Analysis
-
max time kernel
145s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
05/03/2024, 18:30
Behavioral task
behavioral1
Sample
2123b967bdab82370fc9616f35b4a1914c7c8bc9aa1adb6829f85392e0845252.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
-
Target
2123b967bdab82370fc9616f35b4a1914c7c8bc9aa1adb6829f85392e0845252.exe
-
Size
78KB
-
MD5
d0cd8a183519dcacf59ea8f4ed50e4de
-
SHA1
5bcf790ad94a1021b575dd340c84de584be2dfd7
-
SHA256
2123b967bdab82370fc9616f35b4a1914c7c8bc9aa1adb6829f85392e0845252
-
SHA512
530d8d8ab531725c85c157e6ab6d9b5f1bc5b9acb86e5d34714e6831e9746856f1af175e183d9db38522542b7276c8dcf10aae20b1b12385ad9d749c25e8c2a0
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6TVb:zhOmTsF93UYfwC6GIoutiTU2HVS6R
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2920-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1876-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1680-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1096-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/268-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1212-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-258-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1280-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1784-480-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/568-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/540-544-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2692-579-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-786-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2920-1-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000d000000012253-6.dat UPX behavioral1/memory/2952-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0034000000015662-22.dat UPX behavioral1/files/0x000a000000014f57-15.dat UPX behavioral1/memory/2228-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2644-24-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000015c9a-32.dat UPX behavioral1/memory/2648-34-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000015ca8-39.dat UPX behavioral1/memory/2644-30-0x00000000002B0000-0x00000000002D7000-memory.dmp UPX behavioral1/memory/2508-40-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2508-47-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000015cb1-49.dat UPX behavioral1/files/0x0007000000015cc5-55.dat UPX behavioral1/memory/2564-58-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0008000000016122-72.dat UPX behavioral1/memory/2404-70-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0009000000015ce3-64.dat UPX behavioral1/files/0x00060000000163eb-79.dat UPX behavioral1/memory/2296-75-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00060000000164ec-88.dat UPX behavioral1/memory/1508-90-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2232-87-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00060000000167bf-102.dat UPX behavioral1/files/0x0006000000016575-96.dat UPX behavioral1/files/0x0006000000016a28-109.dat UPX behavioral1/memory/2176-111-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016c1f-117.dat UPX behavioral1/memory/1876-124-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1680-128-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016c30-126.dat UPX behavioral1/files/0x0006000000016c38-133.dat UPX behavioral1/files/0x0006000000016c84-141.dat