Analysis
-
max time kernel
127s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/04/2024, 19:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3905604c9050878c5639ed77a50b2136718fc319bc17d0f65c0f54395823b7d1.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
3905604c9050878c5639ed77a50b2136718fc319bc17d0f65c0f54395823b7d1.exe
-
Size
342KB
-
MD5
4cefa7ae5ef3bc4816b17d1730724c6d
-
SHA1
9c3c3fe87dbe80bb2445c6c772f913bc9ef17243
-
SHA256
3905604c9050878c5639ed77a50b2136718fc319bc17d0f65c0f54395823b7d1
-
SHA512
953aabb632260ed767962065c0412aa53598f14aa2c4e409283bb9efb57755488b7c64dcda9fbfdb31c2b32ae4381863dc4fca8c47b669f61b97f4894d17a7b6
-
SSDEEP
6144:n3C9BRo/AIX2MUXownfWQkyCpxwJz9e0pQowLh3EhToK9cT085mnFhXjmnwJQyIl:n3C9uDnUXoSWlnwJv90aKToFqwfIBr
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
resource yara_rule behavioral1/memory/2136-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1008-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1060-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2012-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1020-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/768-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1336-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1440-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-361-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2392-345-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/972-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-393-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-401-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-464-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-483-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-514-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2364-522-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/796-596-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 61 IoCs
resource yara_rule behavioral1/memory/2136-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2136-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3020-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2504-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1008-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1008-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2856-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2272-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2272-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2824-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2880-75-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2752-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2444-124-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2996-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1944-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1676-194-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1060-212-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1060-219-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2012-223-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1020-233-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2260-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/768-272-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1336-304-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1440-330-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1716-361-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2956-353-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2392-345-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2132-294-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-283-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2740-273-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2088-369-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/768-262-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/972-253-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