Analysis
-
max time kernel
133s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24/04/2024, 22:04
Behavioral task
behavioral1
Sample
59eeaa94dcf1db8714f8104f95555a75c2cf637afeadc672a175d6dc1f109f2d.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
59eeaa94dcf1db8714f8104f95555a75c2cf637afeadc672a175d6dc1f109f2d.exe
-
Size
334KB
-
MD5
7bfd88cb4731f1b3992c4a2eadf45fb0
-
SHA1
a5d35beb2c34b37bc72666d15550927cddb81cf0
-
SHA256
59eeaa94dcf1db8714f8104f95555a75c2cf637afeadc672a175d6dc1f109f2d
-
SHA512
ffc31d7b28dc65740d203008459bd21cddd698061e2c7037e7d36ec34a6ba780a88bdd5909851504f86c56effda6502c47955cbdbf0d80354e4d827851ca156f
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1i/U:x4wFHoS3eFaKHpv/VycgE8oU
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1856-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1688-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2036-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1780-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-65-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2492-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-85-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2540-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-123-0x0000000001B80000-0x0000000001BA7000-memory.dmp family_blackmoon behavioral1/memory/2780-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-171-0x0000000001B80000-0x0000000001BA7000-memory.dmp family_blackmoon behavioral1/memory/2960-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-191-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2416-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/592-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/848-219-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/708-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1840-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-264-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/600-276-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2960-285-0x00000000003D0000-0x00000000003F7000-memory.dmp family_blackmoon behavioral1/memory/2104-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-318-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1732-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-368-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2112-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-421-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 61 IoCs
resource yara_rule behavioral1/memory/1856-18-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000900000001447e-7.dat UPX behavioral1/memory/1688-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0009000000014539-16.dat UPX behavioral1/memory/2036-14-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1780-28-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00090000000149f5-25.dat UPX behavioral1/memory/1688-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000014b70-34.dat UPX behavioral1/memory/2620-46-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000a000000014de9-44.dat UPX behavioral1/files/0x0009000000014ef8-54.dat UPX behavioral1/memory/1648-56-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0009000000015018-63.dat UPX behavioral1/memory/2492-67-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2580-75-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00090000000155ed-73.dat UPX behavioral1/memory/2540-86-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00070000000155f7-92.dat