UPX behavioral1/memory/2752-144-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1096-151-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016cb5-150.dat UPX behavioral1/memory/1576-140-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016ce0-157.dat UPX behavioral1/files/0x0006000000016ced-163.dat UPX behavioral1/memory/2896-171-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016cf3-173.dat UPX behavioral1/memory/2868-175-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016cfd-180.dat UPX behavioral1/files/0x0006000000016d06-187.dat UPX behavioral1/memory/1260-188-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d10-195.dat UPX behavioral1/memory/268-198-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d18-204.dat UPX behavioral1/files/0x0006000000016d21-213.dat UPX behavioral1/memory/1212-212-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d29-219.dat UPX behavioral1/memory/1956-220-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d31-227.dat UPX behavioral1/files/0x0006000000016d81-234.dat UPX behavioral1/memory/1648-243-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2268-256-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d85-242.dat UPX behavioral1/files/0x0006000000016da9-250.dat UPX behavioral1/memory/1280-280-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2656-306-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2712-317-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2432-338-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2412-345-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2228 xlxffxf.exe 2952 tbbhnt.exe 2644 hbnhnt.exe 2648 9vjpv.exe 2508 jvjjp.exe 2768 7rflllf.exe 2564 tbhtth.exe 2404 thtttb.exe 2296 vvjvp.exe 2232 lxlffxx.exe 1508 bntnnn.exe 2576 5jdvd.exe 2604 7jdpd.exe 2176 xrxfflr.exe 1876 5nnnbb.exe 1680 hbtntn.exe 1576 5pjjp.exe 2752 jvdvj.exe 1096 1fxllff.exe 1488 1ffxrfr.exe 2896 htbbbb.exe 2868 7jdpv.exe 2032 5pdvp.exe 1260 5frfrxx.exe 268 1lfxflx.exe 1212 nbhhtt.exe 708 3vvjd.exe 1956 pjpvv.exe 1012 rfrxxrf.exe 1192 frxxxrx.exe 1648 9htbhb.exe 2268 bnhbbn.exe 1616 dpvjd.exe 1344 vjvjj.exe 1264 hbbttn.exe 1424 nhtbhh.exe 1280 5jvvv.exe 2924 lxflfff.exe 2952 ntthnb.exe 1524 pdjvd.exe 2656 3jvdp.exe 2652 xlrfrxx.exe 2536 3lrlfxf.exe 2712 nbnnbt.exe 2420 btbntn.exe 2772 hbnbnt.exe 2432 1pjpv.exe 2424 vpjjv.exe 2412 llxlfrf.exe 2344 rxlfxrf.exe 2512 nthttt.exe 2888 1jdjd.exe 1868 1dvvd.exe 2616 3rlrffr.exe 2284 frlrrrl.exe 2636 rflrfff.exe 1248 3bhhbt.exe 1892 5jddj.exe 1900 pddjp.exe 1888 7djjp.exe 1504 7rlxrrx.exe 1880 rlllrxx.exe 1360 hthhhh.exe 2288 5nbttn.exe -
resource yara_rule behavioral1/memory/2920-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000012253-6.dat upx behavioral1/memory/2952-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0034000000015662-22.dat upx behavioral1/files/0x000a000000014f57-15.dat upx behavioral1/memory/2228-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2644-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015c9a-32.dat upx behavioral1/memory/2648-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015ca8-39.dat upx behavioral1/memory/2644-30-0x00000000002B0000-0x00000000002D7000-memory.dmp upx behavioral1/memory/2508-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2508-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015cb1-49.dat