Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2024, 08:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b988e11899bc36d2798e843bf1885cf66151b74eae07869c89e1e19228b44611.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
b988e11899bc36d2798e843bf1885cf66151b74eae07869c89e1e19228b44611.exe
-
Size
60KB
-
MD5
c4a43197a645839e22ad1f015eecc7e4
-
SHA1
20b93c3df473d034bf2be39798e9b1e56b101df1
-
SHA256
b988e11899bc36d2798e843bf1885cf66151b74eae07869c89e1e19228b44611
-
SHA512
85c31158e33b792642764b1a3363558330e7bf041e13f0e551d0affe206936bb987060eee79dfaee6d11a42426558b1bcca334c94e09bd41805bf5707e804088
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIm2hR0fD:ymb3NkkiQ3mdBjFIsIrhRkD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3068-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1840-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1840-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/696-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/868-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3068 btnhhb.exe 5064 ddjdp.exe 4408 vjjvj.exe 3596 xfrlrrl.exe 4940 httnbt.exe 456 9dvjv.exe 1840 fxfxxxx.exe 696 rrxrfxx.exe 1260 9hhbtn.exe 1636 jvppd.exe 2380 ffxlfxr.exe 232 tnhbnb.exe 4980 vvpjd.exe 4080 vpjdv.exe 3484 rlfrlxx.exe 4328 nnhbtt.exe 1928 lffrffl.exe 4780 lxrfxlr.exe 1320 dpjdp.exe 3428 5lrlxrl.exe 712 xffxxrx.exe 4200 bhbhth.exe 3656 vjjdj.exe 4244 frrrrlr.exe 4864 5fxxrrr.exe 4344 9tbbhb.exe 1748 5ntnbb.exe 3180 ppvjj.exe 4464 9xfxlfx.exe 868 bnttbh.exe 428 dvjjp.exe 3888 fllfxxr.exe 5096 ntntth.exe 2396 1jjdv.exe 1480 jjdvp.exe 1580 fxxxffl.exe 1784 btnnhb.exe 2700 tnhnbb.exe 1100 dppjp.exe 3264 dvvvv.exe 1444 7lrllll.exe 2416 9lllfff.exe 3812 bbbbhn.exe 1180 vdjpv.exe 4968 jpddd.exe 2876 fxrlxrr.exe 912 fxxxrxr.exe 744 5bhbhh.exe 4932 ppppd.exe 3228 vdpvd.exe 4628 xllffxx.exe 3580 bttnnn.exe 5064 tbbbnt.exe 2896 ddvpd.exe 1088 fflfrlf.exe 408 lxllfrr.exe 4940 hhnnbb.exe 4008 pjjjj.exe 4240 jjjpv.exe 3460 frxxxrx.exe 976 hhbbtt.exe 696 hhbhhh.exe 544 vpjdd.exe 3600 rrffrrf.exe -
resource yara_rule behavioral2/memory/4768-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3180-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/868-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5btnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4768 wrote to memory of 3068 4768 b988e11899bc36d2798e843bf1885cf66151b74eae07869c89e1e19228b44611.exe 82 PID 4768 wrote to memory of 3068 4768 b988e11899bc36d2798e843bf1885cf66151b74eae07869c89e1e19228b44611.exe 82 PID 4768 wrote to memory of 3068 4768 