Analysis
-
max time kernel
120s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2024, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
645f9fd79c2bcffdac630eb1d9f1ab3955dfc7c0ecf9d1e14b506622c14442c2N.exe
Resource
win7-20240903-en
General
-
Target
645f9fd79c2bcffdac630eb1d9f1ab3955dfc7c0ecf9d1e14b506622c14442c2N.exe
-
Size
82KB
-
MD5
e6a50d5a0ef287fccc1792637d6716c0
-
SHA1
e7d0ab9c150c116817af98b5973382c47f554f98
-
SHA256
645f9fd79c2bcffdac630eb1d9f1ab3955dfc7c0ecf9d1e14b506622c14442c2
-
SHA512
5ee6e7097dd71fb75f1d9d09b000e19ed92e03783fdabc884ff4bff576f70214d0f3c1df2803335b15b3edee18f7faccdadc9e5a5a902b63593de1be72bf9990
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Q9u:ymb3NkkiQ3mdBjFIIp9L9QrrA8Yu
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2352-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/620-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2680-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3204-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2544-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/760-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3896 vjvpp.exe 2952 llrxxxf.exe 620 7bttnb.exe 2680 vdjdv.exe 3536 rrlrxrx.exe 2544 nnhhbn.exe 2004 dpddd.exe 3204 xrrlfff.exe 3684 lfrlfff.exe 216 hbbtbt.exe 1080 nhnbbn.exe 4984 frrlfxr.exe 2444 bbnhhb.exe 3492 thbtnn.exe 384 vjjdp.exe 1508 7djdd.exe 320 bnnbnh.exe 2828 bbhbtt.exe 3216 5ppjv.exe 2436 fxxrllf.exe 3884 hbhnhh.exe 3324 ntthbb.exe 760 vdvpp.exe 2896 1djvj.exe 5076 rfffrrr.exe 4876 jvjvp.exe 3596 lfrllll.exe 1624 nhttnn.exe 4364 thhhtt.exe 4480 jdddp.exe 4428 1pdpj.exe 2596 1xlflfr.exe 372 thbtnn.exe 3808 bthtnn.exe 1680 jpjjv.exe 2432 lxrlffx.exe 1044 7xlffxf.exe 220 xrrrlll.exe 3556 nbbttn.exe 2892 7ddvj.exe 1660 fxrllll.exe 4284 llllfff.exe 2800 nhhbbt.exe 2376 7ppjd.exe 2712 9vpjv.exe 2244 3ppvj.exe 1644 3rllxxr.exe 3932 pvjjd.exe 3604 vvjdp.exe 2580 rfrxrfr.exe 4788 thhbhb.exe 1896 hbtbtt.exe 2452 dvdvd.exe 216 5llxlfx.exe 4496 lfxrlfx.exe 228 bttnht.exe 964 1tnnht.exe 2948 vpdvj.exe 3492 jjjjv.exe 3276 lffxlll.exe 4732 rlllffx.exe 5044 9hnnhh.exe 3000 5vdvj.exe 4448 vpjjv.exe -
resource yara_rule behavioral2/memory/2352-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/620-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2680-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1080-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/384-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/760-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 3896 2352 645f9fd79c2bcffdac630eb1d9f1ab3955dfc7c0ecf9d1e14b506622c14442c2N.exe 84 PID 2352 wrote to memory of 3896 2352 