Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/03/2024, 20:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
67f6adeed498f5fe593dfb698e845ce59eff80eb9b56c17bb0142b7323f74935.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
67f6adeed498f5fe593dfb698e845ce59eff80eb9b56c17bb0142b7323f74935.exe
-
Size
384KB
-
MD5
465468cab67f5663bbf202cbf415490b
-
SHA1
2d63740153e79d31380f847db0471f3ebfd8e4a5
-
SHA256
67f6adeed498f5fe593dfb698e845ce59eff80eb9b56c17bb0142b7323f74935
-
SHA512
83694d7f3e3d39aeb25d20540fdb02bfce8b6d155f5e2c69010511d48755271cc1886f6b50af99f7d75e7cb2c9805c7bd7b80777740e550318fbe7e45aaf64ee
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwOc:n3C9uYA7okVqdKwaO5CVQ
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral1/memory/1252-2-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1116-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1100-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/268-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/676-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1344-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1936-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1900-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1820-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/872-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1428-320-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-329-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-367-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-375-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-408-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-424-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-526-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2092-534-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 52 IoCs
resource yara_rule behavioral1/memory/1252-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1116-15-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1100-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2860-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2516-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2876-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2664-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2388-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/268-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/268-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/676-115-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1344-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1936-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1900-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1820-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1632-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2248-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2248-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2620-192-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2264-213-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2464-225-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/872-244-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2268-254-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2712-292-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1596-310-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1428-320-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1580-329-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2592-358-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-367-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-366-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2412-375-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2876-383-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2544-399-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2544-398-