Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 04:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9247fca85c0946f691ffb613e5fad2c23027848dd1b6c565e69f8ad36f1bd161N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
9247fca85c0946f691ffb613e5fad2c23027848dd1b6c565e69f8ad36f1bd161N.exe
-
Size
52KB
-
MD5
4a6156cda219e78dd79c8ea223e59ee0
-
SHA1
7645eb43f7a798d6ffd76b1ea4f67dc6597152b4
-
SHA256
9247fca85c0946f691ffb613e5fad2c23027848dd1b6c565e69f8ad36f1bd161
-
SHA512
c7d31749e52884d3c145a1f82e1b2f72fd6009cedcdd3b3e61bba7d57cef089bf7ab952b783996fcf6333146a5a4ce4ad6854bf52a6f1370f599f5571914aa3e
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5bx7DUQeG:0cdpeeBSHHMHLf9Rybx7DYG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/880-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2648-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1200-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1128-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2088-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1088-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-326-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-350-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2552-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-382-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-401-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-405-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-433-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-443-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-468-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-472-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/184-479-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2076-501-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-580-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-798-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-841-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-899-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-906-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-961-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-1101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2120-1165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-1652-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3356 fffxfxf.exe 4544 7rlllfx.exe 3496 htbbtn.exe 1628 ddddv.exe 1880 vjddv.exe 2648 5rlrlll.exe 1588 btthnh.exe 2208 7dvvp.exe 3212 lffffll.exe 4316 3xrlfxx.exe 4692 7pdvp.exe 2388 vvvjp.exe 3024 5xxrlfx.exe 1028 pddvp.exe 4424 jjjdv.exe 4372 rflfxxf.exe 1548 tbbbbb.exe 1200 bnbbtn.exe 4836 vjdpj.exe 2028 rlfllxl.exe 3676 rxxrxxr.exe 1436 bnhhhn.exe 2572 vvvpd.exe 3720 dvddd.exe 3388 lxrlxrl.exe 4748 ntbbbh.exe 4072 tbtnbb.exe 3080 7vvdv.exe 3208 frlfrlf.exe 4760 flrrllf.exe 3316 thhhbb.exe 2776 djpjp.exe 4168 jppjd.exe 1128 