Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23-04-2024 03:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c94558fc9b456fb8a6f057330df2bed318c146e6f9ebbd0df3191fba2392400a.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
c94558fc9b456fb8a6f057330df2bed318c146e6f9ebbd0df3191fba2392400a.exe
-
Size
392KB
-
MD5
e7121e435e9361c18d3dad4ba5fe2012
-
SHA1
8b938a61c2db3ba905f351c207c0ae7f238c940d
-
SHA256
c94558fc9b456fb8a6f057330df2bed318c146e6f9ebbd0df3191fba2392400a
-
SHA512
6b4a2edc78dc26cf56a168017587d08ba6d5b4f7445d5aced015eb7502cfbf2e7526f69c83aa7dc6765a1e7ff465397ea969ff1a28c0fbd06d52c270dda7bb5a
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwO1:n3C9uYA7okVqdKwaO5CV7
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
resource yara_rule behavioral1/memory/2616-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2200-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1360-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/108-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/652-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2104-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1224-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1288-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/752-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1444-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-346-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-370-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-401-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-417-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-425-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1880-433-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/452-533-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-541-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-579-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 51 IoCs
resource yara_rule behavioral1/memory/2616-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2128-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2704-23-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2836-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2476-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2436-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2192-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2200-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2692-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1360-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/796-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/108-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1688-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2532-161-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2856-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2856-173-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/652-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2104-220-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2104-222-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1224-232-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1224-234-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1288-244-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/752-255-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2252-272-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1444-310-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1444-312-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2616-330-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2848-338-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2576-346-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2748-354-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2608-369-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