Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2024, 03:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f05aff09e6fff027539c99ddd676b97d14f35105da33846b94ebb15982d5cd5f.exe
Resource
win7-20240708-en
6 signatures
150 seconds
General
-
Target
f05aff09e6fff027539c99ddd676b97d14f35105da33846b94ebb15982d5cd5f.exe
-
Size
72KB
-
MD5
b29035d91da4f594db99b20c5d7ae300
-
SHA1
3189860d6452d208233e0e31e9f3c31f22c18c3a
-
SHA256
f05aff09e6fff027539c99ddd676b97d14f35105da33846b94ebb15982d5cd5f
-
SHA512
647edeaeb0e9d61238cb4dc28b503caab806d9d7348b25ad4c9b854a65bb7d7d5198a1f889ad8c194663c2a1a40449e2f80d81037ed242056ee30560413e4da1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjW3:ymb3NkkiQ3mdBjFI4Vi
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3056-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3796-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1516-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2284 ffxllxx.exe 4192 thbbbh.exe 2332 tthnth.exe 3796 ffllxxl.exe 2752 rrflrrf.exe 2780 htbbht.exe 1632 nbhnnn.exe 1532 1frrllf.exe 3284 rlrrlll.exe 5072 httttb.exe 4220 jvvpd.exe 3480 fflllll.exe 2908 tntttb.exe 5040 vpjvj.exe 1520 rllfrrf.exe 4268 rxxxllx.exe 4264 hthnnt.exe 2368 vpjjv.exe 1192 5dvdp.exe 4576 rllrlfl.exe 2900 nhnhhb.exe 1904 pjpjv.exe 3708 ddjpv.exe 4148 rrfxlll.exe 1516 bbhthb.exe 3580 htthbt.exe 4812 pdvpp.exe 1988 lxrfxrl.exe 3268 lllfxrl.exe 1996 pjddv.exe 3484 btnbtn.exe 4968 9tthnn.exe 684 5ddpv.exe 4048 rxrfxrl.exe 1148 3bbtnh.exe 3256 7bbbnn.exe 4336 dvjdp.exe 4176 lxlrflx.exe 864 xfxxrrf.exe 3396 nhhbbt.exe 2308 pdpjp.exe 444 jppdv.exe 2152 xrxlrxf.exe 3992 fflfrrf.exe 4696 5nttnh.exe 1796 5nhntb.exe 2148 vdjpj.exe 4960 rrxrfff.exe 1536 hbtthn.exe 1504 1tthbb.exe 1300 vpdvp.exe 5080 5vvpd.exe 540 xlrlffx.exe 2744 3bbbtt.exe 1180 btnnhh.exe 4408 dpjdp.exe 1876 1xrllfl.exe 2084 rlfxfxr.exe 3872 5btntn.exe 3848 dpvjp.exe 4520 dvpdp.exe 3528 fxrlxrl.exe 4000 lllllll.exe 728 hhnnhh.exe -
resource yara_rule behavioral2/memory/3056-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3796-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1532-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfrxf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2284 3056 f05aff09e6fff027539c99ddd676b97d14f35105da33846b94ebb15982d5cd5f.exe 84 PID 3056 wrote to memory of 2284 3056 f05aff09e6fff027539c99ddd676b97d14f35105da33846b94ebb15982d5cd5f.exe 84 PID 3056 wrote to memory of 2284 3056 f05aff09e6fff027539c99ddd676b97d14f35105da33846b94ebb15982d5cd5f.exe 84 PID 2284 wrote to memory of 4192 2284 ffxllxx.exe 85 PID 2284 wrote to memory of 