lrfxrrl.exe 2876 7hnnnh.exe 3020 hhbtht.exe 628 dddpp.exe 1636 pddpj.exe 964 rlfxfrf.exe 2136 hhhntt.exe 3468 hbthhh.exe 2884 pdjjv.exe 2948 1jppj.exe 636 xxrrffx.exe 4900 xrxxrrl.exe 4508 hhnhnn.exe 3076 bnbbtb.exe 1076 jpddv.exe 4220 vdjjd.exe 1964 fflxllf.exe 2852 lfxxrxx.exe 3972 btttnn.exe 3544 7jpjp.exe 4076 djjjd.exe 3944 3ffffll.exe 1976 nnnnhn.exe 524 thhhbt.exe 3496 vjpdp.exe 1492 ffxrrrx.exe 2088 3fxrllf.exe 1184 nntbtt.exe 828 7nnnnn.exe 3620 jjdvj.exe 1064 5lrllfx.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flfxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 880 wrote to memory of 3356 880 9247fca85c0946f691ffb613e5fad2c23027848dd1b6c565e69f8ad36f1bd161N.exe 84 PID 880 wrote to memory of 3356 880 9247fca85c0946f691ffb613e5fad2c23027848dd1b6c565e69f8ad36f1bd161N.exe 84 PID 880 wrote to memory of 3356 880 9247fca85c0946f691ffb613e5fad2c23027848dd1b6c565e69f8ad36f1bd161N.exe 84 PID 3356 wrote to memory of 4544 3356 fffxfxf.exe 85 PID 3356 wrote to memory of 4544 3356 fffxfxf.exe 85 PID 3356 wrote to memory of 4544 3356 fffxfxf.exe 85 PID 4544 wrote to memory of 3496 4544 7rlllfx.exe 86 PID 4544 wrote to memory of 3496 4544 7rlllfx.exe 86 PID 4544 wrote to memory of 3496 4544 7rlllfx.exe 86 PID 3496 wrote to memory of 1628 3496 htbbtn.exe 87 PID 3496 wrote to memory of 1628 3496 htbbtn.exe 87 PID 3496 wrote to memory of 1628 3496 htbbtn.exe 87 PID 1628 wrote to memory of 1880 1628 ddddv.exe 88 PID 1628 wrote to memory of 1880 1628 ddddv.exe 88 PID 1628 wrote to memory of 1880 1628 ddddv.exe 88 PID 1880 wrote to memory of 2648 1880 vjddv.exe 89 PID 1880 wrote to memory of 2648 1880 vjddv.exe 89 PID 1880 wrote to memory of 2648 1880 vjddv.exe 89 PID 2648 wrote to memory of 1588 2648 5rlrlll.exe 90 PID 2648 wrote to memory of 1588 2648 5rlrlll.exe 90 PID 2648 wrote to memory of 1588 2648 5rlrlll.exe 90 PID 1588 wrote to memory of 2208 1588 btthnh.exe 91 PID 1588 wrote to memory of 2208 1588 btthnh.exe 91 PID 1588 wrote to memory of 2208 1588 btthnh.exe 91 PID 2208 wrote to memory of 3212 2208 7dvvp.exe 92 PID 2208 wrote to memory of 3212 2208 7dvvp.exe 92 PID 2208 wrote to memory of 3212 2208 7dvvp.exe 92 PID 3212 wrote to memory of 4316 3212 lffffll.exe 93 PID 3212 wrote to memory of 4316 3212 lffffll.exe 93 PID 3212 wrote to memory of 4316 3212 lffffll.exe 93 PID 4316 wrote to memory of 4692 4316 3xrlfxx.exe 94 PID 4316 wrote to memory of 4692 4316 3xrlfxx.exe 94 PID 4316 wrote to memory of 4692 4316 3xrlfxx.exe 94 PID 4692 wrote to memory of 2388 4692 7pdvp.exe 95 PID 4692 wrote to memory of 2388 4692 7pdvp.exe 95 PID 4692 wrote to memory of 2388 4692 7pdvp.exe 95 PID 2388 wrote to memory of 3024 2388 vvvjp.exe 96 PID 2388 wrote to memory of 3024 2388 vvvjp.exe 96 PID 2388 wrote to memory of 3024 2388 vvvjp.exe 96 PID 3024 wrote to memory of 1028 3024 5xxrlfx.exe 97 PID 3024 wrote to