Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2024 15:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a98ec67a2556f073eb240ee5afc5fc54a86fa5b878d12d4805e145c6abccc0c3N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
a98ec67a2556f073eb240ee5afc5fc54a86fa5b878d12d4805e145c6abccc0c3N.exe
-
Size
105KB
-
MD5
d25a27c8c8263759cb09d086019d1af0
-
SHA1
705a4a9bfe25306ff3e40e2486e151c22069947e
-
SHA256
a98ec67a2556f073eb240ee5afc5fc54a86fa5b878d12d4805e145c6abccc0c3
-
SHA512
0af2e2ce0f2aa7abd2aa8b74c7d027ec984df27c2ee98d057fbdbaaf7aed65cb30f89630b1eb8bad95a7cda57bf98baf001e7f932cf581b599991d5913f56016
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHq82PC/:n3C9BRo7tvnJ99T/KZE89/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/264-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2804-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1340-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/936-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1636 ttnnnn.exe 3280 vppjd.exe 4784 flrrxxx.exe 2804 thbtnh.exe 1236 vjdjj.exe 3648 lrrrrxx.exe 4464 bhhhhh.exe 2908 7dvpj.exe 2036 lfxxrrr.exe 2044 9tbbbh.exe 1900 rlfxxrr.exe 4720 rllxrrl.exe 4264 thnhhh.exe 2224 jvddv.exe 1340 fffxrrl.exe 1412 1lxrrrx.exe 5000 dvppj.exe 1784 3dpdd.exe 4908 llxxrrl.exe 408 ttbthh.exe 2788 7jjdv.exe 4140 frfflll.exe 4896 nnnbtt.exe 1708 httnhh.exe 4256 7jppp.exe 3548 7bhbbb.exe 936 9nhnnt.exe 3028 pvvpj.exe 516 1bbhhn.exe 1948 5bhhbb.exe 3244 jjjdd.exe 1244 rrfxxxx.exe 1240 thnbtb.exe 3256 9hhhbh.exe 1224 3pvdd.exe 3932 jjddp.exe 4588 xxlrllf.exe 1500 tbnntb.exe 1104 nnnnhb.exe 616 vppjd.exe 3504 rxffxfl.exe 4408 lflffll.exe 3808 tbbbbb.exe 3112 vddvp.exe 2236 ppdjd.exe 1140 lfrllll.exe 2324 xlffxxr.exe 2872 tttnhh.exe 4784 pppjd.exe 2768 jppdd.exe 4044 flflffl.exe 2692 tttbbh.exe 4700 ppddd.exe 4560 lrlfllf.exe 4900 bbhhhn.exe 4088 vvpvv.exe 1268 pvjdd.exe 4504 fxlfxxr.exe 4260 ntbbtt.exe 4508 7bttnt.exe 4008 5pvvv.exe 1860 rlffxxr.exe 4360 ppdvj.exe 1360 ppddd.exe -
resource yara_rule behavioral2/memory/264-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2804-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1340-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/936-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1948-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 264 wrote to memory of 1636 264 a98ec67a2556f073eb240ee5afc5fc54a86fa5b878d12d4805e145c6abccc0c3N.exe 86 PID 264 wrote to memory of 1636 264 a98ec67a2556f073eb240ee5afc5fc54a86fa5b878d12d4805e145c6abccc0c3N.exe 86 PID 264 wrote to memory of 1636 264 a98ec67a2556f073eb240ee5afc5fc54a86fa5b878d12d4805e145c6abccc0c3N.exe 