Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05-04-2024 21:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
539162b8cb67fedd37b9a100ee4726f29e247b4508e38c7f15ecb0cf97854994.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
539162b8cb67fedd37b9a100ee4726f29e247b4508e38c7f15ecb0cf97854994.exe
-
Size
88KB
-
MD5
6cfc779b04fce1fdd01d26f556ce007b
-
SHA1
42cf6538f8ba94392183890f98041d23674c3caa
-
SHA256
539162b8cb67fedd37b9a100ee4726f29e247b4508e38c7f15ecb0cf97854994
-
SHA512
382ec0b9cf8623a806e54e5008d610d7dd7b87182783ac7674e62a0b5a281531b15c11f148959c50af14f4044ec799469abc2be522c937cfb59ed027fa1a98d4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDISoFGDvPGB1haZJK:ymb3NkkiQ3mdBjFIk7+czK
Malware Config
Signatures
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral2/memory/4580-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/684-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/840-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4376-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/812-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-319-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-357-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-360-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-370-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/936-385-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 51 IoCs
resource yara_rule behavioral2/memory/4580-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4580-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/468-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3180-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4824-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2828-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3152-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1684-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1684-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/972-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2940-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3852-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1480-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3068-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1524-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/684-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2980-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4700-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2156-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3732-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4232-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/232-167-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4148-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4148-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/840-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3660-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4988-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4376-216-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/812-221-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/812-223-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2244-231-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3648-234-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3648-237-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5064-241-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4536