645f9fd79c2bcffdac630eb1d9f1ab3955dfc7c0ecf9d1e14b506622c14442c2N.exe 84 PID 2352 wrote to memory of 3896 2352 645f9fd79c2bcffdac630eb1d9f1ab3955dfc7c0ecf9d1e14b506622c14442c2N.exe 84 PID 3896 wrote to memory of 2952 3896 vjvpp.exe 85 PID 3896 wrote to memory of 2952 3896 vjvpp.exe 85 PID 3896 wrote to memory of 2952 3896 vjvpp.exe 85 PID 2952 wrote to memory of 620 2952 llrxxxf.exe 86 PID 2952 wrote to memory of 620 2952 llrxxxf.exe 86 PID 2952 wrote to memory of 620 2952 llrxxxf.exe 86 PID 620 wrote to memory of 2680 620 7bttnb.exe 87 PID 620 wrote to memory of 2680 620 7bttnb.exe 87 PID 620 wrote to memory of 2680 620 7bttnb.exe 87 PID 2680 wrote to memory of 3536 2680 vdjdv.exe 88 PID 2680 wrote to memory of 3536 2680 vdjdv.exe 88 PID 2680 wrote to memory of 3536 2680 vdjdv.exe 88 PID 3536 wrote to memory of 2544 3536 rrlrxrx.exe 89 PID 3536 wrote to memory of 2544 3536 rrlrxrx.exe 89 PID 3536 wrote to memory of 2544 3536 rrlrxrx.exe 89 PID 2544 wrote to memory of 2004 2544 nnhhbn.exe 90 PID 2544 wrote to memory of 2004 2544 nnhhbn.exe 90 PID 2544 wrote to memory of 2004 2544 nnhhbn.exe 90 PID 2004 wrote to memory of 3204 2004 dpddd.exe 91 PID 2004 wrote to memory of 3204 2004 dpddd.exe 91 PID 2004 wrote to memory of 3204 2004 dpddd.exe 91 PID 3204 wrote to memory of 3684 3204 xrrlfff.exe 92 PID 3204 wrote to memory of 3684 3204 xrrlfff.exe 92 PID 3204 wrote to memory of 3684 3204 xrrlfff.exe 92 PID 3684 wrote to memory of 216 3684 lfrlfff.exe 93 PID 3684 wrote to memory of 216 3684 lfrlfff.exe 93 PID 3684 wrote to memory of 216 3684 lfrlfff.exe 93 PID 216 wrote to memory of 1080 216 hbbtbt.exe 94 PID 216 wrote to memory of 1080 216 hbbtbt.exe 94 PID 216 wrote to memory of 1080 216 hbbtbt.exe 94 PID 1080 wrote to memory of 4984 1080 nhnbbn.exe 95 PID 1080 wrote to memory of 4984 1080 nhnbbn.exe 95 PID 1080 wrote to memory of 4984 1080 nhnbbn.exe 95 PID 4984 wrote to memory of 2444 4984 frrlfxr.exe 96 PID 4984 wrote to memory of 2444 4984 frrlfxr.exe 96 PID 4984 wrote to memory of 2444 4984 frrlfxr.exe 96 PID 2444 wrote to memory of 3492 2444 bbnhhb.exe 97 PID 2444 wrote to memory of 3492 2444 bbnhhb.exe 97 PID 2444 wrote to memory of 3492 2444 bbnhhb.exe 97 PID 3492 wrote to memory of 384 3492 thbtnn.exe 98 PID 3492 wrote to memory of 384 3492 thbtnn.exe 98 PID 3492 wrote to memory of 384 3492 thbtnn.exe 98 PID 384 wrote to memory of 1508 384 vjjdp.exe 99 PID 384 wrote to memory of 1508 384 vjjdp.exe 99 PID 384 wrote to memory of 1508 384 vjjdp.exe 99 PID 1508 wrote to memory of 320 1508 7djdd.exe 100 PID 1508 wrote to memory of 320 1508 7djdd.exe 100 PID 1508 wrote to memory of 320 1508 7djdd.exe 100 PID 320 wrote