b988e11899bc36d2798e843bf1885cf66151b74eae07869c89e1e19228b44611.exe 82 PID 3068 wrote to memory of 5064 3068 btnhhb.exe 83 PID 3068 wrote to memory of 5064 3068 btnhhb.exe 83 PID 3068 wrote to memory of 5064 3068 btnhhb.exe 83 PID 5064 wrote to memory of 4408 5064 ddjdp.exe 84 PID 5064 wrote to memory of 4408 5064 ddjdp.exe 84 PID 5064 wrote to memory of 4408 5064 ddjdp.exe 84 PID 4408 wrote to memory of 3596 4408 vjjvj.exe 85 PID 4408 wrote to memory of 3596 4408 vjjvj.exe 85 PID 4408 wrote to memory of 3596 4408 vjjvj.exe 85 PID 3596 wrote to memory of 4940 3596 xfrlrrl.exe 86 PID 3596 wrote to memory of 4940 3596 xfrlrrl.exe 86 PID 3596 wrote to memory of 4940 3596 xfrlrrl.exe 86 PID 4940 wrote to memory of 456 4940 httnbt.exe 87 PID 4940 wrote to memory of 456 4940 httnbt.exe 87 PID 4940 wrote to memory of 456 4940 httnbt.exe 87 PID 456 wrote to memory of 1840 456 9dvjv.exe 88 PID 456 wrote to memory of 1840 456 9dvjv.exe 88 PID 456 wrote to memory of 1840 456 9dvjv.exe 88 PID 1840 wrote to memory of 696 1840 fxfxxxx.exe 89 PID 1840 wrote to memory of 696 1840 fxfxxxx.exe 89 PID 1840 wrote to memory of 696 1840 fxfxxxx.exe 89 PID 696 wrote to memory of 1260 696 rrxrfxx.exe 90 PID 696 wrote to memory of 1260 696 rrxrfxx.exe 90 PID 696 wrote to memory of 1260 696 rrxrfxx.exe 90 PID 1260 wrote to memory of 1636 1260 9hhbtn.exe 91 PID 1260 wrote to memory of 1636 1260 9hhbtn.exe 91 PID 1260 wrote to memory of 1636 1260 9hhbtn.exe 91 PID 1636 wrote to memory of 2380 1636 jvppd.exe 92 PID 1636 wrote to memory of 2380 1636 jvppd.exe 92 PID 1636 wrote to memory of 2380 1636 jvppd.exe 92 PID 2380 wrote to memory of 232 2380 ffxlfxr.exe 93 PID 2380 wrote to memory of 232 2380 ffxlfxr.exe 93 PID 2380 wrote to memory of 232 2380 ffxlfxr.exe 93 PID 232 wrote to memory of 4980 232 tnhbnb.exe 94 PID 232 wrote to memory of 4980 232 tnhbnb.exe 94 PID 232 wrote to memory of 4980 232 tnhbnb.exe 94 PID 4980 wrote to memory of 4080 4980 vvpjd.exe 95 PID 4980 wrote to memory of 4080 4980 vvpjd.exe 95 PID 4980 wrote to memory of 4080 4980 vvpjd.exe 95 PID 4080 wrote to memory of 3484 4080 vpjdv.exe 96 PID 4080 wrote to memory of 3484 4080 vpjdv.exe 96 PID 4080 wrote to memory of 3484 4080 vpjdv.exe 96 PID 3484 wrote to memory of 4328 3484 rlfrlxx.exe 97 PID 3484 wrote to memory of 4328 3484 rlfrlxx.exe 97 PID 3484 wrote to memory of 4328 3484 rlfrlxx.exe 97 PID 4328 wrote to memory of 1928 4328 nnhbtt.exe 98 PID 4328 wrote to memory of 1928 4328 nnhbtt.exe 98 PID 4328 wrote to memory of 1928 4328 nnhbtt.exe 98 PID 1928 wrote to memory of 4780 1928 lffrffl.exe 99 PID 1928 wrote to memory of 4780 1928 