2608-370-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2996-385-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2536-401-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2908-416-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2908-417-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2820-425-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1880-433-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2148-448-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2688-463-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/844-478-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/588-516-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/652-524-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/452-533-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1904-541-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1920-556-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/764-571-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3004-579-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2872-594-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2264-602-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2636-632-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2128 jvddd.exe 2704 1nbbnt.exe 2096 frrlrlr.exe 2836 dpvdp.exe 2476 rfxxlrx.exe 2436 7vpvv.exe 2192 9hbhnh.exe 2200 lfflrlr.exe 2692 btnbnb.exe 2772 fxlxffr.exe 1360 5jdpp.exe 796 rlxxlff.exe 108 dpjjj.exe 1268 bthhnt.exe 1688 lfxrrrf.exe 2532 tbhhhn.exe 2856 rxlllll.exe 540 rfrflll.exe 300 5dvvd.exe 652 hththh.exe 2308 llrrrrr.exe 2104 9pdjj.exe 1224 lfffflr.exe 1288 vjvpp.exe 752 tnbbhh.exe 3004 lfflrlr.exe 2252 jdjdj.exe 2328 frxrrlx.exe 2304 pdjdp.exe 344 bnhhnn.exe 1444 lrfffff.exe 1544 dddvj.exe 2616 thhbbt.exe 2848 xxlrlxf.exe 2576 5bthnn.exe 2748 frflfxf.exe 2812 pdjjp.exe 2608 bnbntn.exe 2468 7jjdj.exe 2996 nhttbb.exe 1892 1rfrrll.exe 2536 ththtt.exe 2620 xlfxrxf.exe 2908 hbnbhn.exe 2820 3xxxrrr.exe 1880 bbbnnt.exe 1480 3dddv.exe 2148 ffrxffx.exe 1436 hbhhnn.exe 2688 fxrxflx.exe 2228 1vvvd.exe 844 tnhhnb.exe 2532 3pvdd.exe 788 9lfflrf.exe 1152 pjvdj.exe 2964 fxrfrrf.exe 588 dvpvd.exe 652 fxxxflf.exe 452 bhhbnt.exe 1904 lrlxlrl.exe 1476 hbnntb.exe 1920 nnnnnt.exe 500 vpvvp.exe 764 7bhhtb.exe -
resource yara_rule behavioral1/memory/2616-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2436-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1360-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/796-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/108-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1688-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/652-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1224-232-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1224-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1288-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/752-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-310-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1444-312-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-346-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-354-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-370-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-385-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-401-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-416-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-417-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-425-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1880-433-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-448-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2688-463-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-478-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/588-516-