86 PID 1636 wrote to memory of 3280 1636 ttnnnn.exe 87 PID 1636 wrote to memory of 3280 1636 ttnnnn.exe 87 PID 1636 wrote to memory of 3280 1636 ttnnnn.exe 87 PID 3280 wrote to memory of 4784 3280 vppjd.exe 88 PID 3280 wrote to memory of 4784 3280 vppjd.exe 88 PID 3280 wrote to memory of 4784 3280 vppjd.exe 88 PID 4784 wrote to memory of 2804 4784 flrrxxx.exe 89 PID 4784 wrote to memory of 2804 4784 flrrxxx.exe 89 PID 4784 wrote to memory of 2804 4784 flrrxxx.exe 89 PID 2804 wrote to memory of 1236 2804 thbtnh.exe 90 PID 2804 wrote to memory of 1236 2804 thbtnh.exe 90 PID 2804 wrote to memory of 1236 2804 thbtnh.exe 90 PID 1236 wrote to memory of 3648 1236 vjdjj.exe 91 PID 1236 wrote to memory of 3648 1236 vjdjj.exe 91 PID 1236 wrote to memory of 3648 1236 vjdjj.exe 91 PID 3648 wrote to memory of 4464 3648 lrrrrxx.exe 92 PID 3648 wrote to memory of 4464 3648 lrrrrxx.exe 92 PID 3648 wrote to memory of 4464 3648 lrrrrxx.exe 92 PID 4464 wrote to memory of 2908 4464 bhhhhh.exe 93 PID 4464 wrote to memory of 2908 4464 bhhhhh.exe 93 PID 4464 wrote to memory of 2908 4464 bhhhhh.exe 93 PID 2908 wrote to memory of 2036 2908 7dvpj.exe 94 PID 2908 wrote to memory of 2036 2908 7dvpj.exe 94 PID 2908 wrote to memory of 2036 2908 7dvpj.exe 94 PID 2036 wrote to memory of 2044 2036 lfxxrrr.exe 95 PID 2036 wrote to memory of 2044 2036 lfxxrrr.exe 95 PID 2036 wrote to memory of 2044 2036 lfxxrrr.exe 95 PID 2044 wrote to memory of 1900 2044 9tbbbh.exe 96 PID 2044 wrote to memory of 1900 2044 9tbbbh.exe 96 PID 2044 wrote to memory of 1900 2044 9tbbbh.exe 96 PID 1900 wrote to memory of 4720 1900 rlfxxrr.exe 97 PID 1900 wrote to memory of 4720 1900 rlfxxrr.exe 97 PID 1900 wrote to memory of 4720 1900 rlfxxrr.exe 97 PID 4720 wrote to memory of 4264 4720 rllxrrl.exe 98 PID 4720 wrote to memory of 4264 4720 rllxrrl.exe 98 PID 4720 wrote to memory of 4264 4720 rllxrrl.exe 98 PID 4264 wrote to memory of 2224 4264 thnhhh.exe 99 PID 4264 wrote to memory of 2224 4264 thnhhh.exe 99 PID 4264 wrote to memory of 2224 4264 thnhhh.exe 99 PID 2224 wrote to memory of 1340 2224 jvddv.exe 100 PID 2224 wrote to memory of 1340 2224 jvddv.exe 100 PID 2224 wrote to memory of 1340 2224 jvddv.exe 100 PID 1340 wrote to memory of 1412 1340 fffxrrl.exe 101 PID 1340 wrote to memory of 1412 1340 fffxrrl.exe 101 PID 1340 wrote to memory of 1412 1340 fffxrrl.exe 101 PID 1412 wrote to memory of 5000 1412 1lxrrrx.exe 102 PID 1412 wrote to memory of 5000 1412 1lxrrrx.exe 102 PID 1412 wrote to memory of 5000 1412 1lxrrrx.exe 102 PID 5000 wrote to memory of 1784 5000 dvppj.exe 103 PID 5000 wrote to memory of 