Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 21:23
Static task
static1
Behavioral task
behavioral1
Sample
fabaa189d3d25ebb00cb64943b8507694fa8c8ecde0069d8e7be3acbc01a63cfN.exe
Resource
win7-20240903-en
General
-
Target
fabaa189d3d25ebb00cb64943b8507694fa8c8ecde0069d8e7be3acbc01a63cfN.exe
-
Size
83KB
-
MD5
d392214af365ed354a5b48ed78e9c8f0
-
SHA1
b1dd06f4caaf33c648328e65803a6ac9d283d290
-
SHA256
fabaa189d3d25ebb00cb64943b8507694fa8c8ecde0069d8e7be3acbc01a63cf
-
SHA512
6d8eebf09fea206c6d4778a9f89f7f4aef85cf46869ad6eeb7a16196e438e12cd723131785e253fbc0469f361b3de76f14921f76ca992f9b2f1fbf40117a6888
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Qt:ymb3NkkiQ3mdBjFIIp9L9QrrA8I
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2324-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1288-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/444-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/660-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1992-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3524 rlffxff.exe 4876 hbttnh.exe 2388 jppjj.exe 3180 5lfxlfx.exe 2148 tttbtb.exe 4452 pdvvp.exe 1412 frxxxxx.exe 2344 hthtnb.exe 3828 dvppd.exe 4460 vdpdd.exe 5084 frxfxrr.exe 1188 3thnhn.exe 64 3pvvp.exe 2628 1rfrxrx.exe 3556 5xflllf.exe 1288 htbbnn.exe 1520 pppjd.exe 444 5hbthh.exe 1216 vpvvv.exe 2136 lflxrlf.exe 4524 htnnbb.exe 212 hbbnnt.exe 2724 pdjdd.exe 4960 ddddp.exe 5012 7llxrrf.exe 3448 1nbtnh.exe 660 thhbtn.exe 1992 7vpdp.exe 1040 9rrflfl.exe 996 nhhhbb.exe 3368 bthbbb.exe 100 3ddjd.exe 3236 jppvp.exe 4432 fflxlxf.exe 3508 3rxrlll.exe 1508 nhhhbh.exe 4384 fllfrrf.exe 3024 9frxflf.exe 5072 thnbhb.exe 4368 3dvpp.exe 4888 3dvvj.exe 588 1rrfrrl.exe 1324 bhhbnh.exe 3528 ttbbnn.exe 4800 pvvpd.exe 2148 3vpdd.exe 3900 3xxxrrr.exe 4472 fxfxxfx.exe 1356 nbthtt.exe 2720 1tnhtn.exe 2776 dvdvv.exe 3828 vpppj.exe 2032 rxxlrlf.exe 4008 1nnnhh.exe 5052 ttnhtt.exe 3452 9pvpj.exe 3292 vpddp.exe 3724 lxxrlff.exe 2976 frrlrrl.exe 3468 rflllll.exe 5084 nbbbtt.exe 664 dvvjd.exe 4480 jppjd.exe 4256 llrlffx.exe -
resource yara_rule behavioral2/memory/2324-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3180-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3180-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1288-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/444-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/660-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1992-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-216-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxlffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2324 wrote to memory of 3524 2324 