2812-377-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2124-243-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1944-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2892-392-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2892-393-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2500-401-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2572-409-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2624-417-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2704-432-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2528-440-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2844-448-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2044-456-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1252-464-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1692-472-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1944-480-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1944-483-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2228-489-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2380-497-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1604-514-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1604-512-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2364-522-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1800-536-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1092-558-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2244-573-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/796-588-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/796-596-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1288-604-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3020 vdnlr.exe 2504 xrpdtx.exe 1008 jtfbld.exe 2272 hvtrd.exe 2856 btlvv.exe 2824 xvnllb.exe 2880 bdrhlrx.exe 2568 vxdnpxl.exe 2752 ptprhp.exe 2704 pndhvfn.exe 2528 frpft.exe 2444 tjnvhfh.exe 2996 dvprrf.exe 2220 nttvjld.exe 1944 rjlvhtr.exe 2188 pvfrv.exe 2260 vxdxft.exe 2336 vbfjbft.exe 1676 xhlvp.exe 1700 rhltpbh.exe 1060 lfpprr.exe 2012 vfnpv.exe 1020 vldhp.exe 2124 bxdvpvl.exe 972 pjrtprb.exe 768 pxdjnn.exe 2740 blptrhj.exe 2708 nlfhhll.exe 2132 tbjxf.exe 1336 vvjxpn.exe 3040 phxlpp.exe 1440 ptnrjbb.exe 476 vtvxfh.exe 1568 fjbnnn.exe 2392 fxvbh.exe 2956 jftpvnl.exe 1716 dvxvl.exe 2088 lbjdntp.exe 2812 xlxhvpx.exe 2592 lhjlxdf.exe 2892 lrhfnr.exe 2500 djntpv.exe 2572 hprtrxt.exe 2624 xhvxx.exe 2596 fbtbx.exe 2704 tllhbrd.exe 2528 hfbvp.exe 2844 tbvdpvd.exe 2044 dvnxv.exe 1252 lbpnb.exe 1692 pfbpr.exe 1944 dxdhr.exe 2228 vrldpn.exe 2380 vjjthb.exe 2068 nfddthj.exe 1604 thtpx.exe 2364 hjxnt.exe 2012 btdhh.exe 1800 hjlhfnh.exe 2236 htxdjxb.exe 2016 vnddpv.exe 1092 nxxjdbh.exe 1844 ljvnl.exe 2244 htvxdbx.exe -
resource yara_rule behavioral1/memory/2136-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1008-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1008-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2012-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1020-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1336-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-353-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2392-345-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/972-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-377-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-392-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-393-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-401-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-409-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-417-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-432-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2528-440-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-448-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2044-456-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-464-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