Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 05:51
Static task
static1
Behavioral task
behavioral1
Sample
354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe
Resource
win7-20240903-en
General
-
Target
354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe
-
Size
82KB
-
MD5
7b9f0a7b90de77b4940357127d5be098
-
SHA1
95c14897730771404ce4afe3748ff5ac5341fb61
-
SHA256
354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c
-
SHA512
a4d1e321aa4caedda459290e7ed690c45db5bd141bf565732a70231ec5669fd6ee6a2d64c13e2bc9d89b3886d5472ab244767180424610fe709c4781fd8d4548
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeqB:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4rJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2376-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3736-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/976-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/312-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3864-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1440-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1392 vdjjp.exe 3736 dvpjj.exe 4276 xrrfrrr.exe 1564 nnnnhh.exe 4468 jvvpj.exe 1380 fxxrrrx.exe 976 3lrrlrl.exe 312 nhbtnn.exe 4284 pjjdp.exe 5024 pvddj.exe 3864 3frrlxr.exe 3276 htbbth.exe 3212 jdjjj.exe 3788 fxxfxll.exe 3152 5ntttt.exe 1824 ddppd.exe 4592 djppv.exe 2352 rxllllr.exe 1440 bbbbbb.exe 1156 djjdv.exe 4700 fxfrllr.exe 1956 bnbbtt.exe 1408 djdvv.exe 408 dvvvj.exe 3612 lfllflf.exe 4708 nbhhhh.exe 3824 nhhbbb.exe 5040 vjpjd.exe 4120 xxrrfff.exe 912 lxflllr.exe 752 nbbtbb.exe 1184 pjjdd.exe 4428 dvvpp.exe 4876 ffllxfx.exe 2708 7xlllxr.exe 3064 hbnhbn.exe 5104 7hbthh.exe 4608 rxllffx.exe 2124 tbnhtb.exe 4864 nbntnn.exe 4844 jpppv.exe 5000 pvvpp.exe 4548 llrxffr.exe 2172 xxflxlf.exe 4332 ttbtbt.exe 5056 9nhtht.exe 2316 lfxxrxr.exe 2676 lfllrrx.exe 392 ttnnhh.exe 4436 3tbbtb.exe 3736 pjddv.exe 3544 rrllfff.exe 4880 xrlllrr.exe 3020 9thhnn.exe 1072 vvjvp.exe 3500 xlrfxxr.exe 4948 hnttnh.exe 2912 vjjdp.exe 4528 xxxxlfl.exe 4776 1bhhbn.exe 212 ntbtnn.exe 3608 xrffxrr.exe 2880 7nbbtb.exe 1532 btbhbb.exe -
resource yara_rule behavioral2/memory/2376-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/976-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/312-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3864-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1440-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2376 wrote to memory of 1392 2376 354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe 83 PID 2376 wrote to memory of 1392 2376 354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe 83 PID 2376 wrote to memory of 1392 2376 354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe 83 PID 1392 wrote to memory of 3736 1392 vdjjp.exe 84 PID 1392 wrote to memory of 3736 1392 vdjjp.exe 84 PID 1392 wrote to memory of 3736 1392 vdjjp.exe 84 PID 3736 wrote to memory of 4276 3736 dvpjj.exe 85 PID 3736 wrote to memory of 4276 3736 dvpjj.exe 85 PID 3736 wrote to memory of 4276 3736 dvpjj.exe 85 PID 4276 wrote to memory of 1564 4276 xrrfrrr.exe 86 PID 4276 wrote to memory of 1564 4276 xrrfrrr.exe 86 PID 4276 wrote to memory of 1564 4276 xrrfrrr.exe 86 PID 1564 wrote to memory of 4468 1564 nnnnhh.exe 87 PID 1564 wrote to