Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 18:45
Behavioral task
behavioral1
Sample
2bc560764e80a74bde77ffab09ccac9186a249325601ff6a817d1eb45113765b.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
2bc560764e80a74bde77ffab09ccac9186a249325601ff6a817d1eb45113765b.exe
-
Size
340KB
-
MD5
b48dc2c9c9c1d18939e39b6926d9e3dd
-
SHA1
6cb91c4bc865fdde5e14a5a18892c3eb569ecade
-
SHA256
2bc560764e80a74bde77ffab09ccac9186a249325601ff6a817d1eb45113765b
-
SHA512
178a5975f832ad5ee8af70e85853f804e0479d231cb6061e3dde1ddfa4f7d96e137f422d722b0da9edd512ddf46502de203585b33d686bdb5403c5b876d929d8
-
SSDEEP
6144:xcm4FmowdHoSgWrXF5lpKGYV0aTk/6Ai+EgtZTOMrL/xZ8UVrKLo+Q/VjrIVBjdu:74wFHoSgWjdpKGATTk/6Aihgth7L/QOv
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/3020-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1916-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-61-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2696-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-90-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2492-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-108-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3012-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1388-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/784-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/784-201-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1056-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/592-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2256-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/960-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-285-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1604-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-359-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2436-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-406-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2052-412-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2276-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-434-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2052-438-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2412-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1476-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/1916-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000c000000014228-16.dat UPX behavioral1/memory/3020-19-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2196-11-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000a000000012251-9.dat UPX behavioral1/memory/1916-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x003600000001443b-25.dat UPX behavioral1/memory/1708-27-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00070000000146fc-32.dat UPX behavioral1/memory/2568-33-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000014712-39.dat UPX behavioral1/memory/2568-41-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000700000001471a-50.dat UPX behavioral1/memory/2668-49-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000a000000014826-57.dat UPX behavioral1/memory/2696-58-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000900000001487f-67.dat UPX behavioral1/memory/1936-68-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015c9e-77.dat UPX behavioral1/memory/1936-76-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cae-83.dat UPX behavioral1/files/0x0006000000015cb6-92.dat UPX