1784 5000 dvppj.exe 103 PID 5000 wrote to memory of 1784 5000 dvppj.exe 103 PID 1784 wrote to memory of 4908 1784 3dpdd.exe 104 PID 1784 wrote to memory of 4908 1784 3dpdd.exe 104 PID 1784 wrote to memory of 4908 1784 3dpdd.exe 104 PID 4908 wrote to memory of 408 4908 llxxrrl.exe 105 PID 4908 wrote to memory of 408 4908 llxxrrl.exe 105 PID 4908 wrote to memory of 408 4908 llxxrrl.exe 105 PID 408 wrote to memory of 2788 408 ttbthh.exe 106 PID 408 wrote to memory of 2788 408 ttbthh.exe 106 PID 408 wrote to memory of 2788 408 ttbthh.exe 106 PID 2788 wrote to memory of 4140 2788 7jjdv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\a98ec67a2556f073eb240ee5afc5fc54a86fa5b878d12d4805e145c6abccc0c3N.exe"C:\Users\Admin\AppData\Local\Temp\a98ec67a2556f073eb240ee5afc5fc54a86fa5b878d12d4805e145c6abccc0c3N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\ttnnnn.exec:\ttnnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\vppjd.exec:\vppjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\flrrxxx.exec:\flrrxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\thbtnh.exec:\thbtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\vjdjj.exec:\vjdjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\lrrrrxx.exec:\lrrrrxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\bhhhhh.exec:\bhhhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\7dvpj.exec:\7dvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\lfxxrrr.exec:\lfxxrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\9tbbbh.exec:\9tbbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\rlfxxrr.exec:\rlfxxrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\rllxrrl.exec:\rllxrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\thnhhh.exec:\thnhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\jvddv.exec:\jvddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\fffxrrl.exec:\fffxrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\1lxrrrx.exec:\1lxrrrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\dvppj.exec:\dvppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\3dpdd.exec:\3dpdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\llxxrrl.exec:\llxxrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\ttbthh.exec:\ttbthh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\7jjdv.exec:\7jjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\frfflll.exec:\frfflll.exe23⤵
- Executes dropped EXE
PID:4140 -
\??\c:\nnnbtt.exec:\nnnbtt.exe24⤵
- Executes dropped EXE
PID:4896 -
\??\c:\httnhh.exec:\httnhh.exe25⤵
- Executes dropped EXE
PID:1708 -
\??\c:\7jppp.exec:\7jppp.exe26⤵
- Executes dropped EXE
