Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 08:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a0a4e84ad5bc28cf7d5eb146c15bca2733721a388a2ce3d6fa60b3f01ca5f602N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
a0a4e84ad5bc28cf7d5eb146c15bca2733721a388a2ce3d6fa60b3f01ca5f602N.exe
-
Size
53KB
-
MD5
d1598e9c1a4ee205709f43dbdb065360
-
SHA1
0f0ec83d7f60bfcc3bc203c0cc35d48fd6c90fc5
-
SHA256
a0a4e84ad5bc28cf7d5eb146c15bca2733721a388a2ce3d6fa60b3f01ca5f602
-
SHA512
248466e2c9f93495223e73d5164c60865b9b1e91543ca920a2c8833bcceb33ea161f75bb2eaf8f9612d6e785b1f5d3f3ad9cd4da42dc163073d99d7832ccd2a3
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlG:0cdpeeBSHHMHLf9RyI7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/3012-1-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2220-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-137-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/2056-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/852-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-219-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/656-225-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1644-238-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/576-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/576-245-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/700-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/700-282-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2192-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2196-328-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-335-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-362-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2772-367-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-405-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-430-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-476-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-489-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1088-496-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-516-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-515-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/884-555-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2324-568-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-612-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-703-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-862-0x00000000002B0000-0x00000000002D9000-memory.dmp family_blackmoon behavioral1/memory/2772-905-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2408-957-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/948-1013-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1776-1034-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2476-1058-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1776-1061-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2564-1066-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/992-1092-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-1240-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon