Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 14:28
Static task
static1
Behavioral task
behavioral1
Sample
de022f0fd09f1b861d42e439b95e4367cb0e981a9de8d3a4f0ce7039793324a8N.exe
Resource
win7-20241023-en
General
-
Target
de022f0fd09f1b861d42e439b95e4367cb0e981a9de8d3a4f0ce7039793324a8N.exe
-
Size
69KB
-
MD5
928d70ff98f275c234ddc97332b58c90
-
SHA1
70a7ef3237b22c41c7e2f2e7db120f39c0de9ed6
-
SHA256
de022f0fd09f1b861d42e439b95e4367cb0e981a9de8d3a4f0ce7039793324a8
-
SHA512
4c1c95cf4d3fda5415be63b034e851f0c0288c8600268560bdcda308f2542fea6037ece528963e1f35a2eaa4b19e9db330a2799c3853f770eb86ae00283c5cb3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAcb:ymb3NkkiQ3mdBjFIsIVcb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/1820-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5hnhbb.exe9vvpj.exejpdvp.exelxxxrrl.exelxrllff.exehhbbtt.exevddpd.exexxfrxxl.exerflfrll.exebttnnn.exejddvp.exellrlllf.exe5ntnhn.exenhnttt.exejjjdv.exexrllfll.exe9btttt.exevppjj.exerlrxllr.exetnnnhh.exebtbhbn.exevvddv.exerlxxffl.exe7frrfff.exenbbbtt.exe3tnbtn.exejpdvp.exepppjj.exefrrlfxr.exe3nbbbt.exebttnnn.exevvpjd.exerxxlxrl.exe1hnnbt.exevjddd.exerxrllff.exelfxrlrr.exetnbbhh.exe3nnbbb.exe5jvpj.exexxllrxx.exetnnnhh.exevdjjd.exe9pvvp.exellxrllr.exe5bbbtt.exe9hnnnt.exedpvpp.exe1xlfxxf.exebbbthh.exejjdvd.exexrfxlrf.exe1hhhbb.exedpjvp.exe5llfxfx.exenhhhtt.exe5btnbb.exedjvpd.exe9llfxxr.exenhhbbn.exenthbbb.exe3lrrlll.exefrxxrxx.exethttbh.exepid Process 2084 5hnhbb.exe 5072 9vvpj.exe 4220 jpdvp.exe 2760 lxxxrrl.exe 1056 lxrllff.exe 3256 hhbbtt.exe 2756 vddpd.exe 1952 xxfrxxl.exe 4832 rflfrll.exe 4904 bttnnn.exe 3016 jddvp.exe 4880 llrlllf.exe 1976 5ntnhn.exe 3020 nhnttt.exe 3672 jjjdv.exe 3184 xrllfll.exe 3192 9btttt.exe 3656 vppjj.exe 468 rlrxllr.exe 4568 tnnnhh.exe 2304 btbhbn.exe 1448 vvddv.exe 1084 rlxxffl.exe 1356 7frrfff.exe 3912 nbbbtt.exe 5092 3tnbtn.exe 4820 jpdvp.exe 4632 pppjj.exe 1720 frrlfxr.exe 5096 3nbbbt.exe 1652 bttnnn.exe 4244 vvpjd.exe 4856 rxxlxrl.exe 2712 1hnnbt.exe 2360 vjddd.exe 4908 rxrllff.exe 2012 lfxrlrr.exe 3956 tnbbhh.exe 2240 3nnbbb.exe 4052 5jvpj.exe 3404 xxllrxx.exe 2408 tnnnhh.exe 3292 vdjjd.exe 4404 9pvvp.exe 920 llxrllr.exe 1740 5bbbtt.exe 2676 9hnnnt.exe 548 dpvpp.exe 4432 1xlfxxf.exe 1068 bbbthh.exe 2760 jjdvd.exe 4848 xrfxlrf.exe 1504 1hhhbb.exe 1328 dpjvp.exe 2016 5llfxfx.exe 516 nhhhtt.exe 4160 5btnbb.exe 2496 djvpd.exe 2872 9llfxxr.exe 5056 nhhbbn.exe 3268 nthbbb.exe 4880 3lrrlll.exe 400 frxxrxx.exe 3800 thttbh.exe -
Processes:
resource yara_rule behavioral2/memory/1820-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1356-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
dvvjj.exe1bhbtt.exe3vppj.exebtbtnn.exe7nnhth.exe1ntnhb.exetnbbnn.exeppddj.exerlxrlrl.exelffxfff.exe5dvpv.exelffxrrl.exerxffffx.exelxxrlff.exexrfxxxl.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