lffrffl.exe 99 PID 1928 wrote to memory of 4780 1928 lffrffl.exe 99 PID 4780 wrote to memory of 1320 4780 lxrfxlr.exe 100 PID 4780 wrote to memory of 1320 4780 lxrfxlr.exe 100 PID 4780 wrote to memory of 1320 4780 lxrfxlr.exe 100 PID 1320 wrote to memory of 3428 1320 dpjdp.exe 101 PID 1320 wrote to memory of 3428 1320 dpjdp.exe 101 PID 1320 wrote to memory of 3428 1320 dpjdp.exe 101 PID 3428 wrote to memory of 712 3428 5lrlxrl.exe 102 PID 3428 wrote to memory of 712 3428 5lrlxrl.exe 102 PID 3428 wrote to memory of 712 3428 5lrlxrl.exe 102 PID 712 wrote to memory of 4200 712 xffxxrx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\b988e11899bc36d2798e843bf1885cf66151b74eae07869c89e1e19228b44611.exe"C:\Users\Admin\AppData\Local\Temp\b988e11899bc36d2798e843bf1885cf66151b74eae07869c89e1e19228b44611.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\btnhhb.exec:\btnhhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\ddjdp.exec:\ddjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\vjjvj.exec:\vjjvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\xfrlrrl.exec:\xfrlrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\httnbt.exec:\httnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\9dvjv.exec:\9dvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\rrxrfxx.exec:\rrxrfxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\9hhbtn.exec:\9hhbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\jvppd.exec:\jvppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\ffxlfxr.exec:\ffxlfxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\tnhbnb.exec:\tnhbnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\vvpjd.exec:\vvpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\vpjdv.exec:\vpjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\rlfrlxx.exec:\rlfrlxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\nnhbtt.exec:\nnhbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\lffrffl.exec:\lffrffl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\lxrfxlr.exec:\lxrfxlr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\dpjdp.exec:\dpjdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\5lrlxrl.exec:\5lrlxrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\xffxxrx.exec:\xffxxrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
\??\c:\bhbhth.exec:\bhbhth.exe23⤵
- Executes dropped EXE
PID:4200 -
\??\c:\vjjdj.exec:\vjjdj.exe24⤵
- Executes dropped EXE
PID:3656 -
\??\c:\frrrrlr.exec:\frrrrlr.exe25⤵
- Executes dropped EXE
PID:4244 -
\??\c:\5fxxrrr.exec:\5fxxrrr.exe26⤵
- Executes dropped EXE
PID:4864 -
\??\c:\9tbbhb.exec:\9tbbhb.exe27⤵