behavioral1/memory/2492-95-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2504-91-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015ccd-100.dat UPX behavioral1/files/0x0006000000015cd9-106.dat UPX behavioral1/memory/2728-109-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3012-117-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015ce3-118.dat UPX behavioral1/memory/2112-124-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cff-125.dat UPX behavioral1/files/0x0006000000015d20-132.dat UPX behavioral1/memory/2780-139-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00360000000144e8-141.dat UPX behavioral1/memory/2936-143-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015d42-148.dat UPX behavioral1/memory/1396-149-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015d4e-156.dat UPX behavioral1/memory/2312-167-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015d56-165.dat UPX behavioral1/memory/1388-163-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015d5f-173.dat UPX behavioral1/files/0x0006000000015d6b-180.dat UPX behavioral1/files/0x0006000000015d7f-187.dat UPX behavioral1/files/0x0006000000015d87-194.dat UPX behavioral1/files/0x0006000000015d93-203.dat UPX behavioral1/memory/784-202-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1056-206-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015e32-211.dat UPX behavioral1/memory/592-218-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015ecc-219.dat UPX behavioral1/files/0x0006000000015f65-226.dat UPX behavioral1/files/0x0006000000015fe5-233.dat UPX behavioral1/memory/2256-235-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000600000001610f-241.dat UPX behavioral1/files/0x000600000001621e-250.dat UPX behavioral1/memory/1524-249-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000600000001630a-257.dat UPX behavioral1/memory/960-264-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2372-301-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3068-307-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1604-314-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3068-313-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2676-336-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2196 ddvvv.exe 3020 rlxxflx.exe 1708 pjddd.exe 2568 htnhtt.exe 2668 5jvdp.exe 2696 rlxxffl.exe 2556 vvjvv.exe 1936 lrlxxlf.exe 2496 bbntbn.exe 2504 5jjdv.exe 2492 nhtbhn.exe 2728 7jjdv.exe 3012 1tnbhn.exe 2112 rxxrffr.exe 2796 nhnnhh.exe 2780 1jvpv.exe 2936 thbbbb.exe 1396 dpjdd.exe 1388 tnbnhh.exe 2312 jdvdd.exe 2424 jdddj.exe 2896 ddvdv.exe 2208 fflflfx.exe 784 ththth.exe 1056 1pjvp.exe 592 bntbhh.exe 1644 fxflrrr.exe 2096 7tnhnn.exe 2256 jpdjp.exe 1524 xrfflxf.exe 1328 tnbthn.exe 1224 jpddd.exe 960 jdpvj.exe 1032 vvjjp.exe 1580 xxxfflr.exe 672 bhhbth.exe 1932 pjppv.exe 868 lfxlffl.exe 2400 tthnht.exe 2372 pddvv.exe 3068 xfllxxf.exe 1604 nnnbtb.exe 2296 btbbtb.exe 2856 5vvvp.exe 1708 frfrxfx.exe 2676 btbbnh.exe 2672 vpdpv.exe 2448 3fxrlrf.exe 1060 hnnbbt.exe 2600 ppjpp.exe 3048 lrfrrff.exe 2436 1hbhhn.exe 2440 jjjdd.exe 2472 nbhbbn.exe 2972 pddpd.exe 2492 1lxfffr.exe 2832 nnnhbn.exe 2052 pdpjp.exe 2276 vpjjv.exe 296 hhbbnh.exe 2332 hhnbhh.exe 2224 vdjpj.exe 1380 flfrxrf.exe 2324 nhnhhh.exe -