-247-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3708-259-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3436-265-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4824-272-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4264-274-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4264-278-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2624-288-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4328-290-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4760-301-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1848-313-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3976-319-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1316-323-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4316-357-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1020-360-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3732-365-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3964-370-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/936-385-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 468 hbtbhn.exe 3180 fxrlrrx.exe 4824 nnhbnn.exe 2828 lxrfxrl.exe 3152 nbbtnb.exe 1684 hbtnhh.exe 3220 1rrfrlx.exe 972 htnhbt.exe 2940 lrlxrfl.exe 3852 pdvpp.exe 1480 xfxrlfx.exe 3068 vjjdp.exe 1524 xrxrxrf.exe 684 bhhhbt.exe 2980 jpjpj.exe 4700 tbbnhb.exe 3212 rrrrxfr.exe 2156 5tbnhb.exe 3732 5ddvj.exe 4232 httnhb.exe 1460 fllfxrl.exe 4456 pdjpv.exe 232 lllxllf.exe 4148 nhbtnh.exe 840 9lfrfxr.exe 3660 7vvpd.exe 5060 5bhhbh.exe 4988 rlxllfl.exe 4400 thbbtn.exe 4376 pdpjj.exe 812 1flxxrr.exe 2244 vvpjv.exe 3648 3bhttt.exe 5064 rrrlxrl.exe 4536 tnbtnh.exe 3568 pjjvv.exe 3708 hhtnhh.exe 368 hhntht.exe 3436 rlxfrrr.exe 4824 rfxxlxr.exe 4264 3vdvd.exe 3240 hbtntn.exe 2624 dddvj.exe 4328 3ttbtn.exe 5024 5xrfrll.exe 4760 3hbnhb.exe 1052 1lfrllf.exe 1848 ttnbtn.exe 3208 9lffrll.exe 3976 djpjv.exe 1316 ntnthh.exe 2572 1ddpp.exe 3320 lfxrfxr.exe 4996 9tbnhh.exe 2620 3pvpd.exe 4964 bnnhbt.exe 4872 9vppv.exe 4316 1ffrfxx.exe 1020 nhhbtt.exe 3732 rfrlfff.exe 3964 rxrlfxr.exe 1008 djjjd.exe 680 tnnnnb.exe 936 9rrllll.exe -
resource yara_rule behavioral2/memory/4580-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3180-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/684-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/840-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4376-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/812-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/812-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1848-313-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-319-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-323-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-357-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-360-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-365-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-370-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/936-385-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4580 wrote to memory of 468 4580 539162b8cb67fedd37b9a100ee4726f29e247b4508e38c7f15ecb0cf97854994.exe 87 PID 4580 wrote to memory of 468 4580 539162b8cb67fedd37b9a100ee4726f29e247b4508e38c7f15ecb0cf97854994.exe 87 PID 4580 wrote to memory of 468 4580 539162b8cb67fedd37b9a100ee4726f29e247b4508e38c7f15ecb0cf97854994.exe 87 PID 468 wrote to memory of 3180 468 hbtbhn.exe 88 PID 468 wrote to memory of 3180 468 hbtbhn.exe 88 PID 468 wrote to memory of 