Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05-04-2024 18:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01ab3add131dcb76eeb991c1ee58f7dcb420f7651cdb744d3d1a13825c0d9c44.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
01ab3add131dcb76eeb991c1ee58f7dcb420f7651cdb744d3d1a13825c0d9c44.exe
-
Size
369KB
-
MD5
a5df87d81d31410c4fa5c2cda646e219
-
SHA1
7787e88d3dfb1a348138a4eab76d886ffea69ed2
-
SHA256
01ab3add131dcb76eeb991c1ee58f7dcb420f7651cdb744d3d1a13825c0d9c44
-
SHA512
f0007142d1ccef4224dea5c3921d040e3a3612e47f41282afc39c6b0c3251e70f2286781f5fd87eedd4ce9828109bf5ec678c67c0d242c88c24bc897c0386e36
-
SSDEEP
6144:n3C9BRIG0asYFm71mJl3/X8mak5gNv9rC8IwLaYNUvtTxTKMM8:n3C9uYA7i3/stR9HGYyvtTxTKM/
Malware Config
Signatures
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral2/memory/1504-2-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3192-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/564-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-138-0x0000000000470000-0x000000000047C000-memory.dmp family_blackmoon behavioral2/memory/2216-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3140-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1740-351-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/700-372-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-376-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-381-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-383-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-390-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-394-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-416-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/928-420-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 50 IoCs
resource yara_rule behavioral2/memory/1504-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2976-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3744-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3744-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4724-29-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4440-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2740-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4708-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4708-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3192-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3192-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1148-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/564-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2144-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4836-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4964-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2208-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4032-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5036-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2216-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1056-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4592-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1452-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2692-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2692-181-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3308-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3548-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2620-216-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3488-229-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4404-239-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