4192 2284 ffxllxx.exe 85 PID 2284 wrote to memory of 4192 2284 ffxllxx.exe 85 PID 4192 wrote to memory of 2332 4192 thbbbh.exe 86 PID 4192 wrote to memory of 2332 4192 thbbbh.exe 86 PID 4192 wrote to memory of 2332 4192 thbbbh.exe 86 PID 2332 wrote to memory of 3796 2332 tthnth.exe 87 PID 2332 wrote to memory of 3796 2332 tthnth.exe 87 PID 2332 wrote to memory of 3796 2332 tthnth.exe 87 PID 3796 wrote to memory of 2752 3796 ffllxxl.exe 88 PID 3796 wrote to memory of 2752 3796 ffllxxl.exe 88 PID 3796 wrote to memory of 2752 3796 ffllxxl.exe 88 PID 2752 wrote to memory of 2780 2752 rrflrrf.exe 89 PID 2752 wrote to memory of 2780 2752 rrflrrf.exe 89 PID 2752 wrote to memory of 2780 2752 rrflrrf.exe 89 PID 2780 wrote to memory of 1632 2780 htbbht.exe 90 PID 2780 wrote to memory of 1632 2780 htbbht.exe 90 PID 2780 wrote to memory of 1632 2780 htbbht.exe 90 PID 1632 wrote to memory of 1532 1632 nbhnnn.exe 92 PID 1632 wrote to memory of 1532 1632 nbhnnn.exe 92 PID 1632 wrote to memory of 1532 1632 nbhnnn.exe 92 PID 1532 wrote to memory of 3284 1532 1frrllf.exe 93 PID 1532 wrote to memory of 3284 1532 1frrllf.exe 93 PID 1532 wrote to memory of 3284 1532 1frrllf.exe 93 PID 3284 wrote to memory of 5072 3284 rlrrlll.exe 94 PID 3284 wrote to memory of 5072 3284 rlrrlll.exe 94 PID 3284 wrote to memory of 5072 3284 rlrrlll.exe 94 PID 5072 wrote to memory of 4220 5072 httttb.exe 95 PID 5072 wrote to memory of 4220 5072 httttb.exe 95 PID 5072 wrote to memory of 4220 5072 httttb.exe 95 PID 4220 wrote to memory of 3480 4220 jvvpd.exe 96 PID 4220 wrote to memory of 3480 4220 jvvpd.exe 96 PID 4220 wrote to memory of 3480 4220 jvvpd.exe 96 PID 3480 wrote to memory of 2908 3480 fflllll.exe 97 PID 3480 wrote to memory of 2908 3480 fflllll.exe 97 PID 3480 wrote to memory of 2908 3480 fflllll.exe 97 PID 2908 wrote to memory of 5040 2908 tntttb.exe 98 PID 2908 wrote to memory of 5040 2908 tntttb.exe 98 PID 2908 wrote to memory of 5040 2908 tntttb.exe 98 PID 5040 wrote to memory of 1520 5040 vpjvj.exe 99 PID 5040 wrote to memory of 1520 5040 vpjvj.exe 99 PID 5040 wrote to memory of 1520 5040 vpjvj.exe 99 PID 1520 wrote to memory of 4268 1520 rllfrrf.exe 100 PID 1520 wrote to memory of 4268 1520 rllfrrf.exe 100 PID 1520 wrote to memory of 4268 1520 rllfrrf.exe 100 PID 4268 wrote to memory of 4264 4268 rxxxllx.exe 101 PID 4268 wrote to memory of 4264 4268 rxxxllx.exe 101 PID 4268 wrote to memory of 4264 4268 rxxxllx.exe 101 PID 4264 wrote to memory of 2368 4264 hthnnt.exe 103 PID 4264 wrote to memory of 2368 4264 hthnnt.exe 103 PID 4264 wrote to memory of 2368 4264 hthnnt.exe 103 PID 2368 wrote