upx behavioral1/files/0x0007000000015cc5-55.dat upx behavioral1/memory/2564-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016122-72.dat upx behavioral1/memory/2404-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015ce3-64.dat upx behavioral1/files/0x00060000000163eb-79.dat upx behavioral1/memory/2296-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000164ec-88.dat upx behavioral1/memory/1508-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2232-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000167bf-102.dat upx behavioral1/files/0x0006000000016575-96.dat upx behavioral1/files/0x0006000000016a28-109.dat upx behavioral1/memory/2176-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c1f-117.dat upx behavioral1/memory/1876-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1680-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c30-126.dat upx behavioral1/files/0x0006000000016c38-133.dat upx behavioral1/files/0x0006000000016c84-141.dat upx behavioral1/memory/2752-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1096-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cb5-150.dat upx behavioral1/memory/1576-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ce0-157.dat upx behavioral1/files/0x0006000000016ced-163.dat upx behavioral1/memory/2896-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cf3-173.dat upx behavioral1/memory/2868-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cfd-180.dat upx behavioral1/files/0x0006000000016d06-187.dat upx behavioral1/memory/1260-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d10-195.dat upx behavioral1/memory/268-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d18-204.dat upx behavioral1/files/0x0006000000016d21-213.dat upx behavioral1/memory/1212-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d29-219.dat upx behavioral1/memory/1956-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d31-227.dat upx behavioral1/files/0x0006000000016d81-234.dat upx behavioral1/memory/1648-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2268-256-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d85-242.dat upx behavioral1/files/0x0006000000016da9-250.dat upx behavioral1/memory/1280-280-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2656-306-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2712-317-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2432-338-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2412-345-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2920 wrote to memory of 2228 2920 2123b967bdab82370fc9616f35b4a1914c7c8bc9aa1adb6829f85392e0845252.exe 28 PID 2920 wrote to memory of 2228 2920 2123b967bdab82370fc9616f35b4a1914c7c8bc9aa1adb6829f85392e0845252.exe 28 PID 2920 wrote to memory of 2228 2920 2123b967bdab82370fc9616f35b4a1914c7c8bc9aa1adb6829f85392e0845252.exe 28 PID 2920 wrote to memory of 2228 2920 2123b967bdab82370fc9616f35b4a1914c7c8bc9aa1adb6829f85392e0845252.exe 28 PID 2228 wrote to memory of 2952 2228 xlxffxf.exe 29 PID 2228 wrote to memory of 2952 2228 xlxffxf.exe 29 PID 2228 wrote to memory of 2952 2228 xlxffxf.exe 29 PID 2228 wrote to memory of 2952 2228 xlxffxf.exe 29 PID 2952 wrote to memory of 2644 2952 tbbhnt.exe 30 PID 2952 wrote to memory of 2644 2952 tbbhnt.exe 30 PID 2952 wrote to memory of 2644 2952 tbbhnt.exe 30 