Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-12-2024 22:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe
-
Size
53KB
-
MD5
864bf3fac5dde4189a2ec07d7f651cc5
-
SHA1
23d2923fc8be4ae09ccbc158112fbe5c57b6bafb
-
SHA256
7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b
-
SHA512
1b74a2052d9f37771b672ec064b383742abf0b110b17ab1bf023d4444ba1bedc23dc9777e532d6b81bb8886be412fcc90a7dafe73b355a8c6670151a82126bdc
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlm:0cdpeeBSHHMHLf9RyIB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/2792-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2256-65-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2856-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-70-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/2244-85-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2244-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-101-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1948-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1196-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/576-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1092-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/680-140-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/680-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2368-157-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2184-175-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2200-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1104-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/336-229-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1468-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1508-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-332-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-340-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/860-353-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-369-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1520-393-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-408-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-411-0x00000000002B0000-0x00000000002D9000-memory.dmp family_blackmoon behavioral1/memory/2032-416-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-423-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1600-426-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1600-431-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2432-480-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-517-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1800-549-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2588-585-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2588-589-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-614-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-626-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2268-641-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-654-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2380-718-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-721-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2408-756-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/620-764-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/1988-797-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1628-804-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-817-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2628-825-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2628-824-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1636-950-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2392-977-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/1936-988-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1900-1003-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1316-1014-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2312-1029-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2892 ffllxxl.exe 2668 bthnbt.exe 2636 1dvdv.exe 2796 xxllxxl.exe 2592 nnbbbt.exe 2256 nbbbnn.exe 2856 jdjjp.exe 2244 pjppp.exe 1420 xxrffxf.exe 1948 nnbtbt.exe 1196 5btbhh.exe 576 ppjjd.exe 1092 1xlrlrr.exe 680 xrxxlff.exe 532 tthhnn.exe 2368 jdpjp.exe 2152 vpdjv.exe 2184 xxrxfff.exe 2200 nhtbnn.exe 2224 hnhhnt.exe 1104 vvvvj.exe 2408 fxffrrr.exe 1556 bthhnt.exe 336 bnhbbt.exe 2912 7ddjd.exe 1872 lxlfrrx.exe 2328 xrxxffl.exe 1468 bbnthh.exe 2104 3dppv.exe 3032 vpddp.exe 2628 fxrrxxf.exe 2784 ffrrffr.exe 1508 btnhht.exe 2836 jdpjp.exe 2716 ddddd.exe 2544 ffxfxrl.exe 2664 rrfflfl.exe 2592 3thntt.exe 2768 dpjjv.exe 860 vpdvj.exe 2372 fxrxxxf.exe 2360 ffrxrrx.exe 2604 nnbhnh.exe 2028 hhtbbh.exe 2348 jdvpv.exe 1520 9pvdd.exe 2352 rxrflxx.exe 1952 bbttbn.exe 2032 tntthn.exe 2616 hnbbtt.exe 1600 jjvvv.exe 2116 1lrrxfl.exe 1968 rfflxxf.exe 1000 nbbbhn.exe 2204 tnthtt.exe 1584 1pjvj.exe 444 9vvvv.exe 2092 3pppj.exe 2432 5flfxrr.exe 2232 3fxxlfl.exe 2496 bhhthb.exe 2516 hbtnbn.exe 1944 vvjpp.exe 1592 dvjjd.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xfflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2892 2792 7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe 30 PID 2792 wrote to memory of 2892 2792 7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe 30 PID 2792 wrote to memory of 2892 2792 7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe 30 PID 2792 wrote to memory of 2892 2792 7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe 30 PID 2892 wrote to memory of 2668 2892 ffllxxl.exe 31 PID 2892 wrote to memory of 2668 2892 ffllxxl.exe 31 PID 2892 wrote to memory of 2668 2892 ffllxxl.exe 31 PID 2892 wrote to memory of 2668 2892 ffllxxl.exe 31 PID 2668 wrote to memory of 2636 2668 bthnbt.exe 32 PID 2668 wrote to memory of 2636 2668 bthnbt.exe 32 PID 2668 wrote to memory of 2636 2668 bthnbt.exe 32 PID 2668 wrote to memory of 2636 2668 bthnbt.exe 32 PID 2636 wrote to memory of 2796 2636 1dvdv.exe 33 PID 2636 wrote to memory of 2796 2636 1dvdv.exe 33 PID 2636 wrote to memory of 2796 2636 1dvdv.exe 33 PID 2636 wrote to memory of 2796 2636 1dvdv.exe 33 PID 2796 wrote to memory of 2592 2796 xxllxxl.exe 34 PID 2796 wrote to memory of 2592 2796 xxllxxl.exe 34 PID 2796 wrote to memory of 2592 2796 xxllxxl.exe 34 PID 2796 wrote to memory of 2592 2796 xxllxxl.exe 34 PID 2592 wrote to memory of 2256 2592 nnbbbt.exe 35 PID 2592 wrote to