behavioral1/memory/2368-1265-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2456-1276-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2908-1393-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2696-1403-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2992 dvpdp.exe 2188 5ththh.exe 2492 jjdjj.exe 2220 xlxxxll.exe 2892 3tbhtn.exe 2728 ppdjp.exe 2808 ppdpd.exe 2828 fxlrrrf.exe 2608 lfxxxlr.exe 2724 tnhtbb.exe 2552 vvjpd.exe 2508 lfxxfrf.exe 2004 lfrrfxf.exe 2036 bththh.exe 2056 vjjpv.exe 1796 vpdjp.exe 1040 llflxxl.exe 852 tbntbb.exe 1788 btntbh.exe 2920 jjdpd.exe 2792 xxxflrr.exe 1300 nbnhht.exe 2444 5ntbhn.exe 656 dvjpv.exe 1644 jjppv.exe 576 7htbnb.exe 792 1bttbb.exe 592 7jpdv.exe 1220 xxfxlrx.exe 700 bhhhbt.exe 540 hhthhn.exe 2192 jdjjv.exe 2080 rlflxfr.exe 1632 3fxfllr.exe 2100 hbtnnt.exe 2196 1pjpj.exe 2860 vddjd.exe 2760 xxflrrf.exe 2304 ffxrxfr.exe 2912 9ttbhb.exe 2632 5bnhnt.exe 2772 jdvpv.exe 2620 jjppp.exe 3016 fllrrfl.exe 2724 lfrrlff.exe 2296 nnbnbb.exe 2132 nhtthb.exe 1924 3pvvv.exe 1188 jjvdd.exe 2356 llxfllr.exe 2372 5thhnn.exe 1584 dvddd.exe 1920 5xflxff.exe 632 ffrrflr.exe 808 hhtbbt.exe 1756 nthtbb.exe 2128 vpdjp.exe 2456 3pjpp.exe 1968 rlrxffr.exe 1648 lfrrffl.exe 1012 3bbhtt.exe 1088 7nnbnn.exe 964 ppdjp.exe 2392 fxrxllf.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfflxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2992 3012 a0a4e84ad5bc28cf7d5eb146c15bca2733721a388a2ce3d6fa60b3f01ca5f602N.exe 30 PID 3012 wrote to memory of 2992 3012 a0a4e84ad5bc28cf7d5eb146c15bca2733721a388a2ce3d6fa60b3f01ca5f602N.exe 30 PID 3012 wrote to memory of 2992 3012 a0a4e84ad5bc28cf7d5eb146c15bca2733721a388a2ce3d6fa60b3f01ca5f602N.exe 30 PID 3012 wrote to memory of 2992 3012 a0a4e84ad5bc28cf7d5eb146c15bca2733721a388a2ce3d6fa60b3f01ca5f602N.exe 30 PID 2992 wrote to memory of 2188 2992 dvpdp.exe 31 PID 2992 wrote to memory of 2188 2992 dvpdp.exe 31 PID 2992 wrote to memory of 2188 2992 dvpdp.exe 31 PID 2992 wrote to memory of 2188 2992 dvpdp.exe 31 PID 2188 wrote to memory of 2492 2188 5ththh.exe 32 PID 2188 wrote to memory of 2492 2188 5ththh.exe 32 PID 2188 wrote to memory of 2492 2188 5ththh.exe 32 PID 2188 wrote to memory of 2492 2188 5ththh.exe 32 PID 2492 wrote to memory of 2220 2492 jjdjj.exe 33 PID 2492 wrote to memory of 2220 2492 jjdjj.exe 33 PID 2492 wrote to memory of 2220 2492 jjdjj.exe 33 PID 2492 wrote to memory of 2220 2492 jjdjj.exe 33 PID 2220 wrote to memory of 2892 2220 xlxxxll.exe 34 PID 2220 wrote to memory of 2892 2220 xlxxxll.exe 34 PID 2220 wrote to memory of 2892 2220 xlxxxll.exe 34 PID 2220 wrote to memory of 2892 2220 xlxxxll.exe 34 PID 2892 wrote to memory of 2728 2892 3tbhtn.exe 35 PID 2892 wrote to memory of 2728 2892 3tbhtn.exe 35 PID 2892 wrote to memory of 2728 2892 3tbhtn.exe 35 PID 2892 wrote to memory of 2728 2892 3tbhtn.exe 35 PID 2728 wrote to memory of 2808 2728 ppdjp.exe 36 PID 2728 wrote to memory of 2808 2728 ppdjp.exe 36 PID 2728 wrote to memory of 2808 2728 ppdjp.exe 36 PID 2728 wrote to memory of 2808 2728 