- Executes dropped EXE
PID:4344 -
\??\c:\5ntnbb.exec:\5ntnbb.exe28⤵
- Executes dropped EXE
PID:1748 -
\??\c:\ppvjj.exec:\ppvjj.exe29⤵
- Executes dropped EXE
PID:3180 -
\??\c:\9xfxlfx.exec:\9xfxlfx.exe30⤵
- Executes dropped EXE
PID:4464 -
\??\c:\bnttbh.exec:\bnttbh.exe31⤵
- Executes dropped EXE
PID:868 -
\??\c:\dvjjp.exec:\dvjjp.exe32⤵
- Executes dropped EXE
PID:428 -
\??\c:\fllfxxr.exec:\fllfxxr.exe33⤵
- Executes dropped EXE
PID:3888 -
\??\c:\ntntth.exec:\ntntth.exe34⤵
- Executes dropped EXE
PID:5096 -
\??\c:\1jjdv.exec:\1jjdv.exe35⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jjdvp.exec:\jjdvp.exe36⤵
- Executes dropped EXE
PID:1480 -
\??\c:\fxxxffl.exec:\fxxxffl.exe37⤵
- Executes dropped EXE
PID:1580 -
\??\c:\btnnhb.exec:\btnnhb.exe38⤵
- Executes dropped EXE
PID:1784 -
\??\c:\tnhnbb.exec:\tnhnbb.exe39⤵
- Executes dropped EXE
PID:2700 -
\??\c:\dppjp.exec:\dppjp.exe40⤵
- Executes dropped EXE
PID:1100 -
\??\c:\dvvvv.exec:\dvvvv.exe41⤵
- Executes dropped EXE
PID:3264 -
\??\c:\7lrllll.exec:\7lrllll.exe42⤵
- Executes dropped EXE
PID:1444 -
\??\c:\9lllfff.exec:\9lllfff.exe43⤵
- Executes dropped EXE
PID:2416 -
\??\c:\bbbbhn.exec:\bbbbhn.exe44⤵
- Executes dropped EXE
PID:3812 -
\??\c:\vdjpv.exec:\vdjpv.exe45⤵
- Executes dropped EXE
PID:1180 -
\??\c:\jpddd.exec:\jpddd.exe46⤵
- Executes dropped EXE
PID:4968 -
\??\c:\fxrlxrr.exec:\fxrlxrr.exe47⤵
- Executes dropped EXE
PID:2876 -
\??\c:\fxxxrxr.exec:\fxxxrxr.exe48⤵
- Executes dropped EXE
PID:912 -
\??\c:\5bhbhh.exec:\5bhbhh.exe49⤵
- Executes dropped EXE
PID:744 -
\??\c:\ppppd.exec:\ppppd.exe50⤵
- Executes dropped EXE
PID:4932 -
\??\c:\vdpvd.exec:\vdpvd.exe51⤵
- Executes dropped EXE
PID:3228 -
\??\c:\xllffxx.exec:\xllffxx.exe52⤵
- Executes dropped EXE
PID:4628 -
\??\c:\bttnnn.exec:\bttnnn.exe53⤵
- Executes dropped EXE
PID:3580 -
\??\c:\tbbbnt.exec:\tbbbnt.exe54⤵
- Executes dropped EXE
PID:5064 -
\??\c:\ddvpd.exec:\ddvpd.exe55⤵
- Executes dropped EXE
PID:2896 -
\??\c:\fflfrlf.exec:\fflfrlf.exe56⤵
- Executes dropped EXE
PID:1088 -
\??\c:\lxllfrr.exec:\lxllfrr.exe57⤵
- Executes dropped EXE
PID:408 -
\??\c:\hhnnbb.exec:\hhnnbb.exe58⤵
- Executes dropped EXE
PID:4940 -
\??\c:\pjjjj.exec:\pjjjj.exe59⤵
- Executes dropped EXE
PID:4008 -
\??\c:\jjjpv.exec:\jjjpv.exe60⤵
- Executes dropped EXE
PID:4240 -
\??\c:\frxxxrx.exec:\frxxxrx.exe61⤵
- Executes dropped EXE
PID:3460 -
\??\c:\hhbbtt.exec:\hhbbtt.exe62⤵
- Executes dropped EXE
PID:976 -
\??\c:\hhbhhh.exec:\hhbhhh.exe63⤵
- Executes dropped EXE
PID:696 -
\??\c:\vpjdd.exec:\vpjdd.exe64⤵
- Executes dropped EXE
PID:544 -
\??\c:\rrffrrf.exec:\rrffrrf.exe65⤵
- Executes dropped EXE