-472-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-480-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-483-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-489-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-497-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-514-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1604-512-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2364-522-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-536-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1092-558-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-573-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/796-588-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/796-596-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1288-604-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2136 wrote to memory of 3020 2136 3905604c9050878c5639ed77a50b2136718fc319bc17d0f65c0f54395823b7d1.exe 28 PID 2136 wrote to memory of 3020 2136 3905604c9050878c5639ed77a50b2136718fc319bc17d0f65c0f54395823b7d1.exe 28 PID 2136 wrote to memory of 3020 2136 3905604c9050878c5639ed77a50b2136718fc319bc17d0f65c0f54395823b7d1.exe 28 PID 2136 wrote to memory of 3020 2136 3905604c9050878c5639ed77a50b2136718fc319bc17d0f65c0f54395823b7d1.exe 28 PID 3020 wrote to memory of 2504 3020 vdnlr.exe 29 PID 3020 wrote to memory of 2504 3020 vdnlr.exe 29 PID 3020 wrote to memory of 2504 3020 vdnlr.exe 29 PID 3020 wrote to memory of 2504 3020 vdnlr.exe 29 PID 2504 wrote to memory of 1008 2504 xrpdtx.exe 30 PID 2504 wrote to memory of 1008 2504 xrpdtx.exe 30 PID 2504 wrote to memory of 1008 2504 xrpdtx.exe 30 PID 2504 wrote to memory of 1008 2504 xrpdtx.exe 30 PID 1008 wrote to memory of 2272 1008 jtfbld.exe 31 PID 1008 wrote to memory of 2272 1008 jtfbld.exe 31 PID 1008 wrote to memory of 2272 1008 jtfbld.exe 31 PID 1008 wrote to memory of 2272 1008 jtfbld.exe 31 PID 2272 wrote to memory of 2856 2272 hvtrd.exe 32 PID 2272 wrote to memory of 2856 2272 hvtrd.exe 32 PID 2272 wrote to memory of 2856 2272 hvtrd.exe 32 PID 2272 wrote to memory of 2856 2272 hvtrd.exe 32 PID 2856 wrote to memory of 2824 2856 btlvv.exe 33 PID 2856 wrote to memory of 2824 2856 btlvv.exe 33 PID 2856 wrote to memory of 2824 2856 btlvv.exe 33 PID 2856 wrote to memory of 2824 2856 btlvv.exe 33 PID 2824 wrote to memory of 2880 2824 xvnllb.exe 34 PID 2824 wrote to memory of 2880 2824 xvnllb.exe 34 PID 2824 wrote to memory of 2880 2824 xvnllb.exe 34 PID 2824 wrote to memory of 2880 2824 xvnllb.exe 34 PID 2880 wrote to memory of 2568 2880 bdrhlrx.exe 35 PID 2880 wrote to memory of 2568 2880 bdrhlrx.exe 35 PID 2880 wrote to memory of 2568 2880 bdrhlrx.exe 35 PID 2880 wrote to memory of 2568 2880 bdrhlrx.exe 35 PID 2568 wrote to memory of 2752 2568 vxdnpxl.exe 36 PID 2568 wrote to memory of 2752 2568 vxdnpxl.exe 36 PID 2568 wrote to memory of 2752 2568 vxdnpxl.exe 36 PID 2568 wrote to memory of 2752 2568 vxdnpxl.exe 36 PID 2752 wrote to memory of 2704 2752 ptprhp.exe 73 PID 2752 wrote to memory of 2704 2752 ptprhp.exe 73 PID 2752 wrote to memory of 2704 2752 ptprhp.exe 73 PID 2752 wrote to memory of 2704 2752 ptprhp.exe 73 PID 2704 wrote to memory of 2528 2704 pndhvfn.exe 74 PID 2704 wrote to memory of 2528 2704 pndhvfn.exe 74 PID 2704 wrote to memory of 2528 2704 pndhvfn.exe 74 PID 2704 wrote to memory of 2528 2704 pndhvfn.exe 74 PID 2528 wrote to memory of 2444 2528 frpft.exe 39 PID 2528 wrote to memory of 2444 2528 frpft.exe 39 PID 2528 wrote to memory of 2444 2528 frpft.exe 39 PID 2528 wrote to memory of 2444 2528 frpft.exe 39 PID 2444 wrote to memory of 2996 2444 tjnvhfh.exe 40 PID 2444 wrote to memory of 2996 2444 tjnvhfh.exe 40 PID 2444 wrote to memory of 2996 2444 tjnvhfh.exe 40 PID 2444 wrote to memory of 2996 2444 tjnvhfh.exe 40 PID 2996 wrote to memory of 2220 2996 dvprrf.exe 41 PID 2996 wrote to memory of 2220 2996 dvprrf.exe 41 PID 2996 wrote to memory of 2220 2996 dvprrf.exe 