to memory of 2828 320 bnnbnh.exe 101 PID 320 wrote to memory of 2828 320 bnnbnh.exe 101 PID 320 wrote to memory of 2828 320 bnnbnh.exe 101 PID 2828 wrote to memory of 3216 2828 bbhbtt.exe 102 PID 2828 wrote to memory of 3216 2828 bbhbtt.exe 102 PID 2828 wrote to memory of 3216 2828 bbhbtt.exe 102 PID 3216 wrote to memory of 2436 3216 5ppjv.exe 103 PID 3216 wrote to memory of 2436 3216 5ppjv.exe 103 PID 3216 wrote to memory of 2436 3216 5ppjv.exe 103 PID 2436 wrote to memory of 3884 2436 fxxrllf.exe 104 PID 2436 wrote to memory of 3884 2436 fxxrllf.exe 104 PID 2436 wrote to memory of 3884 2436 fxxrllf.exe 104 PID 3884 wrote to memory of 3324 3884 hbhnhh.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\645f9fd79c2bcffdac630eb1d9f1ab3955dfc7c0ecf9d1e14b506622c14442c2N.exe"C:\Users\Admin\AppData\Local\Temp\645f9fd79c2bcffdac630eb1d9f1ab3955dfc7c0ecf9d1e14b506622c14442c2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\vjvpp.exec:\vjvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\llrxxxf.exec:\llrxxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\7bttnb.exec:\7bttnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\vdjdv.exec:\vdjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\rrlrxrx.exec:\rrlrxrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\nnhhbn.exec:\nnhhbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\dpddd.exec:\dpddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\xrrlfff.exec:\xrrlfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\lfrlfff.exec:\lfrlfff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\hbbtbt.exec:\hbbtbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\nhnbbn.exec:\nhnbbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\frrlfxr.exec:\frrlfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\bbnhhb.exec:\bbnhhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\thbtnn.exec:\thbtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\vjjdp.exec:\vjjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\7djdd.exec:\7djdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\bnnbnh.exec:\bnnbnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\bbhbtt.exec:\bbhbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\5ppjv.exec:\5ppjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\fxxrllf.exec:\fxxrllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\hbhnhh.exec:\hbhnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\ntthbb.exec:\ntthbb.exe23⤵
- Executes dropped EXE
PID:3324 -
\??\c:\vdvpp.exec:\vdvpp.exe24⤵
- Executes dropped EXE
PID:760 -
\??\c:\1djvj.exec:\1djvj.exe25⤵
- Executes dropped EXE
PID:2896 -
\??\c:\rfffrrr.exec:\rfffrrr.exe26⤵
