Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 20:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe
-
Size
54KB
-
MD5
b286483fb6d61f417c889121666538d6
-
SHA1
d84d87728b018c74ec989cf5f5b353555b90b678
-
SHA256
21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0
-
SHA512
7890f8e102c7e8d5877661704722c838f9268b3ce18f49ef90b9810f1427ec940c1df24c6c070a2a07e9ad63afafdf396fa897462bb00af084301034a2e79202
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJt:0cdpeeBSHHMHLf9RyIET
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral1/memory/2016-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/280-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/280-24-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/2992-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1840-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-134-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1508-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1672-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/708-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/544-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/544-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-292-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2440-295-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/2168-306-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2992-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-320-0x00000000001C0000-0x00000000001E9000-memory.dmp family_blackmoon behavioral1/memory/2684-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-321-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-335-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1232-391-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-436-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-448-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-529-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-536-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2732-574-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2696-612-0x00000000002B0000-0x00000000002D9000-memory.dmp family_blackmoon behavioral1/memory/1000-650-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1768-682-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/672-701-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2220-714-0x0000000001B50000-0x0000000001B79000-memory.dmp family_blackmoon behavioral1/memory/2204-763-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-784-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-826-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2792-824-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1800-879-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1668-891-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2780-904-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2020-914-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/264-918-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2500-972-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2964-1005-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/1928-1028-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1756-1047-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1600-1056-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2864-1177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-1213-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1436-1311-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/1516-1399-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1984 