resource yara_rule behavioral1/memory/1916-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000014228-16.dat upx behavioral1/memory/3020-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2196-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000012251-9.dat upx behavioral1/memory/1916-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x003600000001443b-25.dat upx behavioral1/memory/1708-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000146fc-32.dat upx behavioral1/memory/2568-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014712-39.dat upx behavioral1/memory/2568-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001471a-50.dat upx behavioral1/memory/2668-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000014826-57.dat upx behavioral1/memory/2696-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001487f-67.dat upx behavioral1/memory/1936-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c9e-77.dat upx behavioral1/memory/1936-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cae-83.dat upx behavioral1/files/0x0006000000015cb6-92.dat upx behavioral1/memory/2492-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2504-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015ccd-100.dat upx behavioral1/files/0x0006000000015cd9-106.dat upx behavioral1/memory/2728-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015ce3-118.dat upx behavioral1/memory/2112-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cff-125.dat upx behavioral1/files/0x0006000000015d20-132.dat upx behavioral1/memory/2780-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00360000000144e8-141.dat upx behavioral1/memory/2936-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d42-148.dat upx behavioral1/memory/1396-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d4e-156.dat upx behavioral1/memory/2312-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d56-165.dat upx behavioral1/memory/1388-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d5f-173.dat upx behavioral1/files/0x0006000000015d6b-180.dat upx behavioral1/files/0x0006000000015d7f-187.dat upx behavioral1/files/0x0006000000015d87-194.dat upx behavioral1/files/0x0006000000015d93-203.dat upx behavioral1/memory/784-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1056-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015e32-211.dat upx behavioral1/memory/592-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015ecc-219.dat upx behavioral1/files/0x0006000000015f65-226.dat upx behavioral1/files/0x0006000000015fe5-233.dat upx behavioral1/memory/2256-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001610f-241.dat upx behavioral1/files/0x000600000001621e-250.dat upx behavioral1/memory/1524-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001630a-257.dat upx behavioral1/memory/960-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2372-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3068-307-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1604-314-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3068-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-336-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1916 wrote to memory of 2196 1916 2bc560764e80a74bde77ffab09ccac9186a249325601ff6a817d1eb45113765b.exe 28 PID 1916 wrote to memory of 2196 1916 2bc560764e80a74bde77ffab09ccac9186a249325601ff6a817d1eb45113765b.exe 28 PID 1916 wrote to memory of 2196 1916 2bc560764e80a74bde77ffab09ccac9186a249325601ff6a817d1eb45113765b.exe 28 PID 1916 wrote to memory of 2196 1916 2bc560764e80a74bde77ffab09ccac9186a249325601ff6a817d1eb45113765b.exe 28 PID 2196 wrote to memory of 3020 2196 ddvvv.exe 29 PID 