Analysis
-
max time kernel
101s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11-03-2024 19:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1c43ce2b500d11f516b91cdaf2eedbc63cea54b8562fbbf2e85c70193f2abe29.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
General
-
Target
1c43ce2b500d11f516b91cdaf2eedbc63cea54b8562fbbf2e85c70193f2abe29.exe
-
Size
840KB
-
MD5
da8b6593a85f9eb5a27bd934779f57fa
-
SHA1
822ca656db3e0da30bbc868e52a6a352fc14d7cb
-
SHA256
1c43ce2b500d11f516b91cdaf2eedbc63cea54b8562fbbf2e85c70193f2abe29
-
SHA512
4259e9c31ac44581e2c4b2a156331ac30085d3289d066ac4ab86950e8d51e6c4692220acee9a3bac540e79e4e05fac7666543b27f0c32107edabdb7fa1fe084a
-
SSDEEP
24576:Sgdn8whSenedn8whhdn76gdn8whSfgdn8whSzS:TFyVPfd
Malware Config
Signatures
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral2/memory/4952-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3848-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2100-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2508-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2300-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3848-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-252-0x0000000002030000-0x000000000210E000-memory.dmp family_blackmoon behavioral2/memory/768-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-320-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-333-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-348-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-357-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-371-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-376-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1716-394-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-416-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-421-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 54 IoCs
resource yara_rule behavioral2/memory/4952-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4952-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4360-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3848-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1648-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2140-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5116-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/228-52-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/228-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1936-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2548-67-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4400-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4400-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4820-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2100-91-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4828-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2376-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4088-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2508-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3328-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3480-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4708-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2300-166-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3352-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1996-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1800-192-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1800-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4700-206-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1156-214-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3848-221-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1648-228-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4940-241-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1940-252-0x0000000002030000-0x000000000210E000-memory.dmp