memory of 1028 3024 5xxrlfx.exe 97 PID 3024 wrote to memory of 1028 3024 5xxrlfx.exe 97 PID 1028 wrote to memory of 4424 1028 pddvp.exe 98 PID 1028 wrote to memory of 4424 1028 pddvp.exe 98 PID 1028 wrote to memory of 4424 1028 pddvp.exe 98 PID 4424 wrote to memory of 4372 4424 jjjdv.exe 99 PID 4424 wrote to memory of 4372 4424 jjjdv.exe 99 PID 4424 wrote to memory of 4372 4424 jjjdv.exe 99 PID 4372 wrote to memory of 1548 4372 rflfxxf.exe 100 PID 4372 wrote to memory of 1548 4372 rflfxxf.exe 100 PID 4372 wrote to memory of 1548 4372 rflfxxf.exe 100 PID 1548 wrote to memory of 1200 1548 tbbbbb.exe 101 PID 1548 wrote to memory of 1200 1548 tbbbbb.exe 101 PID 1548 wrote to memory of 1200 1548 tbbbbb.exe 101 PID 1200 wrote to memory of 4836 1200 bnbbtn.exe 102 PID 1200 wrote to memory of 4836 1200 bnbbtn.exe 102 PID 1200 wrote to memory of 4836 1200 bnbbtn.exe 102 PID 4836 wrote to memory of 2028 4836 vjdpj.exe 103 PID 4836 wrote to memory of 2028 4836 vjdpj.exe 103 PID 4836 wrote to memory of 2028 4836 vjdpj.exe 103 PID 2028 wrote to memory of 3676 2028 rlfllxl.exe 104 PID 2028 wrote to memory of 3676 2028 rlfllxl.exe 104 PID 2028 wrote to memory of 3676 2028 rlfllxl.exe 104 PID 3676 wrote to memory of 1436 3676 rxxrxxr.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\9247fca85c0946f691ffb613e5fad2c23027848dd1b6c565e69f8ad36f1bd161N.exe"C:\Users\Admin\AppData\Local\Temp\9247fca85c0946f691ffb613e5fad2c23027848dd1b6c565e69f8ad36f1bd161N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\fffxfxf.exec:\fffxfxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\7rlllfx.exec:\7rlllfx.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\htbbtn.exec:\htbbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\ddddv.exec:\ddddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\vjddv.exec:\vjddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\5rlrlll.exec:\5rlrlll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\btthnh.exec:\btthnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\7dvvp.exec:\7dvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\lffffll.exec:\lffffll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\3xrlfxx.exec:\3xrlfxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\7pdvp.exec:\7pdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\vvvjp.exec:\vvvjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\5xxrlfx.exec:\5xxrlfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\pddvp.exec:\pddvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\jjjdv.exec:\jjjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\rflfxxf.exec:\rflfxxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\tbbbbb.exec:\tbbbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\bnbbtn.exec:\bnbbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\vjdpj.exec:\vjdpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\rlfllxl.exec:\rlfllxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\rxxrxxr.exec:\rxxrxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\bnhhhn.exec:\bnhhhn.exe23⤵