de022f0fd09f1b861d42e439b95e4367cb0e981a9de8d3a4f0ce7039793324a8N.exe5hnhbb.exe9vvpj.exejpdvp.exelxxxrrl.exelxrllff.exehhbbtt.exevddpd.exexxfrxxl.exerflfrll.exebttnnn.exejddvp.exellrlllf.exe5ntnhn.exenhnttt.exejjjdv.exexrllfll.exe9btttt.exevppjj.exerlrxllr.exetnnnhh.exebtbhbn.exedescription pid Process procid_target PID 1820 wrote to memory of 2084 1820 de022f0fd09f1b861d42e439b95e4367cb0e981a9de8d3a4f0ce7039793324a8N.exe 83 PID 1820 wrote to memory of 2084 1820 de022f0fd09f1b861d42e439b95e4367cb0e981a9de8d3a4f0ce7039793324a8N.exe 83 PID 1820 wrote to memory of 2084 1820 de022f0fd09f1b861d42e439b95e4367cb0e981a9de8d3a4f0ce7039793324a8N.exe 83 PID 2084 wrote to memory of 5072 2084 5hnhbb.exe 84 PID 2084 wrote to memory of 5072 2084 5hnhbb.exe 84 PID 2084 wrote to memory of 5072 2084 5hnhbb.exe 84 PID 5072 wrote to memory of 4220 5072 9vvpj.exe 85 PID 5072 wrote to memory of 4220 5072 9vvpj.exe 85 PID 5072 wrote to memory of 4220 5072 9vvpj.exe 85 PID 4220 wrote to memory of 2760 4220 jpdvp.exe 86 PID 4220 wrote to memory of 2760 4220 jpdvp.exe 86 PID 4220 wrote to memory of 2760 4220 jpdvp.exe 86 PID 2760 wrote to memory of 1056 2760 lxxxrrl.exe 87 PID 2760 wrote to memory of 1056 2760 lxxxrrl.exe 87 PID 2760 wrote to memory of 1056 2760 lxxxrrl.exe 87 PID 1056 wrote to memory of 3256 1056 lxrllff.exe 88 PID 1056 wrote to memory of 3256 1056 lxrllff.exe 88 PID 1056 wrote to memory of 3256 1056 lxrllff.exe 88 PID 3256 wrote to memory of 2756 3256 hhbbtt.exe 89 PID 3256 wrote to memory of 2756 3256 hhbbtt.exe 89 PID 3256 wrote to memory of 2756 3256 hhbbtt.exe 89 PID 2756 wrote to memory of 1952 2756 vddpd.exe 90 PID 2756 wrote to memory of 1952 2756 vddpd.exe 90 PID 2756 wrote to memory of 1952 2756 vddpd.exe 90 PID 1952 wrote to memory of 4832 1952 xxfrxxl.exe 91 PID 1952 wrote to memory of 4832 1952 xxfrxxl.exe 91 PID 1952 wrote to memory of 4832 1952 xxfrxxl.exe 91 PID 4832 wrote to memory of 4904 4832 rflfrll.exe 92 PID 4832 wrote to memory of 4904 4832 rflfrll.exe 92 PID 4832 wrote to memory of 4904 4832 rflfrll.exe 92 PID 4904 wrote to memory of 3016 4904 bttnnn.exe 93 PID 4904 wrote to memory of 3016 4904 bttnnn.exe 93 PID 4904 wrote to memory of 3016 4904 bttnnn.exe 93 PID 3016 wrote to memory of 4880 3016 jddvp.exe 94 PID 3016 wrote to memory of 4880 3016 jddvp.exe 94 PID 3016 wrote to memory of 4880 3016 jddvp.exe 94 PID 4880 wrote to memory of 1976 4880 llrlllf.exe 95 PID 4880 wrote to memory of 1976 4880 llrlllf.exe 95 PID 4880 wrote to memory of 1976 4880 llrlllf.exe 95 PID 1976 wrote to memory of 3020 1976 5ntnhn.exe 96 PID 1976 wrote to memory of 3020 1976 5ntnhn.exe 96 PID 1976 wrote to memory of 3020 1976 5ntnhn.exe 96 PID 3020 wrote to memory of 3672 3020 nhnttt.exe 97 PID 3020 wrote to