memory of 2256 2592 nnbbbt.exe 35 PID 2592 wrote to memory of 2256 2592 nnbbbt.exe 35 PID 2592 wrote to memory of 2256 2592 nnbbbt.exe 35 PID 2256 wrote to memory of 2856 2256 nbbbnn.exe 36 PID 2256 wrote to memory of 2856 2256 nbbbnn.exe 36 PID 2256 wrote to memory of 2856 2256 nbbbnn.exe 36 PID 2256 wrote to memory of 2856 2256 nbbbnn.exe 36 PID 2856 wrote to memory of 2244 2856 jdjjp.exe 37 PID 2856 wrote to memory of 2244 2856 jdjjp.exe 37 PID 2856 wrote to memory of 2244 2856 jdjjp.exe 37 PID 2856 wrote to memory of 2244 2856 jdjjp.exe 37 PID 2244 wrote to memory of 1420 2244 pjppp.exe 38 PID 2244 wrote to memory of 1420 2244 pjppp.exe 38 PID 2244 wrote to memory of 1420 2244 pjppp.exe 38 PID 2244 wrote to memory of 1420 2244 pjppp.exe 38 PID 1420 wrote to memory of 1948 1420 xxrffxf.exe 39 PID 1420 wrote to memory of 1948 1420 xxrffxf.exe 39 PID 1420 wrote to memory of 1948 1420 xxrffxf.exe 39 PID 1420 wrote to memory of 1948 1420 xxrffxf.exe 39 PID 1948 wrote to memory of 1196 1948 nnbtbt.exe 40 PID 1948 wrote to memory of 1196 1948 nnbtbt.exe 40 PID 1948 wrote to memory of 1196 1948 nnbtbt.exe 40 PID 1948 wrote to memory of 1196 1948 nnbtbt.exe 40 PID 1196 wrote to memory of 576 1196 5btbhh.exe 41 PID 1196 wrote to memory of 576 1196 5btbhh.exe 41 PID 1196 wrote to memory of 576 1196 5btbhh.exe 41 PID 1196 wrote to memory of 576 1196 5btbhh.exe 41 PID 576 wrote to memory of 1092 576 ppjjd.exe 42 PID 576 wrote to memory of 1092 576 ppjjd.exe 42 PID 576 wrote to memory of 1092 576 ppjjd.exe 42 PID 576 wrote to memory of 1092 576 ppjjd.exe 42 PID 1092 wrote to memory of 680 1092 1xlrlrr.exe 43 PID 1092 wrote to memory of 680 1092 1xlrlrr.exe 43 PID 1092 wrote to memory of 680 1092 1xlrlrr.exe 43 PID 1092 wrote to memory of 680 1092 1xlrlrr.exe 43 PID 680 wrote to memory of 532 680 xrxxlff.exe 44 PID 680 wrote to memory of 532 680 xrxxlff.exe 44 PID 680 wrote to memory of 532 680 xrxxlff.exe 44 PID 680 wrote to memory of 532 680 xrxxlff.exe 44 PID 532 wrote to memory of 2368 532 tthhnn.exe 45 PID 532 wrote to memory of 2368 532 tthhnn.exe 45 PID 532 wrote to memory of 2368 532 tthhnn.exe 45 PID 532 wrote to memory of 2368 532 tthhnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe"C:\Users\Admin\AppData\Local\Temp\7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\ffllxxl.exec:\ffllxxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\bthnbt.exec:\bthnbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\1dvdv.exec:\1dvdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\xxllxxl.exec:\xxllxxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\nnbbbt.exec:\nnbbbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\nbbbnn.exec:\nbbbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\jdjjp.exec:\jdjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\pjppp.exec:\pjppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\xxrffxf.exec:\xxrffxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\nnbtbt.exec:\nnbtbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\5btbhh.exec:\5btbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\ppjjd.exec:\ppjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\1xlrlrr.exec:\1xlrlrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\xrxxlff.exec:\xrxxlff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\tthhnn.exec:\tthhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\jdpjp.exec:\jdpjp.exe17⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vpdjv.exec:\vpdjv.exe18⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xxrxfff.exec:\xxrxfff.exe19⤵