PID 2952 wrote to memory of 2644 2952 tbbhnt.exe 30 PID 2644 wrote to memory of 2648 2644 hbnhnt.exe 31 PID 2644 wrote to memory of 2648 2644 hbnhnt.exe 31 PID 2644 wrote to memory of 2648 2644 hbnhnt.exe 31 PID 2644 wrote to memory of 2648 2644 hbnhnt.exe 31 PID 2648 wrote to memory of 2508 2648 9vjpv.exe 32 PID 2648 wrote to memory of 2508 2648 9vjpv.exe 32 PID 2648 wrote to memory of 2508 2648 9vjpv.exe 32 PID 2648 wrote to memory of 2508 2648 9vjpv.exe 32 PID 2508 wrote to memory of 2768 2508 jvjjp.exe 33 PID 2508 wrote to memory of 2768 2508 jvjjp.exe 33 PID 2508 wrote to memory of 2768 2508 jvjjp.exe 33 PID 2508 wrote to memory of 2768 2508 jvjjp.exe 33 PID 2768 wrote to memory of 2564 2768 7rflllf.exe 34 PID 2768 wrote to memory of 2564 2768 7rflllf.exe 34 PID 2768 wrote to memory of 2564 2768 7rflllf.exe 34 PID 2768 wrote to memory of 2564 2768 7rflllf.exe 34 PID 2564 wrote to memory of 2404 2564 tbhtth.exe 35 PID 2564 wrote to memory of 2404 2564 tbhtth.exe 35 PID 2564 wrote to memory of 2404 2564 tbhtth.exe 35 PID 2564 wrote to memory of 2404 2564 tbhtth.exe 35 PID 2404 wrote to memory of 2296 2404 thtttb.exe 36 PID 2404 wrote to memory of 2296 2404 thtttb.exe 36 PID 2404 wrote to memory of 2296 2404 thtttb.exe 36 PID 2404 wrote to memory of 2296 2404 thtttb.exe 36 PID 2296 wrote to memory of 2232 2296 vvjvp.exe 37 PID 2296 wrote to memory of 2232 2296 vvjvp.exe 37 PID 2296 wrote to memory of 2232 2296 vvjvp.exe 37 PID 2296 wrote to memory of 2232 2296 vvjvp.exe 37 PID 2232 wrote to memory of 1508 2232 lxlffxx.exe 38 PID 2232 wrote to memory of 1508 2232 lxlffxx.exe 38 PID 2232 wrote to memory of 1508 2232 lxlffxx.exe 38 PID 2232 wrote to memory of 1508 2232 lxlffxx.exe 38 PID 1508 wrote to memory of 2576 1508 bntnnn.exe 39 PID 1508 wrote to memory of 2576 1508 bntnnn.exe 39 PID 1508 wrote to memory of 2576 1508 bntnnn.exe 39 PID 1508 wrote to memory of 2576 1508 bntnnn.exe 39 PID 2576 wrote to memory of 2604 2576 5jdvd.exe 40 PID 2576 wrote to memory of 2604 2576 5jdvd.exe 40 PID 2576 wrote to memory of 2604 2576 5jdvd.exe 40 PID 2576 wrote to memory of 2604 2576 5jdvd.exe 40 PID 2604 wrote to memory of 2176 2604 7jdpd.exe 41 PID 2604 wrote to memory of 2176 2604 7jdpd.exe 41 PID 2604 wrote to memory of 2176 2604 7jdpd.exe 41 PID 2604 wrote to memory of 2176 2604 7jdpd.exe 41 PID 2176 wrote to memory of 1876 2176 xrxfflr.exe 42 PID 2176 wrote to memory of 1876 2176 xrxfflr.exe 42 PID 2176 wrote to memory of 1876 2176 xrxfflr.exe 42 PID 2176 wrote to memory of 1876 2176 xrxfflr.exe 42 PID 1876 wrote to memory of 1680 1876 5nnnbb.exe 43 PID 1876 wrote to memory of 1680 1876 5nnnbb.exe 43 PID 1876 wrote to memory of 1680 1876 5nnnbb.exe 43 PID 1876 wrote to memory of 1680 1876 5nnnbb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2123b967bdab82370fc9616f35b4a1914c7c8bc9aa1adb6829f85392e0845252.exe"C:\Users\Admin\AppData\Local\Temp\2123b967bdab82370fc9616f35b4a1914c7c8bc9aa1adb6829f85392e0845252.