memory of 4468 1564 nnnnhh.exe 87 PID 1564 wrote to memory of 4468 1564 nnnnhh.exe 87 PID 4468 wrote to memory of 1380 4468 jvvpj.exe 88 PID 4468 wrote to memory of 1380 4468 jvvpj.exe 88 PID 4468 wrote to memory of 1380 4468 jvvpj.exe 88 PID 1380 wrote to memory of 976 1380 fxxrrrx.exe 89 PID 1380 wrote to memory of 976 1380 fxxrrrx.exe 89 PID 1380 wrote to memory of 976 1380 fxxrrrx.exe 89 PID 976 wrote to memory of 312 976 3lrrlrl.exe 90 PID 976 wrote to memory of 312 976 3lrrlrl.exe 90 PID 976 wrote to memory of 312 976 3lrrlrl.exe 90 PID 312 wrote to memory of 4284 312 nhbtnn.exe 91 PID 312 wrote to memory of 4284 312 nhbtnn.exe 91 PID 312 wrote to memory of 4284 312 nhbtnn.exe 91 PID 4284 wrote to memory of 5024 4284 pjjdp.exe 92 PID 4284 wrote to memory of 5024 4284 pjjdp.exe 92 PID 4284 wrote to memory of 5024 4284 pjjdp.exe 92 PID 5024 wrote to memory of 3864 5024 pvddj.exe 93 PID 5024 wrote to memory of 3864 5024 pvddj.exe 93 PID 5024 wrote to memory of 3864 5024 pvddj.exe 93 PID 3864 wrote to memory of 3276 3864 3frrlxr.exe 94 PID 3864 wrote to memory of 3276 3864 3frrlxr.exe 94 PID 3864 wrote to memory of 3276 3864 3frrlxr.exe 94 PID 3276 wrote to memory of 3212 3276 htbbth.exe 95 PID 3276 wrote to memory of 3212 3276 htbbth.exe 95 PID 3276 wrote to memory of 3212 3276 htbbth.exe 95 PID 3212 wrote to memory of 3788 3212 jdjjj.exe 96 PID 3212 wrote to memory of 3788 3212 jdjjj.exe 96 PID 3212 wrote to memory of 3788 3212 jdjjj.exe 96 PID 3788 wrote to memory of 3152 3788 fxxfxll.exe 97 PID 3788 wrote to memory of 3152 3788 fxxfxll.exe 97 PID 3788 wrote to memory of 3152 3788 fxxfxll.exe 97 PID 3152 wrote to memory of 1824 3152 5ntttt.exe 98 PID 3152 wrote to memory of 1824 3152 5ntttt.exe 98 PID 3152 wrote to memory of 1824 3152 5ntttt.exe 98 PID 1824 wrote to memory of 4592 1824 ddppd.exe 99 PID 1824 wrote to memory of 4592 1824 ddppd.exe 99 PID 1824 wrote to memory of 4592 1824 ddppd.exe 99 PID 4592 wrote to memory of 2352 4592 djppv.exe 100 PID 4592 wrote to memory of 2352 4592 djppv.exe 100 PID 4592 wrote to memory of 2352 4592 djppv.exe 100 PID 2352 wrote to memory of 1440 2352 rxllllr.exe 101 PID 2352 wrote to memory of 1440 2352 rxllllr.exe 101 PID 2352 wrote to memory of 1440 2352 rxllllr.exe 101 PID 1440 wrote to memory of 1156 1440 bbbbbb.exe 102 PID 1440 wrote to memory of 1156 1440 bbbbbb.exe 102 PID 1440 wrote to memory of 1156 1440 bbbbbb.exe 102 PID 1156 wrote to memory of 4700 1156 djjdv.exe 103 PID 1156 wrote to memory of 4700 1156 djjdv.exe 103 PID 1156 wrote to memory of 4700 1156 djjdv.exe 103 PID 4700 wrote to memory of 1956 4700 fxfrllr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe"C:\Users\Admin\AppData\Local\Temp\354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\vdjjp.exec:\vdjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\dvpjj.exec:\dvpjj.