ppdjp.exe 36 PID 2808 wrote to memory of 2828 2808 ppdpd.exe 37 PID 2808 wrote to memory of 2828 2808 ppdpd.exe 37 PID 2808 wrote to memory of 2828 2808 ppdpd.exe 37 PID 2808 wrote to memory of 2828 2808 ppdpd.exe 37 PID 2828 wrote to memory of 2608 2828 fxlrrrf.exe 38 PID 2828 wrote to memory of 2608 2828 fxlrrrf.exe 38 PID 2828 wrote to memory of 2608 2828 fxlrrrf.exe 38 PID 2828 wrote to memory of 2608 2828 fxlrrrf.exe 38 PID 2608 wrote to memory of 2724 2608 lfxxxlr.exe 39 PID 2608 wrote to memory of 2724 2608 lfxxxlr.exe 39 PID 2608 wrote to memory of 2724 2608 lfxxxlr.exe 39 PID 2608 wrote to memory of 2724 2608 lfxxxlr.exe 39 PID 2724 wrote to memory of 2552 2724 tnhtbb.exe 40 PID 2724 wrote to memory of 2552 2724 tnhtbb.exe 40 PID 2724 wrote to memory of 2552 2724 tnhtbb.exe 40 PID 2724 wrote to memory of 2552 2724 tnhtbb.exe 40 PID 2552 wrote to memory of 2508 2552 vvjpd.exe 41 PID 2552 wrote to memory of 2508 2552 vvjpd.exe 41 PID 2552 wrote to memory of 2508 2552 vvjpd.exe 41 PID 2552 wrote to memory of 2508 2552 vvjpd.exe 41 PID 2508 wrote to memory of 2004 2508 lfxxfrf.exe 42 PID 2508 wrote to memory of 2004 2508 lfxxfrf.exe 42 PID 2508 wrote to memory of 2004 2508 lfxxfrf.exe 42 PID 2508 wrote to memory of 2004 2508 lfxxfrf.exe 42 PID 2004 wrote to memory of 2036 2004 lfrrfxf.exe 43 PID 2004 wrote to memory of 2036 2004 lfrrfxf.exe 43 PID 2004 wrote to memory of 2036 2004 lfrrfxf.exe 43 PID 2004 wrote to memory of 2036 2004 lfrrfxf.exe 43 PID 2036 wrote to memory of 2056 2036 bththh.exe 44 PID 2036 wrote to memory of 2056 2036 bththh.exe 44 PID 2036 wrote to memory of 2056 2036 bththh.exe 44 PID 2036 wrote to memory of 2056 2036 bththh.exe 44 PID 2056 wrote to memory of 1796 2056 vjjpv.exe 45 PID 2056 wrote to memory of 1796 2056 vjjpv.exe 45 PID 2056 wrote to memory of 1796 2056 vjjpv.exe 45 PID 2056 wrote to memory of 1796 2056 vjjpv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0a4e84ad5bc28cf7d5eb146c15bca2733721a388a2ce3d6fa60b3f01ca5f602N.exe"C:\Users\Admin\AppData\Local\Temp\a0a4e84ad5bc28cf7d5eb146c15bca2733721a388a2ce3d6fa60b3f01ca5f602N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\dvpdp.exec:\dvpdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\5ththh.exec:\5ththh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\jjdjj.exec:\jjdjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\xlxxxll.exec:\xlxxxll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\3tbhtn.exec:\3tbhtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\ppdjp.exec:\ppdjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\ppdpd.exec:\ppdpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\fxlrrrf.exec:\fxlrrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\lfxxxlr.exec:\lfxxxlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\tnhtbb.exec:\tnhtbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\vvjpd.exec:\vvjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\lfxxfrf.exec:\lfxxfrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\lfrrfxf.exec:\lfrrfxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\bththh.exec:\bththh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\vjjpv.exec:\vjjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\vpdjp.exec:\vpdjp.exe17⤵