to memory of 1192 2368 vpjjv.exe 104 PID 2368 wrote to memory of 1192 2368 vpjjv.exe 104 PID 2368 wrote to memory of 1192 2368 vpjjv.exe 104 PID 1192 wrote to memory of 4576 1192 5dvdp.exe 105 PID 1192 wrote to memory of 4576 1192 5dvdp.exe 105 PID 1192 wrote to memory of 4576 1192 5dvdp.exe 105 PID 4576 wrote to memory of 2900 4576 rllrlfl.exe 106 PID 4576 wrote to memory of 2900 4576 rllrlfl.exe 106 PID 4576 wrote to memory of 2900 4576 rllrlfl.exe 106 PID 2900 wrote to memory of 1904 2900 nhnhhb.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\f05aff09e6fff027539c99ddd676b97d14f35105da33846b94ebb15982d5cd5f.exe"C:\Users\Admin\AppData\Local\Temp\f05aff09e6fff027539c99ddd676b97d14f35105da33846b94ebb15982d5cd5f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\ffxllxx.exec:\ffxllxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\thbbbh.exec:\thbbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\tthnth.exec:\tthnth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\ffllxxl.exec:\ffllxxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\rrflrrf.exec:\rrflrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\htbbht.exec:\htbbht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nbhnnn.exec:\nbhnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\1frrllf.exec:\1frrllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\rlrrlll.exec:\rlrrlll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\httttb.exec:\httttb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\jvvpd.exec:\jvvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\fflllll.exec:\fflllll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\tntttb.exec:\tntttb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\vpjvj.exec:\vpjvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\rllfrrf.exec:\rllfrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\rxxxllx.exec:\rxxxllx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\hthnnt.exec:\hthnnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\vpjjv.exec:\vpjjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\5dvdp.exec:\5dvdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\rllrlfl.exec:\rllrlfl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\nhnhhb.exec:\nhnhhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\pjpjv.exec:\pjpjv.exe23⤵
- Executes dropped EXE
PID:1904 -
\??\c:\ddjpv.exec:\ddjpv.exe24⤵
- Executes dropped EXE
PID:3708 -
\??\c:\rrfxlll.exec:\rrfxlll.exe25⤵
- Executes dropped EXE
PID:4148 -
\??\c:\bbhthb.exec:\bbhthb.exe26⤵
- Executes dropped EXE
PID:1516 -
\??\c:\htthbt.exec:\htthbt.exe27⤵