fabaa189d3d25ebb00cb64943b8507694fa8c8ecde0069d8e7be3acbc01a63cfN.exe 82 PID 2324 wrote to memory of 3524 2324 fabaa189d3d25ebb00cb64943b8507694fa8c8ecde0069d8e7be3acbc01a63cfN.exe 82 PID 2324 wrote to memory of 3524 2324 fabaa189d3d25ebb00cb64943b8507694fa8c8ecde0069d8e7be3acbc01a63cfN.exe 82 PID 3524 wrote to memory of 4876 3524 rlffxff.exe 83 PID 3524 wrote to memory of 4876 3524 rlffxff.exe 83 PID 3524 wrote to memory of 4876 3524 rlffxff.exe 83 PID 4876 wrote to memory of 2388 4876 hbttnh.exe 84 PID 4876 wrote to memory of 2388 4876 hbttnh.exe 84 PID 4876 wrote to memory of 2388 4876 hbttnh.exe 84 PID 2388 wrote to memory of 3180 2388 jppjj.exe 85 PID 2388 wrote to memory of 3180 2388 jppjj.exe 85 PID 2388 wrote to memory of 3180 2388 jppjj.exe 85 PID 3180 wrote to memory of 2148 3180 5lfxlfx.exe 86 PID 3180 wrote to memory of 2148 3180 5lfxlfx.exe 86 PID 3180 wrote to memory of 2148 3180 5lfxlfx.exe 86 PID 2148 wrote to memory of 4452 2148 tttbtb.exe 87 PID 2148 wrote to memory of 4452 2148 tttbtb.exe 87 PID 2148 wrote to memory of 4452 2148 tttbtb.exe 87 PID 4452 wrote to memory of 1412 4452 pdvvp.exe 88 PID 4452 wrote to memory of 1412 4452 pdvvp.exe 88 PID 4452 wrote to memory of 1412 4452 pdvvp.exe 88 PID 1412 wrote to memory of 2344 1412 frxxxxx.exe 89 PID 1412 wrote to memory of 2344 1412 frxxxxx.exe 89 PID 1412 wrote to memory of 2344 1412 frxxxxx.exe 89 PID 2344 wrote to memory of 3828 2344 hthtnb.exe 90 PID 2344 wrote to memory of 3828 2344 hthtnb.exe 90 PID 2344 wrote to memory of 3828 2344 hthtnb.exe 90 PID 3828 wrote to memory of 4460 3828 dvppd.exe 91 PID 3828 wrote to memory of 4460 3828 dvppd.exe 91 PID 3828 wrote to memory of 4460 3828 dvppd.exe 91 PID 4460 wrote to memory of 5084 4460 vdpdd.exe 92 PID 4460 wrote to memory of 5084 4460 vdpdd.exe 92 PID 4460 wrote to memory of 5084 4460 vdpdd.exe 92 PID 5084 wrote to memory of 1188 5084 frxfxrr.exe 93 PID 5084 wrote to memory of 1188 5084 frxfxrr.exe 93 PID 5084 wrote to memory of 1188 5084 frxfxrr.exe 93 PID 1188 wrote to memory of 64 1188 3thnhn.exe 94 PID 1188 wrote to memory of 64 1188 3thnhn.exe 94 PID 1188 wrote to memory of 64 1188 3thnhn.exe 94 PID 64 wrote to memory of 2628 64 3pvvp.exe 95 PID 64 wrote to memory of 2628 64 3pvvp.exe 95 PID 64 wrote to memory of 2628 64 3pvvp.exe 95 PID 2628 wrote to memory of 3556 2628 1rfrxrx.exe 96 PID 2628 wrote to memory of 3556 2628 1rfrxrx.exe 96 PID 2628 wrote to memory of 3556 2628 1rfrxrx.exe 96 PID 3556 wrote to memory of 1288 3556 5xflllf.exe 97 PID 3556 wrote to memory of 1288 3556 5xflllf.exe 97 PID 3556 wrote to memory of 1288 3556 5xflllf.exe 97 PID 1288 wrote to memory of 1520 1288 htbbnn.exe 98 PID 1288 wrote to memory of 