3180 468 hbtbhn.exe 88 PID 3180 wrote to memory of 4824 3180 fxrlrrx.exe 89 PID 3180 wrote to memory of 4824 3180 fxrlrrx.exe 89 PID 3180 wrote to memory of 4824 3180 fxrlrrx.exe 89 PID 4824 wrote to memory of 2828 4824 nnhbnn.exe 90 PID 4824 wrote to memory of 2828 4824 nnhbnn.exe 90 PID 4824 wrote to memory of 2828 4824 nnhbnn.exe 90 PID 2828 wrote to memory of 3152 2828 lxrfxrl.exe 91 PID 2828 wrote to memory of 3152 2828 lxrfxrl.exe 91 PID 2828 wrote to memory of 3152 2828 lxrfxrl.exe 91 PID 3152 wrote to memory of 1684 3152 nbbtnb.exe 92 PID 3152 wrote to memory of 1684 3152 nbbtnb.exe 92 PID 3152 wrote to memory of 1684 3152 nbbtnb.exe 92 PID 1684 wrote to memory of 3220 1684 hbtnhh.exe 93 PID 1684 wrote to memory of 3220 1684 hbtnhh.exe 93 PID 1684 wrote to memory of 3220 1684 hbtnhh.exe 93 PID 3220 wrote to memory of 972 3220 1rrfrlx.exe 94 PID 3220 wrote to memory of 972 3220 1rrfrlx.exe 94 PID 3220 wrote to memory of 972 3220 1rrfrlx.exe 94 PID 972 wrote to memory of 2940 972 htnhbt.exe 95 PID 972 wrote to memory of 2940 972 htnhbt.exe 95 PID 972 wrote to memory of 2940 972 htnhbt.exe 95 PID 2940 wrote to memory of 3852 2940 lrlxrfl.exe 96 PID 2940 wrote to memory of 3852 2940 lrlxrfl.exe 96 PID 2940 wrote to memory of 3852 2940 lrlxrfl.exe 96 PID 3852 wrote to memory of 1480 3852 pdvpp.exe 97 PID 3852 wrote to memory of 1480 3852 pdvpp.exe 97 PID 3852 wrote to memory of 1480 3852 pdvpp.exe 97 PID 1480 wrote to memory of 3068 1480 xfxrlfx.exe 98 PID 1480 wrote to memory of 3068 1480 xfxrlfx.exe 98 PID 1480 wrote to memory of 3068 1480 xfxrlfx.exe 98 PID 3068 wrote to memory of 1524 3068 vjjdp.exe 99 PID 3068 wrote to memory of 1524 3068 vjjdp.exe 99 PID 3068 wrote to memory of 1524 3068 vjjdp.exe 99 PID 1524 wrote to memory of 684 1524 xrxrxrf.exe 100 PID 1524 wrote to memory of 684 1524 xrxrxrf.exe 100 PID 1524 wrote to memory of 684 1524 xrxrxrf.exe 100 PID 684 wrote to memory of 2980 684 bhhhbt.exe 102 PID 684 wrote to memory of 2980 684 bhhhbt.exe 102 PID 684 wrote to memory of 2980 684 bhhhbt.exe 102 PID 2980 wrote to memory of 4700 2980 jpjpj.exe 103 PID 2980 wrote to memory of 4700 2980 jpjpj.exe 103 PID 2980 wrote to memory of 4700 2980 jpjpj.exe 103 PID 4700 wrote to memory of 3212 4700 tbbnhb.exe 104 PID 4700 wrote to memory of 3212 4700 tbbnhb.exe 104 PID 4700 wrote to memory of 3212 4700 tbbnhb.exe 104 PID 3212 wrote to memory of 2156 3212 rrrrxfr.exe 105 PID 3212 wrote to memory of 2156 3212 rrrrxfr.exe 105 PID 3212 wrote to memory of 2156 3212 rrrrxfr.exe 105 PID 2156 wrote to memory of 3732 2156 5tbnhb.exe 106 PID 2156 wrote to memory of 3732 2156 5tbnhb.exe 106 PID 2156 wrote to memory of 3732 2156 5tbnhb.exe 106 PID 3732 wrote to memory of 4232 3732 5ddvj.exe 107 PID 3732 wrote to memory of 4232 3732 5ddvj.exe 107 PID 3732 wrote to memory of 4232 3732 5ddvj.exe 107 PID 4232 wrote to memory of 1460 4232 httnhb.exe 108 PID 4232 wrote to memory of 1460 4232 httnhb.exe 108 PID 4232 wrote to memory of 1460 4232 httnhb.exe 108 PID 1460 wrote to memory of 4456 1460 fllfxrl.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\539162b8cb67fedd37b9a100ee4726f29e247b4508e38c7f15ecb0cf97854994.exe"C:\Users\Admin\AppData\Local\Temp\539162b8cb67fedd37b9a100ee4726f29e247b4508e38c7f15ecb0cf97854994.