xxfffxf.exe 280 nhbhnb.exe 2992 dddpd.exe 2680 nhnthn.exe 2736 vjpjp.exe 3060 3pjjp.exe 2840 ffrxlrl.exe 2700 llflxfr.exe 2548 tthbnb.exe 3008 dvpdd.exe 1328 rrrffrl.exe 1840 5xxrxrr.exe 2064 bttntb.exe 2264 bbtttb.exe 1508 pjdpp.exe 2600 frflrxx.exe 1268 ttntnb.exe 1404 bbttbh.exe 2888 pdddp.exe 2220 jdjdp.exe 2500 1lffrfr.exe 2940 tnbhtn.exe 1672 nntbtb.exe 708 dddjp.exe 2008 ppvdp.exe 2960 llxxffx.exe 544 7nbhnt.exe 2412 dvpdp.exe 1696 9vdvv.exe 1756 flxfllr.exe 2128 3lxxrxf.exe 2316 nnhhbb.exe 2440 3nbbbt.exe 2168 jvpdv.exe 2992 rrfxflr.exe 2800 hhnbbh.exe 2684 7bhbbb.exe 2560 3jdjj.exe 3004 jvdvd.exe 2704 lfxlrlr.exe 2564 7hbhnt.exe 2980 nnnnnt.exe 1960 9tnttb.exe 3008 1vppd.exe 2632 jvdjp.exe 2760 xxxlxxf.exe 1232 1nhbbt.exe 696 nntntt.exe 1920 jjdpd.exe 1524 3jddd.exe 1764 flxlrxf.exe 1272 lllxrxf.exe 1164 1bbnnt.exe 2572 ddpvj.exe 2152 llrxxfr.exe 2100 flfrxxl.exe 2220 hnthth.exe 1016 bntnnn.exe 1060 jppjj.exe 1356 llrrxfl.exe 1608 llxflrf.exe 968 bhhnbh.exe 2148 5hbnth.exe 568 vvvdv.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxlrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppjp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1984 2016 21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe 31 PID 2016 wrote to memory of 1984 2016 21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe 31 PID 2016 wrote to memory of 1984 2016 21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe 31 PID 2016 wrote to memory of 1984 2016 21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe 31 PID 1984 wrote to memory of 280 1984 xxfffxf.exe 32 PID 1984 wrote to memory of 280 1984 xxfffxf.exe 32 PID 1984 wrote to memory of 280 1984 xxfffxf.exe 32 PID 1984 wrote to memory of 280 1984 xxfffxf.exe 32 PID 280 wrote to memory of 2992 280 nhbhnb.exe 33 PID 280 wrote to memory of 2992 280 nhbhnb.exe 33 PID 280 wrote to memory of 2992 280 nhbhnb.exe 33 PID 280 wrote to memory of 2992 280 nhbhnb.exe 33 PID 2992 wrote to memory of 2680 2992 dddpd.exe 34 PID 2992 wrote to memory of 2680 2992 dddpd.exe 34 PID 2992 wrote to memory of 2680 2992 dddpd.exe 34 PID 2992 wrote to memory of 2680 2992 dddpd.exe 34 PID 2680 wrote to memory of 2736 2680 nhnthn.exe 35 PID 2680 wrote to memory of 2736 2680 nhnthn.exe 35 PID 2680 wrote to memory of 2736 2680 nhnthn.exe 35 PID 2680 wrote to memory of 2736 2680 nhnthn.exe 35 PID 2736 wrote to memory of 3060 2736 vjpjp.exe 36 PID 2736 wrote to memory of 3060 2736 vjpjp.exe 36 PID 2736 wrote to memory of 3060 2736 vjpjp.exe 36 PID 2736 wrote to memory of 3060 2736 vjpjp.exe 36 PID 3060 wrote to memory of 2840 3060 3pjjp.exe 37 PID 3060 wrote