- Executes dropped EXE
PID:1436 -
\??\c:\vvvpd.exec:\vvvpd.exe24⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dvddd.exec:\dvddd.exe25⤵
- Executes dropped EXE
PID:3720 -
\??\c:\lxrlxrl.exec:\lxrlxrl.exe26⤵
- Executes dropped EXE
PID:3388 -
\??\c:\ntbbbh.exec:\ntbbbh.exe27⤵
- Executes dropped EXE
PID:4748 -
\??\c:\tbtnbb.exec:\tbtnbb.exe28⤵
- Executes dropped EXE
PID:4072 -
\??\c:\7vvdv.exec:\7vvdv.exe29⤵
- Executes dropped EXE
PID:3080 -
\??\c:\frlfrlf.exec:\frlfrlf.exe30⤵
- Executes dropped EXE
PID:3208 -
\??\c:\flrrllf.exec:\flrrllf.exe31⤵
- Executes dropped EXE
PID:4760 -
\??\c:\thhhbb.exec:\thhhbb.exe32⤵
- Executes dropped EXE
PID:3316 -
\??\c:\djpjp.exec:\djpjp.exe33⤵
- Executes dropped EXE
PID:2776 -
\??\c:\jppjd.exec:\jppjd.exe34⤵
- Executes dropped EXE
PID:4168 -
\??\c:\lrfxrrl.exec:\lrfxrrl.exe35⤵
- Executes dropped EXE
PID:1128 -
\??\c:\7hnnnh.exec:\7hnnnh.exe36⤵
- Executes dropped EXE
PID:2876 -
\??\c:\hhbtht.exec:\hhbtht.exe37⤵
- Executes dropped EXE
PID:3020 -
\??\c:\dddpp.exec:\dddpp.exe38⤵
- Executes dropped EXE
PID:628 -
\??\c:\pddpj.exec:\pddpj.exe39⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rlfxfrf.exec:\rlfxfrf.exe40⤵
- Executes dropped EXE
PID:964 -
\??\c:\hhhntt.exec:\hhhntt.exe41⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hbthhh.exec:\hbthhh.exe42⤵
- Executes dropped EXE
PID:3468 -
\??\c:\pdjjv.exec:\pdjjv.exe43⤵
- Executes dropped EXE
PID:2884 -
\??\c:\1jppj.exec:\1jppj.exe44⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xxrrffx.exec:\xxrrffx.exe45⤵
- Executes dropped EXE
PID:636 -
\??\c:\xrxxrrl.exec:\xrxxrrl.exe46⤵
- Executes dropped EXE
PID:4900 -
\??\c:\hhnhnn.exec:\hhnhnn.exe47⤵
- Executes dropped EXE
PID:4508 -
\??\c:\bnbbtb.exec:\bnbbtb.exe48⤵
- Executes dropped EXE
PID:3076 -
\??\c:\jpddv.exec:\jpddv.exe49⤵
- Executes dropped EXE
PID:1076 -
\??\c:\vdjjd.exec:\vdjjd.exe50⤵
- Executes dropped EXE
PID:4220 -
\??\c:\fflxllf.exec:\fflxllf.exe51⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lfxxrxx.exec:\lfxxrxx.exe52⤵
- Executes dropped EXE
PID:2852 -
\??\c:\btttnn.exec:\btttnn.exe53⤵
- Executes dropped EXE
PID:3972 -
\??\c:\7jpjp.exec:\7jpjp.exe54⤵
- Executes dropped EXE
PID:3544 -
\??\c:\vvddv.exec:\vvddv.exe55⤵PID:4576
-
\??\c:\djjjd.exec:\djjjd.exe56⤵
- Executes dropped EXE
PID:4076 -
\??\c:\3ffffll.exec:\3ffffll.exe57⤵
- Executes dropped EXE
PID:3944 -
\??\c:\nnnnhn.exec:\nnnnhn.exe58⤵
- Executes dropped EXE
PID:1976 -
\??\c:\thhhbt.exec:\thhhbt.exe59⤵
- Executes dropped EXE
PID:524 -
\??\c:\vjpdp.exec:\vjpdp.exe60⤵
- Executes dropped EXE
PID:3496 -
\??\c:\ffxrrrx.exec:\ffxrrrx.exe61⤵
- Executes dropped EXE
PID:1492 -
\??\c:\3fxrllf.exec:\3fxrllf.exe62⤵