PID:4256 -
\??\c:\7bhbbb.exec:\7bhbbb.exe27⤵
- Executes dropped EXE
PID:3548 -
\??\c:\9nhnnt.exec:\9nhnnt.exe28⤵
- Executes dropped EXE
PID:936 -
\??\c:\pvvpj.exec:\pvvpj.exe29⤵
- Executes dropped EXE
PID:3028 -
\??\c:\1bbhhn.exec:\1bbhhn.exe30⤵
- Executes dropped EXE
PID:516 -
\??\c:\5bhhbb.exec:\5bhhbb.exe31⤵
- Executes dropped EXE
PID:1948 -
\??\c:\jjjdd.exec:\jjjdd.exe32⤵
- Executes dropped EXE
PID:3244 -
\??\c:\rrfxxxx.exec:\rrfxxxx.exe33⤵
- Executes dropped EXE
PID:1244 -
\??\c:\thnbtb.exec:\thnbtb.exe34⤵
- Executes dropped EXE
PID:1240 -
\??\c:\9hhhbh.exec:\9hhhbh.exe35⤵
- Executes dropped EXE
PID:3256 -
\??\c:\3pvdd.exec:\3pvdd.exe36⤵
- Executes dropped EXE
PID:1224 -
\??\c:\jjddp.exec:\jjddp.exe37⤵
- Executes dropped EXE
PID:3932 -
\??\c:\xxlrllf.exec:\xxlrllf.exe38⤵
- Executes dropped EXE
PID:4588 -
\??\c:\tbnntb.exec:\tbnntb.exe39⤵
- Executes dropped EXE
PID:1500 -
\??\c:\nnnnhb.exec:\nnnnhb.exe40⤵
- Executes dropped EXE
PID:1104 -
\??\c:\vppjd.exec:\vppjd.exe41⤵
- Executes dropped EXE
PID:616 -
\??\c:\rxffxfl.exec:\rxffxfl.exe42⤵
- Executes dropped EXE
PID:3504 -
\??\c:\lflffll.exec:\lflffll.exe43⤵
- Executes dropped EXE
PID:4408 -
\??\c:\tbbbbb.exec:\tbbbbb.exe44⤵
- Executes dropped EXE
PID:3808 -
\??\c:\vddvp.exec:\vddvp.exe45⤵
- Executes dropped EXE
PID:3112 -
\??\c:\ppdjd.exec:\ppdjd.exe46⤵
- Executes dropped EXE
PID:2236 -
\??\c:\lfrllll.exec:\lfrllll.exe47⤵
- Executes dropped EXE
PID:1140 -
\??\c:\xlffxxr.exec:\xlffxxr.exe48⤵
- Executes dropped EXE
PID:2324 -
\??\c:\tttnhh.exec:\tttnhh.exe49⤵
- Executes dropped EXE
PID:2872 -
\??\c:\pppjd.exec:\pppjd.exe50⤵
- Executes dropped EXE
PID:4784 -
\??\c:\jppdd.exec:\jppdd.exe51⤵
- Executes dropped EXE
PID:2768 -
\??\c:\flflffl.exec:\flflffl.exe52⤵
- Executes dropped EXE
PID:4044 -
\??\c:\tttbbh.exec:\tttbbh.exe53⤵
- Executes dropped EXE
PID:2692 -
\??\c:\ppddd.exec:\ppddd.exe54⤵
- Executes dropped EXE
PID:4700 -
\??\c:\lrlfllf.exec:\lrlfllf.exe55⤵
- Executes dropped EXE
PID:4560 -
\??\c:\bbhhhn.exec:\bbhhhn.exe56⤵
- Executes dropped EXE
PID:4900 -
\??\c:\vvpvv.exec:\vvpvv.exe57⤵
- Executes dropped EXE
PID:4088 -
\??\c:\pvjdd.exec:\pvjdd.exe58⤵
- Executes dropped EXE
PID:1268 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe59⤵
- Executes dropped EXE
PID:4504 -
\??\c:\ntbbtt.exec:\ntbbtt.exe60⤵
- Executes dropped EXE
PID:4260 -
\??\c:\7bttnt.exec:\7bttnt.exe61⤵
- Executes dropped EXE
PID:4508 -
\??\c:\5pvvv.exec:\5pvvv.exe62⤵
- Executes dropped EXE
PID:4008 -
\??\c:\rlffxxr.exec:\rlffxxr.exe63⤵
- Executes dropped EXE
PID:1860 -
\??\c:\ppdvj.exec:\ppdvj.exe64⤵
- Executes dropped EXE
PID:4360 -
\??\c:\ppddd.exec:\ppddd.exe65⤵