2196 wrote to memory of 3020 2196 ddvvv.exe 29 PID 2196 wrote to memory of 3020 2196 ddvvv.exe 29 PID 2196 wrote to memory of 3020 2196 ddvvv.exe 29 PID 3020 wrote to memory of 1708 3020 rlxxflx.exe 30 PID 3020 wrote to memory of 1708 3020 rlxxflx.exe 30 PID 3020 wrote to memory of 1708 3020 rlxxflx.exe 30 PID 3020 wrote to memory of 1708 3020 rlxxflx.exe 30 PID 1708 wrote to memory of 2568 1708 pjddd.exe 31 PID 1708 wrote to memory of 2568 1708 pjddd.exe 31 PID 1708 wrote to memory of 2568 1708 pjddd.exe 31 PID 1708 wrote to memory of 2568 1708 pjddd.exe 31 PID 2568 wrote to memory of 2668 2568 htnhtt.exe 32 PID 2568 wrote to memory of 2668 2568 htnhtt.exe 32 PID 2568 wrote to memory of 2668 2568 htnhtt.exe 32 PID 2568 wrote to memory of 2668 2568 htnhtt.exe 32 PID 2668 wrote to memory of 2696 2668 5jvdp.exe 33 PID 2668 wrote to memory of 2696 2668 5jvdp.exe 33 PID 2668 wrote to memory of 2696 2668 5jvdp.exe 33 PID 2668 wrote to memory of 2696 2668 5jvdp.exe 33 PID 2696 wrote to memory of 2556 2696 rlxxffl.exe 34 PID 2696 wrote to memory of 2556 2696 rlxxffl.exe 34 PID 2696 wrote to memory of 2556 2696 rlxxffl.exe 34 PID 2696 wrote to memory of 2556 2696 rlxxffl.exe 34 PID 2556 wrote to memory of 1936 2556 vvjvv.exe 35 PID 2556 wrote to memory of 1936 2556 vvjvv.exe 35 PID 2556 wrote to memory of 1936 2556 vvjvv.exe 35 PID 2556 wrote to memory of 1936 2556 vvjvv.exe 35 PID 1936 wrote to memory of 2496 1936 lrlxxlf.exe 36 PID 1936 wrote to memory of 2496 1936 lrlxxlf.exe 36 PID 1936 wrote to memory of 2496 1936 lrlxxlf.exe 36 PID 1936 wrote to memory of 2496 1936 lrlxxlf.exe 36 PID 2496 wrote to memory of 2504 2496 bbntbn.exe 37 PID 2496 wrote to memory of 2504 2496 bbntbn.exe 37 PID 2496 wrote to memory of 2504 2496 bbntbn.exe 37 PID 2496 wrote to memory of 2504 2496 bbntbn.exe 37 PID 2504 wrote to memory of 2492 2504 5jjdv.exe 38 PID 2504 wrote to memory of 2492 2504 5jjdv.exe 38 PID 2504 wrote to memory of 2492 2504 5jjdv.exe 38 PID 2504 wrote to memory of 2492 2504 5jjdv.exe 38 PID 2492 wrote to memory of 2728 2492 nhtbhn.exe 39 PID 2492 wrote to memory of 2728 2492 nhtbhn.exe 39 PID 2492 wrote to memory of 2728 2492 nhtbhn.exe 39 PID 2492 wrote to memory of 2728 2492 nhtbhn.exe 39 PID 2728 wrote to memory of 3012 2728 7jjdv.exe 40 PID 2728 wrote to memory of 3012 2728 7jjdv.exe 40 PID 2728 wrote to memory of 3012 2728 7jjdv.exe 40 PID 2728 wrote to memory of 3012 2728 7jjdv.exe 40 PID 3012 wrote to memory of 2112 3012 1tnbhn.exe 41 PID 3012 wrote to memory of 2112 3012 1tnbhn.exe 41 PID 3012 wrote to memory of 2112 3012 1tnbhn.exe 41 PID 3012 wrote to memory of 2112 3012 1tnbhn.exe 41 PID 2112 wrote to memory of 2796 2112 rxxrffr.exe 42 PID 2112 wrote to memory of 2796 2112 rxxrffr.exe 42 PID 2112 wrote to memory of 2796 2112 rxxrffr.exe 42 PID 2112 wrote to memory of 2796 2112 rxxrffr.exe 42 PID 2796 wrote to memory of 2780 2796 nhnnhh.exe 43 PID 2796 wrote to memory of 2780 2796 nhnnhh.exe 43 PID 2796 wrote to memory of 2780 2796 nhnnhh.exe 43 PID 2796 wrote to memory of 2780 2796 