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2796-407-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2796-408-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2984-416-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2800-424-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1356-433-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1284-441-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2296-449-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1748-472-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1672-480-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1552-495-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1452-510-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2236-526-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2092-534-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2676-542-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1812-586-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2760-594-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2832-602-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2056-618-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1116 ptfllx.exe 1100 lrpbj.exe 2860 dllbrl.exe 2516 ldntt.exe 2876 lrplf.exe 2664 vrhblv.exe 2548 pdbtftl.exe 2388 xvdbtlv.exe 2792 ltrhpt.exe 268 pphvnl.exe 676 pjpvfh.exe 1344 vjrjh.exe 1936 dlxnpl.exe 1140 phbvrbp.exe 1900 dttjl.exe 1820 txfjlln.exe 2224 jthrhdt.exe 1632 vrdlbb.exe 2620 hdhxhb.exe 2248 xjvbbtp.exe 2264 fvftnr.exe 2464 prdrvb.exe 2720 vxhptlp.exe 872 nlbld.exe 2268 xfxrhn.exe 1832 ftdhljx.exe 1120 ltvvhn.exe 2724 tvtlfh.exe 2712 vnhltjp.exe 2928 dnntr.exe 1596 dltjt.exe 1428 xvjhdbl.exe 1580 ddvrp.exe 1068 nthxnhx.exe 1720 brvbp.exe 1100 fnjjhrp.exe 2592 ljpxpx.exe 2708 jxhtt.exe 2412 jvbntxt.exe 2876 nhtnpx.exe 2604 tlhtthr.exe 2544 nfldb.exe 2796 vhtxnt.exe 2984 vvlvrx.exe 2800 jdddj.exe 1356 pfrxtn.exe 1284 xvxlfpd.exe 2296 jtfbnb.exe 924 tvxjjd.exe 1924 tdprhn.exe 1748 lxpxdl.exe 1672 drbhhvv.exe 1976 dplnr.exe 1552 pttxx.exe 2660 hrfpjh.exe 1452 lhtjfn.exe 1956 pvrdl.exe 2236 pvjfr.exe 2092 ntpxtnt.exe 2676 htvvlj.exe 1792 ptdxxpf.exe 932 tjfbt.exe 1664 xfjjl.exe 240 jnrntd.exe -
resource yara_rule behavioral1/memory/1252-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1116-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1100-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/268-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/268-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/676-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1344-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1936-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1900-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1820-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2248-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2464-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/872-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1596-310-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1428-320-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-329-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-358-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-367-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-366-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-375-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-383-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-399-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-398-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-407-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-408-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2984-416-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-424-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1356-433-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1284-441-