UPX behavioral2/memory/1172-255-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/768-260-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1408-266-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2592-272-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/60-276-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2392-282-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4004-287-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2668-299-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2184-305-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2148-315-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1772-320-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3256-333-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3348-348-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4688-357-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1800-371-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4768-376-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4920-385-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1716-394-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5028-407-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4000-416-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4424-421-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4360 frxllll.exe 3848 xxxlffx.exe 1648 lflfxxx.exe 2140 vvvpd.exe 5116 vppjj.exe 1780 btbtnn.exe 228 rrlfxxr.exe 1936 7dvjd.exe 2548 tbtnbn.exe 4400 ttnbtn.exe 4820 vvjvj.exe 2100 hnnbnn.exe 908 xllxrrf.exe 4828 tbhhbb.exe 2376 7bbthb.exe 4088 5ffxrlf.exe 2508 lllfxrf.exe 3328 nhbnhh.exe 3480 bbtbtt.exe 4708 fffrrrl.exe 4288 vdjdd.exe 392 llffxxr.exe 2300 vjjjv.exe 3352 btnhbb.exe 1996 vvvdd.exe 4280 xrfxfff.exe 1800 3xxrlfx.exe 2060 rfrxxrr.exe 4700 5pppj.exe 1156 3thbbh.exe 3848 rrffffx.exe 1648 rrlxrfx.exe 2024 jjdvp.exe 1820 5fxfxrr.exe 4940 9vjdp.exe 4040 tnnbnh.exe 1940 7hhtnh.exe 1172 pvvpp.exe 768 hhbnhh.exe 1408 lfxrxxr.exe 2592 nthbtn.exe 60 flrxrlf.exe 2392 xrxrffx.exe 4004 vvvpj.exe 2484 rflxrll.exe 3508 pjdvp.exe 2668 3thbtn.exe 2184 pjdvd.exe 1020 9xfrllx.exe 2148 jjddv.exe 1772 ttnbtn.exe 2696 jjvvv.exe 1228 hbtnnt.exe 3256 xfxrlll.exe 4072 ddvpj.exe 2312 xfrxrrr.exe 3348 vdvpj.exe 3176 llxrfxr.exe 4688 bbbnhb.exe 724 lffxxrx.exe 1440 dddvj.exe 1800 ttnhtn.exe 4768 xrlfrlf.exe 4700 jjjdp.exe -
resource yara_rule behavioral2/memory/4952-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2508-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2300-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3352-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/768-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-282-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-305-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-320-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-333-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-348-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-357-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-371-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-376-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-385-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-394-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-407-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-416-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-421-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4952 