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\xrrfrrr.exec:\xrrfrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\nnnnhh.exec:\nnnnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\jvvpj.exec:\jvvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\fxxrrrx.exec:\fxxrrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\3lrrlrl.exec:\3lrrlrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\nhbtnn.exec:\nhbtnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\pjjdp.exec:\pjjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\pvddj.exec:\pvddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\3frrlxr.exec:\3frrlxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\htbbth.exec:\htbbth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\jdjjj.exec:\jdjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\fxxfxll.exec:\fxxfxll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\5ntttt.exec:\5ntttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\ddppd.exec:\ddppd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\djppv.exec:\djppv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\rxllllr.exec:\rxllllr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\bbbbbb.exec:\bbbbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\djjdv.exec:\djjdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\fxfrllr.exec:\fxfrllr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\bnbbtt.exec:\bnbbtt.exe23⤵
- Executes dropped EXE
PID:1956 -
\??\c:\djdvv.exec:\djdvv.exe24⤵
- Executes dropped EXE
PID:1408 -
\??\c:\dvvvj.exec:\dvvvj.exe25⤵
- Executes dropped EXE
PID:408 -
\??\c:\lfllflf.exec:\lfllflf.exe26⤵
- Executes dropped EXE
PID:3612 -
\??\c:\nbhhhh.exec:\nbhhhh.exe27⤵
- Executes dropped EXE
PID:4708 -
\??\c:\nhhbbb.exec:\nhhbbb.exe28⤵
- Executes dropped EXE
PID:3824 -
\??\c:\vjpjd.exec:\vjpjd.exe29⤵
- Executes dropped EXE
PID:5040 -
\??\c:\xxrrfff.exec:\xxrrfff.exe30⤵
- Executes dropped EXE
PID:4120 -
\??\c:\lxflllr.exec:\lxflllr.exe31⤵
- Executes dropped EXE
PID:912 -
\??\c:\nbbtbb.exec:\nbbtbb.exe32⤵
- Executes dropped EXE
PID:752 -
\??\c:\pjjdd.exec:\pjjdd.exe33⤵
- Executes dropped EXE
PID:1184 -
\??\c:\dvvpp.exec:\dvvpp.exe34⤵
- Executes dropped EXE
PID:4428 -
\??\c:\ffllxfx.exec:\ffllxfx.exe35⤵
- Executes dropped EXE
PID:4876 -
\??\c:\7xlllxr.exec:\7xlllxr.exe36⤵
- Executes dropped EXE
PID:2708 -
\??\c:\hbnhbn.exec:\hbnhbn.exe37⤵
- Executes dropped EXE
PID:3064 -
\??\c:\7hbthh.exec:\7hbthh.exe38⤵
- Executes dropped EXE
PID:5104 -
\??\c:\rxllffx.exec:\rxllffx.exe39⤵
- Executes dropped EXE
PID:4608 -
\??\c:\tbnhtb.exec:\tbnhtb.exe40⤵
- Executes dropped EXE
PID:2124 -
\??\c:\nbntnn.exec:\nbntnn.exe41⤵
- Executes dropped EXE
PID:4864 -
\??\c:\jpppv.exec:\jpppv.exe42⤵
- Executes dropped EXE
PID:4844 -
\??\c:\pvvpp.exec:\pvvpp.exe43⤵
- Executes dropped EXE
PID:5000 -
\??\c:\llrxffr.exec:\llrxffr.exe44⤵
- Executes dropped EXE
PID:4548 -
\??\c:\xxflxlf.exec:\xxflxlf.exe45⤵
- Executes dropped EXE
PID:2172 -
\??\c:\ttbtbt.exec:\ttbtbt.exe46⤵
- Executes dropped EXE
PID:4332 -
\??\c:\9nhtht.exec:\9nhtht.exe47⤵
- Executes dropped EXE
PID:5056 -
\??\c:\lfxxrxr.exec:\lfxxrxr.exe48⤵
- Executes dropped EXE
PID:2316 -
\??\c:\lfllrrx.exec:\lfllrrx.exe49⤵
- Executes dropped EXE
PID:2676 -
\??\c:\ttnnhh.exec:\ttnnhh.exe50⤵
- Executes dropped EXE
PID:392 -
\??\c:\3tbbtb.exec:\3tbbtb.exe51⤵
- Executes dropped EXE
PID:4436 -
\??\c:\pjddv.exec:\pjddv.exe52⤵
- Executes dropped EXE
PID:3736 -
\??\c:\rrllfff.exec:\rrllfff.exe53⤵
- Executes dropped EXE
PID:3544 -
\??\c:\xrlllrr.exec:\xrlllrr.exe54⤵
- Executes dropped EXE
PID:4880 -
\??\c:\9thhnn.exec:\9thhnn.exe55⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vvjvp.exec:\vvjvp.exe56⤵