- Executes dropped EXE
PID:5076 -
\??\c:\jvjvp.exec:\jvjvp.exe27⤵
- Executes dropped EXE
PID:4876 -
\??\c:\lfrllll.exec:\lfrllll.exe28⤵
- Executes dropped EXE
PID:3596 -
\??\c:\nhttnn.exec:\nhttnn.exe29⤵
- Executes dropped EXE
PID:1624 -
\??\c:\thhhtt.exec:\thhhtt.exe30⤵
- Executes dropped EXE
PID:4364 -
\??\c:\jdddp.exec:\jdddp.exe31⤵
- Executes dropped EXE
PID:4480 -
\??\c:\1pdpj.exec:\1pdpj.exe32⤵
- Executes dropped EXE
PID:4428 -
\??\c:\1xlflfr.exec:\1xlflfr.exe33⤵
- Executes dropped EXE
PID:2596 -
\??\c:\thbtnn.exec:\thbtnn.exe34⤵
- Executes dropped EXE
PID:372 -
\??\c:\bthtnn.exec:\bthtnn.exe35⤵
- Executes dropped EXE
PID:3808 -
\??\c:\jpjjv.exec:\jpjjv.exe36⤵
- Executes dropped EXE
PID:1680 -
\??\c:\lxrlffx.exec:\lxrlffx.exe37⤵
- Executes dropped EXE
PID:2432 -
\??\c:\7xlffxf.exec:\7xlffxf.exe38⤵
- Executes dropped EXE
PID:1044 -
\??\c:\xrrrlll.exec:\xrrrlll.exe39⤵
- Executes dropped EXE
PID:220 -
\??\c:\nbbttn.exec:\nbbttn.exe40⤵
- Executes dropped EXE
PID:3556 -
\??\c:\7ddvj.exec:\7ddvj.exe41⤵
- Executes dropped EXE
PID:2892 -
\??\c:\fxrllll.exec:\fxrllll.exe42⤵
- Executes dropped EXE
PID:1660 -
\??\c:\llllfff.exec:\llllfff.exe43⤵
- Executes dropped EXE
PID:4284 -
\??\c:\nhhbbt.exec:\nhhbbt.exe44⤵
- Executes dropped EXE
PID:2800 -
\??\c:\7ppjd.exec:\7ppjd.exe45⤵
- Executes dropped EXE
PID:2376 -
\??\c:\9vpjv.exec:\9vpjv.exe46⤵
- Executes dropped EXE
PID:2712 -
\??\c:\3ppvj.exec:\3ppvj.exe47⤵
- Executes dropped EXE
PID:2244 -
\??\c:\3rllxxr.exec:\3rllxxr.exe48⤵
- Executes dropped EXE
PID:1644 -
\??\c:\pvjjd.exec:\pvjjd.exe49⤵
- Executes dropped EXE
PID:3932 -
\??\c:\vvjdp.exec:\vvjdp.exe50⤵
- Executes dropped EXE
PID:3604 -
\??\c:\rfrxrfr.exec:\rfrxrfr.exe51⤵
- Executes dropped EXE
PID:2580 -
\??\c:\thhbhb.exec:\thhbhb.exe52⤵
- Executes dropped EXE
PID:4788 -
\??\c:\hbtbtt.exec:\hbtbtt.exe53⤵
- Executes dropped EXE
PID:1896 -
\??\c:\dvdvd.exec:\dvdvd.exe54⤵
- Executes dropped EXE
PID:2452 -
\??\c:\5llxlfx.exec:\5llxlfx.exe55⤵
- Executes dropped EXE
PID:216 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe56⤵
- Executes dropped EXE
PID:4496 -
\??\c:\bttnht.exec:\bttnht.exe57⤵
- Executes dropped EXE
PID:228 -
\??\c:\1tnnht.exec:\1tnnht.exe58⤵
- Executes dropped EXE
PID:964 -
\??\c:\vpdvj.exec:\vpdvj.exe59⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jjjjv.exec:\jjjjv.exe60⤵
- Executes dropped EXE
PID:3492 -
\??\c:\lffxlll.exec:\lffxlll.exe61⤵
- Executes dropped EXE
PID:3276 -
\??\c:\rlllffx.exec:\rlllffx.exe62⤵
- Executes dropped EXE
PID:4732 -
\??\c:\9hnnhh.exec:\9hnnhh.exe63⤵
- Executes dropped EXE
PID:5044 -
\??\c:\5vdvj.exec:\5vdvj.exe64⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vpjjv.exec:\vpjjv.exe65⤵