to memory of 2840 3060 3pjjp.exe 37 PID 3060 wrote to memory of 2840 3060 3pjjp.exe 37 PID 3060 wrote to memory of 2840 3060 3pjjp.exe 37 PID 2840 wrote to memory of 2700 2840 ffrxlrl.exe 38 PID 2840 wrote to memory of 2700 2840 ffrxlrl.exe 38 PID 2840 wrote to memory of 2700 2840 ffrxlrl.exe 38 PID 2840 wrote to memory of 2700 2840 ffrxlrl.exe 38 PID 2700 wrote to memory of 2548 2700 llflxfr.exe 39 PID 2700 wrote to memory of 2548 2700 llflxfr.exe 39 PID 2700 wrote to memory of 2548 2700 llflxfr.exe 39 PID 2700 wrote to memory of 2548 2700 llflxfr.exe 39 PID 2548 wrote to memory of 3008 2548 tthbnb.exe 40 PID 2548 wrote to memory of 3008 2548 tthbnb.exe 40 PID 2548 wrote to memory of 3008 2548 tthbnb.exe 40 PID 2548 wrote to memory of 3008 2548 tthbnb.exe 40 PID 3008 wrote to memory of 1328 3008 dvpdd.exe 41 PID 3008 wrote to memory of 1328 3008 dvpdd.exe 41 PID 3008 wrote to memory of 1328 3008 dvpdd.exe 41 PID 3008 wrote to memory of 1328 3008 dvpdd.exe 41 PID 1328 wrote to memory of 1840 1328 rrrffrl.exe 42 PID 1328 wrote to memory of 1840 1328 rrrffrl.exe 42 PID 1328 wrote to memory of 1840 1328 rrrffrl.exe 42 PID 1328 wrote to memory of 1840 1328 rrrffrl.exe 42 PID 1840 wrote to memory of 2064 1840 5xxrxrr.exe 43 PID 1840 wrote to memory of 2064 1840 5xxrxrr.exe 43 PID 1840 wrote to memory of 2064 1840 5xxrxrr.exe 43 PID 1840 wrote to memory of 2064 1840 5xxrxrr.exe 43 PID 2064 wrote to memory of 2264 2064 bttntb.exe 44 PID 2064 wrote to memory of 2264 2064 bttntb.exe 44 PID 2064 wrote to memory of 2264 2064 bttntb.exe 44 PID 2064 wrote to memory of 2264 2064 bttntb.exe 44 PID 2264 wrote to memory of 1508 2264 bbtttb.exe 45 PID 2264 wrote to memory of 1508 2264 bbtttb.exe 45 PID 2264 wrote to memory of 1508 2264 bbtttb.exe 45 PID 2264 wrote to memory of 1508 2264 bbtttb.exe 45 PID 1508 wrote to memory of 2600 1508 pjdpp.exe 46 PID 1508 wrote to memory of 2600 1508 pjdpp.exe 46 PID 1508 wrote to memory of 2600 1508 pjdpp.exe 46 PID 1508 wrote to memory of 2600 1508 pjdpp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe"C:\Users\Admin\AppData\Local\Temp\21f770bb925e78503e397de3b0d29ad5081d3211abbb57733674fb38c90a14f0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\xxfffxf.exec:\xxfffxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\nhbhnb.exec:\nhbhnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:280 -
\??\c:\dddpd.exec:\dddpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\nhnthn.exec:\nhnthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\vjpjp.exec:\vjpjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\3pjjp.exec:\3pjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\ffrxlrl.exec:\ffrxlrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\llflxfr.exec:\llflxfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\tthbnb.exec:\tthbnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\dvpdd.exec:\dvpdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\rrrffrl.exec:\rrrffrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\5xxrxrr.exec:\5xxrxrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\bttntb.exec:\bttntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\bbtttb.exec:\bbtttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\pjdpp.exec:\pjdpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\frflrxx.exec:\frflrxx.exe17⤵