UPX behavioral1/memory/2264-95-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00070000000155f3-82.dat UPX behavioral1/files/0x0007000000015605-103.dat UPX behavioral1/files/0x0006000000015616-111.dat UPX behavioral1/memory/2732-114-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015626-119.dat UPX behavioral1/memory/2780-129-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015b6f-131.dat UPX behavioral1/files/0x0006000000015c3d-139.dat UPX behavioral1/memory/2932-153-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015c52-150.dat UPX behavioral1/files/0x0006000000015c6b-158.dat UPX behavioral1/files/0x0006000000015c78-168.dat UPX behavioral1/files/0x0006000000015c83-179.dat UPX behavioral1/files/0x0008000000014abe-188.dat UPX behavioral1/memory/2960-192-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2416-182-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015c9f-199.dat UPX behavioral1/files/0x0006000000015cb6-208.dat UPX behavioral1/memory/592-202-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cce-217.dat UPX behavioral1/memory/708-221-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cee-227.dat UPX behavioral1/files/0x0006000000015cf6-233.dat UPX behavioral1/memory/1840-238-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cfe-244.dat UPX behavioral1/memory/1644-247-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015d07-253.dat UPX behavioral1/memory/1988-256-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015d0f-263.dat UPX behavioral1/files/0x0006000000015d1a-273.dat UPX behavioral1/files/0x0006000000015d27-283.dat UPX behavioral1/files/0x0006000000015d31-292.dat UPX behavioral1/files/0x0006000000015d98-301.dat UPX behavioral1/memory/2104-303-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2412-309-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2220-322-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2080-324-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1732-340-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2992-348-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1648-362-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2112-388-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2036 llflfrf.exe 1856 llfrfrf.exe 1780 bbbtht.exe 2656 xxrlflr.exe 2620 5btnbh.exe 1648 frffffr.exe 2492 jpdvd.exe 2580 xlrrxxx.exe 2540 bbttnb.exe 2264 7pjvj.exe 2700 ttnthb.exe 2732 rfllxfl.exe 2780 bnbhbn.exe 2180 vjvvv.exe 2884 xlffllr.exe 2932 7pvvd.exe 896 nhbhtt.exe 2324 vjddd.exe 2416 rlfrfff.exe 2960 3vjjp.exe 592 xlrrfrl.exe 848 djpjv.exe 708 rrlrfrl.exe 2088 5httnn.exe 1840 ffrrfrx.exe 1644 hhbbhn.exe 1988 pvvpp.exe 600 tnnnbn.exe 3016 nnhbht.exe 2232 5rfllxx.exe 1776 lrfxfxr.exe 2104 dvjvp.exe 2412 rrfflrx.exe 2220 lrllxlr.exe 2080 ddvpd.exe 2676 fxxrflf.exe 1732 rrlxflr.exe 2992 hhbhtt.exe 2628 flrflxx.exe 1648 tnhtth.exe 2952 btthnb.exe 1832 vppdp.exe 2488 xxlrllf.exe 2112 hbbhbn.exe 2536 5ntnbb.exe 2868 dppvp.exe 2724 tnhnth.exe 2788 jdjdd.exe 2892 xxlxrxr.exe 2728 thtttt.exe 776 ppvvp.exe 2896 llrrxrl.exe 2736 7fxfrxf.exe 1796 5bhthn.exe 1372 dpppj.exe 1900 flllxrf.exe 2224 xrrrrrx.exe 2996 pjpvj.exe 324 btnbnb.exe 564 pjjpv.exe 592 ddpvd.exe 844 ntnnhn.exe 2096 bttnbn.exe 1816 5jdvj.exe -
