Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 20:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3a2d9c11440568096e6d1a4cbf6c3d688bbf5f8269c73bd388fe9e14be76d69c.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
3a2d9c11440568096e6d1a4cbf6c3d688bbf5f8269c73bd388fe9e14be76d69c.exe
-
Size
65KB
-
MD5
a538f41008561df2b59b24db827ab9a4
-
SHA1
e760a9bdfcf7012517d23a80ed1d6f946687ac10
-
SHA256
3a2d9c11440568096e6d1a4cbf6c3d688bbf5f8269c73bd388fe9e14be76d69c
-
SHA512
5359e151dfdc776be21542d303a84333d7cbd5624d00730aff238cc152fda939901ad351ef95c53b4d88cc8cfa67457ec7110d8c49156ca31348f35e3fd00149
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxeS:ymb3NkkiQ3mdBjF0y7kbUS
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3920-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3784-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1844-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1388-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1296-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3888-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3028 3xrxllr.exe 3784 bhhbnn.exe 1844 9ntbtb.exe 1668 jjdvp.exe 3124 frrlfxr.exe 1388 ffrlrrr.exe 2780 hthhbt.exe 376 pjpjp.exe 3088 vvpvp.exe 1688 xllfrlx.exe 4496 9hhbbb.exe 3272 1nhtnn.exe 3392 jjddj.exe 2712 rrfrrll.exe 4992 fxflrfx.exe 5052 thbtnh.exe 4824 3jpjd.exe 4568 5jjdv.exe 3844 rllxrrl.exe 5108 bttnhh.exe 4860 9thttn.exe 4492 vvvpp.exe 4364 dvdvd.exe 4056 xfllfrl.exe 4708 vvdpv.exe 5116 pvvvv.exe 4836 9lfxlfx.exe 1296 7hnhhh.exe 3888 5hbthb.exe 3400 jpjvj.exe 1184 rlfxllf.exe 1264 ffrxlxr.exe 4360 9tttnn.exe 3692 7ntntt.exe 4916 dvppd.exe 4064 jpjdp.exe 436 xfxxrrl.exe 976 3xxrlfr.exe 1564 5llfrlx.exe 4688 hntthb.exe 1684 hbhthb.exe 2300 pvpvp.exe 2068 5lrlffl.exe 5064 fxxllfx.exe 3028 bttnhb.exe 1556 nhhbnh.exe 2872 vpdvv.exe 4676 vvdvj.exe 2764 lfrlxfx.exe 3448 rrrlfff.exe 4644 ntttnn.exe 2760 bnbnhh.exe 1036 vvjjp.exe 3088 pddvj.exe 1408 9lxrxfr.exe 1116 xxrrffx.exe 4972 hbbbtt.exe 4812 hnnhtt.exe 2140 vvpvj.exe 220 vjdvv.exe 460 jpvpj.exe 752 fllfrrx.exe 5112 ntthbt.exe 1608 nhbtbt.exe -
resource yara_rule behavioral2/memory/3920-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3784-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3784-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1844-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1388-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1388-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3920 wrote to memory of 3028 3920 3a2d9c11440568096e6d1a4cbf6c3d688bbf5f8269c73bd388fe9e14be76d69c.exe 85 PID 3920 wrote to memory of 3028 3920 