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-449-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-472-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-480-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-495-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1452-510-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2236-526-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2092-534-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-542-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1812-586-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-594-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-602-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-618-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1252 wrote to memory of 1116 1252 67f6adeed498f5fe593dfb698e845ce59eff80eb9b56c17bb0142b7323f74935.exe 28 PID 1252 wrote to memory of 1116 1252 67f6adeed498f5fe593dfb698e845ce59eff80eb9b56c17bb0142b7323f74935.exe 28 PID 1252 wrote to memory of 1116 1252 67f6adeed498f5fe593dfb698e845ce59eff80eb9b56c17bb0142b7323f74935.exe 28 PID 1252 wrote to memory of 1116 1252 67f6adeed498f5fe593dfb698e845ce59eff80eb9b56c17bb0142b7323f74935.exe 28 PID 1116 wrote to memory of 1100 1116 ptfllx.exe 29 PID 1116 wrote to memory of 1100 1116 ptfllx.exe 29 PID 1116 wrote to memory of 1100 1116 ptfllx.exe 29 PID 1116 wrote to memory of 1100 1116 ptfllx.exe 29 PID 1100 wrote to memory of 2860 1100 lrpbj.exe 30 PID 1100 wrote to memory of 2860 1100 lrpbj.exe 30 PID 1100 wrote to memory of 2860 1100 lrpbj.exe 30 PID 1100 wrote to memory of 2860 1100 lrpbj.exe 30 PID 2860 wrote to memory of 2516 2860 dllbrl.exe 31 PID 2860 wrote to memory of 2516 2860 dllbrl.exe 31 PID 2860 wrote to memory of 2516 2860 dllbrl.exe 31 PID 2860 wrote to memory of 2516 2860 dllbrl.exe 31 PID 2516 wrote to memory of 2876 2516 ldntt.exe 32 PID 2516 wrote to memory of 2876 2516 ldntt.exe 32 PID 2516 wrote to memory of 2876 2516 ldntt.exe 32 PID 2516 wrote to memory of 2876 2516 ldntt.exe 32 PID 2876 wrote to memory of 2664 2876 lrplf.exe 33 PID 2876 wrote to memory of 2664 2876 lrplf.exe 33 PID 2876 wrote to memory of 2664 2876 lrplf.exe 33 PID 2876 wrote to memory of 2664 2876 lrplf.exe 33 PID 2664 wrote to memory of 2548 2664 vrhblv.exe 34 PID 2664 wrote to memory of 2548 2664 vrhblv.exe 34 PID 2664 wrote to memory of 2548 2664 vrhblv.exe 34 PID 2664 wrote to memory of 2548 2664 vrhblv.exe 34 PID 2548 wrote to memory of 2388 2548 pdbtftl.exe 35 PID 2548 wrote to memory of 2388 2548 pdbtftl.exe 35 PID 2548 wrote to memory of 2388 2548 pdbtftl.exe 35 PID 2548 wrote to memory of 2388 2548 pdbtftl.exe 35 PID 2388 wrote to memory of 2792 2388 xvdbtlv.exe 36 PID 2388 wrote to memory of 2792 2388 xvdbtlv.exe 36 PID 2388 wrote to memory of 2792 2388 xvdbtlv.exe 36 PID 2388 wrote to memory of 2792 2388 xvdbtlv.exe 36 PID 2792 wrote to memory of 268 2792 ltrhpt.exe 37 PID 2792 wrote to memory of 268 2792 ltrhpt.exe 37 PID 2792 wrote to memory of 268 2792 ltrhpt.exe 37 PID 2792 wrote to memory of 268 2792 ltrhpt.exe 37 PID 268 wrote to memory of 676 268 pphvnl.exe 38 PID 268 wrote to memory of 676 268 pphvnl.exe 38 PID 268 wrote to memory of 676 268 pphvnl.exe 38 PID 268 wrote to memory of 676 268 pphvnl.exe 38 PID 676 wrote to memory of 1344 676 pjpvfh.exe 39 PID 676 wrote to memory of 1344 676 pjpvfh.exe 39 PID 676 wrote to memory of 1344 676 pjpvfh.exe 39 PID 676 wrote to memory of 1344 676 pjpvfh.exe 39 PID 1344 wrote to memory of 1936 1344 vjrjh.exe 40 PID 1344 wrote to memory of 1936 1344 vjrjh.exe 40 PID 1344 wrote to memory of 1936 1344 vjrjh.exe 40 PID 1344 wrote to memory of 1936 1344 vjrjh.exe 40 PID 1936 wrote to memory of 1140 1936 dlxnpl.exe 41 PID 1936 wrote to memory of 1140 1936 dlxnpl.exe 41 PID 1936 wrote to memory of 1140 1936 dlxnpl.exe 41 PID 1936 wrote to memory of 1140 1936 dlxnpl.exe 