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\xlxffxf.exec:\xlxffxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\tbbhnt.exec:\tbbhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\hbnhnt.exec:\hbnhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\9vjpv.exec:\9vjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\jvjjp.exec:\jvjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\7rflllf.exec:\7rflllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\tbhtth.exec:\tbhtth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\thtttb.exec:\thtttb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\vvjvp.exec:\vvjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\lxlffxx.exec:\lxlffxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\bntnnn.exec:\bntnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\5jdvd.exec:\5jdvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\7jdpd.exec:\7jdpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\xrxfflr.exec:\xrxfflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\5nnnbb.exec:\5nnnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\hbtntn.exec:\hbtntn.exe17⤵
- Executes dropped EXE
PID:1680 -
\??\c:\5pjjp.exec:\5pjjp.exe18⤵
- Executes dropped EXE
PID:1576 -
\??\c:\jvdvj.exec:\jvdvj.exe19⤵
- Executes dropped EXE
PID:2752 -
\??\c:\1fxllff.exec:\1fxllff.exe20⤵
- Executes dropped EXE
PID:1096 -
\??\c:\1ffxrfr.exec:\1ffxrfr.exe21⤵
- Executes dropped EXE
PID:1488 -
\??\c:\htbbbb.exec:\htbbbb.exe22⤵
- Executes dropped EXE
PID:2896 -
\??\c:\7jdpv.exec:\7jdpv.exe23⤵
- Executes dropped EXE
PID:2868 -
\??\c:\5pdvp.exec:\5pdvp.exe24⤵
- Executes dropped EXE
PID:2032 -
\??\c:\5frfrxx.exec:\5frfrxx.exe25⤵
- Executes dropped EXE
PID:1260 -
\??\c:\1lfxflx.exec:\1lfxflx.exe26⤵
- Executes dropped EXE
PID:268 -
\??\c:\nbhhtt.exec:\nbhhtt.exe27⤵
- Executes dropped EXE
PID:1212 -
\??\c:\3vvjd.exec:\3vvjd.exe28⤵
- Executes dropped EXE
PID:708 -
\??\c:\pjpvv.exec:\pjpvv.exe29⤵
- Executes dropped EXE
PID:1956 -
\??\c:\rfrxxrf.exec:\rfrxxrf.exe30⤵
- Executes dropped EXE
PID:1012 -
\??\c:\frxxxrx.exec:\frxxxrx.exe31⤵
- Executes dropped EXE
PID:1192 -
\??\c:\9htbhb.exec:\9htbhb.exe32⤵
- Executes dropped EXE
PID:1648 -
\??\c:\bnhbbn.exec:\bnhbbn.exe33⤵
- Executes dropped EXE
PID:2268 -
\??\c:\dpvjd.exec:\dpvjd.exe34⤵
- Executes dropped EXE
PID:1616 -
\??\c:\vjvjj.exec:\vjvjj.exe35⤵
- Executes dropped EXE
PID:1344 -
\??\c:\hbbttn.exec:\hbbttn.exe36⤵
- Executes dropped EXE
PID:1264 -
\??\c:\nhtbhh.exec:\nhtbhh.exe37⤵
- Executes dropped EXE
PID:1424 -
\??\c:\5jvvv.exec:\5jvvv.exe38⤵
- Executes dropped EXE
PID:1280 -
\??\c:\lxflfff.exec:\lxflfff.exe39⤵
- Executes dropped EXE
PID:2924 -
\??\c:\ntthnb.exec:\ntthnb.exe40⤵
- Executes dropped EXE
PID:2952 -
\??\c:\pdjvd.exec:\pdjvd.exe41⤵
- Executes dropped EXE
PID:1524 -
\??\c:\3jvdp.exec:\3jvdp.exe42⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xlrfrxx.exec:\xlrfrxx.exe43⤵
- Executes dropped EXE
PID:2652 -
\??\c:\3lrlfxf.exec:\3lrlfxf.exe44⤵
- Executes dropped EXE
PID:2536 -
\??\c:\nbnnbt.exec:\nbnnbt.exe45⤵
- Executes dropped EXE
PID:2712 -
\??\c:\btbntn.exec:\btbntn.exe46⤵
- Executes dropped EXE
PID:2420 -
\??\c:\hbnbnt.exec:\hbnbnt.exe47⤵
- Executes dropped EXE
PID:2772 -
\??\c:\1pjpv.exec:\1pjpv.exe48⤵
- Executes dropped EXE
PID:2432 -
\??\c:\vpjjv.exec:\vpjjv.exe49⤵
- Executes dropped EXE
PID:2424 -
\??\c:\llxlfrf.exec:\llxlfrf.exe50⤵
- Executes dropped EXE
PID:2412 -
\??\c:\rxlfxrf.exec:\rxlfxrf.exe51⤵
- Executes dropped EXE
PID:2344 -
\??\c:\nthttt.exec:\nthttt.exe52⤵
- Executes dropped EXE
PID:2512 -
\??\c:\1jdjd.exec:\1jdjd.exe53⤵
- Executes dropped EXE
PID:2888 -
\??\c:\1dvvd.exec:\1dvvd.exe54⤵
- Executes dropped EXE
PID:1868 -