- Executes dropped EXE
PID:1360 -
\??\c:\bttntt.exec:\bttntt.exe66⤵PID:4612
-
\??\c:\xfrrrfx.exec:\xfrrrfx.exe67⤵PID:2224
-
\??\c:\hbbbnh.exec:\hbbbnh.exe68⤵PID:1648
-
\??\c:\vddvj.exec:\vddvj.exe69⤵PID:1512
-
\??\c:\1fllffx.exec:\1fllffx.exe70⤵PID:4852
-
\??\c:\htnbth.exec:\htnbth.exe71⤵PID:4284
-
\??\c:\ddjpp.exec:\ddjpp.exe72⤵PID:2208
-
\??\c:\xfrxfxl.exec:\xfrxfxl.exe73⤵PID:2028
-
\??\c:\nnnttb.exec:\nnnttb.exe74⤵PID:3564
-
\??\c:\vdpvj.exec:\vdpvj.exe75⤵PID:1372
-
\??\c:\jdpjv.exec:\jdpjv.exe76⤵PID:2500
-
\??\c:\lfxrxxl.exec:\lfxrxxl.exe77⤵PID:4932
-
\??\c:\9thbtt.exec:\9thbtt.exe78⤵PID:1768
-
\??\c:\3vjjv.exec:\3vjjv.exe79⤵PID:1708
-
\??\c:\ttbttt.exec:\ttbttt.exe80⤵PID:4256
-
\??\c:\dvjjj.exec:\dvjjj.exe81⤵PID:3492
-
\??\c:\lxxxffx.exec:\lxxxffx.exe82⤵PID:3288
-
\??\c:\5bbhht.exec:\5bbhht.exe83⤵PID:5052
-
\??\c:\dpvjd.exec:\dpvjd.exe84⤵PID:5072
-
\??\c:\fxxffff.exec:\fxxffff.exe85⤵PID:5100
-
\??\c:\lxlrlrr.exec:\lxlrlrr.exe86⤵PID:3712
-
\??\c:\5hnttb.exec:\5hnttb.exe87⤵PID:4628
-
\??\c:\jdppp.exec:\jdppp.exe88⤵PID:444
-
\??\c:\rxxxxfx.exec:\rxxxxfx.exe89⤵PID:3956
-
\??\c:\xffxrfx.exec:\xffxrfx.exe90⤵PID:2416
-
\??\c:\bnbbth.exec:\bnbbth.exe91⤵PID:228
-
\??\c:\ntntnn.exec:\ntntnn.exe92⤵PID:1896
-
\??\c:\pvdjd.exec:\pvdjd.exe93⤵PID:1576
-
\??\c:\xfrrlll.exec:\xfrrlll.exe94⤵PID:4332
-
\??\c:\hhnttb.exec:\hhnttb.exe95⤵PID:1516
-
\??\c:\ppjvp.exec:\ppjvp.exe96⤵PID:1992
-
\??\c:\djjjj.exec:\djjjj.exe97⤵PID:4420
-
\??\c:\rlxxfxr.exec:\rlxxfxr.exe98⤵PID:3504
-
\??\c:\ntttnt.exec:\ntttnt.exe99⤵PID:1552
-
\??\c:\vjjjd.exec:\vjjjd.exe100⤵PID:1384
-
\??\c:\xxxxfll.exec:\xxxxfll.exe101⤵PID:4324
-
\??\c:\1httbb.exec:\1httbb.exe102⤵PID:2248
-
\??\c:\thtbhh.exec:\thtbhh.exe103⤵PID:4816
-
\??\c:\ppvvp.exec:\ppvvp.exe104⤵PID:828
-
\??\c:\7lfxrxf.exec:\7lfxrxf.exe105⤵PID:3944
-
\??\c:\xxfxrxr.exec:\xxfxrxr.exe106⤵PID:4532
-
\??\c:\bnbnnt.exec:\bnbnnt.exe107⤵PID:4904
-
\??\c:\vpppd.exec:\vpppd.exe108⤵PID:3832
-
\??\c:\vjddp.exec:\vjddp.exe109⤵PID:400
-
\??\c:\rfxrffx.exec:\rfxrffx.exe110⤵PID:3708
-
\??\c:\nnthht.exec:\nnthht.exe111⤵PID:2912
-
\??\c:\bthttt.exec:\bthttt.exe112⤵PID:660
-
\??\c:\3pvpd.exec:\3pvpd.exe113⤵PID:4900
-
\??\c:\lxfffll.exec:\lxfffll.exe114⤵PID:4384
-
\??\c:\9bbbtb.exec:\9bbbtb.exe115⤵PID:1836
-
\??\c:\ppppp.exec:\ppppp.exe116⤵PID:4504
-
\??\c:\rfflffx.exec:\rfflffx.exe117⤵PID:3092
-
\??\c:\tnbttt.exec:\tnbttt.exe118⤵PID:1028
-
\??\c:\hhtbnt.exec:\hhtbnt.exe119⤵PID:3900
-
\??\c:\jpjdd.exec:\jpjdd.exe120⤵PID:2832
-
\??\c:\rlfrlff.exec:\rlfrlff.exe121⤵PID:2460
-
\??\c:\nnbbnn.exec:\nnbbnn.exe122⤵PID:4440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-