wrote to memory of 4360 4952 1c43ce2b500d11f516b91cdaf2eedbc63cea54b8562fbbf2e85c70193f2abe29.exe 89 PID 4952 wrote to memory of 4360 4952 1c43ce2b500d11f516b91cdaf2eedbc63cea54b8562fbbf2e85c70193f2abe29.exe 89 PID 4952 wrote to memory of 4360 4952 1c43ce2b500d11f516b91cdaf2eedbc63cea54b8562fbbf2e85c70193f2abe29.exe 89 PID 4360 wrote to memory of 3848 4360 frxllll.exe 90 PID 4360 wrote to memory of 3848 4360 frxllll.exe 90 PID 4360 wrote to memory of 3848 4360 frxllll.exe 90 PID 3848 wrote to memory of 1648 3848 xxxlffx.exe 91 PID 3848 wrote to memory of 1648 3848 xxxlffx.exe 91 PID 3848 wrote to memory of 1648 3848 xxxlffx.exe 91 PID 1648 wrote to memory of 2140 1648 lflfxxx.exe 92 PID 1648 wrote to memory of 2140 1648 lflfxxx.exe 92 PID 1648 wrote to memory of 2140 1648 lflfxxx.exe 92 PID 2140 wrote to memory of 5116 2140 vvvpd.exe 93 PID 2140 wrote to memory of 5116 2140 vvvpd.exe 93 PID 2140 wrote to memory of 5116 2140 vvvpd.exe 93 PID 5116 wrote to memory of 1780 5116 vppjj.exe 94 PID 5116 wrote to memory of 1780 5116 vppjj.exe 94 PID 5116 wrote to memory of 1780 5116 vppjj.exe 94 PID 1780 wrote to memory of 228 1780 btbtnn.exe 95 PID 1780 wrote to memory of 228 1780 btbtnn.exe 95 PID 1780 wrote to memory of 228 1780 btbtnn.exe 95 PID 228 wrote to memory of 1936 228 rrlfxxr.exe 96 PID 228 wrote to memory of 1936 228 rrlfxxr.exe 96 PID 228 wrote to memory of 1936 228 rrlfxxr.exe 96 PID 1936 wrote to memory of 2548 1936 7dvjd.exe 97 PID 1936 wrote to memory of 2548 1936 7dvjd.exe 97 PID 1936 wrote to memory of 2548 1936 7dvjd.exe 97 PID 2548 wrote to memory of 4400 2548 tbtnbn.exe 98 PID 2548 wrote to memory of 4400 2548 tbtnbn.exe 98 PID 2548 wrote to memory of 4400 2548 tbtnbn.exe 98 PID 4400 wrote to memory of 4820 4400 ttnbtn.exe 99 PID 4400 wrote to memory of 4820 4400 ttnbtn.exe 99 PID 4400 wrote to memory of 4820 4400 ttnbtn.exe 99 PID 4820 wrote to memory of 2100 4820 vvjvj.exe 100 PID 4820 wrote to memory of 2100 4820 vvjvj.exe 100 PID 4820 wrote to memory of 2100 4820 vvjvj.exe 100 PID 2100 wrote to memory of 908 2100 hnnbnn.exe 101 PID 2100 wrote to memory of 908 2100 hnnbnn.exe 101 PID 2100 wrote to memory of 908 2100 hnnbnn.exe 101 PID 908 wrote to memory of 4828 908 xllxrrf.exe 102 PID 908 wrote to memory of 4828 908 xllxrrf.exe 102 PID 908 wrote to memory of 4828 908 xllxrrf.exe 102 PID 4828 wrote to memory of 2376 4828 tbhhbb.exe 103 PID 4828 wrote to memory of 2376 4828 tbhhbb.exe 103 PID 4828 wrote to memory of 2376 4828 tbhhbb.exe 103 PID 2376 wrote to memory of 4088 2376 7bbthb.exe 104 PID 2376 wrote to memory of 4088 2376 7bbthb.exe 104 PID 2376 wrote to memory of 4088 2376 7bbthb.exe 104 PID 4088 wrote to memory of 2508 4088 5ffxrlf.exe 105 PID 4088 wrote to memory of 2508 4088 5ffxrlf.exe 105 PID 4088 wrote to memory of 2508 4088 5ffxrlf.exe 105 PID 2508 wrote to memory of 3328 2508 lllfxrf.exe 106 PID 2508 wrote to memory of 3328 2508 lllfxrf.exe 106 PID 2508 wrote to memory of 3328 2508 lllfxrf.exe 106 PID 3328 wrote to memory of 3480 3328 nhbnhh.exe 107 PID 3328 wrote to memory of 3480 3328 nhbnhh.exe 107 PID 3328 wrote to memory of 3480 3328 nhbnhh.exe 107 PID 3480 wrote to memory of 4708 3480 bbtbtt.exe 108 PID 3480 wrote to memory of 4708 3480 bbtbtt.exe 108 PID 3480 wrote to memory of 4708 3480 bbtbtt.exe 108 PID 4708 wrote to memory of 4288 4708 fffrrrl.exe 109 PID 4708 wrote to memory of 4288 4708 fffrrrl.exe 109 PID 4708 wrote to memory of 4288 4708 fffrrrl.exe 109 PID 4288 wrote to memory of 392 4288 vdjdd.