Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 14:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe
-
Size
69KB
-
MD5
4a8039cf581bbec82ee1fd8d9743cc77
-
SHA1
1cb69dd2513e70ae1f0644007ac9343e350df2da
-
SHA256
b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a
-
SHA512
23b61816860e13ba4b573bce98cdfa21437d5b051547d43215ac154b32a37094c64aacbdde9881eefb6142da861c2f1b061c69143561ec68956d05beaba561f7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAch:ymb3NkkiQ3mdBjFIsIVch
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/5060-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/948-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/836-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2884-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1992-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2092-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4600 pdjjd.exe 2620 lflrxfx.exe 3124 bnbhtb.exe 1908 pdjjd.exe 1424 pppdd.exe 3084 rlxlxxl.exe 4752 hhbthb.exe 1684 jpjvp.exe 4072 xlrrlrr.exe 3388 ntnbht.exe 2136 pvpvp.exe 4468 jdjdp.exe 948 ffrllrx.exe 836 tnthnh.exe 4216 bttnhn.exe 2032 1pjjp.exe 2924 jdvjd.exe 2884 hnbtnn.exe 1992 jvjjd.exe 2692 ffxxrxr.exe 536 nnnnnn.exe 1368 ddvdj.exe 2180 rflfxrl.exe 4780 ntbbtb.exe 2092 ppjdv.exe 5064 djpdj.exe 4716 xfrrxxr.exe 4152 3hthht.exe 2956 thntnn.exe 3516 xrfxrrr.exe 3776 ffffffl.exe 1888 hbhhhn.exe 1980 vpvvv.exe 2356 djddj.exe 208 htnhbb.exe 2508 pjpjd.exe 3440 ddvvv.exe 3344 bthhtn.exe 3048 9pvvv.exe 3508 dpvvp.exe 532 lxfxxfr.exe 1244 hthnbh.exe 628 pjddv.exe 4348 pjpjd.exe 3876 rxffrrr.exe 2656 hhnhbb.exe 544 frfrlrr.exe 2556 vvddv.exe 1212 lfffxff.exe 2620 rrllllf.exe 3124 ppdjd.exe 3916 llxlfrf.exe 5112 ddjjd.exe 4988 btbbhh.exe 396 lfxffrx.exe 3988 bhhhhh.exe 4752 ffrxlrf.exe 3732 nhhtbt.exe 2184 1vppp.exe 4072 rrfllxx.exe 4844 xxfffll.exe 2460 ttbbbb.exe 1952 btbhbh.exe 2936 dddjj.exe -
resource yara_rule behavioral2/memory/5060-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/948-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/836-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2884-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1992-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5060 wrote to memory of 4600 5060 b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe 82 PID 5060 wrote to memory of 4600 5060 b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe 82 PID 5060 wrote to memory of 4600 5060 b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe 82 PID 4600 wrote to memory of 2620 4600 pdjjd.exe 83 PID 4600 wrote to memory of 2620 4600 pdjjd.exe 83 PID 4600 wrote to memory of 2620 4600 pdjjd.exe 83 PID 2620 wrote to memory of 3124 2620 lflrxfx.exe 84 PID 2620 wrote to memory of 3124 2620 lflrxfx.exe 84 PID 2620 wrote to memory of 3124 2620 lflrxfx.exe 84 PID 3124 wrote to memory of 1908 3124 bnbhtb.exe 85 PID 3124 wrote to memory of 1908 3124 bnbhtb.exe 85 PID 3124 wrote to memory of 1908 3124 bnbhtb.exe 85 PID 1908 wrote to memory of 1424 1908 pdjjd.exe 86 PID 1908 wrote to memory of 1424 1908 pdjjd.exe 86 PID 1908 wrote to memory of 1424 1908 pdjjd.exe 86 PID 1424 wrote to memory of 3084 1424 pppdd.exe 87 PID 