- Executes dropped EXE
PID:2600 -
\??\c:\ttntnb.exec:\ttntnb.exe18⤵
- Executes dropped EXE
PID:1268 -
\??\c:\bbttbh.exec:\bbttbh.exe19⤵
- Executes dropped EXE
PID:1404 -
\??\c:\pdddp.exec:\pdddp.exe20⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jdjdp.exec:\jdjdp.exe21⤵
- Executes dropped EXE
PID:2220 -
\??\c:\1lffrfr.exec:\1lffrfr.exe22⤵
- Executes dropped EXE
PID:2500 -
\??\c:\tnbhtn.exec:\tnbhtn.exe23⤵
- Executes dropped EXE
PID:2940 -
\??\c:\nntbtb.exec:\nntbtb.exe24⤵
- Executes dropped EXE
PID:1672 -
\??\c:\dddjp.exec:\dddjp.exe25⤵
- Executes dropped EXE
PID:708 -
\??\c:\ppvdp.exec:\ppvdp.exe26⤵
- Executes dropped EXE
PID:2008 -
\??\c:\llxxffx.exec:\llxxffx.exe27⤵
- Executes dropped EXE
PID:2960 -
\??\c:\7nbhnt.exec:\7nbhnt.exe28⤵
- Executes dropped EXE
PID:544 -
\??\c:\dvpdp.exec:\dvpdp.exe29⤵
- Executes dropped EXE
PID:2412 -
\??\c:\9vdvv.exec:\9vdvv.exe30⤵
- Executes dropped EXE
PID:1696 -
\??\c:\flxfllr.exec:\flxfllr.exe31⤵
- Executes dropped EXE
PID:1756 -
\??\c:\3lxxrxf.exec:\3lxxrxf.exe32⤵
- Executes dropped EXE
PID:2128 -
\??\c:\nnhhbb.exec:\nnhhbb.exe33⤵
- Executes dropped EXE
PID:2316 -
\??\c:\3nbbbt.exec:\3nbbbt.exe34⤵
- Executes dropped EXE
PID:2440 -
\??\c:\jvpdv.exec:\jvpdv.exe35⤵
- Executes dropped EXE
PID:2168 -
\??\c:\rrfxflr.exec:\rrfxflr.exe36⤵
- Executes dropped EXE
PID:2992 -
\??\c:\hhnbbh.exec:\hhnbbh.exe37⤵
- Executes dropped EXE
PID:2800 -
\??\c:\7bhbbb.exec:\7bhbbb.exe38⤵
- Executes dropped EXE
PID:2684 -
\??\c:\3jdjj.exec:\3jdjj.exe39⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jvdvd.exec:\jvdvd.exe40⤵
- Executes dropped EXE
PID:3004 -
\??\c:\lfxlrlr.exec:\lfxlrlr.exe41⤵
- Executes dropped EXE
PID:2704 -
\??\c:\7hbhnt.exec:\7hbhnt.exe42⤵
- Executes dropped EXE
PID:2564 -
\??\c:\nnnnnt.exec:\nnnnnt.exe43⤵
- Executes dropped EXE
PID:2980 -
\??\c:\9tnttb.exec:\9tnttb.exe44⤵
- Executes dropped EXE
PID:1960 -
\??\c:\1vppd.exec:\1vppd.exe45⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jvdjp.exec:\jvdjp.exe46⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xxxlxxf.exec:\xxxlxxf.exe47⤵
- Executes dropped EXE
PID:2760 -
\??\c:\1nhbbt.exec:\1nhbbt.exe48⤵
- Executes dropped EXE
PID:1232 -
\??\c:\nntntt.exec:\nntntt.exe49⤵
- Executes dropped EXE
PID:696 -
\??\c:\jjdpd.exec:\jjdpd.exe50⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3jddd.exec:\3jddd.exe51⤵
- Executes dropped EXE
PID:1524 -
\??\c:\flxlrxf.exec:\flxlrxf.exe52⤵
- Executes dropped EXE
PID:1764 -
\??\c:\lllxrxf.exec:\lllxrxf.exe53⤵
- Executes dropped EXE
PID:1272 -
\??\c:\1bbnnt.exec:\1bbnnt.exe54⤵
- Executes dropped EXE
PID:1164 -
\??\c:\ddpvj.exec:\ddpvj.exe55⤵
- Executes dropped EXE
PID:2572 -
\??\c:\llrxxfr.exec:\llrxxfr.exe56⤵
- Executes dropped EXE
PID:2152 -
\??\c:\flfrxxl.exec:\flfrxxl.exe57⤵
- Executes dropped EXE
PID:2100 -