- Executes dropped EXE
PID:3580 -
\??\c:\pdvpp.exec:\pdvpp.exe28⤵
- Executes dropped EXE
PID:4812 -
\??\c:\lxrfxrl.exec:\lxrfxrl.exe29⤵
- Executes dropped EXE
PID:1988 -
\??\c:\lllfxrl.exec:\lllfxrl.exe30⤵
- Executes dropped EXE
PID:3268 -
\??\c:\pjddv.exec:\pjddv.exe31⤵
- Executes dropped EXE
PID:1996 -
\??\c:\btnbtn.exec:\btnbtn.exe32⤵
- Executes dropped EXE
PID:3484 -
\??\c:\9tthnn.exec:\9tthnn.exe33⤵
- Executes dropped EXE
PID:4968 -
\??\c:\5ddpv.exec:\5ddpv.exe34⤵
- Executes dropped EXE
PID:684 -
\??\c:\rxrfxrl.exec:\rxrfxrl.exe35⤵
- Executes dropped EXE
PID:4048 -
\??\c:\3bbtnh.exec:\3bbtnh.exe36⤵
- Executes dropped EXE
PID:1148 -
\??\c:\7bbbnn.exec:\7bbbnn.exe37⤵
- Executes dropped EXE
PID:3256 -
\??\c:\dvjdp.exec:\dvjdp.exe38⤵
- Executes dropped EXE
PID:4336 -
\??\c:\lxlrflx.exec:\lxlrflx.exe39⤵
- Executes dropped EXE
PID:4176 -
\??\c:\xfxxrrf.exec:\xfxxrrf.exe40⤵
- Executes dropped EXE
PID:864 -
\??\c:\nhhbbt.exec:\nhhbbt.exe41⤵
- Executes dropped EXE
PID:3396 -
\??\c:\pdpjp.exec:\pdpjp.exe42⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jppdv.exec:\jppdv.exe43⤵
- Executes dropped EXE
PID:444 -
\??\c:\xrxlrxf.exec:\xrxlrxf.exe44⤵
- Executes dropped EXE
PID:2152 -
\??\c:\fflfrrf.exec:\fflfrrf.exe45⤵
- Executes dropped EXE
PID:3992 -
\??\c:\5nttnh.exec:\5nttnh.exe46⤵
- Executes dropped EXE
PID:4696 -
\??\c:\5nhntb.exec:\5nhntb.exe47⤵
- Executes dropped EXE
PID:1796 -
\??\c:\vdjpj.exec:\vdjpj.exe48⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rrxrfff.exec:\rrxrfff.exe49⤵
- Executes dropped EXE
PID:4960 -
\??\c:\hbtthn.exec:\hbtthn.exe50⤵
- Executes dropped EXE
PID:1536 -
\??\c:\1tthbb.exec:\1tthbb.exe51⤵
- Executes dropped EXE
PID:1504 -
\??\c:\vpdvp.exec:\vpdvp.exe52⤵
- Executes dropped EXE
PID:1300 -
\??\c:\5vvpd.exec:\5vvpd.exe53⤵
- Executes dropped EXE
PID:5080 -
\??\c:\xlrlffx.exec:\xlrlffx.exe54⤵
- Executes dropped EXE
PID:540 -
\??\c:\3bbbtt.exec:\3bbbtt.exe55⤵
- Executes dropped EXE
PID:2744 -
\??\c:\btnnhh.exec:\btnnhh.exe56⤵
- Executes dropped EXE
PID:1180 -
\??\c:\dpjdp.exec:\dpjdp.exe57⤵
- Executes dropped EXE
PID:4408 -
\??\c:\1xrllfl.exec:\1xrllfl.exe58⤵
- Executes dropped EXE
PID:1876 -
\??\c:\rlfxfxr.exec:\rlfxfxr.exe59⤵
- Executes dropped EXE
PID:2084 -
\??\c:\5btntn.exec:\5btntn.exe60⤵
- Executes dropped EXE
PID:3872 -
\??\c:\dpvjp.exec:\dpvjp.exe61⤵
- Executes dropped EXE
PID:3848 -
\??\c:\dvpdp.exec:\dvpdp.exe62⤵
- Executes dropped EXE
PID:4520 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe63⤵
- Executes dropped EXE
PID:3528 -
\??\c:\lllllll.exec:\lllllll.exe64⤵
- Executes dropped EXE
PID:4000 -
\??\c:\hhnnhh.exec:\hhnnhh.exe65⤵