memory of 3672 3020 nhnttt.exe 97 PID 3020 wrote to memory of 3672 3020 nhnttt.exe 97 PID 3672 wrote to memory of 3184 3672 jjjdv.exe 98 PID 3672 wrote to memory of 3184 3672 jjjdv.exe 98 PID 3672 wrote to memory of 3184 3672 jjjdv.exe 98 PID 3184 wrote to memory of 3192 3184 xrllfll.exe 99 PID 3184 wrote to memory of 3192 3184 xrllfll.exe 99 PID 3184 wrote to memory of 3192 3184 xrllfll.exe 99 PID 3192 wrote to memory of 3656 3192 9btttt.exe 100 PID 3192 wrote to memory of 3656 3192 9btttt.exe 100 PID 3192 wrote to memory of 3656 3192 9btttt.exe 100 PID 3656 wrote to memory of 468 3656 vppjj.exe 101 PID 3656 wrote to memory of 468 3656 vppjj.exe 101 PID 3656 wrote to memory of 468 3656 vppjj.exe 101 PID 468 wrote to memory of 4568 468 rlrxllr.exe 102 PID 468 wrote to memory of 4568 468 rlrxllr.exe 102 PID 468 wrote to memory of 4568 468 rlrxllr.exe 102 PID 4568 wrote to memory of 2304 4568 tnnnhh.exe 103 PID 4568 wrote to memory of 2304 4568 tnnnhh.exe 103 PID 4568 wrote to memory of 2304 4568 tnnnhh.exe 103 PID 2304 wrote to memory of 1448 2304 btbhbn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\de022f0fd09f1b861d42e439b95e4367cb0e981a9de8d3a4f0ce7039793324a8N.exe"C:\Users\Admin\AppData\Local\Temp\de022f0fd09f1b861d42e439b95e4367cb0e981a9de8d3a4f0ce7039793324a8N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\5hnhbb.exec:\5hnhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\9vvpj.exec:\9vvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\jpdvp.exec:\jpdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\lxxxrrl.exec:\lxxxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\lxrllff.exec:\lxrllff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\hhbbtt.exec:\hhbbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\vddpd.exec:\vddpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\xxfrxxl.exec:\xxfrxxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\rflfrll.exec:\rflfrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\bttnnn.exec:\bttnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\jddvp.exec:\jddvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\llrlllf.exec:\llrlllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\5ntnhn.exec:\5ntnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\nhnttt.exec:\nhnttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\jjjdv.exec:\jjjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\xrllfll.exec:\xrllfll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\9btttt.exec:\9btttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\vppjj.exec:\vppjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\rlrxllr.exec:\rlrxllr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\tnnnhh.exec:\tnnnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\btbhbn.exec:\btbhbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\vvddv.exec:\vvddv.exe23⤵