- Executes dropped EXE
PID:2184 -
\??\c:\nhtbnn.exec:\nhtbnn.exe20⤵
- Executes dropped EXE
PID:2200 -
\??\c:\hnhhnt.exec:\hnhhnt.exe21⤵
- Executes dropped EXE
PID:2224 -
\??\c:\vvvvj.exec:\vvvvj.exe22⤵
- Executes dropped EXE
PID:1104 -
\??\c:\fxffrrr.exec:\fxffrrr.exe23⤵
- Executes dropped EXE
PID:2408 -
\??\c:\bthhnt.exec:\bthhnt.exe24⤵
- Executes dropped EXE
PID:1556 -
\??\c:\bnhbbt.exec:\bnhbbt.exe25⤵
- Executes dropped EXE
PID:336 -
\??\c:\7ddjd.exec:\7ddjd.exe26⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lxlfrrx.exec:\lxlfrrx.exe27⤵
- Executes dropped EXE
PID:1872 -
\??\c:\xrxxffl.exec:\xrxxffl.exe28⤵
- Executes dropped EXE
PID:2328 -
\??\c:\bbnthh.exec:\bbnthh.exe29⤵
- Executes dropped EXE
PID:1468 -
\??\c:\3dppv.exec:\3dppv.exe30⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vpddp.exec:\vpddp.exe31⤵
- Executes dropped EXE
PID:3032 -
\??\c:\fxrrxxf.exec:\fxrrxxf.exe32⤵
- Executes dropped EXE
PID:2628 -
\??\c:\ffrrffr.exec:\ffrrffr.exe33⤵
- Executes dropped EXE
PID:2784 -
\??\c:\btnhht.exec:\btnhht.exe34⤵
- Executes dropped EXE
PID:1508 -
\??\c:\jdpjp.exec:\jdpjp.exe35⤵
- Executes dropped EXE
PID:2836 -
\??\c:\ddddd.exec:\ddddd.exe36⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ffxfxrl.exec:\ffxfxrl.exe37⤵
- Executes dropped EXE
PID:2544 -
\??\c:\rrfflfl.exec:\rrfflfl.exe38⤵
- Executes dropped EXE
PID:2664 -
\??\c:\3thntt.exec:\3thntt.exe39⤵
- Executes dropped EXE
PID:2592 -
\??\c:\dpjjv.exec:\dpjjv.exe40⤵
- Executes dropped EXE
PID:2768 -
\??\c:\vpdvj.exec:\vpdvj.exe41⤵
- Executes dropped EXE
PID:860 -
\??\c:\fxrxxxf.exec:\fxrxxxf.exe42⤵
- Executes dropped EXE
PID:2372 -
\??\c:\ffrxrrx.exec:\ffrxrrx.exe43⤵
- Executes dropped EXE
PID:2360 -
\??\c:\nnbhnh.exec:\nnbhnh.exe44⤵
- Executes dropped EXE
PID:2604 -
\??\c:\hhtbbh.exec:\hhtbbh.exe45⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jdvpv.exec:\jdvpv.exe46⤵
- Executes dropped EXE
PID:2348 -
\??\c:\9pvdd.exec:\9pvdd.exe47⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rxrflxx.exec:\rxrflxx.exe48⤵
- Executes dropped EXE
PID:2352 -
\??\c:\bbttbn.exec:\bbttbn.exe49⤵
- Executes dropped EXE
PID:1952 -
\??\c:\tntthn.exec:\tntthn.exe50⤵
- Executes dropped EXE
PID:2032 -
\??\c:\hnbbtt.exec:\hnbbtt.exe51⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jjvvv.exec:\jjvvv.exe52⤵
- Executes dropped EXE
PID:1600 -
\??\c:\1lrrxfl.exec:\1lrrxfl.exe53⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rfflxxf.exec:\rfflxxf.exe54⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nbbbhn.exec:\nbbbhn.exe55⤵
- Executes dropped EXE
PID:1000 -
\??\c:\tnthtt.exec:\tnthtt.exe56⤵
- Executes dropped EXE
PID:2204 -
\??\c:\1pjvj.exec:\1pjvj.exe57⤵
- Executes dropped EXE
PID:1584 -