/232-248-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4868-253-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3748-271-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4608-280-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3140-289-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2212-303-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3960-308-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3152-317-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4960-334-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3592-340-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1740-351-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/700-372-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1680-376-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1680-381-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2028-383-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4492-390-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4160-394-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/656-405-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4120-416-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/928-420-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2976 xlfxrlf.exe 3744 llxrlxl.exe 4724 bbhbht.exe 4440 vjjjj.exe 2740 dvpjj.exe 4708 bnhntn.exe 3192 rffxrrl.exe 2648 lxfrllf.exe 1148 nnhbtt.exe 564 xfxxrff.exe 2144 pjpjd.exe 3180 nbbtnt.exe 4836 thhbbb.exe 3996 dvvpd.exe 4964 nbnhhn.exe 2208 lllfllf.exe 4032 pdjdj.exe 2244 hbhbhb.exe 5036 xlfxxxf.exe 2216 tbntnb.exe 1056 7rfxxxr.exe 4592 vdjdd.exe 4484 nnnbtn.exe 1452 dvdvj.exe 2692 rxlfxxr.exe 1252 rxxlxrl.exe 3308 9vvpd.exe 3548 xrlrlrl.exe 2192 7frlrxf.exe 2620 1jddv.exe 2892 htthbn.exe 3488 lxrfxlf.exe 2840 vdvpp.exe 4404 xlrlfff.exe 1036 9tnbtn.exe 232 3llfxxr.exe 4868 vvjjd.exe 4420 lffrfrl.exe 424 5bbnbt.exe 3636 lfrfrfl.exe 3748 ttbnbt.exe 2032 llfrlfr.exe 4608 3vvpj.exe 3736 rlflxrl.exe 3140 dvjdp.exe 1844 7lxfxrl.exe 3728 nbhthb.exe 2212 1llfrlf.exe 3960 5vdpp.exe 3992 rrxlrlr.exe 3152 jjjdv.exe 1040 ffrlfxr.exe 4688 djpjj.exe 4136 1nbthh.exe 4960 7dpvj.exe 3592 hntthh.exe 4964 xllxrlf.exe 1740 9hhbnh.exe 5032 jppdj.exe 3776 nnnhbh.exe 4312 lxfxxrr.exe 1632 vppjd.exe 700 7rflfxr.exe 1680 bttnnh.exe -
resource yara_rule behavioral2/memory/1504-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3192-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/564-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3548-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-317-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-334-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-351-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/700-372-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-376-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-381-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-383-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-390-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-394-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/656-405-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-416-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/928-420-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1504 wrote to memory of 2976 1504 01ab3add131dcb76eeb991c1ee58f7dcb420f7651cdb744d3d1a13825c0d9c44.exe 86 PID 1504 wrote to memory of 2976 1504 01ab3add131dcb76eeb991c1ee58f7dcb420f7651cdb744d3d1a13825c0d9c44.exe 86 PID 1504 wrote to memory of 2976 1504 