nhnnhh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bc560764e80a74bde77ffab09ccac9186a249325601ff6a817d1eb45113765b.exe"C:\Users\Admin\AppData\Local\Temp\2bc560764e80a74bde77ffab09ccac9186a249325601ff6a817d1eb45113765b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\ddvvv.exec:\ddvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\rlxxflx.exec:\rlxxflx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\pjddd.exec:\pjddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\htnhtt.exec:\htnhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\5jvdp.exec:\5jvdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\rlxxffl.exec:\rlxxffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\vvjvv.exec:\vvjvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\lrlxxlf.exec:\lrlxxlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\bbntbn.exec:\bbntbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\5jjdv.exec:\5jjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\nhtbhn.exec:\nhtbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\7jjdv.exec:\7jjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\1tnbhn.exec:\1tnbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\rxxrffr.exec:\rxxrffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\nhnnhh.exec:\nhnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\1jvpv.exec:\1jvpv.exe17⤵
- Executes dropped EXE
PID:2780 -
\??\c:\thbbbb.exec:\thbbbb.exe18⤵
- Executes dropped EXE
PID:2936 -
\??\c:\dpjdd.exec:\dpjdd.exe19⤵
- Executes dropped EXE
PID:1396 -
\??\c:\tnbnhh.exec:\tnbnhh.exe20⤵
- Executes dropped EXE
PID:1388 -
\??\c:\jdvdd.exec:\jdvdd.exe21⤵
- Executes dropped EXE
PID:2312 -
\??\c:\jdddj.exec:\jdddj.exe22⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ddvdv.exec:\ddvdv.exe23⤵
- Executes dropped EXE
PID:2896 -
\??\c:\fflflfx.exec:\fflflfx.exe24⤵
- Executes dropped EXE
PID:2208 -
\??\c:\ththth.exec:\ththth.exe25⤵
- Executes dropped EXE
PID:784 -
\??\c:\1pjvp.exec:\1pjvp.exe26⤵
- Executes dropped EXE
PID:1056 -
\??\c:\bntbhh.exec:\bntbhh.exe27⤵
- Executes dropped EXE
PID:592 -
\??\c:\fxflrrr.exec:\fxflrrr.exe28⤵
- Executes dropped EXE
PID:1644 -
\??\c:\7tnhnn.exec:\7tnhnn.exe29⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jpdjp.exec:\jpdjp.exe30⤵
- Executes dropped EXE
PID:2256 -
\??\c:\xrfflxf.exec:\xrfflxf.exe31⤵
- Executes dropped EXE
PID:1524 -
\??\c:\tnbthn.exec:\tnbthn.exe32⤵
- Executes dropped EXE
PID:1328 -
\??\c:\jpddd.exec:\jpddd.exe33⤵
- Executes dropped EXE
PID:1224 -
\??\c:\jdpvj.exec:\jdpvj.exe34⤵
- Executes dropped EXE
PID:960 -
\??\c:\vvjjp.exec:\vvjjp.exe35⤵
- Executes dropped EXE
PID:1032 -
\??\c:\xxxfflr.exec:\xxxfflr.exe36⤵
- Executes dropped EXE
PID:1580 -
\??\c:\bhhbth.exec:\bhhbth.exe37⤵
- Executes dropped EXE
PID:672 -
\??\c:\pjppv.exec:\pjppv.exe38⤵
- Executes dropped EXE
PID:1932 -
\??\c:\lfxlffl.exec:\lfxlffl.exe39⤵
- Executes dropped EXE
PID:868 -
\??\c:\tthnht.exec:\tthnht.exe40⤵
- Executes dropped EXE
PID:2400 -
\??\c:\pddvv.exec:\pddvv.exe41⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xfllxxf.exec:\xfllxxf.exe42⤵
- Executes dropped EXE
PID:3068 -
\??\c:\nnnbtb.exec:\nnnbtb.exe43⤵
- Executes dropped EXE
PID:1604 -
\??\c:\btbbtb.exec:\btbbtb.exe44⤵
- Executes dropped EXE
PID:2296 -
\??\c:\5vvvp.exec:\5vvvp.exe45⤵
- Executes dropped EXE
PID:2856 -
\??\c:\frfrxfx.exec:\frfrxfx.exe46⤵
- Executes dropped EXE
PID:1708 -
\??\c:\btbbnh.exec:\btbbnh.exe47⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vpdpv.exec:\vpdpv.exe48⤵
- Executes dropped EXE
PID:2672 -
\??\c:\3fxrlrf.exec:\3fxrlrf.exe49⤵
- Executes dropped EXE
PID:2448 -
\??\c:\hnnbbt.exec:\hnnbbt.exe50⤵
- Executes dropped EXE
PID:1060 -
\??\c:\ppjpp.exec:\ppjpp.exe51⤵
- Executes dropped EXE
PID:2600 -
\??\c:\lrfrrff.exec:\lrfrrff.exe52⤵
- Executes dropped EXE
PID:3048 -
\??\c:\1hbhhn.exec:\1hbhhn.exe53⤵