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/652-524-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/452-533-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-541-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-556-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-571-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-579-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-594-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-602-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-632-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2616 wrote to memory of 2128 2616 c94558fc9b456fb8a6f057330df2bed318c146e6f9ebbd0df3191fba2392400a.exe 28 PID 2616 wrote to memory of 2128 2616 c94558fc9b456fb8a6f057330df2bed318c146e6f9ebbd0df3191fba2392400a.exe 28 PID 2616 wrote to memory of 2128 2616 c94558fc9b456fb8a6f057330df2bed318c146e6f9ebbd0df3191fba2392400a.exe 28 PID 2616 wrote to memory of 2128 2616 c94558fc9b456fb8a6f057330df2bed318c146e6f9ebbd0df3191fba2392400a.exe 28 PID 2128 wrote to memory of 2704 2128 jvddd.exe 29 PID 2128 wrote to memory of 2704 2128 jvddd.exe 29 PID 2128 wrote to memory of 2704 2128 jvddd.exe 29 PID 2128 wrote to memory of 2704 2128 jvddd.exe 29 PID 2704 wrote to memory of 2096 2704 1nbbnt.exe 30 PID 2704 wrote to memory of 2096 2704 1nbbnt.exe 30 PID 2704 wrote to memory of 2096 2704 1nbbnt.exe 30 PID 2704 wrote to memory of 2096 2704 1nbbnt.exe 30 PID 2096 wrote to memory of 2836 2096 frrlrlr.exe 31 PID 2096 wrote to memory of 2836 2096 frrlrlr.exe 31 PID 2096 wrote to memory of 2836 2096 frrlrlr.exe 31 PID 2096 wrote to memory of 2836 2096 frrlrlr.exe 31 PID 2836 wrote to memory of 2476 2836 dpvdp.exe 32 PID 2836 wrote to memory of 2476 2836 dpvdp.exe 32 PID 2836 wrote to memory of 2476 2836 dpvdp.exe 32 PID 2836 wrote to memory of 2476 2836 dpvdp.exe 32 PID 2476 wrote to memory of 2436 2476 rfxxlrx.exe 33 PID 2476 wrote to memory of 2436 2476 rfxxlrx.exe 33 PID 2476 wrote to memory of 2436 2476 rfxxlrx.exe 33 PID 2476 wrote to memory of 2436 2476 rfxxlrx.exe 33 PID 2436 wrote to memory of 2192 2436 7vpvv.exe 34 PID 2436 wrote to memory of 2192 2436 7vpvv.exe 34 PID 2436 wrote to memory of 2192 2436 7vpvv.exe 34 PID 2436 wrote to memory of 2192 2436 7vpvv.exe 34 PID 2192 wrote to memory of 2200 2192 9hbhnh.exe 35 PID 2192 wrote to memory of 2200 2192 9hbhnh.exe 35 PID 2192 wrote to memory of 2200 2192 9hbhnh.exe 35 PID 2192 wrote to memory of 2200 2192 9hbhnh.exe 35 PID 2200 wrote to memory of 2692 2200 lfflrlr.exe 36 PID 2200 wrote to memory of 2692 2200 lfflrlr.exe 36 PID 2200 wrote to memory of 2692 2200 lfflrlr.exe 36 PID 2200 wrote to memory of 2692 2200 lfflrlr.exe 36 PID 2692 wrote to memory of 2772 2692 btnbnb.exe 37 PID 2692 wrote to memory of 2772 2692 btnbnb.exe 37 PID 2692 wrote to memory of 2772 2692 btnbnb.exe 37 PID 2692 wrote to memory of 2772 2692 btnbnb.exe 37 PID 2772 wrote to memory of 1360 2772 fxlxffr.exe 38 PID 2772 wrote to memory of 1360 2772 fxlxffr.exe 38 PID 2772 wrote to memory of 1360 2772 fxlxffr.exe 38 PID 2772 wrote to memory of 1360 2772 fxlxffr.exe 38 PID 1360 wrote to memory of 796 1360 5jdpp.exe 39 PID 1360 wrote to memory of 796 1360 5jdpp.exe 39 PID 1360 wrote to memory of 796 1360 5jdpp.exe 39 PID 1360 wrote to memory of 796 1360 5jdpp.exe 39 PID 796 wrote to memory of 108 796 rlxxlff.exe 40 PID 796 wrote to memory of 108 796 rlxxlff.exe 40 PID 796 wrote to memory of 108 796 rlxxlff.exe 40 PID 796 wrote to memory of 108 796 rlxxlff.exe 40 PID 108 wrote to memory of 1268 108 dpjjj.exe 41 PID 108 wrote to memory of 1268 108 dpjjj.exe 41 PID 108 wrote to memory of 1268 108 dpjjj.exe 41 PID 108 wrote to memory of 1268 108 dpjjj.exe 41 PID 1268 wrote to memory of 1688 1268 bthhnt.exe 42 PID 1268 wrote to memory of 1688 1268 bthhnt.exe 42 PID 1268 