01ab3add131dcb76eeb991c1ee58f7dcb420f7651cdb744d3d1a13825c0d9c44.exe 86 PID 2976 wrote to memory of 3744 2976 xlfxrlf.exe 88 PID 2976 wrote to memory of 3744 2976 xlfxrlf.exe 88 PID 2976 wrote to memory of 3744 2976 xlfxrlf.exe 88 PID 3744 wrote to memory of 4724 3744 llxrlxl.exe 89 PID 3744 wrote to memory of 4724 3744 llxrlxl.exe 89 PID 3744 wrote to memory of 4724 3744 llxrlxl.exe 89 PID 4724 wrote to memory of 4440 4724 bbhbht.exe 90 PID 4724 wrote to memory of 4440 4724 bbhbht.exe 90 PID 4724 wrote to memory of 4440 4724 bbhbht.exe 90 PID 4440 wrote to memory of 2740 4440 vjjjj.exe 91 PID 4440 wrote to memory of 2740 4440 vjjjj.exe 91 PID 4440 wrote to memory of 2740 4440 vjjjj.exe 91 PID 2740 wrote to memory of 4708 2740 dvpjj.exe 92 PID 2740 wrote to memory of 4708 2740 dvpjj.exe 92 PID 2740 wrote to memory of 4708 2740 dvpjj.exe 92 PID 4708 wrote to memory of 3192 4708 bnhntn.exe 93 PID 4708 wrote to memory of 3192 4708 bnhntn.exe 93 PID 4708 wrote to memory of 3192 4708 bnhntn.exe 93 PID 3192 wrote to memory of 2648 3192 rffxrrl.exe 94 PID 3192 wrote to memory of 2648 3192 rffxrrl.exe 94 PID 3192 wrote to memory of 2648 3192 rffxrrl.exe 94 PID 2648 wrote to memory of 1148 2648 lxfrllf.exe 96 PID 2648 wrote to memory of 1148 2648 lxfrllf.exe 96 PID 2648 wrote to memory of 1148 2648 lxfrllf.exe 96 PID 1148 wrote to memory of 564 1148 nnhbtt.exe 97 PID 1148 wrote to memory of 564 1148 nnhbtt.exe 97 PID 1148 wrote to memory of 564 1148 nnhbtt.exe 97 PID 564 wrote to memory of 2144 564 xfxxrff.exe 98 PID 564 wrote to memory of 2144 564 xfxxrff.exe 98 PID 564 wrote to memory of 2144 564 xfxxrff.exe 98 PID 2144 wrote to memory of 3180 2144 pjpjd.exe 99 PID 2144 wrote to memory of 3180 2144 pjpjd.exe 99 PID 2144 wrote to memory of 3180 2144 pjpjd.exe 99 PID 3180 wrote to memory of 4836 3180 nbbtnt.exe 100 PID 3180 wrote to memory of 4836 3180 nbbtnt.exe 100 PID 3180 wrote to memory of 4836 3180 nbbtnt.exe 100 PID 4836 wrote to memory of 3996 4836 thhbbb.exe 101 PID 4836 wrote to memory of 3996 4836 thhbbb.exe 101 PID 4836 wrote to memory of 3996 4836 thhbbb.exe 101 PID 3996 wrote to memory of 4964 3996 dvvpd.exe 102 PID 3996 wrote to memory of 4964 3996 dvvpd.exe 102 PID 3996 wrote to memory of 4964 3996 dvvpd.exe 102 PID 4964 wrote to memory of 2208 4964 nbnhhn.exe 104 PID 4964 wrote to memory of 2208 4964 nbnhhn.exe 104 PID 4964 wrote to memory of 2208 4964 nbnhhn.exe 104 PID 2208 wrote to memory of 4032 2208 lllfllf.exe 105 PID 2208 wrote to memory of 4032 2208 lllfllf.exe 105 PID 2208 wrote to memory of 4032 2208 lllfllf.exe 105 PID 4032 wrote to memory of 2244 4032 pdjdj.exe 106 PID 4032 wrote to memory of 2244 4032 pdjdj.exe 106 PID 4032 wrote to memory of 2244 4032 pdjdj.exe 106 PID 2244 wrote to memory of 5036 2244 hbhbhb.exe 107 PID 2244 wrote to memory of 5036 2244 hbhbhb.exe 107 PID 2244 wrote to memory of 5036 2244 hbhbhb.exe 107 PID 5036 wrote to memory of 2216 5036 xlfxxxf.exe 108 PID 5036 wrote to memory of 2216 5036 xlfxxxf.exe 108 PID 5036 wrote to memory of 2216 5036 xlfxxxf.exe 108 PID 2216 wrote to memory of 1056 2216 tbntnb.exe 109 PID 2216 wrote to memory of 1056 2216 tbntnb.exe 109 PID 2216 wrote to memory of 1056 2216 tbntnb.exe 109 PID 1056 wrote to memory of 4592 1056 7rfxxxr.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\01ab3add131dcb76eeb991c1ee58f7dcb420f7651cdb744d3d1a13825c0d9c44.exe"C:\Users\Admin\AppData\Local\Temp\01ab3add131dcb76eeb991c1ee58f7dcb420f7651cdb744d3d1a13825c0d9c44.