- Executes dropped EXE
PID:1796 -
\??\c:\llflxxl.exec:\llflxxl.exe18⤵
- Executes dropped EXE
PID:1040 -
\??\c:\tbntbb.exec:\tbntbb.exe19⤵
- Executes dropped EXE
PID:852 -
\??\c:\btntbh.exec:\btntbh.exe20⤵
- Executes dropped EXE
PID:1788 -
\??\c:\jjdpd.exec:\jjdpd.exe21⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xxxflrr.exec:\xxxflrr.exe22⤵
- Executes dropped EXE
PID:2792 -
\??\c:\nbnhht.exec:\nbnhht.exe23⤵
- Executes dropped EXE
PID:1300 -
\??\c:\5ntbhn.exec:\5ntbhn.exe24⤵
- Executes dropped EXE
PID:2444 -
\??\c:\dvjpv.exec:\dvjpv.exe25⤵
- Executes dropped EXE
PID:656 -
\??\c:\jjppv.exec:\jjppv.exe26⤵
- Executes dropped EXE
PID:1644 -
\??\c:\7htbnb.exec:\7htbnb.exe27⤵
- Executes dropped EXE
PID:576 -
\??\c:\1bttbb.exec:\1bttbb.exe28⤵
- Executes dropped EXE
PID:792 -
\??\c:\7jpdv.exec:\7jpdv.exe29⤵
- Executes dropped EXE
PID:592 -
\??\c:\xxfxlrx.exec:\xxfxlrx.exe30⤵
- Executes dropped EXE
PID:1220 -
\??\c:\bhhhbt.exec:\bhhhbt.exe31⤵
- Executes dropped EXE
PID:700 -
\??\c:\hhthhn.exec:\hhthhn.exe32⤵
- Executes dropped EXE
PID:540 -
\??\c:\jdjjv.exec:\jdjjv.exe33⤵
- Executes dropped EXE
PID:2192 -
\??\c:\rlflxfr.exec:\rlflxfr.exe34⤵
- Executes dropped EXE
PID:2080 -
\??\c:\3fxfllr.exec:\3fxfllr.exe35⤵
- Executes dropped EXE
PID:1632 -
\??\c:\hbtnnt.exec:\hbtnnt.exe36⤵
- Executes dropped EXE
PID:2100 -
\??\c:\1pjpj.exec:\1pjpj.exe37⤵
- Executes dropped EXE
PID:2196 -
\??\c:\vddjd.exec:\vddjd.exe38⤵
- Executes dropped EXE
PID:2860 -
\??\c:\xxflrrf.exec:\xxflrrf.exe39⤵
- Executes dropped EXE
PID:2760 -
\??\c:\ffxrxfr.exec:\ffxrxfr.exe40⤵
- Executes dropped EXE
PID:2304 -
\??\c:\9ttbhb.exec:\9ttbhb.exe41⤵
- Executes dropped EXE
PID:2912 -
\??\c:\5bnhnt.exec:\5bnhnt.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jdvpv.exec:\jdvpv.exe43⤵
- Executes dropped EXE
PID:2772 -
\??\c:\jjppp.exec:\jjppp.exe44⤵
- Executes dropped EXE
PID:2620 -
\??\c:\fllrrfl.exec:\fllrrfl.exe45⤵
- Executes dropped EXE
PID:3016 -
\??\c:\lfrrlff.exec:\lfrrlff.exe46⤵
- Executes dropped EXE
PID:2724 -
\??\c:\nnbnbb.exec:\nnbnbb.exe47⤵
- Executes dropped EXE
PID:2296 -
\??\c:\nhtthb.exec:\nhtthb.exe48⤵
- Executes dropped EXE
PID:2132 -
\??\c:\3pvvv.exec:\3pvvv.exe49⤵
- Executes dropped EXE
PID:1924 -
\??\c:\jjvdd.exec:\jjvdd.exe50⤵
- Executes dropped EXE
PID:1188 -
\??\c:\llxfllr.exec:\llxfllr.exe51⤵
- Executes dropped EXE
PID:2356 -
\??\c:\5thhnn.exec:\5thhnn.exe52⤵
- Executes dropped EXE
PID:2372 -
\??\c:\dvddd.exec:\dvddd.exe53⤵
- Executes dropped EXE
PID:1584 -
\??\c:\5xflxff.exec:\5xflxff.exe54⤵
- Executes dropped EXE
PID:1920 -
\??\c:\ffrrflr.exec:\ffrrflr.exe55⤵
- Executes dropped EXE
PID:632 -
\??\c:\hhtbbt.exec:\hhtbbt.exe56⤵
- Executes dropped EXE
PID:808 -
\??\c:\nthtbb.exec:\nthtbb.exe57⤵
- Executes dropped EXE
PID:1756 -
\??\c:\vpdjp.exec:\vpdjp.exe58⤵
- Executes dropped EXE
PID:2128 -