41 PID 2996 wrote to memory of 2220 2996 dvprrf.exe 41 PID 2220 wrote to memory of 1944 2220 nttvjld.exe 79 PID 2220 wrote to memory of 1944 2220 nttvjld.exe 79 PID 2220 wrote to memory of 1944 2220 nttvjld.exe 79 PID 2220 wrote to memory of 1944 2220 nttvjld.exe 79 PID 1944 wrote to memory of 2188 1944 rjlvhtr.exe 43 PID 1944 wrote to memory of 2188 1944 rjlvhtr.exe 43 PID 1944 wrote to memory of 2188 1944 rjlvhtr.exe 43 PID 1944 wrote to memory of 2188 1944 rjlvhtr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\3905604c9050878c5639ed77a50b2136718fc319bc17d0f65c0f54395823b7d1.exe"C:\Users\Admin\AppData\Local\Temp\3905604c9050878c5639ed77a50b2136718fc319bc17d0f65c0f54395823b7d1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\vdnlr.exec:\vdnlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\xrpdtx.exec:\xrpdtx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\jtfbld.exec:\jtfbld.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\hvtrd.exec:\hvtrd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\btlvv.exec:\btlvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\xvnllb.exec:\xvnllb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\bdrhlrx.exec:\bdrhlrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\vxdnpxl.exec:\vxdnpxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\ptprhp.exec:\ptprhp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\pndhvfn.exec:\pndhvfn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\frpft.exec:\frpft.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\tjnvhfh.exec:\tjnvhfh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\dvprrf.exec:\dvprrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\nttvjld.exec:\nttvjld.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\rjlvhtr.exec:\rjlvhtr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\pvfrv.exec:\pvfrv.exe17⤵
- Executes dropped EXE
PID:2188 -
\??\c:\vxdxft.exec:\vxdxft.exe18⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vbfjbft.exec:\vbfjbft.exe19⤵
- Executes dropped EXE
PID:2336 -
\??\c:\xhlvp.exec:\xhlvp.exe20⤵
- Executes dropped EXE
PID:1676 -
\??\c:\rhltpbh.exec:\rhltpbh.exe21⤵
- Executes dropped EXE
PID:1700 -
\??\c:\lfpprr.exec:\lfpprr.exe22⤵
- Executes dropped EXE
PID:1060 -
\??\c:\vfnpv.exec:\vfnpv.exe23⤵
- Executes dropped EXE
PID:2012 -
\??\c:\vldhp.exec:\vldhp.exe24⤵
- Executes dropped EXE
PID:1020 -
\??\c:\bxdvpvl.exec:\bxdvpvl.exe25⤵
- Executes dropped EXE
PID:2124 -
\??\c:\pjrtprb.exec:\pjrtprb.exe26⤵
- Executes dropped EXE
PID:972 -
\??\c:\pxdjnn.exec:\pxdjnn.exe27⤵
- Executes dropped EXE
PID:768 -
\??\c:\blptrhj.exec:\blptrhj.exe28⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nlfhhll.exec:\nlfhhll.exe29⤵
- Executes dropped EXE
PID:2708 -
\??\c:\tbjxf.exec:\tbjxf.exe30⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vvjxpn.exec:\vvjxpn.exe31⤵
- Executes dropped EXE
PID:1336 -
\??\c:\phxlpp.exec:\phxlpp.exe32⤵
- Executes dropped EXE
PID:3040 -
\??\c:\ptnrjbb.exec:\ptnrjbb.exe33⤵
- Executes dropped EXE
PID:1440 -
\??\c:\vtvxfh.exec:\vtvxfh.exe34⤵
- Executes dropped EXE
PID:476 -
\??\c:\fjbnnn.exec:\fjbnnn.exe35⤵
- Executes dropped EXE
PID:1568 -
\??\c:\fxvbh.exec:\fxvbh.exe36⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jftpvnl.exec:\jftpvnl.exe37⤵
- Executes dropped EXE
PID:2956 -
\??\c:\dvxvl.exec:\dvxvl.exe38⤵
- Executes dropped EXE
PID:1716 -
\??\c:\lbjdntp.exec:\lbjdntp.exe39⤵
- Executes dropped EXE
PID:2088 -
\??\c:\xlxhvpx.exec:\xlxhvpx.exe40⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lhjlxdf.exec:\lhjlxdf.exe41⤵
- Executes dropped EXE
PID:2592 -
\??\c:\lrhfnr.exec:\lrhfnr.exe42⤵
- Executes dropped EXE
PID:2892 -
\??\c:\djntpv.exec:\djntpv.exe43⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hprtrxt.exec:\hprtrxt.exe44⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xhvxx.exec:\xhvxx.exe45⤵
- Executes dropped EXE
PID:2624 -
\??\c:\fbtbx.exec:\fbtbx.exe46⤵