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\xlfxrlf.exec:\xlfxrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\llxrlxl.exec:\llxrlxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\bbhbht.exec:\bbhbht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\vjjjj.exec:\vjjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\dvpjj.exec:\dvpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\bnhntn.exec:\bnhntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\rffxrrl.exec:\rffxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\lxfrllf.exec:\lxfrllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\nnhbtt.exec:\nnhbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\xfxxrff.exec:\xfxxrff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\pjpjd.exec:\pjpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\nbbtnt.exec:\nbbtnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\thhbbb.exec:\thhbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\dvvpd.exec:\dvvpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\nbnhhn.exec:\nbnhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\lllfllf.exec:\lllfllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\pdjdj.exec:\pdjdj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\hbhbhb.exec:\hbhbhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\xlfxxxf.exec:\xlfxxxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\tbntnb.exec:\tbntnb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\7rfxxxr.exec:\7rfxxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\vdjdd.exec:\vdjdd.exe23⤵
- Executes dropped EXE
PID:4592 -
\??\c:\nnnbtn.exec:\nnnbtn.exe24⤵
- Executes dropped EXE
PID:4484 -
\??\c:\dvdvj.exec:\dvdvj.exe25⤵
- Executes dropped EXE
PID:1452 -
\??\c:\rxlfxxr.exec:\rxlfxxr.exe26⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rxxlxrl.exec:\rxxlxrl.exe27⤵
- Executes dropped EXE
PID:1252 -
\??\c:\9vvpd.exec:\9vvpd.exe28⤵
- Executes dropped EXE
PID:3308 -
\??\c:\xrlrlrl.exec:\xrlrlrl.exe29⤵
- Executes dropped EXE
PID:3548 -
\??\c:\7frlrxf.exec:\7frlrxf.exe30⤵
- Executes dropped EXE
PID:2192 -
\??\c:\1jddv.exec:\1jddv.exe31⤵
- Executes dropped EXE
PID:2620 -
\??\c:\htthbn.exec:\htthbn.exe32⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lxrfxlf.exec:\lxrfxlf.exe33⤵
- Executes dropped EXE
PID:3488 -
\??\c:\vdvpp.exec:\vdvpp.exe34⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xlrlfff.exec:\xlrlfff.exe35⤵
- Executes dropped EXE
PID:4404 -
\??\c:\9tnbtn.exec:\9tnbtn.exe36⤵
- Executes dropped EXE
PID:1036 -
\??\c:\3llfxxr.exec:\3llfxxr.exe37⤵
- Executes dropped EXE
PID:232 -
\??\c:\vvjjd.exec:\vvjjd.exe38⤵
- Executes dropped EXE
PID:4868 -
\??\c:\lffrfrl.exec:\lffrfrl.exe39⤵
- Executes dropped EXE
PID:4420 -
\??\c:\5bbnbt.exec:\5bbnbt.exe40⤵
- Executes dropped EXE
PID:424 -
\??\c:\lfrfrfl.exec:\lfrfrfl.exe41⤵
- Executes dropped EXE
PID:3636 -
\??\c:\ttbnbt.exec:\ttbnbt.exe42⤵
- Executes dropped EXE
PID:3748 -
\??\c:\llfrlfr.exec:\llfrlfr.exe43⤵
- Executes dropped EXE
PID:2032 -
\??\c:\3vvpj.exec:\3vvpj.exe44⤵
- Executes dropped EXE
PID:4608 -
\??\c:\rlflxrl.exec:\rlflxrl.exe45⤵
- Executes dropped EXE
PID:3736 -
\??\c:\dvjdp.exec:\dvjdp.exe46⤵
- Executes dropped EXE
PID:3140 -
\??\c:\7lxfxrl.exec:\7lxfxrl.exe47⤵
- Executes dropped EXE
PID:1844 -
\??\c:\nbhthb.exec:\nbhthb.exe48⤵
- Executes dropped EXE
PID:3728 -
\??\c:\1llfrlf.exec:\1llfrlf.exe49⤵
- Executes dropped EXE
PID:2212 -
\??\c:\5vdpp.exec:\5vdpp.exe50⤵
- Executes dropped EXE
PID:3960 -
\??\c:\rrxlrlr.exec:\rrxlrlr.exe51⤵
- Executes dropped EXE
PID:3992 -