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c43ce2b500d11f516b91cdaf2eedbc63cea54b8562fbbf2e85c70193f2abe29.exe"C:\Users\Admin\AppData\Local\Temp\1c43ce2b500d11f516b91cdaf2eedbc63cea54b8562fbbf2e85c70193f2abe29.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\frxllll.exec:\frxllll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\xxxlffx.exec:\xxxlffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\lflfxxx.exec:\lflfxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\vvvpd.exec:\vvvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\vppjj.exec:\vppjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\btbtnn.exec:\btbtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\rrlfxxr.exec:\rrlfxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\7dvjd.exec:\7dvjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\tbtnbn.exec:\tbtnbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\ttnbtn.exec:\ttnbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\vvjvj.exec:\vvjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\hnnbnn.exec:\hnnbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\xllxrrf.exec:\xllxrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\tbhhbb.exec:\tbhhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\7bbthb.exec:\7bbthb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\5ffxrlf.exec:\5ffxrlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\lllfxrf.exec:\lllfxrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\nhbnhh.exec:\nhbnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\bbtbtt.exec:\bbtbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\fffrrrl.exec:\fffrrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\vdjdd.exec:\vdjdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\llffxxr.exec:\llffxxr.exe23⤵
- Executes dropped EXE
PID:392 -
\??\c:\vjjjv.exec:\vjjjv.exe24⤵
- Executes dropped EXE
PID:2300 -
\??\c:\btnhbb.exec:\btnhbb.exe25⤵
- Executes dropped EXE
PID:3352 -
\??\c:\vvvdd.exec:\vvvdd.exe26⤵
- Executes dropped EXE
PID:1996 -
\??\c:\xrfxfff.exec:\xrfxfff.exe27⤵
- Executes dropped EXE
PID:4280 -
\??\c:\3xxrlfx.exec:\3xxrlfx.exe28⤵
- Executes dropped EXE
PID:1800 -
\??\c:\rfrxxrr.exec:\rfrxxrr.exe29⤵
- Executes dropped EXE
PID:2060 -
\??\c:\5pppj.exec:\5pppj.exe30⤵
- Executes dropped EXE
PID:4700 -
\??\c:\3thbbh.exec:\3thbbh.exe31⤵
- Executes dropped EXE
PID:1156 -
\??\c:\rrffffx.exec:\rrffffx.exe32⤵
- Executes dropped EXE
PID:3848 -
\??\c:\rrlxrfx.exec:\rrlxrfx.exe33⤵
- Executes dropped EXE
PID:1648 -
\??\c:\jjdvp.exec:\jjdvp.exe34⤵
- Executes dropped EXE
PID:2024 -
\??\c:\5fxfxrr.exec:\5fxfxrr.exe35⤵
- Executes dropped EXE
PID:1820 -
\??\c:\9vjdp.exec:\9vjdp.exe36⤵
- Executes dropped EXE
PID:4940 -
\??\c:\tnnbnh.exec:\tnnbnh.exe37⤵
- Executes dropped EXE
PID:4040 -
\??\c:\7hhtnh.exec:\7hhtnh.exe38⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pvvpp.exec:\pvvpp.exe39⤵
- Executes dropped EXE
PID:1172 -
\??\c:\hhbnhh.exec:\hhbnhh.exe40⤵
- Executes dropped EXE
PID:768 -
\??\c:\lfxrxxr.exec:\lfxrxxr.exe41⤵
- Executes dropped EXE
PID:1408 -
\??\c:\nthbtn.exec:\nthbtn.exe42⤵
- Executes dropped EXE
PID:2592 -
\??\c:\flrxrlf.exec:\flrxrlf.exe43⤵
- Executes dropped EXE
PID:60 -
\??\c:\xrxrffx.exec:\xrxrffx.exe44⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vvvpj.exec:\vvvpj.exe45⤵
- Executes dropped EXE
PID:4004 -
\??\c:\rflxrll.exec:\rflxrll.exe46⤵
- Executes dropped EXE
PID:2484 -
\??\c:\pjdvp.exec:\pjdvp.exe47⤵
- Executes dropped EXE
PID:3508 -
\??\c:\3thbtn.exec:\3thbtn.exe48⤵
- Executes dropped EXE
PID:2668 -
\??\c:\pjdvd.exec:\pjdvd.exe49⤵
- Executes dropped EXE
PID:2184 -
\??\c:\9xfrllx.exec:\9xfrllx.exe50⤵
- Executes dropped EXE
PID:1020 -