3a2d9c11440568096e6d1a4cbf6c3d688bbf5f8269c73bd388fe9e14be76d69c.exe 85 PID 3920 wrote to memory of 3028 3920 3a2d9c11440568096e6d1a4cbf6c3d688bbf5f8269c73bd388fe9e14be76d69c.exe 85 PID 3028 wrote to memory of 3784 3028 3xrxllr.exe 86 PID 3028 wrote to memory of 3784 3028 3xrxllr.exe 86 PID 3028 wrote to memory of 3784 3028 3xrxllr.exe 86 PID 3784 wrote to memory of 1844 3784 bhhbnn.exe 87 PID 3784 wrote to memory of 1844 3784 bhhbnn.exe 87 PID 3784 wrote to memory of 1844 3784 bhhbnn.exe 87 PID 1844 wrote to memory of 1668 1844 9ntbtb.exe 88 PID 1844 wrote to memory of 1668 1844 9ntbtb.exe 88 PID 1844 wrote to memory of 1668 1844 9ntbtb.exe 88 PID 1668 wrote to memory of 3124 1668 jjdvp.exe 89 PID 1668 wrote to memory of 3124 1668 jjdvp.exe 89 PID 1668 wrote to memory of 3124 1668 jjdvp.exe 89 PID 3124 wrote to memory of 1388 3124 frrlfxr.exe 90 PID 3124 wrote to memory of 1388 3124 frrlfxr.exe 90 PID 3124 wrote to memory of 1388 3124 frrlfxr.exe 90 PID 1388 wrote to memory of 2780 1388 ffrlrrr.exe 91 PID 1388 wrote to memory of 2780 1388 ffrlrrr.exe 91 PID 1388 wrote to memory of 2780 1388 ffrlrrr.exe 91 PID 2780 wrote to memory of 376 2780 hthhbt.exe 92 PID 2780 wrote to memory of 376 2780 hthhbt.exe 92 PID 2780 wrote to memory of 376 2780 hthhbt.exe 92 PID 376 wrote to memory of 3088 376 pjpjp.exe 93 PID 376 wrote to memory of 3088 376 pjpjp.exe 93 PID 376 wrote to memory of 3088 376 pjpjp.exe 93 PID 3088 wrote to memory of 1688 3088 vvpvp.exe 94 PID 3088 wrote to memory of 1688 3088 vvpvp.exe 94 PID 3088 wrote to memory of 1688 3088 vvpvp.exe 94 PID 1688 wrote to memory of 4496 1688 xllfrlx.exe 95 PID 1688 wrote to memory of 4496 1688 xllfrlx.exe 95 PID 1688 wrote to memory of 4496 1688 xllfrlx.exe 95 PID 4496 wrote to memory of 3272 4496 9hhbbb.exe 96 PID 4496 wrote to memory of 3272 4496 9hhbbb.exe 96 PID 4496 wrote to memory of 3272 4496 9hhbbb.exe 96 PID 3272 wrote to memory of 3392 3272 1nhtnn.exe 97 PID 3272 wrote to memory of 3392 3272 1nhtnn.exe 97 PID 3272 wrote to memory of 3392 3272 1nhtnn.exe 97 PID 3392 wrote to memory of 2712 3392 jjddj.exe 98 PID 3392 wrote to memory of 2712 3392 jjddj.exe 98 PID 3392 wrote to memory of 2712 3392 jjddj.exe 98 PID 2712 wrote to memory of 4992 2712 rrfrrll.exe 99 PID 2712 wrote to memory of 4992 2712 rrfrrll.exe 99 PID 2712 wrote to memory of 4992 2712 rrfrrll.exe 99 PID 4992 wrote to memory of 5052 4992 fxflrfx.exe 100 PID 4992 wrote to memory of 5052 4992 fxflrfx.exe 100 PID 4992 wrote to memory of 5052 4992 fxflrfx.exe 100 PID 5052 wrote to memory of 4824 5052 thbtnh.exe 101 PID 5052 wrote to memory of 4824 5052 thbtnh.exe 101 PID 5052 wrote to memory of 4824 5052 thbtnh.exe 101 PID 4824 wrote to