Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 04:12
Behavioral task
behavioral1
Sample
eca27f580042b0bc46e1398089fadba984c5da2405c0a0106f12d8288f17bd2c.exe
Resource
win7-20240419-en
windows7-x64
6 signatures
150 seconds
General
-
Target
eca27f580042b0bc46e1398089fadba984c5da2405c0a0106f12d8288f17bd2c.exe
-
Size
186KB
-
MD5
79e29dd7c8731d199c8d6ab066fccbe2
-
SHA1
b8ff002065cee959e09ce6a79a560af82c7cd980
-
SHA256
eca27f580042b0bc46e1398089fadba984c5da2405c0a0106f12d8288f17bd2c
-
SHA512
4854b66065aa5f693c64a985ea2aba18f6e40b965c435b3fcebf48a8e3375702954e04bb1d83bc2c015f12c644719e0cfa87d6850ad1d8d7280fde8575e2ab26
-
SSDEEP
3072:3hOmTsF93UYfwC6GIoutw8YcvrqrE66kropO6BWlPFH4tw1D43eMRcm:3cm4FmowdHoSzhraHcpOFltH4twl43vf
Malware Config
Signatures
-
Detect Blackmoon payload 34 IoCs
resource yara_rule behavioral1/memory/2396-9-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2860-18-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2676-28-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2620-53-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2604-63-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2980-73-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2564-84-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2960-100-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2772-109-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2944-126-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1756-142-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2132-159-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/884-169-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2308-177-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2064-187-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2052-214-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/3064-255-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1624-272-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/568-281-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1392-290-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2988-297-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1524-305-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2644-342-0x0000000000440000-0x0000000000472000-memory.dmp family_blackmoon behavioral1/memory/2748-357-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2664-401-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2296-421-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1820-447-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2720-496-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/1800-509-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/3004-570-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2768-596-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2984-658-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2940-686-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral1/memory/2052-785-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2396-0-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/2396-3-0x0000000000220000-0x0000000000252000-memory.dmp UPX behavioral1/files/0x000b000000012271-7.dat UPX behavioral1/memory/2396-9-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/2860-10-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/2860-18-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x00370000000144d6-20.dat UPX behavioral1/memory/2676-28-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/2636-29-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x00080000000146a7-26.dat UPX behavioral1/files/0x000700000001474b-37.dat UPX behavioral1/files/0x000700000001475f-44.dat UPX behavioral1/files/0x00070000000148af-54.dat UPX behavioral1/memory/2620-53-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0009000000014a29-61.dat UPX behavioral1/memory/2980-64-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/2604-63-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/2980-73-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0009000000015c9b-72.dat UPX behavioral1/files/0x0006000000015ca9-80.dat UPX behavioral1/memory/2564-84-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0006000000015cc2-90.dat UPX behavioral1/memory/2960-91-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0006000000015cca-98.dat UPX behavioral1/memory/2960-100-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0006000000015cd8-107.dat UPX behavioral1/memory/2772-109-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0006000000015ce1-116.dat UPX behavioral1/files/0x0006000000015ced-125.dat UPX behavioral1/memory/2944-126-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0006000000015cf5-133.dat UPX behavioral1/memory/1756-142-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0006000000015d02-143.dat UPX behavioral1/files/0x0006000000015d13-150.dat UPX behavioral1/files/0x0006000000015d1e-160.dat UPX behavioral1/memory/2132-159-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0006000000015d28-167.dat UPX behavioral1/memory/884-169-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0006000000015d89-178.dat UPX behavioral1/memory/2308-177-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0006000000015d99-185.dat UPX behavioral1/memory/2064-187-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0006000000015f40-195.dat UPX behavioral1/files/0x0006000000015fbb-204.dat UPX behavioral1/memory/2052-214-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x003700000001451d-213.dat UPX behavioral1/files/0x0006000000016020-221.dat UPX behavioral1/memory/1280-223-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0006000000016126-231.dat UPX behavioral1/files/0x0006000000016228-239.dat UPX behavioral1/files/0x000600000001640f-247.dat UPX behavioral1/files/0x000600000001650f-256.dat UPX behavioral1/memory/3064-255-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0006000000016591-264.dat UPX behavioral1/memory/1624-272-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x00060000000167e8-273.dat UPX behavioral1/memory/568-281-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/files/0x0006000000016a3a-282.dat UPX