wrote to memory of 1688 1268 bthhnt.exe 42 PID 1268 wrote to memory of 1688 1268 bthhnt.exe 42 PID 1688 wrote to memory of 2532 1688 lfxrrrf.exe 43 PID 1688 wrote to memory of 2532 1688 lfxrrrf.exe 43 PID 1688 wrote to memory of 2532 1688 lfxrrrf.exe 43 PID 1688 wrote to memory of 2532 1688 lfxrrrf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\c94558fc9b456fb8a6f057330df2bed318c146e6f9ebbd0df3191fba2392400a.exe"C:\Users\Admin\AppData\Local\Temp\c94558fc9b456fb8a6f057330df2bed318c146e6f9ebbd0df3191fba2392400a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\jvddd.exec:\jvddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\1nbbnt.exec:\1nbbnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\frrlrlr.exec:\frrlrlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\dpvdp.exec:\dpvdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\rfxxlrx.exec:\rfxxlrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\7vpvv.exec:\7vpvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\9hbhnh.exec:\9hbhnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\lfflrlr.exec:\lfflrlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\btnbnb.exec:\btnbnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\fxlxffr.exec:\fxlxffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\5jdpp.exec:\5jdpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\rlxxlff.exec:\rlxxlff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\dpjjj.exec:\dpjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
\??\c:\bthhnt.exec:\bthhnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\lfxrrrf.exec:\lfxrrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\tbhhhn.exec:\tbhhhn.exe17⤵
- Executes dropped EXE
PID:2532 -
\??\c:\rxlllll.exec:\rxlllll.exe18⤵
- Executes dropped EXE
PID:2856 -
\??\c:\rfrflll.exec:\rfrflll.exe19⤵
- Executes dropped EXE
PID:540 -
\??\c:\5dvvd.exec:\5dvvd.exe20⤵
- Executes dropped EXE
PID:300 -
\??\c:\hththh.exec:\hththh.exe21⤵
- Executes dropped EXE
PID:652 -
\??\c:\llrrrrr.exec:\llrrrrr.exe22⤵
- Executes dropped EXE
PID:2308 -
\??\c:\9pdjj.exec:\9pdjj.exe23⤵
- Executes dropped EXE
PID:2104 -
\??\c:\lfffflr.exec:\lfffflr.exe24⤵
- Executes dropped EXE
PID:1224 -
\??\c:\vjvpp.exec:\vjvpp.exe25⤵
- Executes dropped EXE
PID:1288 -
\??\c:\tnbbhh.exec:\tnbbhh.exe26⤵
- Executes dropped EXE
PID:752 -
\??\c:\lfflrlr.exec:\lfflrlr.exe27⤵
- Executes dropped EXE
PID:3004 -
\??\c:\jdjdj.exec:\jdjdj.exe28⤵
- Executes dropped EXE
PID:2252 -
\??\c:\frxrrlx.exec:\frxrrlx.exe29⤵
- Executes dropped EXE
PID:2328 -
\??\c:\pdjdp.exec:\pdjdp.exe30⤵
- Executes dropped EXE
PID:2304 -
\??\c:\bnhhnn.exec:\bnhhnn.exe31⤵
- Executes dropped EXE
PID:344 -
\??\c:\lrfffff.exec:\lrfffff.exe32⤵
- Executes dropped EXE
PID:1444 -
\??\c:\dddvj.exec:\dddvj.exe33⤵
- Executes dropped EXE
PID:1544 -
\??\c:\thhbbt.exec:\thhbbt.exe34⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xxlrlxf.exec:\xxlrlxf.exe35⤵
- Executes dropped EXE
PID:2848 -
\??\c:\5bthnn.exec:\5bthnn.exe36⤵
- Executes dropped EXE
PID:2576 -
\??\c:\frflfxf.exec:\frflfxf.exe37⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pdjjp.exec:\pdjjp.exe38⤵
- Executes dropped EXE
PID:2812 -
\??\c:\bnbntn.exec:\bnbntn.exe39⤵
- Executes dropped EXE
PID:2608 -
\??\c:\7jjdj.exec:\7jjdj.exe40⤵
- Executes dropped EXE
PID:2468 -
\??\c:\nhttbb.exec:\nhttbb.exe41⤵
- Executes dropped EXE
PID:2996 -
\??\c:\1rfrrll.exec:\1rfrrll.exe42⤵
- Executes dropped EXE
PID:1892 -
\??\c:\ththtt.exec:\ththtt.exe43⤵
- Executes dropped EXE
PID:2536 -
\??\c:\xlfxrxf.exec:\xlfxrxf.exe44⤵
- Executes dropped EXE
PID:2620 -
\??\c:\hbnbhn.exec:\hbnbhn.exe45⤵
- Executes dropped EXE
PID:2908 -
\??\c:\3xxxrrr.exec:\3xxxrrr.exe46⤵
- Executes dropped EXE
PID:2820 -
\??\c:\bbbnnt.exec:\bbbnnt.exe47⤵
- Executes dropped EXE
PID:1880 -