memory of 4568 4824 3jpjd.exe 102 PID 4824 wrote to memory of 4568 4824 3jpjd.exe 102 PID 4824 wrote to memory of 4568 4824 3jpjd.exe 102 PID 4568 wrote to memory of 3844 4568 5jjdv.exe 103 PID 4568 wrote to memory of 3844 4568 5jjdv.exe 103 PID 4568 wrote to memory of 3844 4568 5jjdv.exe 103 PID 3844 wrote to memory of 5108 3844 rllxrrl.exe 105 PID 3844 wrote to memory of 5108 3844 rllxrrl.exe 105 PID 3844 wrote to memory of 5108 3844 rllxrrl.exe 105 PID 5108 wrote to memory of 4860 5108 bttnhh.exe 106 PID 5108 wrote to memory of 4860 5108 bttnhh.exe 106 PID 5108 wrote to memory of 4860 5108 bttnhh.exe 106 PID 4860 wrote to memory of 4492 4860 9thttn.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a2d9c11440568096e6d1a4cbf6c3d688bbf5f8269c73bd388fe9e14be76d69c.exe"C:\Users\Admin\AppData\Local\Temp\3a2d9c11440568096e6d1a4cbf6c3d688bbf5f8269c73bd388fe9e14be76d69c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\3xrxllr.exec:\3xrxllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\bhhbnn.exec:\bhhbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\9ntbtb.exec:\9ntbtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\jjdvp.exec:\jjdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\frrlfxr.exec:\frrlfxr.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\ffrlrrr.exec:\ffrlrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\hthhbt.exec:\hthhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\pjpjp.exec:\pjpjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\vvpvp.exec:\vvpvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\xllfrlx.exec:\xllfrlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\9hhbbb.exec:\9hhbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\1nhtnn.exec:\1nhtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\jjddj.exec:\jjddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\rrfrrll.exec:\rrfrrll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\fxflrfx.exec:\fxflrfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\thbtnh.exec:\thbtnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\3jpjd.exec:\3jpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\5jjdv.exec:\5jjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\rllxrrl.exec:\rllxrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\bttnhh.exec:\bttnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\9thttn.exec:\9thttn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\vvvpp.exec:\vvvpp.exe23⤵
- Executes dropped EXE
PID:4492 -
\??\c:\dvdvd.exec:\dvdvd.exe24⤵
- Executes dropped EXE
PID:4364 -
\??\c:\xfllfrl.exec:\xfllfrl.exe25⤵
- Executes dropped EXE
PID:4056 -
\??\c:\vvdpv.exec:\vvdpv.exe26⤵
