pjdvj.exec:\pjdvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\rllfxrx.exec:\rllfxrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\9btnbt.exec:\9btnbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\dvvpj.exec:\dvvpj.exe23⤵
- Executes dropped EXE
PID:212 -
\??\c:\dpvpd.exec:\dpvpd.exe24⤵
- Executes dropped EXE
PID:4596 -
\??\c:\5rxlxrx.exec:\5rxlxrx.exe25⤵
- Executes dropped EXE
PID:4532 -
\??\c:\1hbtnn.exec:\1hbtnn.exe26⤵
- Executes dropped EXE
PID:316 -
\??\c:\5dvjv.exec:\5dvjv.exe27⤵
- Executes dropped EXE
PID:4704 -
\??\c:\jppdp.exec:\jppdp.exe28⤵
- Executes dropped EXE
PID:392 -
\??\c:\frlfffx.exec:\frlfffx.exe29⤵
- Executes dropped EXE
PID:1816 -
\??\c:\btbtnh.exec:\btbtnh.exe30⤵
- Executes dropped EXE
PID:3672 -
\??\c:\7jpjj.exec:\7jpjj.exe31⤵
- Executes dropped EXE
PID:4872 -
\??\c:\flrfrlx.exec:\flrfrlx.exe32⤵
- Executes dropped EXE
PID:2880 -
\??\c:\rffxlrf.exec:\rffxlrf.exe33⤵
- Executes dropped EXE
PID:540 -
\??\c:\tbtnhb.exec:\tbtnhb.exe34⤵
- Executes dropped EXE
PID:3676 -
\??\c:\7jjdv.exec:\7jjdv.exe35⤵
- Executes dropped EXE
PID:3876 -
\??\c:\pdjdd.exec:\pdjdd.exe36⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe37⤵
- Executes dropped EXE
PID:4216 -
\??\c:\9rrlfxr.exec:\9rrlfxr.exe38⤵
- Executes dropped EXE
PID:1028 -
\??\c:\3hnhnh.exec:\3hnhnh.exe39⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vvvpv.exec:\vvvpv.exe40⤵
- Executes dropped EXE
PID:4556 -
\??\c:\jdvvd.exec:\jdvvd.exe41⤵
- Executes dropped EXE
PID:4132 -
\??\c:\rrrrlfx.exec:\rrrrlfx.exe42⤵
- Executes dropped EXE
PID:1604 -
\??\c:\hthhhh.exec:\hthhhh.exe43⤵
- Executes dropped EXE
PID:3904 -
\??\c:\thnbhh.exec:\thnbhh.exe44⤵
- Executes dropped EXE
PID:4020 -
\??\c:\pjdvj.exec:\pjdvj.exe45⤵
- Executes dropped EXE
PID:4512 -
\??\c:\jdjdv.exec:\jdjdv.exe46⤵
- Executes dropped EXE
PID:2104 -
\??\c:\xlllfxr.exec:\xlllfxr.exe47⤵
- Executes dropped EXE
PID:1724 -
\??\c:\9hhbtt.exec:\9hhbtt.exe48⤵
- Executes dropped EXE
PID:1016 -
\??\c:\bhnttn.exec:\bhnttn.exe49⤵
- Executes dropped EXE
PID:4528 -
\??\c:\jdjjv.exec:\jdjjv.exe50⤵
- Executes dropped EXE
PID:2552 -
\??\c:\xlffxlf.exec:\xlffxlf.exe51⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nbbtnh.exec:\nbbtnh.exe52⤵
- Executes dropped EXE
PID:2704 -
\??\c:\bbbnnn.exec:\bbbnnn.exe53⤵
- Executes dropped EXE
PID:1940 -
\??\c:\vvdpd.exec:\vvdpd.exe54⤵
- Executes dropped EXE
PID:4572 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe55⤵
- Executes dropped EXE
PID:3344 -
\??\c:\tntttn.exec:\tntttn.exe56⤵
- Executes dropped EXE
PID:3144 -
\??\c:\bbhtbt.exec:\bbhtbt.exe57⤵
- Executes dropped EXE
PID:3120 -
\??\c:\dvpjj.exec:\dvpjj.exe58⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rrlfffr.exec:\rrlfffr.exe59⤵
- Executes dropped EXE
PID:4088 -
\??\c:\bnhbtt.exec:\bnhbtt.exe60⤵
- Executes dropped EXE
PID:1348 -
\??\c:\hbtntt.exec:\hbtntt.exe61⤵
- Executes dropped EXE
PID:804 -