PID:3600 -
\??\c:\tbthbh.exec:\tbthbh.exe66⤵PID:1184
-
\??\c:\nhhhhh.exec:\nhhhhh.exe67⤵PID:1936
-
\??\c:\vppjd.exec:\vppjd.exe68⤵PID:1760
-
\??\c:\lllllrx.exec:\lllllrx.exe69⤵PID:1732
-
\??\c:\hbhnhh.exec:\hbhnhh.exe70⤵PID:4980
-
\??\c:\bnnhnn.exec:\bnnhnn.exe71⤵PID:2892
-
\??\c:\dvppd.exec:\dvppd.exe72⤵PID:112
-
\??\c:\lrrxxxx.exec:\lrrxxxx.exe73⤵PID:4848
-
\??\c:\vdvjd.exec:\vdvjd.exe74⤵PID:4328
-
\??\c:\fflfxrl.exec:\fflfxrl.exe75⤵PID:2560
-
\??\c:\llxlfrx.exec:\llxlfrx.exe76⤵PID:4772
-
\??\c:\tnnnhb.exec:\tnnnhb.exe77⤵PID:3836
-
\??\c:\tnnhtn.exec:\tnnhtn.exe78⤵PID:4280
-
\??\c:\vjdjv.exec:\vjdjv.exe79⤵PID:4996
-
\??\c:\rlfrfxx.exec:\rlfrfxx.exe80⤵PID:4172
-
\??\c:\nbthth.exec:\nbthth.exe81⤵PID:4388
-
\??\c:\tnhthh.exec:\tnhthh.exe82⤵PID:3408
-
\??\c:\vpppd.exec:\vpppd.exe83⤵PID:2888
-
\??\c:\1ppjj.exec:\1ppjj.exe84⤵PID:4420
-
\??\c:\lrxrrfx.exec:\lrxrrfx.exe85⤵PID:2928
-
\??\c:\fflffll.exec:\fflffll.exe86⤵PID:3820
-
\??\c:\nhnhhh.exec:\nhnhhh.exe87⤵PID:2816
-
\??\c:\vddvp.exec:\vddvp.exe88⤵PID:1600
-
\??\c:\pjvpp.exec:\pjvpp.exe89⤵PID:3212
-
\??\c:\lflffrr.exec:\lflffrr.exe90⤵PID:2024
-
\??\c:\xrxrxfl.exec:\xrxrxfl.exe91⤵PID:2880
-
\??\c:\hbbtnn.exec:\hbbtnn.exe92⤵PID:3488
-
\??\c:\bttnbb.exec:\bttnbb.exe93⤵PID:868
-
\??\c:\jvvpj.exec:\jvvpj.exe94⤵PID:4720
-
\??\c:\pjpvv.exec:\pjpvv.exe95⤵PID:4816
-
\??\c:\7ffxrlf.exec:\7ffxrlf.exe96⤵PID:4468
-
\??\c:\lrrlffx.exec:\lrrlffx.exe97⤵PID:4360
-
\??\c:\hhntnt.exec:\hhntnt.exe98⤵PID:3192
-
\??\c:\vjvpj.exec:\vjvpj.exe99⤵PID:864
-
\??\c:\vdppd.exec:\vdppd.exe100⤵PID:2260
-
\??\c:\rflfxxr.exec:\rflfxxr.exe101⤵PID:3076
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe102⤵PID:4936
-
\??\c:\hbbhbb.exec:\hbbhbb.exe103⤵PID:1588
-
\??\c:\tntnhb.exec:\tntnhb.exe104⤵PID:2828
-
\??\c:\dvvvv.exec:\dvvvv.exe105⤵PID:2656
-
\??\c:\jdvvj.exec:\jdvvj.exe106⤵PID:1144
-
\??\c:\xrffllr.exec:\xrffllr.exe107⤵PID:2964
-
\??\c:\bnnhhh.exec:\bnnhhh.exe108⤵PID:4852
-
\??\c:\bbtthh.exec:\bbtthh.exe109⤵PID:3904
-
\??\c:\tnhbnh.exec:\tnhbnh.exe110⤵PID:1676
-
\??\c:\pjvvj.exec:\pjvvj.exe111⤵PID:3400
-
\??\c:\rffxxrr.exec:\rffxxrr.exe112⤵PID:3336
-
\??\c:\rrrlrrr.exec:\rrrlrrr.exe113⤵PID:3692
-
\??\c:\9htttt.exec:\9htttt.exe114⤵PID:3908
-
\??\c:\hbtnbb.exec:\hbtnbb.exe115⤵PID:2544
-
\??\c:\tntnnn.exec:\tntnnn.exe116⤵PID:4408
-
\??\c:\3dddd.exec:\3dddd.exe117⤵PID:2220
-
\??\c:\dvvjd.exec:\dvvjd.exe118⤵PID:4728
-
\??\c:\1flfxxf.exec:\1flfxxf.exe119⤵PID:916
-
\??\c:\tnnhhh.exec:\tnnhhh.exe120⤵PID:4320
-
\??\c:\ttnhhh.exec:\ttnhhh.exe121⤵PID:3120
-
\??\c:\jpjdv.exec:\jpjdv.exe122⤵PID:2232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-