- Executes dropped EXE
PID:4708 -
\??\c:\pvvvv.exec:\pvvvv.exe27⤵
- Executes dropped EXE
PID:5116 -
\??\c:\9lfxlfx.exec:\9lfxlfx.exe28⤵
- Executes dropped EXE
PID:4836 -
\??\c:\7hnhhh.exec:\7hnhhh.exe29⤵
- Executes dropped EXE
PID:1296 -
\??\c:\5hbthb.exec:\5hbthb.exe30⤵
- Executes dropped EXE
PID:3888 -
\??\c:\jpjvj.exec:\jpjvj.exe31⤵
- Executes dropped EXE
PID:3400 -
\??\c:\rlfxllf.exec:\rlfxllf.exe32⤵
- Executes dropped EXE
PID:1184 -
\??\c:\ffrxlxr.exec:\ffrxlxr.exe33⤵
- Executes dropped EXE
PID:1264 -
\??\c:\9tttnn.exec:\9tttnn.exe34⤵
- Executes dropped EXE
PID:4360 -
\??\c:\7ntntt.exec:\7ntntt.exe35⤵
- Executes dropped EXE
PID:3692 -
\??\c:\dvppd.exec:\dvppd.exe36⤵
- Executes dropped EXE
PID:4916 -
\??\c:\jpjdp.exec:\jpjdp.exe37⤵
- Executes dropped EXE
PID:4064 -
\??\c:\xfxxrrl.exec:\xfxxrrl.exe38⤵
- Executes dropped EXE
PID:436 -
\??\c:\3xxrlfr.exec:\3xxrlfr.exe39⤵
- Executes dropped EXE
PID:976 -
\??\c:\5llfrlx.exec:\5llfrlx.exe40⤵
- Executes dropped EXE
PID:1564 -
\??\c:\hntthb.exec:\hntthb.exe41⤵
- Executes dropped EXE
PID:4688 -
\??\c:\hbhthb.exec:\hbhthb.exe42⤵
- Executes dropped EXE
PID:1684 -
\??\c:\pvpvp.exec:\pvpvp.exe43⤵
- Executes dropped EXE
PID:2300 -
\??\c:\5lrlffl.exec:\5lrlffl.exe44⤵
- Executes dropped EXE
PID:2068 -
\??\c:\fxxllfx.exec:\fxxllfx.exe45⤵
- Executes dropped EXE
PID:5064 -
\??\c:\bttnhb.exec:\bttnhb.exe46⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nhhbnh.exec:\nhhbnh.exe47⤵
- Executes dropped EXE
PID:1556 -
\??\c:\vpdvv.exec:\vpdvv.exe48⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vvdvj.exec:\vvdvj.exe49⤵
- Executes dropped EXE
PID:4676 -
\??\c:\lfrlxfx.exec:\lfrlxfx.exe50⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rrrlfff.exec:\rrrlfff.exe51⤵
- Executes dropped EXE
PID:3448 -
\??\c:\ntttnn.exec:\ntttnn.exe52⤵
- Executes dropped EXE
PID:4644 -
\??\c:\bnbnhh.exec:\bnbnhh.exe53⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vvjjp.exec:\vvjjp.exe54⤵
- Executes dropped EXE
PID:1036 -
\??\c:\pddvj.exec:\pddvj.exe55⤵
- Executes dropped EXE
PID:3088 -
\??\c:\9lxrxfr.exec:\9lxrxfr.exe56⤵
- Executes dropped EXE
PID:1408 -
\??\c:\xxrrffx.exec:\xxrrffx.exe57⤵
- Executes dropped EXE
PID:1116 -
\??\c:\hbbbtt.exec:\hbbbtt.exe58⤵
- Executes dropped EXE
PID:4972 -
\??\c:\hnnhtt.exec:\hnnhtt.exe59⤵
- Executes dropped EXE
PID:4812 -
\??\c:\vvpvj.exec:\vvpvj.exe60⤵
- Executes dropped EXE
PID:2140 -
\??\c:\vjdvv.exec:\vjdvv.exe61⤵
- Executes dropped EXE
PID:220 -
\??\c:\jpvpj.exec:\jpvpj.exe62⤵
- Executes dropped EXE
PID:460 -
\??\c:\fllfrrx.exec:\fllfrrx.exe63⤵
- Executes dropped EXE
PID:752 -
\??\c:\ntthbt.exec:\ntthbt.exe64⤵
- Executes dropped EXE
PID:5112 -