41 PID 1140 wrote to memory of 1900 1140 phbvrbp.exe 42 PID 1140 wrote to memory of 1900 1140 phbvrbp.exe 42 PID 1140 wrote to memory of 1900 1140 phbvrbp.exe 42 PID 1140 wrote to memory of 1900 1140 phbvrbp.exe 42 PID 1900 wrote to memory of 1820 1900 dttjl.exe 43 PID 1900 wrote to memory of 1820 1900 dttjl.exe 43 PID 1900 wrote to memory of 1820 1900 dttjl.exe 43 PID 1900 wrote to memory of 1820 1900 dttjl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\67f6adeed498f5fe593dfb698e845ce59eff80eb9b56c17bb0142b7323f74935.exe"C:\Users\Admin\AppData\Local\Temp\67f6adeed498f5fe593dfb698e845ce59eff80eb9b56c17bb0142b7323f74935.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\ptfllx.exec:\ptfllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\lrpbj.exec:\lrpbj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\dllbrl.exec:\dllbrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\ldntt.exec:\ldntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\lrplf.exec:\lrplf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\vrhblv.exec:\vrhblv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\pdbtftl.exec:\pdbtftl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\xvdbtlv.exec:\xvdbtlv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\ltrhpt.exec:\ltrhpt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\pphvnl.exec:\pphvnl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:268 -
\??\c:\pjpvfh.exec:\pjpvfh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\vjrjh.exec:\vjrjh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\dlxnpl.exec:\dlxnpl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\phbvrbp.exec:\phbvrbp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\dttjl.exec:\dttjl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\txfjlln.exec:\txfjlln.exe17⤵
- Executes dropped EXE
PID:1820 -
\??\c:\jthrhdt.exec:\jthrhdt.exe18⤵
- Executes dropped EXE
PID:2224 -
\??\c:\vrdlbb.exec:\vrdlbb.exe19⤵
- Executes dropped EXE
PID:1632 -
\??\c:\hdhxhb.exec:\hdhxhb.exe20⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xjvbbtp.exec:\xjvbbtp.exe21⤵
- Executes dropped EXE
PID:2248 -
\??\c:\fvftnr.exec:\fvftnr.exe22⤵
- Executes dropped EXE
PID:2264 -
\??\c:\prdrvb.exec:\prdrvb.exe23⤵
- Executes dropped EXE
PID:2464 -
\??\c:\vxhptlp.exec:\vxhptlp.exe24⤵
- Executes dropped EXE
PID:2720 -
\??\c:\nlbld.exec:\nlbld.exe25⤵
- Executes dropped EXE
PID:872 -
\??\c:\xfxrhn.exec:\xfxrhn.exe26⤵
- Executes dropped EXE
PID:2268 -
\??\c:\ftdhljx.exec:\ftdhljx.exe27⤵
- Executes dropped EXE
PID:1832 -
\??\c:\ltvvhn.exec:\ltvvhn.exe28⤵
- Executes dropped EXE
PID:1120 -
\??\c:\tvtlfh.exec:\tvtlfh.exe29⤵
- Executes dropped EXE
PID:2724 -
\??\c:\vnhltjp.exec:\vnhltjp.exe30⤵
- Executes dropped EXE
PID:2712 -
\??\c:\dnntr.exec:\dnntr.exe31⤵
- Executes dropped EXE
PID:2928 -
\??\c:\dltjt.exec:\dltjt.exe32⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xvjhdbl.exec:\xvjhdbl.exe33⤵
- Executes dropped EXE
PID:1428 -
\??\c:\ddvrp.exec:\ddvrp.exe34⤵
- Executes dropped EXE
PID:1580 -
\??\c:\nthxnhx.exec:\nthxnhx.exe35⤵
- Executes dropped EXE
PID:1068 -
\??\c:\brvbp.exec:\brvbp.exe36⤵
- Executes dropped EXE
PID:1720 -
\??\c:\fnjjhrp.exec:\fnjjhrp.exe37⤵
- Executes dropped EXE
PID:1100 -
\??\c:\ljpxpx.exec:\ljpxpx.exe38⤵
- Executes dropped EXE
PID:2592 -
\??\c:\jxhtt.exec:\jxhtt.exe39⤵
- Executes dropped EXE
PID:2708 -
\??\c:\jvbntxt.exec:\jvbntxt.exe40⤵
- Executes dropped EXE
PID:2412 -
\??\c:\nhtnpx.exec:\nhtnpx.exe41⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tlhtthr.exec:\tlhtthr.exe42⤵
- Executes dropped EXE
PID:2604 -
\??\c:\nfldb.exec:\nfldb.exe43⤵
- Executes dropped EXE
PID:2544 -
\??\c:\vhtxnt.exec:\vhtxnt.exe44⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vvlvrx.exec:\vvlvrx.exe45⤵
- Executes dropped EXE
PID:2984 -
\??\c:\jdddj.exec:\jdddj.exe46⤵
- Executes dropped EXE