resource yara_rule behavioral1/memory/1856-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001447e-7.dat upx behavioral1/memory/1688-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000014539-16.dat upx behavioral1/memory/2036-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1780-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000149f5-25.dat upx behavioral1/memory/1688-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014b70-34.dat upx behavioral1/memory/2656-38-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2620-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000014de9-44.dat upx behavioral1/memory/2620-52-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0009000000014ef8-54.dat upx behavioral1/memory/1648-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015018-63.dat upx behavioral1/memory/2492-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2580-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000155ed-73.dat upx behavioral1/memory/2540-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000155f7-92.dat upx behavioral1/memory/2264-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000155f3-82.dat upx behavioral1/files/0x0007000000015605-103.dat upx behavioral1/files/0x0006000000015616-111.dat upx behavioral1/memory/2732-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015626-119.dat upx behavioral1/memory/2780-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015b6f-131.dat upx behavioral1/files/0x0006000000015c3d-139.dat upx behavioral1/memory/2932-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c52-150.dat upx behavioral1/files/0x0006000000015c6b-158.dat upx behavioral1/files/0x0006000000015c78-168.dat upx behavioral1/files/0x0006000000015c83-179.dat upx behavioral1/files/0x0008000000014abe-188.dat upx behavioral1/memory/2960-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2416-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c9f-199.dat upx behavioral1/files/0x0006000000015cb6-208.dat upx behavioral1/memory/592-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cce-217.dat upx behavioral1/memory/708-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cee-227.dat upx behavioral1/files/0x0006000000015cf6-233.dat upx behavioral1/memory/1840-238-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cfe-244.dat upx behavioral1/memory/1644-247-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d07-253.dat upx behavioral1/memory/1988-256-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d0f-263.dat upx behavioral1/files/0x0006000000015d1a-273.dat upx behavioral1/files/0x0006000000015d27-283.dat upx behavioral1/files/0x0006000000015d31-292.dat upx behavioral1/files/0x0006000000015d98-301.dat upx behavioral1/memory/2104-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2412-309-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2220-322-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2080-324-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1732-340-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2992-348-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1648-362-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2112-388-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2036 1688 59eeaa94dcf1db8714f8104f95555a75c2cf637afeadc672a175d6dc1f109f2d.exe 28 PID 1688 wrote to memory of 2036 1688 59eeaa94dcf1db8714f8104f95555a75c2cf637afeadc672a175d6dc1f109f2d.exe 28 PID 1688 wrote to memory of 2036 1688 59eeaa94dcf1db8714f8104f95555a75c2cf637afeadc672a175d6dc1f109f2d.exe 28 PID 1688 wrote to memory of 2036 1688 59eeaa94dcf1db8714f8104f95555a75c2cf637afeadc672a175d6dc1f109f2d.exe 28 PID 2036 wrote to memory of 