- Executes dropped EXE
PID:1072 -
\??\c:\xlrfxxr.exec:\xlrfxxr.exe57⤵
- Executes dropped EXE
PID:3500 -
\??\c:\hnttnh.exec:\hnttnh.exe58⤵
- Executes dropped EXE
PID:4948 -
\??\c:\vjjdp.exec:\vjjdp.exe59⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xxxxlfl.exec:\xxxxlfl.exe60⤵
- Executes dropped EXE
PID:4528 -
\??\c:\1bhhbn.exec:\1bhhbn.exe61⤵
- Executes dropped EXE
PID:4776 -
\??\c:\ntbtnn.exec:\ntbtnn.exe62⤵
- Executes dropped EXE
PID:212 -
\??\c:\xrffxrr.exec:\xrffxrr.exe63⤵
- Executes dropped EXE
PID:3608 -
\??\c:\7nbbtb.exec:\7nbbtb.exe64⤵
- Executes dropped EXE
PID:2880 -
\??\c:\btbhbb.exec:\btbhbb.exe65⤵
- Executes dropped EXE
PID:1532 -
\??\c:\9dvpj.exec:\9dvpj.exe66⤵PID:4116
-
\??\c:\dpvvd.exec:\dpvvd.exe67⤵PID:2944
-
\??\c:\lffrllf.exec:\lffrllf.exe68⤵PID:1228
-
\??\c:\tttnnn.exec:\tttnnn.exe69⤵PID:4444
-
\??\c:\jdjjd.exec:\jdjjd.exe70⤵PID:1784
-
\??\c:\llrxlrr.exec:\llrxlrr.exe71⤵PID:4800
-
\??\c:\nbhttn.exec:\nbhttn.exe72⤵PID:4624
-
\??\c:\1nnhtt.exec:\1nnhtt.exe73⤵PID:4792
-
\??\c:\bntbbb.exec:\bntbbb.exe74⤵PID:1408
-
\??\c:\hbnhhh.exec:\hbnhhh.exe75⤵PID:1424
-
\??\c:\pddpp.exec:\pddpp.exe76⤵PID:228
-
\??\c:\rllfxrr.exec:\rllfxrr.exe77⤵PID:4960
-
\??\c:\fxffffx.exec:\fxffffx.exe78⤵PID:1600
-
\??\c:\nhtthh.exec:\nhtthh.exe79⤵PID:4080
-
\??\c:\1tthbt.exec:\1tthbt.exe80⤵PID:4584
-
\??\c:\jvdjv.exec:\jvdjv.exe81⤵PID:2204
-
\??\c:\pppjj.exec:\pppjj.exe82⤵PID:3908
-
\??\c:\rfrrrxr.exec:\rfrrrxr.exe83⤵PID:4464
-
\??\c:\bnnhbt.exec:\bnnhbt.exe84⤵PID:1208
-
\??\c:\nnhbtt.exec:\nnhbtt.exe85⤵PID:4804
-
\??\c:\vvpjd.exec:\vvpjd.exe86⤵PID:1184
-
\??\c:\rxfxlfx.exec:\rxfxlfx.exe87⤵PID:4428
-
\??\c:\7frrxxx.exec:\7frrxxx.exe88⤵PID:4876
-
\??\c:\httntt.exec:\httntt.exe89⤵PID:2652
-
\??\c:\5tbbtt.exec:\5tbbtt.exe90⤵PID:4952
-
\??\c:\jvjjd.exec:\jvjjd.exe91⤵PID:4260
-
\??\c:\rllfxxf.exec:\rllfxxf.exe92⤵PID:3492
-
\??\c:\xlrrlff.exec:\xlrrlff.exe93⤵PID:3344
-
\??\c:\tbnhbh.exec:\tbnhbh.exe94⤵PID:3960
-
\??\c:\9bbbnn.exec:\9bbbnn.exe95⤵PID:5084
-
\??\c:\jdvvp.exec:\jdvvp.exe96⤵PID:4364
-
\??\c:\xrlxlxl.exec:\xrlxlxl.exe97⤵PID:4356
-
\??\c:\httnhh.exec:\httnhh.exe98⤵PID:4452
-
\??\c:\3pvpd.exec:\3pvpd.exe99⤵PID:2020
-
\??\c:\vvjdd.exec:\vvjdd.exe100⤵PID:4416
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe101⤵PID:1984
-
\??\c:\xrxrlll.exec:\xrxrlll.exe102⤵PID:1416
-
\??\c:\5ttnbh.exec:\5ttnbh.exe103⤵PID:5100
-
\??\c:\1vvpj.exec:\1vvpj.exe104⤵PID:4436
-
\??\c:\9ppjv.exec:\9ppjv.exe105⤵PID:3620
-
\??\c:\rrllfxf.exec:\rrllfxf.exe106⤵PID:4092
-
\??\c:\3rrxxxx.exec:\3rrxxxx.exe107⤵PID:4880
-
\??\c:\bbbbbt.exec:\bbbbbt.exe108⤵PID:3020
-
\??\c:\pjpjp.exec:\pjpjp.exe109⤵PID:1072
-
\??\c:\vdjjv.exec:\vdjjv.exe110⤵PID:3092
-
\??\c:\xllxlfx.exec:\xllxlfx.exe111⤵PID:4948
-
\??\c:\flxrrrl.exec:\flxrrrl.exe112⤵PID:2912
-
\??\c:\thbnbt.exec:\thbnbt.exe113⤵PID:4284
-
\??\c:\vjdjv.exec:\vjdjv.exe114⤵PID:4776
-
\??\c:\dpdvp.exec:\dpdvp.exe115⤵PID:1488
-
\??\c:\lxxlxfl.exec:\lxxlxfl.exe116⤵PID:3140
-
\??\c:\nbhbtt.exec:\nbhbtt.exe117⤵PID:1868
-
\??\c:\bhbtnh.exec:\bhbtnh.exe118⤵PID:2264
-
\??\c:\pppjj.exec:\pppjj.exe119⤵PID:2980
-
\??\c:\ppjjd.exec:\ppjjd.exe120⤵PID:400
-
\??\c:\lxxfrlf.exec:\lxxfrlf.exe121⤵PID:3884
-
\??\c:\hthbtb.exec:\hthbtb.exe122⤵PID:3676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-