PID:2800 -
\??\c:\pfrxtn.exec:\pfrxtn.exe47⤵
- Executes dropped EXE
PID:1356 -
\??\c:\xvxlfpd.exec:\xvxlfpd.exe48⤵
- Executes dropped EXE
PID:1284 -
\??\c:\jtfbnb.exec:\jtfbnb.exe49⤵
- Executes dropped EXE
PID:2296 -
\??\c:\tvxjjd.exec:\tvxjjd.exe50⤵
- Executes dropped EXE
PID:924 -
\??\c:\tdprhn.exec:\tdprhn.exe51⤵
- Executes dropped EXE
PID:1924 -
\??\c:\lxpxdl.exec:\lxpxdl.exe52⤵
- Executes dropped EXE
PID:1748 -
\??\c:\drbhhvv.exec:\drbhhvv.exe53⤵
- Executes dropped EXE
PID:1672 -
\??\c:\dplnr.exec:\dplnr.exe54⤵
- Executes dropped EXE
PID:1976 -
\??\c:\pttxx.exec:\pttxx.exe55⤵
- Executes dropped EXE
PID:1552 -
\??\c:\hrfpjh.exec:\hrfpjh.exe56⤵
- Executes dropped EXE
PID:2660 -
\??\c:\lhtjfn.exec:\lhtjfn.exe57⤵
- Executes dropped EXE
PID:1452 -
\??\c:\pvrdl.exec:\pvrdl.exe58⤵
- Executes dropped EXE
PID:1956 -
\??\c:\pvjfr.exec:\pvjfr.exe59⤵
- Executes dropped EXE
PID:2236 -
\??\c:\ntpxtnt.exec:\ntpxtnt.exe60⤵
- Executes dropped EXE
PID:2092 -
\??\c:\htvvlj.exec:\htvvlj.exe61⤵
- Executes dropped EXE
PID:2676 -
\??\c:\ptdxxpf.exec:\ptdxxpf.exe62⤵
- Executes dropped EXE
PID:1792 -
\??\c:\tjfbt.exec:\tjfbt.exe63⤵
- Executes dropped EXE
PID:932 -
\??\c:\xfjjl.exec:\xfjjl.exe64⤵
- Executes dropped EXE
PID:1664 -
\??\c:\jnrntd.exec:\jnrntd.exe65⤵
- Executes dropped EXE
PID:240 -
\??\c:\nhbhth.exec:\nhbhth.exe66⤵PID:1832
-
\??\c:\frfnj.exec:\frfnj.exe67⤵PID:1812
-
\??\c:\hjprhfd.exec:\hjprhfd.exe68⤵PID:2760
-
\??\c:\dfdxhd.exec:\dfdxhd.exe69⤵PID:2832
-
\??\c:\tdxrdbp.exec:\tdxrdbp.exe70⤵PID:2916
-
\??\c:\vhdvv.exec:\vhdvv.exe71⤵PID:2056
-
\??\c:\pbnxx.exec:\pbnxx.exe72⤵PID:1596
-
\??\c:\dlvrj.exec:\dlvrj.exe73⤵PID:2080
-
\??\c:\lndbrb.exec:\lndbrb.exe74⤵PID:2700
-
\??\c:\fhbtf.exec:\fhbtf.exe75⤵PID:1056
-
\??\c:\phhhhv.exec:\phhhhv.exe76⤵PID:2652
-
\??\c:\xrbtxx.exec:\xrbtxx.exe77⤵PID:2196
-
\??\c:\rdvnt.exec:\rdvnt.exe78⤵PID:1100
-
\??\c:\hvdtn.exec:\hvdtn.exe79⤵PID:2480
-
\??\c:\xpbtlt.exec:\xpbtlt.exe80⤵PID:2520
-
\??\c:\pbfnbf.exec:\pbfnbf.exe81⤵PID:2704
-
\??\c:\htndvjh.exec:\htndvjh.exe82⤵PID:2608
-
\??\c:\rhnbhrt.exec:\rhnbhrt.exe83⤵PID:2408
-
\??\c:\nrlxjbp.exec:\nrlxjbp.exe84⤵PID:2544
-
\??\c:\xvdnf.exec:\xvdnf.exe85⤵PID:2160
-
\??\c:\dlvldr.exec:\dlvldr.exe86⤵PID:2304
-
\??\c:\djhhnl.exec:\djhhnl.exe87⤵PID:580
-
\??\c:\pdnvln.exec:\pdnvln.exe88⤵PID:1372
-
\??\c:\lfvbv.exec:\lfvbv.exe89⤵PID:1344
-
\??\c:\bjlbnjd.exec:\bjlbnjd.exe90⤵PID:1932
-
\??\c:\xjtvt.exec:\xjtvt.exe91⤵PID:1996
-
\??\c:\tptrp.exec:\tptrp.exe92⤵PID:1072
-
\??\c:\jnvpnnr.exec:\jnvpnnr.exe93⤵PID:744
-
\??\c:\dfjbl.exec:\dfjbl.exe94⤵PID:1820
-
\??\c:\fllxb.exec:\fllxb.exe95⤵PID:1536
-
\??\c:\rbjrt.exec:\rbjrt.exe96⤵PID:1764
-
\??\c:\vlrfb.exec:\vlrfb.exe97⤵PID:824
-
\??\c:\hldhrxb.exec:\hldhrxb.exe98⤵PID:2256
-
\??\c:\lvpvddd.exec:\lvpvddd.exe99⤵PID:2808
-
\??\c:\pbvnt.exec:\pbvnt.exe100⤵PID:2244
-
\??\c:\dbrfll.exec:\dbrfll.exe101⤵PID:2008
-
\??\c:\txhxldx.exec:\txhxldx.exe102⤵PID:364
-
\??\c:\dhtjlnp.exec:\dhtjlnp.exe103⤵PID:940
-
\??\c:\htfpxf.exec:\htfpxf.exe104⤵PID:2108
-
\??\c:\jxjbrb.exec:\jxjbrb.exe105⤵PID:1040
-
\??\c:\vbpjj.exec:\vbpjj.exe106⤵PID:848
-
\??\c:\prlxnpf.exec:\prlxnpf.exe107⤵PID:3004
-
\??\c:\prvpdr.exec:\prvpdr.exe108⤵PID:3012
-
\??\c:\xvtjppx.exec:\xvtjppx.exe109⤵PID:2752
-
\??\c:\vbbxtx.exec:\vbbxtx.exe110⤵PID:3048
-
\??\c:\jfdddh.exec:\jfdddh.exe111⤵PID:2144
-
\??\c:\tvttndd.exec:\tvttndd.exe112⤵PID:2056
-
\??\c:\ntpxjd.exec:\ntpxjd.exe113⤵PID:2212
-
\??\c:\phvrd.exec:\phvrd.exe114⤵PID:2152
-
\??\c:\lxllrrv.exec:\lxllrrv.exe115⤵PID:1428
-
\??\c:\fvjvp.exec:\fvjvp.exe116⤵PID:2468
-
\??\c:\xvljn.exec:\xvljn.exe117⤵PID:2200
-
\??\c:\ljxvlh.exec:\ljxvlh.exe118⤵PID:1720
-
\??\c:\tbxhh.exec:\tbxhh.exe119⤵PID:2536
-
\??\c:\nxppv.exec:\nxppv.exe120⤵PID:2884
-
\??\c:\vlttrhp.exec:\vlttrhp.exe121⤵PID:2412
-
\??\c:\vrvtjxb.exec:\vrvtjxb.exe122⤵PID:2704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-