1856 2036 llflfrf.exe 29 PID 2036 wrote to memory of 1856 2036 llflfrf.exe 29 PID 2036 wrote to memory of 1856 2036 llflfrf.exe 29 PID 2036 wrote to memory of 1856 2036 llflfrf.exe 29 PID 1856 wrote to memory of 1780 1856 llfrfrf.exe 30 PID 1856 wrote to memory of 1780 1856 llfrfrf.exe 30 PID 1856 wrote to memory of 1780 1856 llfrfrf.exe 30 PID 1856 wrote to memory of 1780 1856 llfrfrf.exe 30 PID 1780 wrote to memory of 2656 1780 bbbtht.exe 31 PID 1780 wrote to memory of 2656 1780 bbbtht.exe 31 PID 1780 wrote to memory of 2656 1780 bbbtht.exe 31 PID 1780 wrote to memory of 2656 1780 bbbtht.exe 31 PID 2656 wrote to memory of 2620 2656 xxrlflr.exe 32 PID 2656 wrote to memory of 2620 2656 xxrlflr.exe 32 PID 2656 wrote to memory of 2620 2656 xxrlflr.exe 32 PID 2656 wrote to memory of 2620 2656 xxrlflr.exe 32 PID 2620 wrote to memory of 1648 2620 5btnbh.exe 33 PID 2620 wrote to memory of 1648 2620 5btnbh.exe 33 PID 2620 wrote to memory of 1648 2620 5btnbh.exe 33 PID 2620 wrote to memory of 1648 2620 5btnbh.exe 33 PID 1648 wrote to memory of 2492 1648 frffffr.exe 34 PID 1648 wrote to memory of 2492 1648 frffffr.exe 34 PID 1648 wrote to memory of 2492 1648 frffffr.exe 34 PID 1648 wrote to memory of 2492 1648 frffffr.exe 34 PID 2492 wrote to memory of 2580 2492 jpdvd.exe 35 PID 2492 wrote to memory of 2580 2492 jpdvd.exe 35 PID 2492 wrote to memory of 2580 2492 jpdvd.exe 35 PID 2492 wrote to memory of 2580 2492 jpdvd.exe 35 PID 2580 wrote to memory of 2540 2580 xlrrxxx.exe 36 PID 2580 wrote to memory of 2540 2580 xlrrxxx.exe 36 PID 2580 wrote to memory of 2540 2580 xlrrxxx.exe 36 PID 2580 wrote to memory of 2540 2580 xlrrxxx.exe 36 PID 2540 wrote to memory of 2264 2540 bbttnb.exe 37 PID 2540 wrote to memory of 2264 2540 bbttnb.exe 37 PID 2540 wrote to memory of 2264 2540 bbttnb.exe 37 PID 2540 wrote to memory of 2264 2540 bbttnb.exe 37 PID 2264 wrote to memory of 2700 2264 7pjvj.exe 38 PID 2264 wrote to memory of 2700 2264 7pjvj.exe 38 PID 2264 wrote to memory of 2700 2264 7pjvj.exe 38 PID 2264 wrote to memory of 2700 2264 7pjvj.exe 38 PID 2700 wrote to memory of 2732 2700 ttnthb.exe 39 PID 2700 wrote to memory of 2732 2700 ttnthb.exe 39 PID 2700 wrote to memory of 2732 2700 ttnthb.exe 39 PID 2700 wrote to memory of 2732 2700 ttnthb.exe 39 PID 2732 wrote to memory of 2780 2732 rfllxfl.exe 40 PID 2732 wrote to memory of 2780 2732 rfllxfl.exe 40 PID 2732 wrote to memory of 2780 2732 rfllxfl.exe 40 PID 2732 wrote to memory of 2780 2732 rfllxfl.exe 40 PID 2780 wrote to memory of 2180 2780 bnbhbn.exe 41 PID 2780 wrote to memory of 2180 2780 bnbhbn.exe 41 PID 2780 wrote to memory of 2180 2780 bnbhbn.exe 41 PID 2780 wrote to memory of 2180 2780 bnbhbn.exe 41 PID 2180 wrote to memory of 2884 2180 vjvvv.exe 42 PID 2180 wrote to memory of 2884 2180 vjvvv.exe 42 PID 2180 wrote to memory of 2884 2180 vjvvv.exe 42 PID 2180 wrote to memory of 2884 2180 vjvvv.exe 42 PID 2884 wrote to memory of 2932 2884 xlffllr.exe 43 PID 2884 wrote to memory of 2932 2884 xlffllr.exe 43 PID 2884 wrote to memory of 2932 2884 xlffllr.exe 43 PID 2884 wrote to memory of 2932 2884 