1520 1288 htbbnn.exe 98 PID 1288 wrote to memory of 1520 1288 htbbnn.exe 98 PID 1520 wrote to memory of 444 1520 pppjd.exe 99 PID 1520 wrote to memory of 444 1520 pppjd.exe 99 PID 1520 wrote to memory of 444 1520 pppjd.exe 99 PID 444 wrote to memory of 1216 444 5hbthh.exe 100 PID 444 wrote to memory of 1216 444 5hbthh.exe 100 PID 444 wrote to memory of 1216 444 5hbthh.exe 100 PID 1216 wrote to memory of 2136 1216 vpvvv.exe 101 PID 1216 wrote to memory of 2136 1216 vpvvv.exe 101 PID 1216 wrote to memory of 2136 1216 vpvvv.exe 101 PID 2136 wrote to memory of 4524 2136 lflxrlf.exe 102 PID 2136 wrote to memory of 4524 2136 lflxrlf.exe 102 PID 2136 wrote to memory of 4524 2136 lflxrlf.exe 102 PID 4524 wrote to memory of 212 4524 htnnbb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\fabaa189d3d25ebb00cb64943b8507694fa8c8ecde0069d8e7be3acbc01a63cfN.exe"C:\Users\Admin\AppData\Local\Temp\fabaa189d3d25ebb00cb64943b8507694fa8c8ecde0069d8e7be3acbc01a63cfN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\rlffxff.exec:\rlffxff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\hbttnh.exec:\hbttnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\jppjj.exec:\jppjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\5lfxlfx.exec:\5lfxlfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\tttbtb.exec:\tttbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\pdvvp.exec:\pdvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\frxxxxx.exec:\frxxxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\hthtnb.exec:\hthtnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\dvppd.exec:\dvppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\vdpdd.exec:\vdpdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\frxfxrr.exec:\frxfxrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\3thnhn.exec:\3thnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\3pvvp.exec:\3pvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\1rfrxrx.exec:\1rfrxrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\5xflllf.exec:\5xflllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\htbbnn.exec:\htbbnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\pppjd.exec:\pppjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\5hbthh.exec:\5hbthh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\vpvvv.exec:\vpvvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\lflxrlf.exec:\lflxrlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\htnnbb.exec:\htnnbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\hbbnnt.exec:\hbbnnt.exe23⤵
- Executes dropped EXE
PID:212 -
\??\c:\pdjdd.exec:\pdjdd.exe24⤵
- Executes dropped EXE
PID:2724 -
\??\c:\ddddp.exec:\ddddp.exe25⤵