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\hbtbhn.exec:\hbtbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\fxrlrrx.exec:\fxrlrrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\nnhbnn.exec:\nnhbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\lxrfxrl.exec:\lxrfxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\nbbtnb.exec:\nbbtnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\hbtnhh.exec:\hbtnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\1rrfrlx.exec:\1rrfrlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\htnhbt.exec:\htnhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\lrlxrfl.exec:\lrlxrfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\pdvpp.exec:\pdvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\xfxrlfx.exec:\xfxrlfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\vjjdp.exec:\vjjdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\xrxrxrf.exec:\xrxrxrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\bhhhbt.exec:\bhhhbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\jpjpj.exec:\jpjpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\tbbnhb.exec:\tbbnhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\rrrrxfr.exec:\rrrrxfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\5tbnhb.exec:\5tbnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\5ddvj.exec:\5ddvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\httnhb.exec:\httnhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\fllfxrl.exec:\fllfxrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\pdjpv.exec:\pdjpv.exe23⤵
- Executes dropped EXE
PID:4456 -
\??\c:\lllxllf.exec:\lllxllf.exe24⤵
- Executes dropped EXE
PID:232 -
\??\c:\nhbtnh.exec:\nhbtnh.exe25⤵
- Executes dropped EXE
PID:4148 -
\??\c:\9lfrfxr.exec:\9lfrfxr.exe26⤵
- Executes dropped EXE
PID:840 -
\??\c:\7vvpd.exec:\7vvpd.exe27⤵
- Executes dropped EXE
PID:3660 -
\??\c:\5bhhbh.exec:\5bhhbh.exe28⤵
- Executes dropped EXE
PID:5060 -
\??\c:\rlxllfl.exec:\rlxllfl.exe29⤵
- Executes dropped EXE
PID:4988 -
\??\c:\thbbtn.exec:\thbbtn.exe30⤵
- Executes dropped EXE
PID:4400 -
\??\c:\pdpjj.exec:\pdpjj.exe31⤵
- Executes dropped EXE
PID:4376 -
\??\c:\1flxxrr.exec:\1flxxrr.exe32⤵
- Executes dropped EXE
PID:812 -
\??\c:\vvpjv.exec:\vvpjv.exe33⤵
- Executes dropped EXE
PID:2244 -
\??\c:\3bhttt.exec:\3bhttt.exe34⤵
- Executes dropped EXE
PID:3648 -
\??\c:\rrrlxrl.exec:\rrrlxrl.exe35⤵
- Executes dropped EXE
PID:5064 -
\??\c:\tnbtnh.exec:\tnbtnh.exe36⤵
- Executes dropped EXE
PID:4536 -
\??\c:\pjjvv.exec:\pjjvv.exe37⤵
- Executes dropped EXE
PID:3568 -
\??\c:\hhtnhh.exec:\hhtnhh.exe38⤵
- Executes dropped EXE
PID:3708 -
\??\c:\hhntht.exec:\hhntht.exe39⤵
- Executes dropped EXE
PID:368 -
\??\c:\rlxfrrr.exec:\rlxfrrr.exe40⤵
- Executes dropped EXE
PID:3436 -
\??\c:\rfxxlxr.exec:\rfxxlxr.exe41⤵
- Executes dropped EXE
PID:4824 -
\??\c:\3vdvd.exec:\3vdvd.exe42⤵
- Executes dropped EXE
PID:4264 -
\??\c:\hbtntn.exec:\hbtntn.exe43⤵
- Executes dropped EXE
PID:3240 -
\??\c:\dddvj.exec:\dddvj.exe44⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3ttbtn.exec:\3ttbtn.exe45⤵
- Executes dropped EXE
PID:4328 -
\??\c:\5xrfrll.exec:\5xrfrll.exe46⤵
- Executes dropped EXE
PID:5024 -
\??\c:\3hbnhb.exec:\3hbnhb.exe47⤵
- Executes dropped EXE
PID:4760 -
\??\c:\1lfrllf.exec:\1lfrllf.exe48⤵
- Executes dropped EXE
PID:1052 -
\??\c:\ttnbtn.exec:\ttnbtn.exe49⤵
- Executes dropped EXE
PID:1848 -
\??\c:\9lffrll.exec:\9lffrll.exe50⤵
- Executes dropped EXE
PID:3208 -
\??\c:\djpjv.exec:\djpjv.exe51⤵
- Executes dropped EXE
PID:3976 -
\??\c:\ntnthh.exec:\ntnthh.exe52⤵
- Executes dropped EXE
PID:1316 -