- Executes dropped EXE
PID:2596 -
\??\c:\tllhbrd.exec:\tllhbrd.exe47⤵
- Executes dropped EXE
PID:2704 -
\??\c:\hfbvp.exec:\hfbvp.exe48⤵
- Executes dropped EXE
PID:2528 -
\??\c:\tbvdpvd.exec:\tbvdpvd.exe49⤵
- Executes dropped EXE
PID:2844 -
\??\c:\dvnxv.exec:\dvnxv.exe50⤵
- Executes dropped EXE
PID:2044 -
\??\c:\lbpnb.exec:\lbpnb.exe51⤵
- Executes dropped EXE
PID:1252 -
\??\c:\pfbpr.exec:\pfbpr.exe52⤵
- Executes dropped EXE
PID:1692 -
\??\c:\dxdhr.exec:\dxdhr.exe53⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vrldpn.exec:\vrldpn.exe54⤵
- Executes dropped EXE
PID:2228 -
\??\c:\vjjthb.exec:\vjjthb.exe55⤵
- Executes dropped EXE
PID:2380 -
\??\c:\nfddthj.exec:\nfddthj.exe56⤵
- Executes dropped EXE
PID:2068 -
\??\c:\thtpx.exec:\thtpx.exe57⤵
- Executes dropped EXE
PID:1604 -
\??\c:\hjxnt.exec:\hjxnt.exe58⤵
- Executes dropped EXE
PID:2364 -
\??\c:\btdhh.exec:\btdhh.exe59⤵
- Executes dropped EXE
PID:2012 -
\??\c:\hjlhfnh.exec:\hjlhfnh.exe60⤵
- Executes dropped EXE
PID:1800 -
\??\c:\htxdjxb.exec:\htxdjxb.exe61⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vnddpv.exec:\vnddpv.exe62⤵
- Executes dropped EXE
PID:2016 -
\??\c:\nxxjdbh.exec:\nxxjdbh.exe63⤵
- Executes dropped EXE
PID:1092 -
\??\c:\ljvnl.exec:\ljvnl.exe64⤵
- Executes dropped EXE
PID:1844 -
\??\c:\htvxdbx.exec:\htvxdbx.exe65⤵
- Executes dropped EXE
PID:2244 -
\??\c:\tbdhlt.exec:\tbdhlt.exe66⤵PID:948
-
\??\c:\fpvjt.exec:\fpvjt.exe67⤵PID:796
-
\??\c:\bnphn.exec:\bnphn.exe68⤵PID:2156
-
\??\c:\ttjtn.exec:\ttjtn.exe69⤵PID:1288
-
\??\c:\tjfxprn.exec:\tjfxprn.exe70⤵PID:3040
-
\??\c:\dvxrrdp.exec:\dvxrrdp.exe71⤵PID:1540
-
\??\c:\blplvn.exec:\blplvn.exe72⤵PID:1576
-
\??\c:\lhhbv.exec:\lhhbv.exe73⤵PID:2396
-
\??\c:\rxjhx.exec:\rxjhx.exe74⤵PID:1736
-
\??\c:\hvdrf.exec:\hvdrf.exe75⤵PID:2948
-
\??\c:\bnbdvff.exec:\bnbdvff.exe76⤵PID:2816
-
\??\c:\lnnnn.exec:\lnnnn.exe77⤵PID:1716
-
\??\c:\xtlfv.exec:\xtlfv.exe78⤵PID:1448
-
\??\c:\rbfnf.exec:\rbfnf.exe79⤵PID:1204
-
\??\c:\xttxhbb.exec:\xttxhbb.exe80⤵PID:2496
-
\??\c:\ltjtbjt.exec:\ltjtbjt.exe81⤵PID:2744
-
\??\c:\jlnnpxr.exec:\jlnnpxr.exe82⤵PID:2520
-
\??\c:\jtdrjpf.exec:\jtdrjpf.exe83⤵PID:2500
-
\??\c:\dhbjlt.exec:\dhbjlt.exe84⤵PID:2584
-
\??\c:\ljdbjr.exec:\ljdbjr.exe85⤵PID:2848
-
\??\c:\rxxnjlh.exec:\rxxnjlh.exe86⤵PID:2424
-
\??\c:\nvxjhf.exec:\nvxjhf.exe87⤵PID:2476
-
\??\c:\vnjhvrb.exec:\vnjhvrb.exe88⤵PID:2224
-
\??\c:\bptln.exec:\bptln.exe89⤵PID:2384
-
\??\c:\jtrrn.exec:\jtrrn.exe90⤵PID:2836
-
\??\c:\vdnjjvf.exec:\vdnjjvf.exe91⤵PID:2312
-
\??\c:\bvvphpf.exec:\bvvphpf.exe92⤵PID:2184
-
\??\c:\dpljdh.exec:\dpljdh.exe93⤵PID:1952
-
\??\c:\jtlbrjn.exec:\jtlbrjn.exe94⤵PID:1760
-
\??\c:\dhrjtj.exec:\dhrjtj.exe95⤵PID:1528
-
\??\c:\pfrbrtj.exec:\pfrbrtj.exe96⤵PID:1940
-
\??\c:\drxjh.exec:\drxjh.exe97⤵PID:1628
-
\??\c:\hpldvj.exec:\hpldvj.exe98⤵PID:1672
-
\??\c:\nxltdbb.exec:\nxltdbb.exe99⤵PID:1564
-
\??\c:\jhpfl.exec:\jhpfl.exe100⤵PID:1520
-
\??\c:\fvbxrp.exec:\fvbxrp.exe101⤵PID:2348
-
\??\c:\vdxfnrf.exec:\vdxfnrf.exe102⤵PID:1808
-
\??\c:\bxnbpb.exec:\bxnbpb.exe103⤵PID:1316
-
\??\c:\ldnrxbt.exec:\ldnrxbt.exe104⤵PID:1980
-
\??\c:\hrjbt.exec:\hrjbt.exe105⤵PID:2144
-
\??\c:\xhlhthn.exec:\xhlhthn.exe106⤵PID:2112
-
\??\c:\rvttvb.exec:\rvttvb.exe107⤵PID:2132
-
\??\c:\dxxjtt.exec:\dxxjtt.exe108⤵PID:1304
-
\??\c:\rpvlvd.exec:\rpvlvd.exe109⤵PID:2140
-
\??\c:\tbbpvj.exec:\tbbpvj.exe110⤵PID:2912
-
\??\c:\ptnxvld.exec:\ptnxvld.exe111⤵PID:1460
-
\??\c:\njvfnd.exec:\njvfnd.exe112⤵PID:2296
-
\??\c:\ftbht.exec:\ftbht.exe113⤵PID:1576
-
\??\c:\nhbtn.exec:\nhbtn.exe114⤵PID:2736
-
\??\c:\nrvftt.exec:\nrvftt.exe115⤵PID:668
-
\??\c:\vfttp.exec:\vfttp.exe116⤵PID:2792
-
\??\c:\hrfrhbl.exec:\hrfrhbl.exe117⤵PID:2100
-
\??\c:\llfdv.exec:\llfdv.exe118⤵PID:2940
-
\??\c:\trnllv.exec:\trnllv.exe119⤵PID:1688
-
\??\c:\fvlvh.exec:\fvlvh.exe120⤵PID:2820
-
\??\c:\nrvprx.exec:\nrvprx.exe121⤵PID:2692
-
\??\c:\prlbl.exec:\prlbl.exe122⤵PID:2564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-