- Executes dropped EXE
PID:728 -
\??\c:\nbhhbb.exec:\nbhhbb.exe66⤵PID:708
-
\??\c:\vvpvd.exec:\vvpvd.exe67⤵PID:1192
-
\??\c:\lfllfll.exec:\lfllfll.exe68⤵PID:4560
-
\??\c:\rffxfff.exec:\rffxfff.exe69⤵PID:2900
-
\??\c:\thhhhh.exec:\thhhhh.exe70⤵PID:4056
-
\??\c:\nnhbtt.exec:\nnhbtt.exe71⤵PID:4676
-
\??\c:\vvvdp.exec:\vvvdp.exe72⤵PID:5060
-
\??\c:\3pvvj.exec:\3pvvj.exe73⤵PID:2416
-
\??\c:\lxrrlll.exec:\lxrrlll.exe74⤵PID:3744
-
\??\c:\hhhhnn.exec:\hhhhnn.exe75⤵PID:2408
-
\??\c:\nntnhh.exec:\nntnhh.exe76⤵PID:4304
-
\??\c:\7dpdd.exec:\7dpdd.exe77⤵PID:1092
-
\??\c:\rfflflf.exec:\rfflflf.exe78⤵PID:1988
-
\??\c:\bhbbhn.exec:\bhbbhn.exe79⤵PID:3472
-
\??\c:\nntnnb.exec:\nntnnb.exe80⤵PID:1996
-
\??\c:\jdjjj.exec:\jdjjj.exe81⤵PID:2236
-
\??\c:\5dddd.exec:\5dddd.exe82⤵PID:4936
-
\??\c:\lxlrfrr.exec:\lxlrfrr.exe83⤵PID:3748
-
\??\c:\rxlrlll.exec:\rxlrlll.exe84⤵PID:1156
-
\??\c:\7nbttt.exec:\7nbttt.exe85⤵PID:2312
-
\??\c:\7vvvv.exec:\7vvvv.exe86⤵PID:3288
-
\??\c:\9jpvp.exec:\9jpvp.exe87⤵PID:3256
-
\??\c:\xxrlfff.exec:\xxrlfff.exe88⤵PID:4284
-
\??\c:\nhbntn.exec:\nhbntn.exe89⤵PID:5048
-
\??\c:\nthhnn.exec:\nthhnn.exe90⤵PID:3676
-
\??\c:\jjjjj.exec:\jjjjj.exe91⤵PID:3548
-
\??\c:\vppjd.exec:\vppjd.exe92⤵PID:3596
-
\??\c:\xrrlffx.exec:\xrrlffx.exe93⤵PID:1984
-
\??\c:\rfrffxf.exec:\rfrffxf.exe94⤵PID:2692
-
\??\c:\hbbbtt.exec:\hbbbtt.exe95⤵PID:60
-
\??\c:\tthhtt.exec:\tthhtt.exe96⤵PID:3904
-
\??\c:\pjpvp.exec:\pjpvp.exe97⤵PID:3040
-
\??\c:\xlfxlll.exec:\xlfxlll.exe98⤵PID:920
-
\??\c:\rxxflrl.exec:\rxxflrl.exe99⤵PID:1120
-
\??\c:\htbbtt.exec:\htbbtt.exe100⤵PID:4996
-
\??\c:\5bbbtb.exec:\5bbbtb.exe101⤵PID:3048
-
\??\c:\hbhbtt.exec:\hbhbtt.exe102⤵PID:4972
-
\??\c:\vjppj.exec:\vjppj.exe103⤵PID:2604
-
\??\c:\5vdvp.exec:\5vdvp.exe104⤵PID:4756
-
\??\c:\3rrrlrl.exec:\3rrrlrl.exe105⤵PID:376
-
\??\c:\thhhhn.exec:\thhhhn.exe106⤵PID:4544
-
\??\c:\bnnhhh.exec:\bnnhhh.exe107⤵PID:2464
-
\??\c:\ppjjv.exec:\ppjjv.exe108⤵PID:3036
-
\??\c:\7rlfxxr.exec:\7rlfxxr.exe109⤵PID:2084
-
\??\c:\xrrxxll.exec:\xrrxxll.exe110⤵PID:4468
-
\??\c:\nnhhtb.exec:\nnhhtb.exe111⤵PID:3848
-
\??\c:\vpjjv.exec:\vpjjv.exe112⤵PID:3052
-
\??\c:\5jjjv.exec:\5jjjv.exe113⤵PID:3528
-
\??\c:\lrrlfrl.exec:\lrrlfrl.exe114⤵PID:4744
-
\??\c:\xxlrlll.exec:\xxlrlll.exe115⤵PID:4556
-
\??\c:\3tnnnn.exec:\3tnnnn.exe116⤵PID:708
-
\??\c:\3ddvp.exec:\3ddvp.exe117⤵PID:1192
-
\??\c:\jjddv.exec:\jjddv.exe118⤵PID:4512
-
\??\c:\1lrlxlf.exec:\1lrlxlf.exe119⤵PID:500
-
\??\c:\rrrrllf.exec:\rrrrllf.exe120⤵PID:4056
-
\??\c:\ttbttt.exec:\ttbttt.exe121⤵PID:4676
-
\??\c:\nbbbnn.exec:\nbbbnn.exe122⤵PID:3320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-