\??\c:\3dddv.exec:\3dddv.exe48⤵
- Executes dropped EXE
PID:1480 -
\??\c:\ffrxffx.exec:\ffrxffx.exe49⤵
- Executes dropped EXE
PID:2148 -
\??\c:\hbhhnn.exec:\hbhhnn.exe50⤵
- Executes dropped EXE
PID:1436 -
\??\c:\fxrxflx.exec:\fxrxflx.exe51⤵
- Executes dropped EXE
PID:2688 -
\??\c:\1vvvd.exec:\1vvvd.exe52⤵
- Executes dropped EXE
PID:2228 -
\??\c:\tnhhnb.exec:\tnhhnb.exe53⤵
- Executes dropped EXE
PID:844 -
\??\c:\3pvdd.exec:\3pvdd.exe54⤵
- Executes dropped EXE
PID:2532 -
\??\c:\9lfflrf.exec:\9lfflrf.exe55⤵
- Executes dropped EXE
PID:788 -
\??\c:\pjvdj.exec:\pjvdj.exe56⤵
- Executes dropped EXE
PID:1152 -
\??\c:\fxrfrrf.exec:\fxrfrrf.exe57⤵
- Executes dropped EXE
PID:2964 -
\??\c:\dvpvd.exec:\dvpvd.exe58⤵
- Executes dropped EXE
PID:588 -
\??\c:\fxxxflf.exec:\fxxxflf.exe59⤵
- Executes dropped EXE
PID:652 -
\??\c:\bhhbnt.exec:\bhhbnt.exe60⤵
- Executes dropped EXE
PID:452 -
\??\c:\lrlxlrl.exec:\lrlxlrl.exe61⤵
- Executes dropped EXE
PID:1904 -
\??\c:\hbnntb.exec:\hbnntb.exe62⤵
- Executes dropped EXE
PID:1476 -
\??\c:\nnnnnt.exec:\nnnnnt.exe63⤵
- Executes dropped EXE
PID:1920 -
\??\c:\vpvvp.exec:\vpvvp.exe64⤵
- Executes dropped EXE
PID:500 -
\??\c:\7bhhtb.exec:\7bhhtb.exe65⤵
- Executes dropped EXE
PID:764 -
\??\c:\jpdpv.exec:\jpdpv.exe66⤵PID:3004
-
\??\c:\xxflrxr.exec:\xxflrxr.exe67⤵PID:1896
-
\??\c:\hbttnn.exec:\hbttnn.exe68⤵PID:2872
-
\??\c:\5bhbnn.exec:\5bhbnn.exe69⤵PID:2264
-
\??\c:\fllrxfl.exec:\fllrxfl.exe70⤵PID:2304
-
\??\c:\dddjp.exec:\dddjp.exe71⤵PID:2520
-
\??\c:\lfllllx.exec:\lfllllx.exe72⤵PID:1540
-
\??\c:\hnnttn.exec:\hnnttn.exe73⤵PID:2636
-
\??\c:\1pjjj.exec:\1pjjj.exe74⤵PID:3028
-
\??\c:\ttbhhh.exec:\ttbhhh.exe75⤵PID:2712
-
\??\c:\fxxfxlr.exec:\fxxfxlr.exe76⤵PID:3048
-
\??\c:\nhnnnh.exec:\nhnnnh.exe77⤵PID:2780
-
\??\c:\xrlffxx.exec:\xrlffxx.exe78⤵PID:2836
-
\??\c:\dpdjj.exec:\dpdjj.exe79⤵PID:2548
-
\??\c:\9xllfff.exec:\9xllfff.exe80⤵PID:2932
-
\??\c:\5nnttb.exec:\5nnttb.exe81⤵PID:2500
-
\??\c:\xrllrxl.exec:\xrllrxl.exe82⤵PID:2940
-
\??\c:\hhhntt.exec:\hhhntt.exe83⤵PID:1632
-
\??\c:\vvdjj.exec:\vvdjj.exe84⤵PID:2624
-
\??\c:\1bbnbt.exec:\1bbnbt.exe85⤵PID:2924
-
\??\c:\llflfrl.exec:\llflfrl.exe86⤵PID:1196
-
\??\c:\bnbntb.exec:\bnbntb.exe87⤵PID:2772
-
\??\c:\1rffrlr.exec:\1rffrlr.exe88⤵PID:1460
-
\??\c:\nhttbb.exec:\nhttbb.exe89⤵PID:1576
-
\??\c:\lfrrxlr.exec:\lfrrxlr.exe90⤵PID:2140
-
\??\c:\1pjpv.exec:\1pjpv.exe91⤵PID:1216
-
\??\c:\3dvvj.exec:\3dvvj.exe92⤵PID:2504
-
\??\c:\9rllrxx.exec:\9rllrxx.exe93⤵PID:624
-
\??\c:\dvpvv.exec:\dvpvv.exe94⤵PID:2044
-
\??\c:\btnttt.exec:\btnttt.exe95⤵PID:876
-
\??\c:\pvvjv.exec:\pvvjv.exe96⤵PID:540
-
\??\c:\lfffxfr.exec:\lfffxfr.exe97⤵PID:1080
-
\??\c:\jvpjj.exec:\jvpjj.exe98⤵PID:1748
-
\??\c:\frffffl.exec:\frffffl.exe99⤵PID:564
-
\??\c:\bbttbh.exec:\bbttbh.exe100⤵PID:652
-
\??\c:\rlxxlrl.exec:\rlxxlrl.exe101⤵PID:452
-
\??\c:\httthn.exec:\httthn.exe102⤵PID:1048
-
\??\c:\3jppp.exec:\3jppp.exe103⤵PID:2056
-
\??\c:\1rfflrf.exec:\1rfflrf.exe104⤵PID:896
-
\??\c:\jdjpp.exec:\jdjpp.exe105⤵PID:320
-
\??\c:\lrlxffx.exec:\lrlxffx.exe106⤵PID:1044
-
\??\c:\3bhhnh.exec:\3bhhnh.exe107⤵PID:2144
-
\??\c:\5xrrrrf.exec:\5xrrrrf.exe108⤵PID:1040
-
\??\c:\nbtnnn.exec:\nbtnnn.exe109⤵PID:1512
-
\??\c:\lxlflfr.exec:\lxlflfr.exe110⤵PID:2328
-
\??\c:\9fxrxfl.exec:\9fxrxfl.exe111⤵PID:1776
-
\??\c:\9nntth.exec:\9nntth.exe112⤵PID:2824
-
\??\c:\fxrrrxl.exec:\fxrrrxl.exe113⤵PID:2232
-
\??\c:\nbnbtn.exec:\nbnbtn.exe114⤵PID:1948
-
\??\c:\fxxxrrf.exec:\fxxxrrf.exe115⤵PID:2724
-
\??\c:\3htbbh.exec:\3htbbh.exe116⤵PID:2588
-
\??\c:\dvpjp.exec:\dvpjp.exe117⤵PID:2444
-
\??\c:\btnntt.exec:\btnntt.exe118⤵PID:2572
-
\??\c:\1hnnnt.exec:\1hnnnt.exe119⤵PID:2484
-
\??\c:\xlfllfl.exec:\xlfllfl.exe120⤵PID:2448
-
\??\c:\htnnbt.exec:\htnnbt.exe121⤵PID:2512
-
\??\c:\3fllfff.exec:\3fllfff.exe122⤵PID:2944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-