1424 wrote to memory of 3084 1424 pppdd.exe 87 PID 1424 wrote to memory of 3084 1424 pppdd.exe 87 PID 3084 wrote to memory of 4752 3084 rlxlxxl.exe 88 PID 3084 wrote to memory of 4752 3084 rlxlxxl.exe 88 PID 3084 wrote to memory of 4752 3084 rlxlxxl.exe 88 PID 4752 wrote to memory of 1684 4752 hhbthb.exe 89 PID 4752 wrote to memory of 1684 4752 hhbthb.exe 89 PID 4752 wrote to memory of 1684 4752 hhbthb.exe 89 PID 1684 wrote to memory of 4072 1684 jpjvp.exe 90 PID 1684 wrote to memory of 4072 1684 jpjvp.exe 90 PID 1684 wrote to memory of 4072 1684 jpjvp.exe 90 PID 4072 wrote to memory of 3388 4072 xlrrlrr.exe 91 PID 4072 wrote to memory of 3388 4072 xlrrlrr.exe 91 PID 4072 wrote to memory of 3388 4072 xlrrlrr.exe 91 PID 3388 wrote to memory of 2136 3388 ntnbht.exe 92 PID 3388 wrote to memory of 2136 3388 ntnbht.exe 92 PID 3388 wrote to memory of 2136 3388 ntnbht.exe 92 PID 2136 wrote to memory of 4468 2136 pvpvp.exe 93 PID 2136 wrote to memory of 4468 2136 pvpvp.exe 93 PID 2136 wrote to memory of 4468 2136 pvpvp.exe 93 PID 4468 wrote to memory of 948 4468 jdjdp.exe 94 PID 4468 wrote to memory of 948 4468 jdjdp.exe 94 PID 4468 wrote to memory of 948 4468 jdjdp.exe 94 PID 948 wrote to memory of 836 948 ffrllrx.exe 95 PID 948 wrote to memory of 836 948 ffrllrx.exe 95 PID 948 wrote to memory of 836 948 ffrllrx.exe 95 PID 836 wrote to memory of 4216 836 tnthnh.exe 96 PID 836 wrote to memory of 4216 836 tnthnh.exe 96 PID 836 wrote to memory of 4216 836 tnthnh.exe 96 PID 4216 wrote to memory of 2032 4216 bttnhn.exe 97 PID 4216 wrote to memory of 2032 4216 bttnhn.exe 97 PID 4216 wrote to memory of 2032 4216 bttnhn.exe 97 PID 2032 wrote to memory of 2924 2032 1pjjp.exe 98 PID 2032 wrote to memory of 2924 2032 1pjjp.exe 98 PID 2032 wrote to memory of 2924 2032 1pjjp.exe 98 PID 2924 wrote to memory of 2884 2924 jdvjd.exe 99 PID 2924 wrote to memory of 2884 2924 jdvjd.exe 99 PID 2924 wrote to memory of 2884 2924 jdvjd.exe 99 PID 2884 wrote to memory of 1992 2884 hnbtnn.exe 100 PID 2884 wrote to memory of 1992 2884 hnbtnn.exe 100 PID 2884 wrote to memory of 1992 2884 hnbtnn.exe 100 PID 1992 wrote to memory of 2692 1992 jvjjd.exe 101 PID 1992 wrote to memory of 2692 1992 jvjjd.exe 101 PID 1992 wrote to memory of 2692 1992 jvjjd.exe 101 PID 2692 wrote to memory of 536 2692 ffxxrxr.exe 102 PID 2692 wrote to memory of 536 2692 ffxxrxr.exe 102 PID 2692 wrote to memory of 536 2692 ffxxrxr.exe 102 PID 536 wrote to memory of 1368 536 nnnnnn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe"C:\Users\Admin\AppData\Local\Temp\b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\pdjjd.exec:\pdjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\lflrxfx.exec:\lflrxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\bnbhtb.exec:\bnbhtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\pdjjd.exec:\pdjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\pppdd.exec:\pppdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\rlxlxxl.exec:\rlxlxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\hhbthb.exec:\hhbthb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\jpjvp.exec:\jpjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\xlrrlrr.exec:\xlrrlrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\ntnbht.exec:\ntnbht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\pvpvp.exec:\pvpvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\jdjdp.exec:\jdjdp.