- Executes dropped EXE
PID:1448 -
\??\c:\rlxxffl.exec:\rlxxffl.exe24⤵
- Executes dropped EXE
PID:1084 -
\??\c:\7frrfff.exec:\7frrfff.exe25⤵
- Executes dropped EXE
PID:1356 -
\??\c:\nbbbtt.exec:\nbbbtt.exe26⤵
- Executes dropped EXE
PID:3912 -
\??\c:\3tnbtn.exec:\3tnbtn.exe27⤵
- Executes dropped EXE
PID:5092 -
\??\c:\jpdvp.exec:\jpdvp.exe28⤵
- Executes dropped EXE
PID:4820 -
\??\c:\pppjj.exec:\pppjj.exe29⤵
- Executes dropped EXE
PID:4632 -
\??\c:\frrlfxr.exec:\frrlfxr.exe30⤵
- Executes dropped EXE
PID:1720 -
\??\c:\3nbbbt.exec:\3nbbbt.exe31⤵
- Executes dropped EXE
PID:5096 -
\??\c:\bttnnn.exec:\bttnnn.exe32⤵
- Executes dropped EXE
PID:1652 -
\??\c:\vvpjd.exec:\vvpjd.exe33⤵
- Executes dropped EXE
PID:4244 -
\??\c:\rxxlxrl.exec:\rxxlxrl.exe34⤵
- Executes dropped EXE
PID:4856 -
\??\c:\1hnnbt.exec:\1hnnbt.exe35⤵
- Executes dropped EXE
PID:2712 -
\??\c:\vjddd.exec:\vjddd.exe36⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rxrllff.exec:\rxrllff.exe37⤵
- Executes dropped EXE
PID:4908 -
\??\c:\lfxrlrr.exec:\lfxrlrr.exe38⤵
- Executes dropped EXE
PID:2012 -
\??\c:\tnbbhh.exec:\tnbbhh.exe39⤵
- Executes dropped EXE
PID:3956 -
\??\c:\3nnbbb.exec:\3nnbbb.exe40⤵
- Executes dropped EXE
PID:2240 -
\??\c:\5jvpj.exec:\5jvpj.exe41⤵
- Executes dropped EXE
PID:4052 -
\??\c:\xxllrxx.exec:\xxllrxx.exe42⤵
- Executes dropped EXE
PID:3404 -
\??\c:\tnnnhh.exec:\tnnnhh.exe43⤵
- Executes dropped EXE
PID:2408 -
\??\c:\vdjjd.exec:\vdjjd.exe44⤵
- Executes dropped EXE
PID:3292 -
\??\c:\9pvvp.exec:\9pvvp.exe45⤵
- Executes dropped EXE
PID:4404 -
\??\c:\llxrllr.exec:\llxrllr.exe46⤵
- Executes dropped EXE
PID:920 -
\??\c:\5bbbtt.exec:\5bbbtt.exe47⤵
- Executes dropped EXE
PID:1740 -
\??\c:\9hnnnt.exec:\9hnnnt.exe48⤵
- Executes dropped EXE
PID:2676 -
\??\c:\dpvpp.exec:\dpvpp.exe49⤵
- Executes dropped EXE
PID:548 -
\??\c:\1xlfxxf.exec:\1xlfxxf.exe50⤵
- Executes dropped EXE
PID:4432 -
\??\c:\bbbthh.exec:\bbbthh.exe51⤵
- Executes dropped EXE
PID:1068 -
\??\c:\jjdvd.exec:\jjdvd.exe52⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xrfxlrf.exec:\xrfxlrf.exe53⤵
- Executes dropped EXE
PID:4848 -
\??\c:\1hhhbb.exec:\1hhhbb.exe54⤵
- Executes dropped EXE
PID:1504 -
\??\c:\dpjvp.exec:\dpjvp.exe55⤵
- Executes dropped EXE
PID:1328 -
\??\c:\5llfxfx.exec:\5llfxfx.exe56⤵
- Executes dropped EXE
PID:2016 -
\??\c:\nhhhtt.exec:\nhhhtt.exe57⤵
- Executes dropped EXE
PID:516 -
\??\c:\5btnbb.exec:\5btnbb.exe58⤵
- Executes dropped EXE
PID:4160 -
\??\c:\djvpd.exec:\djvpd.exe59⤵
- Executes dropped EXE
PID:2496 -
\??\c:\9llfxxr.exec:\9llfxxr.exe60⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nhhbbn.exec:\nhhbbn.exe61⤵
- Executes dropped EXE
PID:5056 -
\??\c:\nthbbb.exec:\nthbbb.exe62⤵
- Executes dropped EXE
PID:3268 -