\??\c:\9vvvv.exec:\9vvvv.exe58⤵
- Executes dropped EXE
PID:444 -
\??\c:\3pppj.exec:\3pppj.exe59⤵
- Executes dropped EXE
PID:2092 -
\??\c:\5flfxrr.exec:\5flfxrr.exe60⤵
- Executes dropped EXE
PID:2432 -
\??\c:\3fxxlfl.exec:\3fxxlfl.exe61⤵
- Executes dropped EXE
PID:2232 -
\??\c:\bhhthb.exec:\bhhthb.exe62⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hbtnbn.exec:\hbtnbn.exe63⤵
- Executes dropped EXE
PID:2516 -
\??\c:\vvjpp.exec:\vvjpp.exe64⤵
- Executes dropped EXE
PID:1944 -
\??\c:\dvjjd.exec:\dvjjd.exe65⤵
- Executes dropped EXE
PID:1592 -
\??\c:\9xrxxfr.exec:\9xrxxfr.exe66⤵PID:2084
-
\??\c:\xllrfxf.exec:\xllrfxf.exe67⤵PID:1720
-
\??\c:\rxlrxfl.exec:\rxlrxfl.exe68⤵PID:1628
-
\??\c:\btnttt.exec:\btnttt.exe69⤵PID:1468
-
\??\c:\lflxxxf.exec:\lflxxxf.exe70⤵PID:1444
-
\??\c:\5hbthh.exec:\5hbthh.exe71⤵PID:1800
-
\??\c:\tnhtbn.exec:\tnhtbn.exe72⤵PID:2140
-
\??\c:\pjvvd.exec:\pjvvd.exe73⤵PID:2228
-
\??\c:\9dvdv.exec:\9dvdv.exe74⤵PID:2812
-
\??\c:\dvdpp.exec:\dvdpp.exe75⤵PID:2572
-
\??\c:\rlxllxf.exec:\rlxllxf.exe76⤵PID:2852
-
\??\c:\1rfxlrx.exec:\1rfxlrx.exe77⤵PID:2588
-
\??\c:\9ttbhn.exec:\9ttbhn.exe78⤵PID:2576
-
\??\c:\1hnntt.exec:\1hnntt.exe79⤵PID:2560
-
\??\c:\1dddj.exec:\1dddj.exe80⤵PID:2468
-
\??\c:\7jvvd.exec:\7jvvd.exe81⤵PID:2964
-
\??\c:\rrfxrrl.exec:\rrfxrrl.exe82⤵PID:2856
-
\??\c:\7xlffxf.exec:\7xlffxf.exe83⤵PID:2144
-
\??\c:\bbhbhh.exec:\bbhbhh.exe84⤵PID:2420
-
\??\c:\pjvvp.exec:\pjvvp.exe85⤵PID:1692
-
\??\c:\jdjjj.exec:\jdjjj.exe86⤵PID:2268
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe87⤵PID:1256
-
\??\c:\ffrrffl.exec:\ffrrffl.exe88⤵PID:2276
-
\??\c:\hnttbt.exec:\hnttbt.exe89⤵PID:1008
-
\??\c:\nbbbnt.exec:\nbbbnt.exe90⤵PID:2832
-
\??\c:\vpdpv.exec:\vpdpv.exe91⤵PID:2900
-
\??\c:\vpdvp.exec:\vpdvp.exe92⤵PID:588
-
\??\c:\5xllrrr.exec:\5xllrrr.exe93⤵PID:696
-
\??\c:\fxxrxxl.exec:\fxxrxxl.exe94⤵PID:1684
-
\??\c:\hbnhnb.exec:\hbnhnb.exe95⤵PID:1748
-
\??\c:\1nbthn.exec:\1nbthn.exe96⤵PID:2164
-
\??\c:\ddjvv.exec:\ddjvv.exe97⤵PID:2380
-
\??\c:\1vddd.exec:\1vddd.exe98⤵PID:2088
-
\??\c:\1vjjj.exec:\1vjjj.exe99⤵PID:1412
-
\??\c:\ffllrxx.exec:\ffllrxx.exe100⤵PID:2060
-
\??\c:\lxllrlx.exec:\lxllrlx.exe101⤵PID:1972
-
\??\c:\tthhtt.exec:\tthhtt.exe102⤵PID:2432
-
\??\c:\pjddp.exec:\pjddp.exe103⤵PID:2408
-
\??\c:\jjppv.exec:\jjppv.exe104⤵PID:620
-
\??\c:\vvddd.exec:\vvddd.exe105⤵PID:2440
-
\??\c:\7ffffff.exec:\7ffffff.exe106⤵PID:1744
-
\??\c:\hbntbb.exec:\hbntbb.exe107⤵PID:1592
-
\??\c:\tnhhnn.exec:\tnhhnn.exe108⤵PID:2096
-
\??\c:\vpppj.exec:\vpppj.exe109⤵PID:1988
-
\??\c:\ddppp.exec:\ddppp.exe110⤵PID:1628
-
\??\c:\fxrxfff.exec:\fxrxfff.exe111⤵PID:2700
-
\??\c:\rxxrrlr.exec:\rxxrrlr.exe112⤵PID:2792
-
\??\c:\3nhnnn.exec:\3nhnnn.exe113⤵PID:2628
-
\??\c:\nhntbh.exec:\nhntbh.exe114⤵PID:2676
-
\??\c:\jdpjp.exec:\jdpjp.exe115⤵PID:3060
-
\??\c:\vjjdj.exec:\vjjdj.exe116⤵PID:1508
-
\??\c:\xrfxflr.exec:\xrfxflr.exe117⤵PID:2636
-
\??\c:\xxflxxf.exec:\xxflxxf.exe118⤵PID:2600
-
\??\c:\tthnnn.exec:\tthnnn.exe119⤵PID:2564
-
\??\c:\hthhhn.exec:\hthhhn.exe120⤵PID:2472
-
\??\c:\dvvvv.exec:\dvvvv.exe121⤵PID:2256
-
\??\c:\1ppvp.exec:\1ppvp.exe122⤵PID:2956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-