\??\c:\3pjpp.exec:\3pjpp.exe59⤵
- Executes dropped EXE
PID:2456 -
\??\c:\rlrxffr.exec:\rlrxffr.exe60⤵
- Executes dropped EXE
PID:1968 -
\??\c:\lfrrffl.exec:\lfrrffl.exe61⤵
- Executes dropped EXE
PID:1648 -
\??\c:\3bbhtt.exec:\3bbhtt.exe62⤵
- Executes dropped EXE
PID:1012 -
\??\c:\7nnbnn.exec:\7nnbnn.exe63⤵
- Executes dropped EXE
PID:1088 -
\??\c:\ppdjp.exec:\ppdjp.exe64⤵
- Executes dropped EXE
PID:964 -
\??\c:\fxrxllf.exec:\fxrxllf.exe65⤵
- Executes dropped EXE
PID:2392 -
\??\c:\flfxrlr.exec:\flfxrlr.exe66⤵PID:2308
-
\??\c:\lrxlxlx.exec:\lrxlxlx.exe67⤵PID:2180
-
\??\c:\hhtbhn.exec:\hhtbhn.exe68⤵PID:2964
-
\??\c:\djvvd.exec:\djvvd.exe69⤵PID:1908
-
\??\c:\1pddd.exec:\1pddd.exe70⤵PID:2124
-
\??\c:\rlxfrrx.exec:\rlxfrrx.exe71⤵PID:1052
-
\??\c:\7lxxllr.exec:\7lxxllr.exe72⤵PID:884
-
\??\c:\bbhhhn.exec:\bbhhhn.exe73⤵PID:3004
-
\??\c:\bththh.exec:\bththh.exe74⤵PID:2688
-
\??\c:\vdvdv.exec:\vdvdv.exe75⤵PID:2324
-
\??\c:\vpddv.exec:\vpddv.exe76⤵PID:1700
-
\??\c:\fxrxllx.exec:\fxrxllx.exe77⤵PID:2928
-
\??\c:\xxrxfxr.exec:\xxrxfxr.exe78⤵PID:2908
-
\??\c:\nnbhnn.exec:\nnbhnn.exe79⤵PID:2872
-
\??\c:\hthbnn.exec:\hthbnn.exe80⤵PID:2896
-
\??\c:\jjppd.exec:\jjppd.exe81⤵PID:2876
-
\??\c:\jjjpv.exec:\jjjpv.exe82⤵PID:2736
-
\??\c:\ffrfrfl.exec:\ffrfrfl.exe83⤵PID:2796
-
\??\c:\fxrxffl.exec:\fxrxffl.exe84⤵PID:2640
-
\??\c:\hbttnn.exec:\hbttnn.exe85⤵PID:2604
-
\??\c:\tbbhtb.exec:\tbbhtb.exe86⤵PID:2656
-
\??\c:\vvpdj.exec:\vvpdj.exe87⤵PID:2620
-
\??\c:\pdjjp.exec:\pdjjp.exe88⤵PID:3016
-
\??\c:\7xlrrxf.exec:\7xlrrxf.exe89⤵PID:3028
-
\??\c:\rrlrffl.exec:\rrlrffl.exe90⤵PID:2296
-
\??\c:\nnbbhn.exec:\nnbbhn.exe91⤵PID:1712
-
\??\c:\vvpvp.exec:\vvpvp.exe92⤵PID:1924
-
\??\c:\dvjpv.exec:\dvjpv.exe93⤵PID:2408
-
\??\c:\fxrxffl.exec:\fxrxffl.exe94⤵PID:1960
-
\??\c:\rlrrlrl.exec:\rlrrlrl.exe95⤵PID:2416
-
\??\c:\hnhnbb.exec:\hnhnbb.exe96⤵PID:2056
-
\??\c:\ttbttb.exec:\ttbttb.exe97⤵PID:1452
-
\??\c:\1ttthh.exec:\1ttthh.exe98⤵PID:632
-
\??\c:\ppvdp.exec:\ppvdp.exe99⤵PID:844
-
\??\c:\ppvdp.exec:\ppvdp.exe100⤵PID:852
-
\??\c:\fxxllrx.exec:\fxxllrx.exe101⤵PID:1868
-
\??\c:\ffxfllx.exec:\ffxfllx.exe102⤵PID:2128
-
\??\c:\nttthn.exec:\nttthn.exe103⤵PID:1488
-
\??\c:\5dpvv.exec:\5dpvv.exe104⤵PID:304
-
\??\c:\9jppp.exec:\9jppp.exe105⤵PID:2960
-
\??\c:\5rlxlrx.exec:\5rlxlrx.exe106⤵PID:836
-
\??\c:\5xrxfff.exec:\5xrxfff.exe107⤵PID:1088
-
\??\c:\xrxxrfl.exec:\xrxxrfl.exe108⤵PID:1304
-
\??\c:\hhbnhb.exec:\hhbnhb.exe109⤵PID:876
-
\??\c:\ddjvd.exec:\ddjvd.exe110⤵PID:264
-
\??\c:\1vjdp.exec:\1vjdp.exe111⤵PID:1152
-
\??\c:\5jdpv.exec:\5jdpv.exe112⤵PID:2564
-
\??\c:\rrffxrx.exec:\rrffxrx.exe113⤵PID:2964
-
\??\c:\fflrflr.exec:\fflrflr.exe114⤵PID:2248
-
\??\c:\bbtthh.exec:\bbtthh.exe115⤵PID:2124
-
\??\c:\7bnbnn.exec:\7bnbnn.exe116⤵PID:768
-
\??\c:\1pdvj.exec:\1pdvj.exe117⤵PID:2988
-
\??\c:\jdpvd.exec:\jdpvd.exe118⤵PID:2992
-
\??\c:\ffflrfr.exec:\ffflrfr.exe119⤵PID:2184
-
\??\c:\5frxflr.exec:\5frxflr.exe120⤵PID:2104
-
\??\c:\tthnbb.exec:\tthnbb.exe121⤵PID:2800
-
\??\c:\hhtntb.exec:\hhtntb.exe122⤵PID:2752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-