\??\c:\3lrrlll.exec:\3lrrlll.exe63⤵
- Executes dropped EXE
PID:4880 -
\??\c:\frxxrxx.exec:\frxxrxx.exe64⤵
- Executes dropped EXE
PID:400 -
\??\c:\thttbh.exec:\thttbh.exe65⤵
- Executes dropped EXE
PID:3800 -
\??\c:\ththtn.exec:\ththtn.exe66⤵PID:556
-
\??\c:\pjjpd.exec:\pjjpd.exe67⤵PID:2804
-
\??\c:\1dpjv.exec:\1dpjv.exe68⤵PID:1852
-
\??\c:\rrxfrrr.exec:\rrxfrrr.exe69⤵PID:1428
-
\??\c:\htthbt.exec:\htthbt.exe70⤵PID:868
-
\??\c:\7htnbb.exec:\7htnbb.exe71⤵PID:3244
-
\??\c:\dvdvd.exec:\dvdvd.exe72⤵PID:372
-
\??\c:\pdvpd.exec:\pdvpd.exe73⤵PID:656
-
\??\c:\3flfxxx.exec:\3flfxxx.exe74⤵PID:4568
-
\??\c:\tnnnhh.exec:\tnnnhh.exe75⤵PID:4508
-
\??\c:\bnbnht.exec:\bnbnht.exe76⤵PID:2356
-
\??\c:\pjjdv.exec:\pjjdv.exe77⤵PID:4784
-
\??\c:\frxrxlx.exec:\frxrxlx.exe78⤵PID:1084
-
\??\c:\rrrlxxl.exec:\rrrlxxl.exe79⤵PID:1816
-
\??\c:\btbbbb.exec:\btbbbb.exe80⤵PID:916
-
\??\c:\thntnn.exec:\thntnn.exe81⤵PID:2372
-
\??\c:\xffxrll.exec:\xffxrll.exe82⤵PID:2988
-
\??\c:\7xrlxfx.exec:\7xrlxfx.exe83⤵PID:2656
-
\??\c:\bbbtnh.exec:\bbbtnh.exe84⤵PID:1252
-
\??\c:\ntbbnn.exec:\ntbbnn.exe85⤵PID:848
-
\??\c:\dvvdp.exec:\dvvdp.exe86⤵PID:4900
-
\??\c:\jpvpd.exec:\jpvpd.exe87⤵PID:1644
-
\??\c:\xrffffx.exec:\xrffffx.exe88⤵PID:1488
-
\??\c:\hbbhhn.exec:\hbbhhn.exe89⤵PID:964
-
\??\c:\5tnnbb.exec:\5tnnbb.exe90⤵PID:4368
-
\??\c:\pdjvp.exec:\pdjvp.exe91⤵PID:2620
-
\??\c:\jvjjd.exec:\jvjjd.exe92⤵PID:3272
-
\??\c:\fflllll.exec:\fflllll.exe93⤵PID:3472
-
\??\c:\5flfxxx.exec:\5flfxxx.exe94⤵PID:3956
-
\??\c:\tthbtb.exec:\tthbtb.exe95⤵PID:2008
-
\??\c:\vpdpj.exec:\vpdpj.exe96⤵PID:4052
-
\??\c:\pjjjd.exec:\pjjjd.exe97⤵PID:3404
-
\??\c:\xfffrrr.exec:\xfffrrr.exe98⤵PID:2408
-
\??\c:\xxxrllf.exec:\xxxrllf.exe99⤵PID:3292
-
\??\c:\hhhbhh.exec:\hhhbhh.exe100⤵PID:3988
-
\??\c:\nbbbtn.exec:\nbbbtn.exe101⤵PID:4852
-
\??\c:\3ppvj.exec:\3ppvj.exe102⤵PID:4776
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe103⤵PID:2592
-
\??\c:\frffffx.exec:\frffffx.exe104⤵PID:4696
-
\??\c:\7rfxflx.exec:\7rfxflx.exe105⤵PID:1120
-
\??\c:\tnttnt.exec:\tnttnt.exe106⤵PID:3740
-
\??\c:\vpvvj.exec:\vpvvj.exe107⤵PID:1056
-
\??\c:\jjpjv.exec:\jjpjv.exe108⤵PID:4848
-
\??\c:\fxxllff.exec:\fxxllff.exe109⤵PID:1504
-
\??\c:\bhntnt.exec:\bhntnt.exe110⤵PID:3532
-
\??\c:\3hhbnn.exec:\3hhbnn.exe111⤵PID:456
-
\??\c:\3pvvp.exec:\3pvvp.exe112⤵PID:4832
-
\??\c:\9xxrrrx.exec:\9xxrrrx.exe113⤵PID:4160
-
\??\c:\7frrrxx.exec:\7frrrxx.exe114⤵PID:2436
-
\??\c:\hntnhh.exec:\hntnhh.exe115⤵PID:3496
-
\??\c:\jdppd.exec:\jdppd.exe116⤵PID:1688
-
\??\c:\jvdvv.exec:\jvdvv.exe117⤵PID:808
-
\??\c:\xlrrrxf.exec:\xlrrrxf.exe118⤵PID:4652
-
\??\c:\xxfxlfx.exec:\xxfxlfx.exe119⤵PID:4716
-
\??\c:\1bbthb.exec:\1bbthb.exe120⤵PID:3800
-
\??\c:\nhbnbt.exec:\nhbnbt.exe121⤵PID:3228
-
\??\c:\pddvp.exec:\pddvp.exe122⤵PID:2044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-