\??\c:\jjjdv.exec:\jjjdv.exe52⤵
- Executes dropped EXE
PID:3152 -
\??\c:\ffrlfxr.exec:\ffrlfxr.exe53⤵
- Executes dropped EXE
PID:1040 -
\??\c:\djpjj.exec:\djpjj.exe54⤵
- Executes dropped EXE
PID:4688 -
\??\c:\1nbthh.exec:\1nbthh.exe55⤵
- Executes dropped EXE
PID:4136 -
\??\c:\7dpvj.exec:\7dpvj.exe56⤵
- Executes dropped EXE
PID:4960 -
\??\c:\hntthh.exec:\hntthh.exe57⤵
- Executes dropped EXE
PID:3592 -
\??\c:\xllxrlf.exec:\xllxrlf.exe58⤵
- Executes dropped EXE
PID:4964 -
\??\c:\9hhbnh.exec:\9hhbnh.exe59⤵
- Executes dropped EXE
PID:1740 -
\??\c:\jppdj.exec:\jppdj.exe60⤵
- Executes dropped EXE
PID:5032 -
\??\c:\nnnhbh.exec:\nnnhbh.exe61⤵
- Executes dropped EXE
PID:3776 -
\??\c:\lxfxxrr.exec:\lxfxxrr.exe62⤵
- Executes dropped EXE
PID:4312 -
\??\c:\vppjd.exec:\vppjd.exe63⤵
- Executes dropped EXE
PID:1632 -
\??\c:\7rflfxr.exec:\7rflfxr.exe64⤵
- Executes dropped EXE
PID:700 -
\??\c:\bttnnh.exec:\bttnnh.exe65⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nhbtnb.exec:\nhbtnb.exe66⤵PID:2028
-
\??\c:\dvpjd.exec:\dvpjd.exe67⤵PID:4492
-
\??\c:\xxrlfxr.exec:\xxrlfxr.exe68⤵PID:4160
-
\??\c:\vjvjd.exec:\vjvjd.exe69⤵PID:4696
-
\??\c:\nnhthb.exec:\nnhthb.exe70⤵PID:4744
-
\??\c:\vjdpd.exec:\vjdpd.exe71⤵PID:656
-
\??\c:\xrlxrlx.exec:\xrlxrlx.exe72⤵PID:4296
-
\??\c:\7ffxrxr.exec:\7ffxrxr.exe73⤵PID:4120
-
\??\c:\htnhtn.exec:\htnhtn.exe74⤵PID:928
-
\??\c:\pjjvd.exec:\pjjvd.exe75⤵PID:2620
-
\??\c:\thhhtn.exec:\thhhtn.exe76⤵PID:2408
-
\??\c:\dvdpd.exec:\dvdpd.exe77⤵PID:3496
-
\??\c:\bhnhbt.exec:\bhnhbt.exe78⤵PID:4756
-
\??\c:\9lffrlf.exec:\9lffrlf.exe79⤵PID:1600
-
\??\c:\btthbt.exec:\btthbt.exe80⤵PID:2876
-
\??\c:\jjppv.exec:\jjppv.exe81⤵PID:1036
-
\??\c:\bbnnhb.exec:\bbnnhb.exe82⤵PID:1748
-
\??\c:\1ddvp.exec:\1ddvp.exe83⤵PID:1636
-
\??\c:\tnbhtt.exec:\tnbhtt.exe84⤵PID:424
-
\??\c:\xfllffx.exec:\xfllffx.exe85⤵PID:2880
-
\??\c:\bbbtnh.exec:\bbbtnh.exe86⤵PID:640
-
\??\c:\5nhbhb.exec:\5nhbhb.exe87⤵PID:1960
-
\??\c:\5vpdv.exec:\5vpdv.exe88⤵PID:568
-
\??\c:\fxllfxx.exec:\fxllfxx.exe89⤵PID:1496
-
\??\c:\pppdp.exec:\pppdp.exe90⤵PID:4288
-
\??\c:\5xfrflx.exec:\5xfrflx.exe91⤵PID:4996
-
\??\c:\pdvjd.exec:\pdvjd.exe92⤵PID:4864
-
\??\c:\flfxflr.exec:\flfxflr.exe93⤵PID:1956
-
\??\c:\vjjjv.exec:\vjjjv.exe94⤵PID:4860
-
\??\c:\fxxrrlr.exec:\fxxrrlr.exe95⤵PID:2844
-
\??\c:\1hnhbt.exec:\1hnhbt.exe96⤵PID:4136
-
\??\c:\9jjvj.exec:\9jjvj.exe97⤵PID:1692
-
\??\c:\rlffxxx.exec:\rlffxxx.exe98⤵PID:2264
-
\??\c:\nbnhhb.exec:\nbnhhb.exe99⤵PID:1848
-
\??\c:\jpvpv.exec:\jpvpv.exe100⤵PID:400
-
\??\c:\ffrrxfl.exec:\ffrrxfl.exe101⤵PID:1604
-
\??\c:\ttbthb.exec:\ttbthb.exe102⤵PID:1132
-
\??\c:\xrlfrlf.exec:\xrlfrlf.exe103⤵PID:8
-
\??\c:\htnhtt.exec:\htnhtt.exe104⤵PID:4376
-
\??\c:\rffxxrl.exec:\rffxxrl.exe105⤵PID:724
-
\??\c:\nhbnbt.exec:\nhbnbt.exe106⤵PID:2724
-
\??\c:\fxxlffr.exec:\fxxlffr.exe107⤵PID:3540
-
\??\c:\7tbnhn.exec:\7tbnhn.exe108⤵PID:1880
-
\??\c:\lrxrfxr.exec:\lrxrfxr.exe109⤵PID:1444
-
\??\c:\hbbnnn.exec:\hbbnnn.exe110⤵PID:4696
-
\??\c:\lfxxrlf.exec:\lfxxrlf.exe111⤵PID:3988
-
\??\c:\nhttnh.exec:\nhttnh.exe112⤵PID:3548
-
\??\c:\frrfrrf.exec:\frrfrrf.exe113⤵PID:3712
-
\??\c:\nbbtnn.exec:\nbbtnn.exe114⤵PID:692
-
\??\c:\pddvp.exec:\pddvp.exe115⤵PID:4172
-
\??\c:\fxxxrxr.exec:\fxxxrxr.exe116⤵PID:2176
-
\??\c:\dpvvv.exec:\dpvvv.exe117⤵PID:4324
-
\??\c:\rxfxrll.exec:\rxfxrll.exe118⤵PID:2840
-
\??\c:\bbnhhh.exec:\bbnhhh.exe119⤵PID:4404
-
\??\c:\3pjvj.exec:\3pjvj.exe120⤵PID:3752
-
\??\c:\rrlfffx.exec:\rrlfffx.exe121⤵PID:2876
-
\??\c:\vvvvp.exec:\vvvvp.exe122⤵PID:1036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-