\??\c:\3rlrffr.exec:\3rlrffr.exe55⤵
- Executes dropped EXE
PID:2616 -
\??\c:\frlrrrl.exec:\frlrrrl.exe56⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rflrfff.exec:\rflrfff.exe57⤵
- Executes dropped EXE
PID:2636 -
\??\c:\3bhhbt.exec:\3bhhbt.exe58⤵
- Executes dropped EXE
PID:1248 -
\??\c:\5jddj.exec:\5jddj.exe59⤵
- Executes dropped EXE
PID:1892 -
\??\c:\pddjp.exec:\pddjp.exe60⤵
- Executes dropped EXE
PID:1900 -
\??\c:\7djjp.exec:\7djjp.exe61⤵
- Executes dropped EXE
PID:1888 -
\??\c:\7rlxrrx.exec:\7rlxrrx.exe62⤵
- Executes dropped EXE
PID:1504 -
\??\c:\rlllrxx.exec:\rlllrxx.exe63⤵
- Executes dropped EXE
PID:1880 -
\??\c:\hthhhh.exec:\hthhhh.exe64⤵
- Executes dropped EXE
PID:1360 -
\??\c:\5nbttn.exec:\5nbttn.exe65⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vjvjv.exec:\vjvjv.exe66⤵PID:772
-
\??\c:\7lxffxf.exec:\7lxffxf.exe67⤵PID:844
-
\??\c:\rfrxlrr.exec:\rfrxlrr.exe68⤵PID:2072
-
\??\c:\lxrrrrr.exec:\lxrrrrr.exe69⤵PID:320
-
\??\c:\9bntnn.exec:\9bntnn.exe70⤵PID:1844
-
\??\c:\tnnhtt.exec:\tnnhtt.exe71⤵PID:2480
-
\??\c:\5jvvv.exec:\5jvvv.exe72⤵PID:600
-
\??\c:\dpdjp.exec:\dpdjp.exe73⤵PID:2568
-
\??\c:\djjjj.exec:\djjjj.exe74⤵PID:268
-
\??\c:\5xlrxxf.exec:\5xlrxxf.exe75⤵PID:1636
-
\??\c:\1fxxxfl.exec:\1fxxxfl.exe76⤵PID:1784
-
\??\c:\nbtbhh.exec:\nbtbhh.exe77⤵PID:1540
-
\??\c:\3htttn.exec:\3htttn.exe78⤵PID:1484
-
\??\c:\djjdd.exec:\djjdd.exe79⤵PID:2348
-
\??\c:\pjjjp.exec:\pjjjp.exe80⤵PID:568
-
\??\c:\fxflxlf.exec:\fxflxlf.exe81⤵PID:2816
-
\??\c:\fxfxlrx.exec:\fxfxlrx.exe82⤵PID:2268
-
\??\c:\5nttbh.exec:\5nttbh.exe83⤵PID:2192
-
\??\c:\hbhhhh.exec:\hbhhhh.exe84⤵PID:2828
-
\??\c:\3pdjd.exec:\3pdjd.exe85⤵PID:1656
-
\??\c:\jdddd.exec:\jdddd.exe86⤵PID:892
-
\??\c:\jvdjj.exec:\jvdjj.exe87⤵PID:540
-
\??\c:\1rrxfxf.exec:\1rrxfxf.exe88⤵PID:1676
-
\??\c:\1frxfff.exec:\1frxfff.exe89⤵PID:1988
-
\??\c:\7nhtbh.exec:\7nhtbh.exe90⤵PID:2924
-
\??\c:\vjdpp.exec:\vjdpp.exe91⤵PID:2952
-
\??\c:\1jjpd.exec:\1jjpd.exe92⤵PID:1524
-
\??\c:\5pjjj.exec:\5pjjj.exe93⤵PID:2740
-
\??\c:\fxrxfrf.exec:\fxrxfrf.exe94⤵PID:2692
-
\??\c:\rlrflrf.exec:\rlrflrf.exe95⤵PID:2724
-
\??\c:\fxrlfrf.exec:\fxrlfrf.exe96⤵PID:1196
-
\??\c:\nhbnbn.exec:\nhbnbn.exe97⤵PID:2688
-
\??\c:\hhbbtn.exec:\hhbbtn.exe98⤵PID:2772
-
\??\c:\vddpd.exec:\vddpd.exe99⤵PID:2456
-
\??\c:\vvpdj.exec:\vvpdj.exe100⤵PID:2396
-
\??\c:\7xxxrll.exec:\7xxxrll.exe101⤵PID:2408
-
\??\c:\xrflxfr.exec:\xrflxfr.exe102⤵PID:2344
-
\??\c:\hnntbt.exec:\hnntbt.exe103⤵PID:1348
-
\??\c:\hbhtnn.exec:\hbhtnn.exe104⤵PID:2888
-
\??\c:\djppv.exec:\djppv.exe105⤵PID:1564
-
\??\c:\1vvpp.exec:\1vvpp.exe106⤵PID:2592
-
\??\c:\jvvjd.exec:\jvvjd.exe107⤵PID:2284
-
\??\c:\9xxlxlx.exec:\9xxlxlx.exe108⤵PID:356
-
\??\c:\rfxfffl.exec:\rfxfffl.exe109⤵PID:1248
-
\??\c:\hbthnt.exec:\hbthnt.exe110⤵PID:1020
-
\??\c:\7nhnnn.exec:\7nhnnn.exe111⤵PID:2160
-
\??\c:\dpjjj.exec:\dpjjj.exe112⤵PID:1888
-
\??\c:\jjpjp.exec:\jjpjp.exe113⤵PID:1632
-
\??\c:\frllxxr.exec:\frllxxr.exe114⤵PID:1880
-
\??\c:\rfffllr.exec:\rfffllr.exe115⤵PID:1416
-
\??\c:\llflrrx.exec:\llflrrx.exe116⤵PID:1440
-
\??\c:\hhbtnh.exec:\hhbtnh.exe117⤵PID:2892
-
\??\c:\vpjpv.exec:\vpjpv.exe118⤵PID:848
-
\??\c:\vvpvj.exec:\vvpvj.exe119⤵PID:2204
-
\??\c:\rrlrffr.exec:\rrlrffr.exe120⤵PID:2044
-
\??\c:\lxrxlrx.exec:\lxrxlrx.exe121⤵PID:1992
-
\??\c:\bbbbnh.exec:\bbbbnh.exe122⤵PID:556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-