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\ffrllrx.exec:\ffrllrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\tnthnh.exec:\tnthnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\bttnhn.exec:\bttnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\1pjjp.exec:\1pjjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\jdvjd.exec:\jdvjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\hnbtnn.exec:\hnbtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\jvjjd.exec:\jvjjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\ffxxrxr.exec:\ffxxrxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\nnnnnn.exec:\nnnnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\ddvdj.exec:\ddvdj.exe23⤵
- Executes dropped EXE
PID:1368 -
\??\c:\rflfxrl.exec:\rflfxrl.exe24⤵
- Executes dropped EXE
PID:2180 -
\??\c:\ntbbtb.exec:\ntbbtb.exe25⤵
- Executes dropped EXE
PID:4780 -
\??\c:\ppjdv.exec:\ppjdv.exe26⤵
- Executes dropped EXE
PID:2092 -
\??\c:\djpdj.exec:\djpdj.exe27⤵
- Executes dropped EXE
PID:5064 -
\??\c:\xfrrxxr.exec:\xfrrxxr.exe28⤵
- Executes dropped EXE
PID:4716 -
\??\c:\3hthht.exec:\3hthht.exe29⤵
- Executes dropped EXE
PID:4152 -
\??\c:\thntnn.exec:\thntnn.exe30⤵
- Executes dropped EXE
PID:2956 -
\??\c:\xrfxrrr.exec:\xrfxrrr.exe31⤵
- Executes dropped EXE
PID:3516 -
\??\c:\ffffffl.exec:\ffffffl.exe32⤵
- Executes dropped EXE
PID:3776 -
\??\c:\hbhhhn.exec:\hbhhhn.exe33⤵
- Executes dropped EXE
PID:1888 -
\??\c:\vpvvv.exec:\vpvvv.exe34⤵
- Executes dropped EXE
PID:1980 -
\??\c:\djddj.exec:\djddj.exe35⤵
- Executes dropped EXE
PID:2356 -
\??\c:\htnhbb.exec:\htnhbb.exe36⤵
- Executes dropped EXE
PID:208 -
\??\c:\pjpjd.exec:\pjpjd.exe37⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ddvvv.exec:\ddvvv.exe38⤵
- Executes dropped EXE
PID:3440 -
\??\c:\bthhtn.exec:\bthhtn.exe39⤵
- Executes dropped EXE
PID:3344 -
\??\c:\9pvvv.exec:\9pvvv.exe40⤵
- Executes dropped EXE
PID:3048 -
\??\c:\dpvvp.exec:\dpvvp.exe41⤵
- Executes dropped EXE
PID:3508 -
\??\c:\lxfxxfr.exec:\lxfxxfr.exe42⤵
- Executes dropped EXE
PID:532 -
\??\c:\hthnbh.exec:\hthnbh.exe43⤵
- Executes dropped EXE
PID:1244 -
\??\c:\pjddv.exec:\pjddv.exe44⤵
- Executes dropped EXE
PID:628 -
\??\c:\pjpjd.exec:\pjpjd.exe45⤵
- Executes dropped EXE
PID:4348 -
\??\c:\rxffrrr.exec:\rxffrrr.exe46⤵
- Executes dropped EXE
PID:3876 -
\??\c:\hhnhbb.exec:\hhnhbb.exe47⤵
- Executes dropped EXE
PID:2656 -
\??\c:\frfrlrr.exec:\frfrlrr.exe48⤵
- Executes dropped EXE
PID:544 -
\??\c:\vvddv.exec:\vvddv.exe49⤵
- Executes dropped EXE
PID:2556 -
\??\c:\lfffxff.exec:\lfffxff.exe50⤵
- Executes dropped EXE
PID:1212 -
\??\c:\rrllllf.exec:\rrllllf.exe51⤵
- Executes dropped EXE
PID:2620 -
\??\c:\ppdjd.exec:\ppdjd.exe52⤵
- Executes dropped EXE
PID:3124 -
\??\c:\llxlfrf.exec:\llxlfrf.exe53⤵
- Executes dropped EXE
PID:3916 -
\??\c:\ddjjd.exec:\ddjjd.exe54⤵
- Executes dropped EXE
PID:5112 -
\??\c:\btbbhh.exec:\btbbhh.exe55⤵
- Executes dropped EXE
PID:4988 -
\??\c:\lfxffrx.exec:\lfxffrx.exe56⤵
- Executes dropped EXE