\??\c:\jjddv.exec:\jjddv.exe51⤵
- Executes dropped EXE
PID:2148 -
\??\c:\ttnbtn.exec:\ttnbtn.exe52⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jjvvv.exec:\jjvvv.exe53⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hbtnnt.exec:\hbtnnt.exe54⤵
- Executes dropped EXE
PID:1228 -
\??\c:\xfxrlll.exec:\xfxrlll.exe55⤵
- Executes dropped EXE
PID:3256 -
\??\c:\ddvpj.exec:\ddvpj.exe56⤵
- Executes dropped EXE
PID:4072 -
\??\c:\xfrxrrr.exec:\xfrxrrr.exe57⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vdvpj.exec:\vdvpj.exe58⤵
- Executes dropped EXE
PID:3348 -
\??\c:\llxrfxr.exec:\llxrfxr.exe59⤵
- Executes dropped EXE
PID:3176 -
\??\c:\bbbnhb.exec:\bbbnhb.exe60⤵
- Executes dropped EXE
PID:4688 -
\??\c:\lffxxrx.exec:\lffxxrx.exe61⤵
- Executes dropped EXE
PID:724 -
\??\c:\dddvj.exec:\dddvj.exe62⤵
- Executes dropped EXE
PID:1440 -
\??\c:\9rlfxxx.exec:\9rlfxxx.exe63⤵PID:4336
-
\??\c:\ttnhtn.exec:\ttnhtn.exe64⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xrlfrlf.exec:\xrlfrlf.exe65⤵
- Executes dropped EXE
PID:4768 -
\??\c:\jjjdp.exec:\jjjdp.exe66⤵
- Executes dropped EXE
PID:4700 -
\??\c:\9bhbtt.exec:\9bhbtt.exe67⤵PID:4920
-
\??\c:\7vjdd.exec:\7vjdd.exe68⤵PID:1364
-
\??\c:\tbthbt.exec:\tbthbt.exe69⤵PID:1716
-
\??\c:\pjjjd.exec:\pjjjd.exe70⤵PID:3200
-
\??\c:\ffrlrlr.exec:\ffrlrlr.exe71⤵PID:2728
-
\??\c:\hhbtnn.exec:\hhbtnn.exe72⤵PID:5028
-
\??\c:\rlfxxrl.exec:\rlfxxrl.exe73⤵PID:1172
-
\??\c:\dvdvj.exec:\dvdvj.exe74⤵PID:4000
-
\??\c:\lflffxf.exec:\lflffxf.exe75⤵PID:4424
-
\??\c:\pvpjv.exec:\pvpjv.exe76⤵PID:620
-
\??\c:\bbhtnt.exec:\bbhtnt.exe77⤵PID:2100
-
\??\c:\xffrlfx.exec:\xffrlfx.exe78⤵PID:4808
-
\??\c:\7vvdd.exec:\7vvdd.exe79⤵PID:4236
-
\??\c:\rrllxrr.exec:\rrllxrr.exe80⤵PID:4376
-
\??\c:\vpvpj.exec:\vpvpj.exe81⤵PID:1988
-
\??\c:\nbthbt.exec:\nbthbt.exe82⤵PID:4244
-
\??\c:\rllrlfx.exec:\rllrlfx.exe83⤵PID:8
-
\??\c:\5tnbnn.exec:\5tnbnn.exe84⤵PID:4704
-
\??\c:\fxlflff.exec:\fxlflff.exe85⤵PID:4248
-
\??\c:\tbtnbt.exec:\tbtnbt.exe86⤵PID:4944
-
\??\c:\pjjpj.exec:\pjjpj.exe87⤵PID:4228
-
\??\c:\1tthtt.exec:\1tthtt.exe88⤵PID:3360
-
\??\c:\dpvpj.exec:\dpvpj.exe89⤵PID:4880
-
\??\c:\5bthnn.exec:\5bthnn.exe90⤵PID:1688
-
\??\c:\rflrfxf.exec:\rflrfxf.exe91⤵PID:1996
-
\??\c:\tnhbnt.exec:\tnhbnt.exe92⤵PID:2856
-
\??\c:\vvddd.exec:\vvddd.exe93⤵PID:1440
-
\??\c:\djjvp.exec:\djjvp.exe94⤵PID:4320
-
\??\c:\5tbtnn.exec:\5tbtnn.exe95⤵PID:4036
-
\??\c:\xffxrlf.exec:\xffxrlf.exe96⤵PID:5024
-
\??\c:\hbtnhb.exec:\hbtnhb.exe97⤵PID:1560
-
\??\c:\frllffx.exec:\frllffx.exe98⤵PID:2504
-
\??\c:\7vjdp.exec:\7vjdp.exe99⤵PID:1364
-
\??\c:\3bttnh.exec:\3bttnh.exe100⤵PID:232
-
\??\c:\jvdpv.exec:\jvdpv.exe101⤵PID:2784
-
\??\c:\xxrfxxr.exec:\xxrfxxr.exe102⤵PID:4468
-
\??\c:\dvdjj.exec:\dvdjj.exe103⤵PID:5028
-
\??\c:\3tnhbb.exec:\3tnhbb.exe104⤵PID:4996
-
\??\c:\rlfxxfr.exec:\rlfxxfr.exe105⤵PID:2356
-
\??\c:\ddvpp.exec:\ddvpp.exe106⤵PID:5060
-
\??\c:\hhtnnh.exec:\hhtnnh.exe107⤵PID:4992
-
\??\c:\3vvpj.exec:\3vvpj.exe108⤵PID:908
-
\??\c:\nhnhhh.exec:\nhnhhh.exe109⤵PID:2472
-
\??\c:\3fflxxl.exec:\3fflxxl.exe110⤵PID:4236
-
\??\c:\hhtnnh.exec:\hhtnnh.exe111⤵PID:1216
-
\??\c:\ddjvv.exec:\ddjvv.exe112⤵PID:4088
-
\??\c:\bnhthb.exec:\bnhthb.exe113⤵PID:4244
-
\??\c:\jjjdv.exec:\jjjdv.exe114⤵PID:1132
-
\??\c:\9hbnhb.exec:\9hbnhb.exe115⤵PID:4496
-
\??\c:\xrllffl.exec:\xrllffl.exe116⤵PID:1412
-
\??\c:\pdpdv.exec:\pdpdv.exe117⤵PID:2312
-
\??\c:\7bbnhh.exec:\7bbnhh.exe118⤵PID:1824
-
\??\c:\pdvjv.exec:\pdvjv.exe119⤵PID:4412
-
\??\c:\tbbttn.exec:\tbbttn.exe120⤵PID:4948
-
\??\c:\3frfrrf.exec:\3frfrrf.exe121⤵PID:4280
-
\??\c:\nbbttt.exec:\nbbttt.exe122⤵PID:4336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-