\??\c:\hnthth.exec:\hnthth.exe58⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bntnnn.exec:\bntnnn.exe59⤵
- Executes dropped EXE
PID:1016 -
\??\c:\jppjj.exec:\jppjj.exe60⤵
- Executes dropped EXE
PID:1060 -
\??\c:\llrrxfl.exec:\llrrxfl.exe61⤵
- Executes dropped EXE
PID:1356 -
\??\c:\llxflrf.exec:\llxflrf.exe62⤵
- Executes dropped EXE
PID:1608 -
\??\c:\bhhnbh.exec:\bhhnbh.exe63⤵
- Executes dropped EXE
PID:968 -
\??\c:\5hbnth.exec:\5hbnth.exe64⤵
- Executes dropped EXE
PID:2148 -
\??\c:\vvvdv.exec:\vvvdv.exe65⤵
- Executes dropped EXE
PID:568 -
\??\c:\jpdjj.exec:\jpdjj.exe66⤵PID:2428
-
\??\c:\llffffx.exec:\llffffx.exe67⤵PID:544
-
\??\c:\llfxxlx.exec:\llfxxlx.exe68⤵PID:2272
-
\??\c:\xrxflrf.exec:\xrxflrf.exe69⤵PID:880
-
\??\c:\hhbhnh.exec:\hhbhnh.exe70⤵PID:2612
-
\??\c:\hbntbh.exec:\hbntbh.exe71⤵PID:2944
-
\??\c:\9pjpd.exec:\9pjpd.exe72⤵PID:2128
-
\??\c:\vvjvv.exec:\vvjvv.exe73⤵PID:2832
-
\??\c:\rlrxfxf.exec:\rlrxfxf.exe74⤵PID:280
-
\??\c:\1fxxrrx.exec:\1fxxrrx.exe75⤵PID:2640
-
\??\c:\nnthhh.exec:\nnthhh.exe76⤵PID:2156
-
\??\c:\5nbbnt.exec:\5nbbnt.exe77⤵PID:2732
-
\??\c:\ddpdj.exec:\ddpdj.exe78⤵PID:2800
-
\??\c:\9vpjj.exec:\9vpjj.exe79⤵PID:3060
-
\??\c:\7xxflxl.exec:\7xxflxl.exe80⤵PID:2852
-
\??\c:\llfflfr.exec:\llfflfr.exe81⤵PID:2804
-
\??\c:\tthttn.exec:\tthttn.exe82⤵PID:2544
-
\??\c:\bbnttb.exec:\bbnttb.exe83⤵PID:2696
-
\??\c:\5vjjp.exec:\5vjjp.exe84⤵PID:2420
-
\??\c:\5jddd.exec:\5jddd.exe85⤵PID:2996
-
\??\c:\lfxrrrr.exec:\lfxrrrr.exe86⤵PID:1112
-
\??\c:\lfrxxfl.exec:\lfrxxfl.exe87⤵PID:2776
-
\??\c:\3nhhnb.exec:\3nhhnb.exe88⤵PID:2620
-
\??\c:\nhntbh.exec:\nhntbh.exe89⤵PID:1000
-
\??\c:\pjvvd.exec:\pjvvd.exe90⤵PID:704
-
\??\c:\rrflflx.exec:\rrflflx.exe91⤵PID:1320
-
\??\c:\xfxfrrx.exec:\xfxfrrx.exe92⤵PID:2036
-
\??\c:\nnbhbh.exec:\nnbhbh.exe93⤵PID:636
-
\??\c:\hhbbbh.exec:\hhbbbh.exe94⤵PID:1768
-
\??\c:\nnbhbt.exec:\nnbhbt.exe95⤵PID:2856
-
\??\c:\djjvj.exec:\djjvj.exe96⤵PID:1160
-
\??\c:\xxfrrxl.exec:\xxfrrxl.exe97⤵PID:672
-
\??\c:\1xrxrxf.exec:\1xrxrxf.exe98⤵PID:2216
-
\??\c:\5nhnnt.exec:\5nhnnt.exe99⤵PID:2220
-
\??\c:\1tnntb.exec:\1tnntb.exe100⤵PID:2772
-
\??\c:\vdpvj.exec:\vdpvj.exe101⤵PID:1924
-
\??\c:\ddppv.exec:\ddppv.exe102⤵PID:1452
-
\??\c:\1rfxxfx.exec:\1rfxxfx.exe103⤵PID:1732
-
\??\c:\rxrfrrf.exec:\rxrfrrf.exe104⤵PID:708
-
\??\c:\nbttbt.exec:\nbttbt.exe105⤵PID:2148
-
\??\c:\5vvjp.exec:\5vvjp.exe106⤵PID:2960
-
\??\c:\vddjd.exec:\vddjd.exe107⤵PID:1504
-
\??\c:\1vpvv.exec:\1vpvv.exe108⤵PID:2204
-
\??\c:\rrfrfrx.exec:\rrfrfrx.exe109⤵PID:1864
-
\??\c:\1nhnnt.exec:\1nhnnt.exe110⤵PID:2896
-
\??\c:\bbhhtt.exec:\bbhhtt.exe111⤵PID:2904
-
\??\c:\nhtttb.exec:\nhtttb.exe112⤵PID:2108
-
\??\c:\9dppv.exec:\9dppv.exe113⤵PID:2728
-
\??\c:\5xxxlrf.exec:\5xxxlrf.exe114⤵PID:2508
-
\??\c:\xfxflxf.exec:\xfxflxf.exe115⤵PID:2836
-
\??\c:\nntbnt.exec:\nntbnt.exe116⤵PID:2756
-
\??\c:\bbnnbb.exec:\bbnnbb.exe117⤵PID:2792
-
\??\c:\vpdjv.exec:\vpdjv.exe118⤵PID:2664
-
\??\c:\djjvd.exec:\djjvd.exe119⤵PID:2816
-
\??\c:\1lrffrf.exec:\1lrffrf.exe120⤵PID:2692
-
\??\c:\ffrfrxl.exec:\ffrfrxl.exe121⤵PID:1992
-
\??\c:\bhntnn.exec:\bhntnn.exe122⤵PID:2536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-