PID:396 -
\??\c:\bhhhhh.exec:\bhhhhh.exe57⤵
- Executes dropped EXE
PID:3988 -
\??\c:\ffrxlrf.exec:\ffrxlrf.exe58⤵
- Executes dropped EXE
PID:4752 -
\??\c:\nhhtbt.exec:\nhhtbt.exe59⤵
- Executes dropped EXE
PID:3732 -
\??\c:\1vppp.exec:\1vppp.exe60⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rrfllxx.exec:\rrfllxx.exe61⤵
- Executes dropped EXE
PID:4072 -
\??\c:\xxfffll.exec:\xxfffll.exe62⤵
- Executes dropped EXE
PID:4844 -
\??\c:\ttbbbb.exec:\ttbbbb.exe63⤵
- Executes dropped EXE
PID:2460 -
\??\c:\btbhbh.exec:\btbhbh.exe64⤵
- Executes dropped EXE
PID:1952 -
\??\c:\dddjj.exec:\dddjj.exe65⤵
- Executes dropped EXE
PID:2936 -
\??\c:\frxlrlr.exec:\frxlrlr.exe66⤵PID:4908
-
\??\c:\hnbbht.exec:\hnbbht.exe67⤵PID:4548
-
\??\c:\vpjjp.exec:\vpjjp.exe68⤵PID:4144
-
\??\c:\lfxrlrr.exec:\lfxrlrr.exe69⤵PID:112
-
\??\c:\hbhnnh.exec:\hbhnnh.exe70⤵PID:2428
-
\??\c:\ppdpv.exec:\ppdpv.exe71⤵PID:3960
-
\??\c:\tnthbt.exec:\tnthbt.exe72⤵PID:2924
-
\??\c:\thhhtt.exec:\thhhtt.exe73⤵PID:3372
-
\??\c:\djjpd.exec:\djjpd.exe74⤵PID:4004
-
\??\c:\rrxxlrf.exec:\rrxxlrf.exe75⤵PID:2044
-
\??\c:\httbbn.exec:\httbbn.exe76⤵PID:3276
-
\??\c:\jjpdv.exec:\jjpdv.exe77⤵PID:3420
-
\??\c:\vdpvv.exec:\vdpvv.exe78⤵PID:224
-
\??\c:\ddjjv.exec:\ddjjv.exe79⤵PID:64
-
\??\c:\nbtttt.exec:\nbtttt.exe80⤵PID:4212
-
\??\c:\pjdpd.exec:\pjdpd.exe81⤵PID:4784
-
\??\c:\flxxffr.exec:\flxxffr.exe82⤵PID:2832
-
\??\c:\3vpdp.exec:\3vpdp.exe83⤵PID:2068
-
\??\c:\jjpjd.exec:\jjpjd.exe84⤵PID:4716
-
\??\c:\xlflrfx.exec:\xlflrfx.exe85⤵PID:1668
-
\??\c:\hbbhhb.exec:\hbbhhb.exe86⤵PID:1184
-
\??\c:\dvjjj.exec:\dvjjj.exe87⤵PID:776
-
\??\c:\1dddv.exec:\1dddv.exe88⤵PID:644
-
\??\c:\5rrlxxx.exec:\5rrlxxx.exe89⤵PID:1744
-
\??\c:\bnbbth.exec:\bnbbth.exe90⤵PID:1888
-
\??\c:\jdpvv.exec:\jdpvv.exe91⤵PID:4528
-
\??\c:\vdjjp.exec:\vdjjp.exe92⤵PID:1532
-
\??\c:\1llrllr.exec:\1llrllr.exe93⤵PID:1688
-
\??\c:\3rfrxrf.exec:\3rfrxrf.exe94⤵PID:3880
-
\??\c:\hhtntt.exec:\hhtntt.exe95⤵PID:2212
-
\??\c:\jvdvv.exec:\jvdvv.exe96⤵PID:624
-
\??\c:\vvjjj.exec:\vvjjj.exe97⤵PID:1792
-
\??\c:\fllfffl.exec:\fllfffl.exe98⤵PID:2292
-
\??\c:\nttbht.exec:\nttbht.exe99⤵PID:628
-
\??\c:\tntttt.exec:\tntttt.exe100⤵PID:4632
-
\??\c:\dppjj.exec:\dppjj.exe101⤵PID:2656
-
\??\c:\jvddv.exec:\jvddv.exe102⤵PID:2616
-
\??\c:\rrllrxr.exec:\rrllrxr.exe103⤵PID:3396
-
\??\c:\9nbbbh.exec:\9nbbbh.exe104⤵PID:1528
-
\??\c:\btnhhh.exec:\btnhhh.exe105⤵PID:4464
-
\??\c:\jddvp.exec:\jddvp.exe106⤵PID:3916
-
\??\c:\xlrlxfx.exec:\xlrlxfx.exe107⤵PID:5112
-
\??\c:\rxflflf.exec:\rxflflf.exe108⤵PID:2504
-
\??\c:\tthhnt.exec:\tthhnt.exe109⤵PID:3704
-
\??\c:\vvjjj.exec:\vvjjj.exe110⤵PID:3076
-
\??\c:\3lrrrfx.exec:\3lrrrfx.exe111⤵PID:3448
-
\??\c:\bbtttb.exec:\bbtttb.exe112⤵PID:632
-
\??\c:\jddvp.exec:\jddvp.exe113⤵PID:2364
-
\??\c:\pdvpd.exec:\pdvpd.exe114⤵PID:4744
-
\??\c:\bnbbtt.exec:\bnbbtt.exe115⤵PID:2716
-
\??\c:\jpvpj.exec:\jpvpj.exe116⤵PID:1148
-
\??\c:\hbhhbh.exec:\hbhhbh.exe117⤵PID:5044
-
\??\c:\xfrlflx.exec:\xfrlflx.exe118⤵PID:4228
-
\??\c:\hnnhbt.exec:\hnnhbt.exe119⤵PID:4424
-
\??\c:\thbhbn.exec:\thbhbn.exe120⤵PID:4644
-
\??\c:\dvdpj.exec:\dvdpj.exe121⤵PID:4224
-
\??\c:\lrrffrx.exec:\lrrffrx.exe122⤵PID:112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-