- Executes dropped EXE
PID:4960 -
\??\c:\7llxrrf.exec:\7llxrrf.exe26⤵
- Executes dropped EXE
PID:5012 -
\??\c:\1nbtnh.exec:\1nbtnh.exe27⤵
- Executes dropped EXE
PID:3448 -
\??\c:\thhbtn.exec:\thhbtn.exe28⤵
- Executes dropped EXE
PID:660 -
\??\c:\7vpdp.exec:\7vpdp.exe29⤵
- Executes dropped EXE
PID:1992 -
\??\c:\9rrflfl.exec:\9rrflfl.exe30⤵
- Executes dropped EXE
PID:1040 -
\??\c:\nhhhbb.exec:\nhhhbb.exe31⤵
- Executes dropped EXE
PID:996 -
\??\c:\bthbbb.exec:\bthbbb.exe32⤵
- Executes dropped EXE
PID:3368 -
\??\c:\3ddjd.exec:\3ddjd.exe33⤵
- Executes dropped EXE
PID:100 -
\??\c:\jppvp.exec:\jppvp.exe34⤵
- Executes dropped EXE
PID:3236 -
\??\c:\fflxlxf.exec:\fflxlxf.exe35⤵
- Executes dropped EXE
PID:4432 -
\??\c:\3rxrlll.exec:\3rxrlll.exe36⤵
- Executes dropped EXE
PID:3508 -
\??\c:\nhhhbh.exec:\nhhhbh.exe37⤵
- Executes dropped EXE
PID:1508 -
\??\c:\fllfrrf.exec:\fllfrrf.exe38⤵
- Executes dropped EXE
PID:4384 -
\??\c:\9frxflf.exec:\9frxflf.exe39⤵
- Executes dropped EXE
PID:3024 -
\??\c:\thnbhb.exec:\thnbhb.exe40⤵
- Executes dropped EXE
PID:5072 -
\??\c:\3dvpp.exec:\3dvpp.exe41⤵
- Executes dropped EXE
PID:4368 -
\??\c:\3dvvj.exec:\3dvvj.exe42⤵
- Executes dropped EXE
PID:4888 -
\??\c:\1rrfrrl.exec:\1rrfrrl.exe43⤵
- Executes dropped EXE
PID:588 -
\??\c:\bhhbnh.exec:\bhhbnh.exe44⤵
- Executes dropped EXE
PID:1324 -
\??\c:\ttbbnn.exec:\ttbbnn.exe45⤵
- Executes dropped EXE
PID:3528 -
\??\c:\pvvpd.exec:\pvvpd.exe46⤵
- Executes dropped EXE
PID:4800 -
\??\c:\3vpdd.exec:\3vpdd.exe47⤵
- Executes dropped EXE
PID:2148 -
\??\c:\3xxxrrr.exec:\3xxxrrr.exe48⤵
- Executes dropped EXE
PID:3900 -
\??\c:\fxfxxfx.exec:\fxfxxfx.exe49⤵
- Executes dropped EXE
PID:4472 -
\??\c:\nbthtt.exec:\nbthtt.exe50⤵
- Executes dropped EXE
PID:1356 -
\??\c:\1tnhtn.exec:\1tnhtn.exe51⤵
- Executes dropped EXE
PID:2720 -
\??\c:\dvdvv.exec:\dvdvv.exe52⤵
- Executes dropped EXE
PID:2776 -
\??\c:\vpppj.exec:\vpppj.exe53⤵
- Executes dropped EXE
PID:3828 -
\??\c:\rxxlrlf.exec:\rxxlrlf.exe54⤵
- Executes dropped EXE
PID:2032 -
\??\c:\1nnnhh.exec:\1nnnhh.exe55⤵
- Executes dropped EXE
PID:4008 -
\??\c:\ttnhtt.exec:\ttnhtt.exe56⤵
- Executes dropped EXE
PID:5052 -
\??\c:\9pvpj.exec:\9pvpj.exe57⤵
- Executes dropped EXE
PID:3452 -
\??\c:\vpddp.exec:\vpddp.exe58⤵
- Executes dropped EXE
PID:3292 -
\??\c:\lxxrlff.exec:\lxxrlff.exe59⤵
- Executes dropped EXE
PID:3724 -
\??\c:\frrlrrl.exec:\frrlrrl.exe60⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rflllll.exec:\rflllll.exe61⤵
- Executes dropped EXE
PID:3468 -
\??\c:\nbbbtt.exec:\nbbbtt.exe62⤵
- Executes dropped EXE
PID:5084 -
\??\c:\dvvjd.exec:\dvvjd.exe63⤵
- Executes dropped EXE
PID:664 -
\??\c:\jppjd.exec:\jppjd.exe64⤵