- Executes dropped EXE
PID:2436 -
\??\c:\jjjdd.exec:\jjjdd.exe54⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nbhbbn.exec:\nbhbbn.exe55⤵
- Executes dropped EXE
PID:2472 -
\??\c:\pddpd.exec:\pddpd.exe56⤵
- Executes dropped EXE
PID:2972 -
\??\c:\1lxfffr.exec:\1lxfffr.exe57⤵
- Executes dropped EXE
PID:2492 -
\??\c:\nnnhbn.exec:\nnnhbn.exe58⤵
- Executes dropped EXE
PID:2832 -
\??\c:\pdpjp.exec:\pdpjp.exe59⤵
- Executes dropped EXE
PID:2052 -
\??\c:\vpjjv.exec:\vpjjv.exe60⤵
- Executes dropped EXE
PID:2276 -
\??\c:\hhbbnh.exec:\hhbbnh.exe61⤵
- Executes dropped EXE
PID:296 -
\??\c:\hhnbhh.exec:\hhnbhh.exe62⤵
- Executes dropped EXE
PID:2332 -
\??\c:\vdjpj.exec:\vdjpj.exe63⤵
- Executes dropped EXE
PID:2224 -
\??\c:\flfrxrf.exec:\flfrxrf.exe64⤵
- Executes dropped EXE
PID:1380 -
\??\c:\nhnhhh.exec:\nhnhhh.exe65⤵
- Executes dropped EXE
PID:2324 -
\??\c:\5jjvd.exec:\5jjvd.exe66⤵PID:1308
-
\??\c:\7xlxrff.exec:\7xlxrff.exe67⤵PID:2304
-
\??\c:\nnbthn.exec:\nnbthn.exe68⤵PID:2320
-
\??\c:\ddpdp.exec:\ddpdp.exe69⤵PID:1816
-
\??\c:\9lffllr.exec:\9lffllr.exe70⤵PID:2888
-
\??\c:\thhbbt.exec:\thhbbt.exe71⤵PID:2004
-
\??\c:\bthnhh.exec:\bthnhh.exe72⤵PID:1784
-
\??\c:\dvjpv.exec:\dvjpv.exe73⤵PID:2208
-
\??\c:\7lxxffl.exec:\7lxxffl.exe74⤵PID:488
-
\??\c:\ttnttt.exec:\ttnttt.exe75⤵PID:1732
-
\??\c:\3dpvd.exec:\3dpvd.exe76⤵PID:1476
-
\??\c:\ffflrxf.exec:\ffflrxf.exe77⤵PID:2412
-
\??\c:\rrllxfl.exec:\rrllxfl.exe78⤵PID:1536
-
\??\c:\9btbtb.exec:\9btbtb.exe79⤵PID:2084
-
\??\c:\vvjvv.exec:\vvjvv.exe80⤵PID:2116
-
\??\c:\flfxrxf.exec:\flfxrxf.exe81⤵PID:276
-
\??\c:\5hnnhn.exec:\5hnnhn.exe82⤵PID:660
-
\??\c:\fxrfffr.exec:\fxrfffr.exe83⤵PID:1336
-
\??\c:\llrlrlf.exec:\llrlrlf.exe84⤵PID:380
-
\??\c:\pddvp.exec:\pddvp.exe85⤵PID:2260
-
\??\c:\hbhbht.exec:\hbhbht.exe86⤵PID:576
-
\??\c:\jvvpd.exec:\jvvpd.exe87⤵PID:2008
-
\??\c:\rxlxlrl.exec:\rxlxlrl.exe88⤵PID:1580
-
\??\c:\bthtbt.exec:\bthtbt.exe89⤵PID:672
-
\??\c:\pvvjp.exec:\pvvjp.exe90⤵PID:3028
-
\??\c:\fxflxxf.exec:\fxflxxf.exe91⤵PID:884
-
\??\c:\bhhtbh.exec:\bhhtbh.exe92⤵PID:2196
-
\??\c:\7pjpv.exec:\7pjpv.exe93⤵PID:2372
-
\??\c:\ffxxlrr.exec:\ffxxlrr.exe94⤵PID:1584
-
\??\c:\ttbtth.exec:\ttbtth.exe95⤵PID:1604
-
\??\c:\ppppj.exec:\ppppj.exe96⤵PID:2340
-
\??\c:\djjdv.exec:\djjdv.exe97⤵PID:1256
-
\??\c:\lfllrlf.exec:\lfllrlf.exe98⤵PID:2548
-
\??\c:\hhnnbh.exec:\hhnnbh.exe99⤵PID:2880
-
\??\c:\ddpvj.exec:\ddpvj.exe100⤵PID:2664
-
\??\c:\lrfxfxf.exec:\lrfxfxf.exe101⤵PID:2692
-
\??\c:\xflfrlf.exec:\xflfrlf.exe102⤵PID:2464
-
\??\c:\tnbhbb.exec:\tnbhbb.exe103⤵PID:2792
-
\??\c:\jjdpj.exec:\jjdpj.exe104⤵PID:2444
-
\??\c:\rrrrfrr.exec:\rrrrfrr.exe105⤵PID:2484
-
\??\c:\5fxfxfr.exec:\5fxfxfr.exe106⤵PID:2964
-
\??\c:\tnhtnt.exec:\tnhtnt.exe107⤵PID:2516
-
\??\c:\dvpdp.exec:\dvpdp.exe108⤵PID:1448
-
\??\c:\7pdpp.exec:\7pdpp.exe109⤵PID:636
-
\??\c:\flrfxfx.exec:\flrfxfx.exe110⤵PID:2952
-
\??\c:\5hhbnn.exec:\5hhbnn.exe111⤵PID:1976
-
\??\c:\3ddvj.exec:\3ddvj.exe112⤵PID:1996
-
\??\c:\fxrxrxl.exec:\fxrxrxl.exe113⤵PID:2776
-
\??\c:\xlrllrr.exec:\xlrllrr.exe114⤵PID:296
-
\??\c:\ttnbbn.exec:\ttnbbn.exe115⤵PID:2332
-
\??\c:\3pppj.exec:\3pppj.exe116⤵PID:2948
-
\??\c:\lxlxflr.exec:\lxlxflr.exe117⤵PID:2784
-
\??\c:\rlxxrlr.exec:\rlxxrlr.exe118⤵PID:848
-
\??\c:\bnnbtb.exec:\bnnbtb.exe119⤵PID:2324
-
\??\c:\vvvjj.exec:\vvvjj.exe120⤵PID:1288
-
\??\c:\xfxfrlr.exec:\xfxfrlr.exe121⤵PID:1928
-
\??\c:\hthhtb.exec:\hthhtb.exe122⤵PID:1912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-