\??\c:\1ddpp.exec:\1ddpp.exe53⤵
- Executes dropped EXE
PID:2572 -
\??\c:\lfxrfxr.exec:\lfxrfxr.exe54⤵
- Executes dropped EXE
PID:3320 -
\??\c:\9tbnhh.exec:\9tbnhh.exe55⤵
- Executes dropped EXE
PID:4996 -
\??\c:\3pvpd.exec:\3pvpd.exe56⤵
- Executes dropped EXE
PID:2620 -
\??\c:\bnnhbt.exec:\bnnhbt.exe57⤵
- Executes dropped EXE
PID:4964 -
\??\c:\9vppv.exec:\9vppv.exe58⤵
- Executes dropped EXE
PID:4872 -
\??\c:\1ffrfxx.exec:\1ffrfxx.exe59⤵
- Executes dropped EXE
PID:4316 -
\??\c:\nhhbtt.exec:\nhhbtt.exe60⤵
- Executes dropped EXE
PID:1020 -
\??\c:\rfrlfff.exec:\rfrlfff.exe61⤵
- Executes dropped EXE
PID:3732 -
\??\c:\rxrlfxr.exec:\rxrlfxr.exe62⤵
- Executes dropped EXE
PID:3964 -
\??\c:\djjjd.exec:\djjjd.exe63⤵
- Executes dropped EXE
PID:1008 -
\??\c:\tnnnnb.exec:\tnnnnb.exe64⤵
- Executes dropped EXE
PID:680 -
\??\c:\9rrllll.exec:\9rrllll.exe65⤵
- Executes dropped EXE
PID:936 -
\??\c:\hhttnt.exec:\hhttnt.exe66⤵PID:3704
-
\??\c:\pdvjv.exec:\pdvjv.exe67⤵PID:632
-
\??\c:\9fxlfxf.exec:\9fxlfxf.exe68⤵PID:388
-
\??\c:\hbtbbn.exec:\hbtbbn.exe69⤵PID:4680
-
\??\c:\frfrlfx.exec:\frfrlfx.exe70⤵PID:1728
-
\??\c:\9xrlxrr.exec:\9xrlxrr.exe71⤵PID:452
-
\??\c:\vpdvj.exec:\vpdvj.exe72⤵PID:836
-
\??\c:\fllxlfr.exec:\fllxlfr.exe73⤵PID:2556
-
\??\c:\1bnhbt.exec:\1bnhbt.exe74⤵PID:1908
-
\??\c:\jjjvj.exec:\jjjvj.exe75⤵PID:2244
-
\??\c:\lrxrflf.exec:\lrxrflf.exe76⤵PID:3368
-
\??\c:\tbnhtt.exec:\tbnhtt.exe77⤵PID:920
-
\??\c:\btnntb.exec:\btnntb.exe78⤵PID:2128
-
\??\c:\xrxrlxl.exec:\xrxrlxl.exe79⤵PID:4536
-
\??\c:\1ppdv.exec:\1ppdv.exe80⤵PID:516
-
\??\c:\rlfxlff.exec:\rlfxlff.exe81⤵PID:644
-
\??\c:\jdjdp.exec:\jdjdp.exe82⤵PID:1700
-
\??\c:\bthntb.exec:\bthntb.exe83⤵PID:4948
-
\??\c:\bbnhnn.exec:\bbnhnn.exe84⤵PID:3048
-
\??\c:\llxllxl.exec:\llxllxl.exe85⤵PID:1916
-
\??\c:\btnhbt.exec:\btnhbt.exe86⤵PID:3176
-
\??\c:\jvpdp.exec:\jvpdp.exe87⤵PID:5000
-
\??\c:\1bbbnn.exec:\1bbbnn.exe88⤵PID:3480
-
\??\c:\pjpjj.exec:\pjpjj.exe89⤵PID:1060
-
\??\c:\1bbnbt.exec:\1bbnbt.exe90⤵PID:2748
-
\??\c:\djvdj.exec:\djvdj.exe91⤵PID:2664
-
\??\c:\bhhbtn.exec:\bhhbtn.exe92⤵PID:1352
-
\??\c:\7vvpv.exec:\7vvpv.exe93⤵PID:3228
-
\??\c:\btthbb.exec:\btthbb.exe94⤵PID:1376
-
\??\c:\3jjdv.exec:\3jjdv.exe95⤵PID:3428
-
\??\c:\lxfxlfx.exec:\lxfxlfx.exe96⤵PID:2028
-
\??\c:\bnnhbt.exec:\bnnhbt.exe97⤵PID:2620
-
\??\c:\fxrlrrl.exec:\fxrlrrl.exe98⤵PID:4240
-
\??\c:\thbbtn.exec:\thbbtn.exe99⤵PID:4012
-
\??\c:\pjppd.exec:\pjppd.exe100⤵PID:3004
-
\??\c:\fxxrllf.exec:\fxxrllf.exe101⤵PID:940
-
\??\c:\3tnnbh.exec:\3tnnbh.exe102⤵PID:4992
-
\??\c:\lrrlxrr.exec:\lrrlxrr.exe103⤵PID:3904
-
\??\c:\hbthbb.exec:\hbthbb.exe104⤵PID:1856
-
\??\c:\3pvpj.exec:\3pvpj.exe105⤵PID:680
-
\??\c:\htbtnn.exec:\htbtnn.exe106⤵PID:936
-
\??\c:\ppdvp.exec:\ppdvp.exe107⤵PID:924
-
\??\c:\xfrrlxf.exec:\xfrrlxf.exe108⤵PID:632
-
\??\c:\7tnhbb.exec:\7tnhbb.exe109⤵PID:2768
-
\??\c:\dpvvv.exec:\dpvvv.exe110⤵PID:4680
-
\??\c:\rxfxxxx.exec:\rxfxxxx.exe111⤵PID:4544
-
\??\c:\hbbthb.exec:\hbbthb.exe112⤵PID:2348
-
\??\c:\pdvpd.exec:\pdvpd.exe113⤵PID:1752
-
\??\c:\tnhthb.exec:\tnhthb.exe114⤵PID:4792
-
\??\c:\djpjd.exec:\djpjd.exe115⤵PID:4800
-
\??\c:\flfxffr.exec:\flfxffr.exe116⤵PID:540
-
\??\c:\7jjdp.exec:\7jjdp.exe117⤵PID:3368
-
\??\c:\rrfxxrr.exec:\rrfxxrr.exe118⤵PID:3664
-
\??\c:\jvvpp.exec:\jvvpp.exe119⤵PID:4396
-
\??\c:\1llxlfl.exec:\1llxlfl.exe120⤵PID:1032
-
\??\c:\pddvp.exec:\pddvp.exe121⤵PID:3084
-
\??\c:\9rfflfx.exec:\9rfflfx.exe122⤵PID:3276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-