- Executes dropped EXE
PID:4480 -
\??\c:\llrlffx.exec:\llrlffx.exe65⤵
- Executes dropped EXE
PID:4256 -
\??\c:\xllfxxr.exec:\xllfxxr.exe66⤵PID:3652
-
\??\c:\ntbbnb.exec:\ntbbnb.exe67⤵PID:404
-
\??\c:\bbhbtt.exec:\bbhbtt.exe68⤵PID:4424
-
\??\c:\1vpjv.exec:\1vpjv.exe69⤵PID:3628
-
\??\c:\jdpdj.exec:\jdpdj.exe70⤵PID:4840
-
\??\c:\xffxrrl.exec:\xffxrrl.exe71⤵PID:4456
-
\??\c:\rlfffff.exec:\rlfffff.exe72⤵PID:1916
-
\??\c:\btnnhh.exec:\btnnhh.exe73⤵PID:2144
-
\??\c:\nthhnh.exec:\nthhnh.exe74⤵PID:876
-
\??\c:\jvpjp.exec:\jvpjp.exe75⤵PID:3572
-
\??\c:\rlrflfr.exec:\rlrflfr.exe76⤵PID:4524
-
\??\c:\xffxlfx.exec:\xffxlfx.exe77⤵PID:2036
-
\??\c:\thttnn.exec:\thttnn.exe78⤵PID:4724
-
\??\c:\3dvpp.exec:\3dvpp.exe79⤵PID:3424
-
\??\c:\7vpjv.exec:\7vpjv.exe80⤵PID:2340
-
\??\c:\3fxrlfx.exec:\3fxrlfx.exe81⤵PID:208
-
\??\c:\xfflflf.exec:\xfflflf.exe82⤵PID:1920
-
\??\c:\tbbthb.exec:\tbbthb.exe83⤵PID:3748
-
\??\c:\ddvpd.exec:\ddvpd.exe84⤵PID:4572
-
\??\c:\rllflrx.exec:\rllflrx.exe85⤵PID:2360
-
\??\c:\9xrlfxr.exec:\9xrlfxr.exe86⤵PID:364
-
\??\c:\3ttnhh.exec:\3ttnhh.exe87⤵PID:4264
-
\??\c:\5ntnhh.exec:\5ntnhh.exe88⤵PID:1220
-
\??\c:\jdvpj.exec:\jdvpj.exe89⤵PID:4696
-
\??\c:\rrrfrrf.exec:\rrrfrrf.exe90⤵PID:3236
-
\??\c:\frfxffl.exec:\frfxffl.exe91⤵PID:2412
-
\??\c:\tnnnhh.exec:\tnnnhh.exe92⤵PID:1692
-
\??\c:\thbtnh.exec:\thbtnh.exe93⤵PID:4420
-
\??\c:\ppvpp.exec:\ppvpp.exe94⤵PID:2740
-
\??\c:\pjdvv.exec:\pjdvv.exe95⤵PID:4740
-
\??\c:\rxrfxfx.exec:\rxrfxfx.exe96⤵PID:2396
-
\??\c:\thhhhb.exec:\thhhhb.exe97⤵PID:4876
-
\??\c:\jdvdp.exec:\jdvdp.exe98⤵PID:1660
-
\??\c:\vvpjv.exec:\vvpjv.exe99⤵PID:548
-
\??\c:\flfxrrl.exec:\flfxrrl.exe100⤵PID:4520
-
\??\c:\3frrrrl.exec:\3frrrrl.exe101⤵PID:3180
-
\??\c:\3nttnn.exec:\3nttnn.exe102⤵PID:1808
-
\??\c:\7jjvj.exec:\7jjvj.exe103⤵PID:3496
-
\??\c:\3ddvv.exec:\3ddvv.exe104⤵PID:1172
-
\??\c:\flrrllf.exec:\flrrllf.exe105⤵PID:4312
-
\??\c:\nhhbnn.exec:\nhhbnn.exe106⤵PID:4916
-
\??\c:\1hbttt.exec:\1hbttt.exe107⤵PID:436
-
\??\c:\9pppd.exec:\9pppd.exe108⤵PID:4220
-
\??\c:\dppjv.exec:\dppjv.exe109⤵PID:2840
-
\??\c:\llrlrrx.exec:\llrlrrx.exe110⤵PID:4268
-
\??\c:\rffxrrr.exec:\rffxrrr.exe111⤵PID:1424
-
\??\c:\thbtnn.exec:\thbtnn.exe112⤵PID:2344
-
\??\c:\nbbnbb.exec:\nbbnbb.exe113⤵PID:1984
-
\??\c:\pvppv.exec:\pvppv.exe114⤵PID:1000
-
\??\c:\pvvvv.exec:\pvvvv.exe115⤵PID:3420
-
\??\c:\rxrxrfl.exec:\rxrxrfl.exe116⤵PID:3520
-
\??\c:\fxffffl.exec:\fxffffl.exe117⤵PID:912
-
\??\c:\bttnht.exec:\bttnht.exe118⤵PID:5080
-
\??\c:\9bhthh.exec:\9bhthh.exe119⤵PID:1156
-
\??\c:\3djjv.exec:\3djjv.exe120⤵PID:4072
-
\??\c:\jdpjd.exec:\jdpjd.exe121⤵PID:1084
-
\??\c:\1xfxlfr.exec:\1xfxlfr.exe122⤵PID:2628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-