\??\c:\vjjdd.exec:\vjjdd.exe62⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xxfrlfx.exec:\xxfrlfx.exe63⤵
- Executes dropped EXE
PID:4324 -
\??\c:\rfrxxlf.exec:\rfrxxlf.exe64⤵
- Executes dropped EXE
PID:4868 -
\??\c:\9bbtnn.exec:\9bbtnn.exe65⤵
- Executes dropped EXE
PID:3528 -
\??\c:\jpddd.exec:\jpddd.exe66⤵PID:2304
-
\??\c:\jjvpd.exec:\jjvpd.exe67⤵PID:3560
-
\??\c:\lrxrllf.exec:\lrxrllf.exe68⤵PID:3636
-
\??\c:\thhbbb.exec:\thhbbb.exe69⤵PID:2424
-
\??\c:\thnthn.exec:\thnthn.exe70⤵PID:3380
-
\??\c:\frrrxrr.exec:\frrrxrr.exe71⤵PID:1512
-
\??\c:\nthtnh.exec:\nthtnh.exe72⤵PID:4404
-
\??\c:\jdpdv.exec:\jdpdv.exe73⤵PID:4456
-
\??\c:\flrfxxx.exec:\flrfxxx.exe74⤵PID:4228
-
\??\c:\xlrrlfx.exec:\xlrrlfx.exe75⤵PID:3448
-
\??\c:\hbtbth.exec:\hbtbth.exe76⤵PID:2076
-
\??\c:\7nnbtn.exec:\7nnbtn.exe77⤵PID:1984
-
\??\c:\jvddv.exec:\jvddv.exe78⤵PID:3416
-
\??\c:\fxxrlll.exec:\fxxrlll.exe79⤵PID:3388
-
\??\c:\tnhbtt.exec:\tnhbtt.exe80⤵PID:2072
-
\??\c:\hbtnhn.exec:\hbtnhn.exe81⤵PID:2512
-
\??\c:\pppdp.exec:\pppdp.exe82⤵PID:2936
-
\??\c:\xfffrxf.exec:\xfffrxf.exe83⤵PID:644
-
\??\c:\rfrlfff.exec:\rfrlfff.exe84⤵PID:4420
-
\??\c:\nbthbb.exec:\nbthbb.exe85⤵PID:4508
-
\??\c:\vjdjd.exec:\vjdjd.exe86⤵PID:436
-
\??\c:\lllfrfx.exec:\lllfrfx.exe87⤵PID:884
-
\??\c:\xxxrxrr.exec:\xxxrxrr.exe88⤵PID:2388
-
\??\c:\hnntbh.exec:\hnntbh.exe89⤵PID:1676
-
\??\c:\nntntt.exec:\nntntt.exe90⤵PID:3176
-
\??\c:\ddjpj.exec:\ddjpj.exe91⤵PID:3276
-
\??\c:\rllrrrx.exec:\rllrrrx.exe92⤵PID:1868
-
\??\c:\rfxflfx.exec:\rfxflfx.exe93⤵PID:2820
-
\??\c:\9tbbtt.exec:\9tbbtt.exe94⤵PID:368
-
\??\c:\3htnhb.exec:\3htnhb.exe95⤵PID:3640
-
\??\c:\dpjdv.exec:\dpjdv.exe96⤵PID:2024
-
\??\c:\ffllffx.exec:\ffllffx.exe97⤵PID:1264
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe98⤵PID:4684
-
\??\c:\nhnhhh.exec:\nhnhhh.exe99⤵PID:5112
-
\??\c:\ntnhtn.exec:\ntnhtn.exe100⤵PID:4396
-
\??\c:\dvpjj.exec:\dvpjj.exe101⤵PID:2224
-
\??\c:\xxxrrrf.exec:\xxxrrrf.exe102⤵PID:2704
-
\??\c:\xllfxxl.exec:\xllfxxl.exe103⤵PID:4476
-
\??\c:\nbbhnn.exec:\nbbhnn.exe104⤵PID:3968
-
\??\c:\jvpdp.exec:\jvpdp.exe105⤵PID:3344
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe106⤵PID:3848
-
\??\c:\fffxfff.exec:\fffxfff.exe107⤵PID:3120
-
\??\c:\lflrlrl.exec:\lflrlrl.exe108⤵PID:3480
-
\??\c:\7hhhbb.exec:\7hhhbb.exe109⤵PID:4088
-
\??\c:\djvvv.exec:\djvvv.exe110⤵PID:632
-
\??\c:\ppjdd.exec:\ppjdd.exe111⤵PID:1836
-
\??\c:\xflfrrr.exec:\xflfrrr.exe112⤵PID:2760
-
\??\c:\hbnnhh.exec:\hbnnhh.exe113⤵PID:4324
-
\??\c:\thttnh.exec:\thttnh.exe114⤵PID:2924
-
\??\c:\1jdvj.exec:\1jdvj.exe115⤵PID:3256
-
\??\c:\nntthb.exec:\nntthb.exe116⤵PID:2304
-
\??\c:\1hhhtn.exec:\1hhhtn.exe117⤵PID:4076
-
\??\c:\pvjdv.exec:\pvjdv.exe118⤵PID:3636
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe119⤵PID:4488
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe120⤵PID:4920
-
\??\c:\hhhntb.exec:\hhhntb.exe121⤵PID:3312
-
\??\c:\dpvjd.exec:\dpvjd.exe122⤵PID:4404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-