\??\c:\nhbtbt.exec:\nhbtbt.exe65⤵
- Executes dropped EXE
PID:1608 -
\??\c:\dvdvj.exec:\dvdvj.exe66⤵PID:3444
-
\??\c:\3pjdv.exec:\3pjdv.exe67⤵PID:4212
-
\??\c:\7xrlxfx.exec:\7xrlxfx.exe68⤵PID:3304
-
\??\c:\1nnbtb.exec:\1nnbtb.exe69⤵PID:5108
-
\??\c:\lffrlfx.exec:\lffrlfx.exe70⤵PID:4860
-
\??\c:\lllfxrl.exec:\lllfxrl.exe71⤵PID:648
-
\??\c:\vdjvp.exec:\vdjvp.exe72⤵PID:4180
-
\??\c:\9jdvp.exec:\9jdvp.exe73⤵PID:3524
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe74⤵PID:4976
-
\??\c:\xxxxfxr.exec:\xxxxfxr.exe75⤵PID:392
-
\??\c:\tttnht.exec:\tttnht.exe76⤵PID:5116
-
\??\c:\fxrffxx.exec:\fxrffxx.exe77⤵PID:3000
-
\??\c:\lfxrllf.exec:\lfxrllf.exe78⤵PID:4592
-
\??\c:\7bbthb.exec:\7bbthb.exe79⤵PID:3280
-
\??\c:\nhhbtn.exec:\nhhbtn.exe80⤵PID:4268
-
\??\c:\pjjdv.exec:\pjjdv.exe81⤵PID:1840
-
\??\c:\pjjdp.exec:\pjjdp.exe82⤵PID:4460
-
\??\c:\fffrfxr.exec:\fffrfxr.exe83⤵PID:4884
-
\??\c:\xlfflll.exec:\xlfflll.exe84⤵PID:2224
-
\??\c:\1hbthb.exec:\1hbthb.exe85⤵PID:4360
-
\??\c:\3ttnbb.exec:\3ttnbb.exe86⤵PID:2892
-
\??\c:\jpjvj.exec:\jpjvj.exe87⤵PID:4916
-
\??\c:\7ppvj.exec:\7ppvj.exe88⤵PID:436
-
\??\c:\bbthbt.exec:\bbthbt.exe89⤵PID:1132
-
\??\c:\jppjv.exec:\jppjv.exe90⤵PID:4388
-
\??\c:\1dvpd.exec:\1dvpd.exe91⤵PID:4688
-
\??\c:\xlxxlrx.exec:\xlxxlrx.exe92⤵PID:4148
-
\??\c:\lfxrfxr.exec:\lfxrfxr.exe93⤵PID:3920
-
\??\c:\nbnhtn.exec:\nbnhtn.exe94⤵PID:4152
-
\??\c:\nbtnbb.exec:\nbtnbb.exe95⤵PID:3544
-
\??\c:\dvppj.exec:\dvppj.exe96⤵PID:264
-
\??\c:\5jppd.exec:\5jppd.exe97⤵PID:2976
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe98⤵PID:2792
-
\??\c:\rlllfll.exec:\rlllfll.exe99⤵PID:552
-
\??\c:\3bbtbb.exec:\3bbtbb.exe100⤵PID:3124
-
\??\c:\vdpdp.exec:\vdpdp.exe101⤵PID:3932
-
\??\c:\pjdvj.exec:\pjdvj.exe102⤵PID:2212
-
\??\c:\llxxrxr.exec:\llxxrxr.exe103⤵PID:4224
-
\??\c:\lrrrxxr.exec:\lrrrxxr.exe104⤵PID:3472
-
\??\c:\rllfxxr.exec:\rllfxxr.exe105⤵PID:4700
-
\??\c:\hnbtnt.exec:\hnbtnt.exe106⤵PID:4740
-
\??\c:\1bbthb.exec:\1bbthb.exe107⤵PID:3464
-
\??\c:\jjjvp.exec:\jjjvp.exe108⤵PID:424
-
\??\c:\vpjdv.exec:\vpjdv.exe109⤵PID:4472
-
\??\c:\7lffrlf.exec:\7lffrlf.exe110⤵PID:2712
-
\??\c:\lrrlrlf.exec:\lrrlrlf.exe111⤵PID:1532
-
\??\c:\thhbtt.exec:\thhbtt.exe112⤵PID:1632
-
\??\c:\bhnbtn.exec:\bhnbtn.exe113⤵PID:2704
-
\??\c:\jpdvp.exec:\jpdvp.exe114⤵PID:1484
-
\??\c:\ddjdp.exec:\ddjdp.exe115⤵PID:2320
-
\??\c:\9rxxxxx.exec:\9rxxxxx.exe116⤵PID:2388
-
\??\c:\fxxrrlx.exec:\fxxrrlx.exe117⤵PID:1180
-
\??\c:\3nnhbn.exec:\3nnhbn.exe118⤵PID:2584
-
\??\c:\hhtttb.exec:\hhtttb.exe119⤵PID:3744
-
\??\c:\jddvv.exec:\jddvv.exe120⤵PID:2552
-
\??\c:\pddvj.exec:\pddvj.exe121⤵PID:3360
-
\??\c:\fxlffxr.exec:\fxlffxr.exe122⤵PID:2244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-