- Executes dropped EXE
PID:2088 -
\??\c:\nntbtt.exec:\nntbtt.exe63⤵
- Executes dropped EXE
PID:1184 -
\??\c:\7nnnnn.exec:\7nnnnn.exe64⤵
- Executes dropped EXE
PID:828 -
\??\c:\jjdvj.exec:\jjdvj.exe65⤵
- Executes dropped EXE
PID:3620 -
\??\c:\5lrllfx.exec:\5lrllfx.exe66⤵
- Executes dropped EXE
PID:1064 -
\??\c:\rfxrffr.exec:\rfxrffr.exe67⤵PID:1088
-
\??\c:\hbhhnn.exec:\hbhhnn.exe68⤵PID:3212
-
\??\c:\3vpjv.exec:\3vpjv.exe69⤵PID:400
-
\??\c:\jdvpp.exec:\jdvpp.exe70⤵PID:4768
-
\??\c:\xllxlfr.exec:\xllxlfr.exe71⤵PID:1568
-
\??\c:\fxffffl.exec:\fxffffl.exe72⤵PID:748
-
\??\c:\nnbbtb.exec:\nnbbtb.exe73⤵PID:4460
-
\??\c:\7vvpj.exec:\7vvpj.exe74⤵PID:4208
-
\??\c:\vjddd.exec:\vjddd.exe75⤵PID:5064
-
\??\c:\fllfrfl.exec:\fllfrfl.exe76⤵PID:1028
-
\??\c:\xrrrxrr.exec:\xrrrxrr.exe77⤵PID:1172
-
\??\c:\nhhhbt.exec:\nhhhbt.exe78⤵PID:3668
-
\??\c:\nbntbn.exec:\nbntbn.exe79⤵PID:5096
-
\??\c:\vpjvj.exec:\vpjvj.exe80⤵PID:3548
-
\??\c:\vvvpj.exec:\vvvpj.exe81⤵PID:2936
-
\??\c:\5xfrrrr.exec:\5xfrrrr.exe82⤵PID:4948
-
\??\c:\bbnnbt.exec:\bbnnbt.exe83⤵PID:2940
-
\??\c:\tnnhnt.exec:\tnnhnt.exe84⤵PID:1412
-
\??\c:\pdddp.exec:\pdddp.exe85⤵PID:412
-
\??\c:\vjpjj.exec:\vjpjj.exe86⤵PID:1192
-
\??\c:\pdppp.exec:\pdppp.exe87⤵PID:5032
-
\??\c:\jpvjv.exec:\jpvjv.exe88⤵PID:2572
-
\??\c:\rlrlffl.exec:\rlrlffl.exe89⤵PID:2552
-
\??\c:\9xxrlfx.exec:\9xxrlfx.exe90⤵PID:4752
-
\??\c:\tnhhbh.exec:\tnhhbh.exe91⤵PID:3388
-
\??\c:\1pvpp.exec:\1pvpp.exe92⤵PID:3404
-
\??\c:\9vpvj.exec:\9vpvj.exe93⤵PID:4360
-
\??\c:\1llxfxl.exec:\1llxfxl.exe94⤵PID:4968
-
\??\c:\nnnnbh.exec:\nnnnbh.exe95⤵PID:4116
-
\??\c:\ntbnbt.exec:\ntbnbt.exe96⤵PID:3308
-
\??\c:\ddpjj.exec:\ddpjj.exe97⤵PID:4396
-
\??\c:\fxlxxxx.exec:\fxlxxxx.exe98⤵PID:1584
-
\??\c:\ffxrfxr.exec:\ffxrfxr.exe99⤵PID:3316
-
\??\c:\htbthh.exec:\htbthh.exe100⤵PID:3976
-
\??\c:\1ttnbt.exec:\1ttnbt.exe101⤵PID:3528
-
\??\c:\jjppv.exec:\jjppv.exe102⤵PID:1760
-
\??\c:\vvdpj.exec:\vvdpj.exe103⤵PID:948
-
\??\c:\xffxlfx.exec:\xffxlfx.exe104⤵PID:2152
-
\??\c:\7lxxffl.exec:\7lxxffl.exe105⤵PID:1304
-
\??\c:\bthbhh.exec:\bthbhh.exe106⤵PID:1132
-
\??\c:\tttnhh.exec:\tttnhh.exe107⤵PID:4872
-
\??\c:\pjjdd.exec:\pjjdd.exe108⤵PID:3640
-
\??\c:\jvvvd.exec:\jvvvd.exe109⤵PID:4660
-
\??\c:\rlrrxxl.exec:\rlrrxxl.exe110⤵PID:4764
-
\??\c:\hnnbtn.exec:\hnnbtn.exe111⤵PID:2624
-
\??\c:\nnnhnn.exec:\nnnhnn.exe112⤵PID:1860
-
\??\c:\jddvj.exec:\jddvj.exe113⤵PID:636
-
\??\c:\llrrxxf.exec:\llrrxxf.exe114⤵PID:184
-
\??\c:\5rrlffr.exec:\5rrlffr.exe115⤵PID:4972
-
\??\c:\nttbbt.exec:\nttbbt.exe116⤵PID:4996
-
\??\c:\dvvpj.exec:\dvvpj.exe117⤵PID:4056
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe118⤵PID:5016
-
\??\c:\5bbbhn.exec:\5bbbhn.exe119⤵PID:3120
-
\??\c:\bbhbtt.exec:\bbhbtt.exe120⤵PID:2852
-
\??\c:\vdvvj.exec:\vdvvj.exe121⤵PID:4448
-
\??\c:\jjvdj.exec:\jjvdj.exe122⤵PID:3716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-