xlffllr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\59eeaa94dcf1db8714f8104f95555a75c2cf637afeadc672a175d6dc1f109f2d.exe"C:\Users\Admin\AppData\Local\Temp\59eeaa94dcf1db8714f8104f95555a75c2cf637afeadc672a175d6dc1f109f2d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\llflfrf.exec:\llflfrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\llfrfrf.exec:\llfrfrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\bbbtht.exec:\bbbtht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\xxrlflr.exec:\xxrlflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\5btnbh.exec:\5btnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\frffffr.exec:\frffffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\jpdvd.exec:\jpdvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\xlrrxxx.exec:\xlrrxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\bbttnb.exec:\bbttnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\7pjvj.exec:\7pjvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\ttnthb.exec:\ttnthb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\rfllxfl.exec:\rfllxfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\bnbhbn.exec:\bnbhbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vjvvv.exec:\vjvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\xlffllr.exec:\xlffllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\7pvvd.exec:\7pvvd.exe17⤵
- Executes dropped EXE
PID:2932 -
\??\c:\nhbhtt.exec:\nhbhtt.exe18⤵
- Executes dropped EXE
PID:896 -
\??\c:\vjddd.exec:\vjddd.exe19⤵
- Executes dropped EXE
PID:2324 -
\??\c:\rlfrfff.exec:\rlfrfff.exe20⤵
- Executes dropped EXE
PID:2416 -
\??\c:\3vjjp.exec:\3vjjp.exe21⤵
- Executes dropped EXE
PID:2960 -
\??\c:\xlrrfrl.exec:\xlrrfrl.exe22⤵
- Executes dropped EXE
PID:592 -
\??\c:\djpjv.exec:\djpjv.exe23⤵
- Executes dropped EXE
PID:848 -
\??\c:\rrlrfrl.exec:\rrlrfrl.exe24⤵
- Executes dropped EXE
PID:708 -
\??\c:\5httnn.exec:\5httnn.exe25⤵
- Executes dropped EXE
PID:2088 -
\??\c:\ffrrfrx.exec:\ffrrfrx.exe26⤵
- Executes dropped EXE
PID:1840 -
\??\c:\hhbbhn.exec:\hhbbhn.exe27⤵
- Executes dropped EXE
PID:1644 -
\??\c:\pvvpp.exec:\pvvpp.exe28⤵
- Executes dropped EXE
PID:1988 -
\??\c:\tnnnbn.exec:\tnnnbn.exe29⤵
- Executes dropped EXE
PID:600 -
\??\c:\nnhbht.exec:\nnhbht.exe30⤵
- Executes dropped EXE
PID:3016 -
\??\c:\5rfllxx.exec:\5rfllxx.exe31⤵
- Executes dropped EXE
PID:2232 -
\??\c:\lrfxfxr.exec:\lrfxfxr.exe32⤵
- Executes dropped EXE
PID:1776 -
\??\c:\dvjvp.exec:\dvjvp.exe33⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rrfflrx.exec:\rrfflrx.exe34⤵
- Executes dropped EXE
PID:2412 -
\??\c:\lrllxlr.exec:\lrllxlr.exe35⤵
- Executes dropped EXE
PID:2220 -
\??\c:\ddvpd.exec:\ddvpd.exe36⤵
- Executes dropped EXE
PID:2080 -
\??\c:\fxxrflf.exec:\fxxrflf.exe37⤵
- Executes dropped EXE
PID:2676 -
\??\c:\rrlxflr.exec:\rrlxflr.exe38⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hhbhtt.exec:\hhbhtt.exe39⤵
- Executes dropped EXE
PID:2992 -
\??\c:\flrflxx.exec:\flrflxx.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\tnhtth.exec:\tnhtth.exe41⤵
- Executes dropped EXE
PID:1648 -
\??\c:\btthnb.exec:\btthnb.exe42⤵
- Executes dropped EXE
PID:2952 -
\??\c:\vppdp.exec:\vppdp.exe43⤵
- Executes dropped EXE
PID:1832 -
\??\c:\xxlrllf.exec:\xxlrllf.exe44⤵
- Executes dropped EXE
PID:2488 -
\??\c:\hbbhbn.exec:\hbbhbn.exe45⤵
- Executes dropped EXE
PID:2112 -
\??\c:\5ntnbb.exec:\5ntnbb.exe46⤵
- Executes dropped EXE
PID:2536 -
\??\c:\dppvp.exec:\dppvp.exe47⤵
- Executes dropped EXE
PID:2868 -
\??\c:\tnhnth.exec:\tnhnth.exe48⤵
- Executes dropped EXE
PID:2724 -
\??\c:\jdjdd.exec:\jdjdd.exe49⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xxlxrxr.exec:\xxlxrxr.exe50⤵
- Executes dropped EXE
PID:2892 -
\??\c:\thtttt.exec:\thtttt.exe51⤵
- Executes dropped EXE
PID:2728 -
\??\c:\ppvvp.exec:\ppvvp.exe52⤵
- Executes dropped EXE