- Executes dropped EXE
PID:4448 -
\??\c:\7lfxrrl.exec:\7lfxrrl.exe66⤵PID:2608
-
\??\c:\xxxxrlf.exec:\xxxxrlf.exe67⤵PID:3388
-
\??\c:\1tnhhh.exec:\1tnhhh.exe68⤵PID:408
-
\??\c:\nhhbbb.exec:\nhhbbb.exe69⤵PID:4756
-
\??\c:\vvddj.exec:\vvddj.exe70⤵PID:3324
-
\??\c:\xffxllf.exec:\xffxllf.exe71⤵PID:3820
-
\??\c:\ttttnb.exec:\ttttnb.exe72⤵PID:2000
-
\??\c:\vjjvj.exec:\vjjvj.exe73⤵PID:3320
-
\??\c:\pddvp.exec:\pddvp.exe74⤵PID:5076
-
\??\c:\rlrlfff.exec:\rlrlfff.exe75⤵PID:3472
-
\??\c:\rrfxllx.exec:\rrfxllx.exe76⤵PID:3332
-
\??\c:\bbttnt.exec:\bbttnt.exe77⤵PID:4988
-
\??\c:\tnnnhh.exec:\tnnnhh.exe78⤵PID:3528
-
\??\c:\vjpjv.exec:\vjpjv.exe79⤵PID:1576
-
\??\c:\pjppj.exec:\pjppj.exe80⤵PID:864
-
\??\c:\rxflffr.exec:\rxflffr.exe81⤵PID:4744
-
\??\c:\tbtbth.exec:\tbtbth.exe82⤵PID:4716
-
\??\c:\1vvpd.exec:\1vvpd.exe83⤵PID:2396
-
\??\c:\jdvpd.exec:\jdvpd.exe84⤵PID:732
-
\??\c:\fxrlxxx.exec:\fxrlxxx.exe85⤵PID:4896
-
\??\c:\5flfrrx.exec:\5flfrrx.exe86⤵PID:2432
-
\??\c:\bthbtt.exec:\bthbtt.exe87⤵PID:3688
-
\??\c:\bhbtbt.exec:\bhbtbt.exe88⤵PID:4380
-
\??\c:\djvdv.exec:\djvdv.exe89⤵PID:4164
-
\??\c:\jdjdd.exec:\jdjdd.exe90⤵PID:2180
-
\??\c:\rrfxllx.exec:\rrfxllx.exe91⤵PID:1936
-
\??\c:\rlffxrr.exec:\rlffxrr.exe92⤵PID:2848
-
\??\c:\nbnhbn.exec:\nbnhbn.exe93⤵PID:5060
-
\??\c:\pdppd.exec:\pdppd.exe94⤵PID:3896
-
\??\c:\fffxrrl.exec:\fffxrrl.exe95⤵PID:3780
-
\??\c:\xrxrllf.exec:\xrxrllf.exe96⤵PID:908
-
\??\c:\nbbhhh.exec:\nbbhhh.exe97⤵PID:5008
-
\??\c:\hbhbtt.exec:\hbhbtt.exe98⤵PID:4368
-
\??\c:\1jjdv.exec:\1jjdv.exe99⤵PID:3012
-
\??\c:\9jjdp.exec:\9jjdp.exe100⤵PID:620
-
\??\c:\lxxrffx.exec:\lxxrffx.exe101⤵PID:2856
-
\??\c:\rrxrllf.exec:\rrxrllf.exe102⤵PID:1668
-
\??\c:\bbtttn.exec:\bbtttn.exe103⤵PID:2132
-
\??\c:\dvvvp.exec:\dvvvp.exe104⤵PID:1756
-
\??\c:\rllxfxl.exec:\rllxfxl.exe105⤵PID:1080
-
\??\c:\rfxlfrr.exec:\rfxlfrr.exe106⤵PID:4248
-
\??\c:\hbhbbb.exec:\hbhbbb.exe107⤵PID:4356
-
\??\c:\dpppp.exec:\dpppp.exe108⤵PID:2688
-
\??\c:\7pppp.exec:\7pppp.exe109⤵PID:2516
-
\??\c:\frxxxxx.exec:\frxxxxx.exe110⤵PID:880
-
\??\c:\5xfllrr.exec:\5xfllrr.exe111⤵PID:4732
-
\??\c:\hthttb.exec:\hthttb.exe112⤵PID:1016
-
\??\c:\ttttnn.exec:\ttttnn.exe113⤵PID:3220
-
\??\c:\3bnnhh.exec:\3bnnhh.exe114⤵PID:4660
-
\??\c:\3pvpj.exec:\3pvpj.exe115⤵PID:1028
-
\??\c:\ddjjj.exec:\ddjjj.exe116⤵PID:1456
-
\??\c:\xrxrlll.exec:\xrxrlll.exe117⤵PID:2428
-
\??\c:\xllrrxx.exec:\xllrrxx.exe118⤵PID:4944
-
\??\c:\3ntbbh.exec:\3ntbbh.exe119⤵PID:2228
-
\??\c:\bhtbbb.exec:\bhtbbb.exe120⤵PID:5020
-
\??\c:\9vvdv.exec:\9vvdv.exe121⤵PID:4396
-
\??\c:\jdddp.exec:\jdddp.exe122⤵PID:632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-