PID:776 -
\??\c:\llrrxrl.exec:\llrrxrl.exe53⤵
- Executes dropped EXE
PID:2896 -
\??\c:\7fxfrxf.exec:\7fxfrxf.exe54⤵
- Executes dropped EXE
PID:2736 -
\??\c:\5bhthn.exec:\5bhthn.exe55⤵
- Executes dropped EXE
PID:1796 -
\??\c:\dpppj.exec:\dpppj.exe56⤵
- Executes dropped EXE
PID:1372 -
\??\c:\flllxrf.exec:\flllxrf.exe57⤵
- Executes dropped EXE
PID:1900 -
\??\c:\xrrrrrx.exec:\xrrrrrx.exe58⤵
- Executes dropped EXE
PID:2224 -
\??\c:\pjpvj.exec:\pjpvj.exe59⤵
- Executes dropped EXE
PID:2996 -
\??\c:\btnbnb.exec:\btnbnb.exe60⤵
- Executes dropped EXE
PID:324 -
\??\c:\pjjpv.exec:\pjjpv.exe61⤵
- Executes dropped EXE
PID:564 -
\??\c:\ddpvd.exec:\ddpvd.exe62⤵
- Executes dropped EXE
PID:592 -
\??\c:\ntnnhn.exec:\ntnnhn.exe63⤵
- Executes dropped EXE
PID:844 -
\??\c:\bttnbn.exec:\bttnbn.exe64⤵
- Executes dropped EXE
PID:2096 -
\??\c:\5jdvj.exec:\5jdvj.exe65⤵
- Executes dropped EXE
PID:1816 -
\??\c:\1ffrxfr.exec:\1ffrxfr.exe66⤵PID:1584
-
\??\c:\hhhbhh.exec:\hhhbhh.exe67⤵PID:1636
-
\??\c:\7pvdj.exec:\7pvdj.exe68⤵PID:1980
-
\??\c:\pdpjp.exec:\pdpjp.exe69⤵PID:908
-
\??\c:\rrxrlxr.exec:\rrxrlxr.exe70⤵PID:1076
-
\??\c:\tttttt.exec:\tttttt.exe71⤵PID:600
-
\??\c:\hbthth.exec:\hbthth.exe72⤵PID:2240
-
\??\c:\lfxlrxl.exec:\lfxlrxl.exe73⤵PID:2196
-
\??\c:\xxxlflf.exec:\xxxlflf.exe74⤵PID:1276
-
\??\c:\bntthh.exec:\bntthh.exe75⤵PID:1776
-
\??\c:\dddpj.exec:\dddpj.exe76⤵PID:2104
-
\??\c:\ttnbnb.exec:\ttnbnb.exe77⤵PID:1856
-
\??\c:\ppjpj.exec:\ppjpj.exe78⤵PID:2144
-
\??\c:\3fxxlrx.exec:\3fxxlrx.exe79⤵PID:2348
-
\??\c:\7tthhh.exec:\7tthhh.exe80⤵PID:2936
-
\??\c:\xfrxfxx.exec:\xfrxfxx.exe81⤵PID:1604
-
\??\c:\tthnhn.exec:\tthnhn.exe82⤵PID:2836
-
\??\c:\ppvjv.exec:\ppvjv.exe83⤵PID:2772
-
\??\c:\xrflxxl.exec:\xrflxxl.exe84⤵PID:2496
-
\??\c:\1tnnbt.exec:\1tnnbt.exe85⤵PID:2604
-
\??\c:\7fxrxxl.exec:\7fxrxxl.exe86⤵PID:2484
-
\??\c:\hhhthn.exec:\hhhthn.exe87⤵PID:2588
-
\??\c:\7jdpv.exec:\7jdpv.exe88⤵PID:2948
-
\??\c:\1nhhnt.exec:\1nhhnt.exe89⤵PID:2544
-
\??\c:\jjdpv.exec:\jjdpv.exe90⤵PID:2112
-
\??\c:\5bhbbt.exec:\5bhbbt.exe91⤵PID:820
-
\??\c:\rrfxffr.exec:\rrfxffr.exe92⤵PID:2868
-
\??\c:\xrflrxl.exec:\xrflrxl.exe93⤵PID:2784
-
\??\c:\ppvjv.exec:\ppvjv.exe94⤵PID:2788
-
\??\c:\rlrfllx.exec:\rlrfllx.exe95⤵PID:1204
-
\??\c:\dpdjp.exec:\dpdjp.exe96⤵PID:2728
-
\??\c:\hhnttt.exec:\hhnttt.exe97⤵PID:2920
-
\??\c:\tnnttt.exec:\tnnttt.exe98⤵PID:1764
-
\??\c:\1lllrfl.exec:\1lllrfl.exe99⤵PID:1784
-
\??\c:\xxxrxfl.exec:\xxxrxfl.exe100⤵PID:2344
-
\??\c:\ddvvd.exec:\ddvvd.exe101⤵PID:2564
-
\??\c:\llfrffx.exec:\llfrffx.exe102⤵PID:2312
-
\??\c:\3jjvd.exec:\3jjvd.exe103⤵PID:1904
-
\??\c:\ddvpv.exec:\ddvpv.exe104⤵PID:692
-
\??\c:\hbtttb.exec:\hbtttb.exe105⤵PID:2996
-
\??\c:\xxflrfl.exec:\xxflrfl.exe106⤵PID:784
-
\??\c:\7tbbht.exec:\7tbbht.exe107⤵PID:608
-
\??\c:\3flxfff.exec:\3flxfff.exe108⤵PID:1496
-
\??\c:\1dpdj.exec:\1dpdj.exe109⤵PID:708
-
\??\c:\ppjpd.exec:\ppjpd.exe110⤵PID:2152
-
\??\c:\7bnttb.exec:\7bnttb.exe111⤵PID:1816
-
\??\c:\jdpjv.exec:\jdpjv.exe112⤵PID:2008
-
\??\c:\btnhnh.exec:\btnhnh.exe113⤵PID:1984
-
\??\c:\jjjjv.exec:\jjjjv.exe114⤵PID:2116
-
\??\c:\xrlxrxf.exec:\xrlxrxf.exe115⤵PID:3028
-
\??\c:\nhtbtb.exec:\nhtbtb.exe116⤵PID:2020
-
\??\c:\rlfrffr.exec:\rlfrffr.exe117⤵PID:2208
-
\??\c:\1rlflxx.exec:\1rlflxx.exe118⤵PID:2232
-
\??\c:\tthhtt.exec:\tthhtt.exe119⤵PID:1688
-
\??\c:\dvpvv.exec:\dvpvv.exe120⤵PID:1936
-
\??\c:\bhhtbn.exec:\bhhtbn.exe121⤵PID:1752
-
\??\c:\xxlxxxf.exec:\xxlxxxf.exe122⤵PID:2236
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-