behavioral1/memory/1392-290-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/2988-297-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/1524-305-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/2596-323-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/2748-350-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral1/memory/2748-357-0x0000000000400000-0x0000000000432000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2860 9fxxffl.exe 2676 bbtthh.exe 2636 jdpdj.exe 2708 nhbbnt.exe 2620 tnnbtb.exe 2604 5vjvp.exe 2980 lxrlxxl.exe 2752 btthbh.exe 2564 3dddp.exe 2960 fxrxxfr.exe 2772 7btthn.exe 2812 9dpdv.exe 2944 xrlrflf.exe 912 bthbhn.exe 1756 7djdp.exe 1820 lxrfrxr.exe 2132 hhthth.exe 884 dvpdp.exe 2308 lfxxflx.exe 2064 5htntt.exe 2440 5jdpd.exe 2900 jdjpj.exe 2052 nhnbbh.exe 700 jdpjv.exe 1280 vpdvd.exe 1568 xlfrllx.exe 1620 pvpdj.exe 3064 fxfrlxf.exe 840 tttbth.exe 1624 nbbbnt.exe 568 dpjdj.exe 1392 rxflxff.exe 2988 hbntth.exe 2292 vjpvj.exe 1524 5xrxflx.exe 2368 fxrxlrr.exe 1604 thbhtt.exe 2596 bntttn.exe 2704 ddpvj.exe 2644 xrrxxfr.exe 2496 fxlxlrf.exe 2748 9hnnnn.exe 2652 pjvjp.exe 2172 rlfxrxl.exe 2740 3xrrlxr.exe 2956 ntbnhn.exe 1896 5nbthh.exe 1808 1pdpp.exe 2664 9vpvp.exe 2792 xrrxfxf.exe 2576 tttbtt.exe 1272 tnnhtb.exe 2296 5dppd.exe 2016 vpjdp.exe 2044 xlfrrxl.exe 1820 5hnttt.exe 2132 btbttb.exe 1680 pjvvd.exe 1556 9pdjp.exe 2060 xfrffxr.exe 2072 bbthbn.exe 1196 tbhbtn.exe 2888 jdpjp.exe 2720 1dvjp.exe -
resource yara_rule behavioral1/memory/2396-0-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2396-3-0x0000000000220000-0x0000000000252000-memory.dmp upx behavioral1/files/0x000b000000012271-7.dat upx behavioral1/memory/2396-9-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2860-10-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2860-18-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x00370000000144d6-20.dat upx behavioral1/memory/2676-28-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2636-29-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x00080000000146a7-26.dat upx behavioral1/files/0x000700000001474b-37.dat upx behavioral1/files/0x000700000001475f-44.dat upx behavioral1/files/0x00070000000148af-54.dat upx behavioral1/memory/2620-53-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0009000000014a29-61.dat upx behavioral1/memory/2980-64-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2604-63-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2980-73-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0009000000015c9b-72.dat upx behavioral1/files/0x0006000000015ca9-80.dat upx behavioral1/memory/2564-84-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000015cc2-90.dat upx behavioral1/memory/2960-91-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000015cca-98.dat upx behavioral1/memory/2960-100-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000015cd8-107.dat upx behavioral1/memory/2772-109-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000015ce1-116.dat upx behavioral1/files/0x0006000000015ced-125.dat upx behavioral1/memory/2944-126-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000015cf5-133.dat upx behavioral1/memory/1756-142-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000015d02-143.dat upx behavioral1/files/0x0006000000015d13-150.dat upx behavioral1/files/0x0006000000015d1e-160.dat upx behavioral1/memory/2132-159-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000015d28-167.dat upx behavioral1/memory/884-169-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000015d89-178.dat upx behavioral1/memory/2308-177-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000015d99-185.dat upx behavioral1/memory/2064-187-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000015f40-195.dat upx behavioral1/files/0x0006000000015fbb-204.dat upx behavioral1/memory/2052-214-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x003700000001451d-213.dat upx behavioral1/files/0x0006000000016020-221.dat upx behavioral1/memory/1280-223-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000016126-231.dat upx behavioral1/files/0x0006000000016228-239.dat upx behavioral1/files/0x000600000001640f-247.dat upx behavioral1/files/0x000600000001650f-256.dat upx behavioral1/memory/3064-255-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000016591-264.dat upx behavioral1/memory/1624-272-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x00060000000167e8-273.dat upx behavioral1/memory/568-281-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x0006000000016a3a-282.dat upx behavioral1/memory/1392-290-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2988-297-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/1524-305-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2596-323-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2748-350-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/memory/2748-357-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2396 wrote to memory of 2860 2396 eca27f580042b0bc46e1398089fadba984c5da2405c0a0106f12d8288f17bd2c.exe 28 PID 2396 wrote to memory of 2860 2396 eca27f580042b0bc46e1398089fadba984c5da2405c0a0106f12d8288f17bd2c.exe 28 PID 2396 wrote to memory of 2860 2396 eca27f580042b0bc46e1398089fadba984c5da2405c0a0106f12d8288f17bd2c.exe 28 PID 2396 wrote to memory of 2860 2396 eca27f580042b0bc46e1398089fadba984c5da2405c0a0106f12d8288f17bd2c.exe 28 PID 2860 wrote to memory of 2676 2860 9fxxffl.exe 29 PID 2860 wrote to memory of 2676 2860 9fxxffl.exe 29 PID 2860 wrote to memory of 2676 2860 9fxxffl.exe 29 PID 2860 wrote to memory of 2676 2860 9fxxffl.exe 29 PID 2676 wrote to memory of 2636 2676 bbtthh.exe 30 PID 2676 wrote to memory of 2636 2676 bbtthh.exe 30 PID 2676 wrote to memory of 2636 2676 bbtthh.exe 30 PID 2676 wrote to memory of 2636 2676 bbtthh.exe 30 PID 2636 wrote to memory of 2708 2636 jdpdj.exe 31 PID 2636 wrote to memory of 2708 2636 jdpdj.exe 31 PID 2636 wrote to memory of 2708 2636 jdpdj.exe 31 PID 2636 wrote to memory of 2708 2636 jdpdj.exe 31 PID 2708 wrote to memory of 2620 2708 nhbbnt.exe 32 PID 2708 wrote to memory of 2620 2708 nhbbnt.exe 32 PID 2708 wrote to memory of 2620 2708 nhbbnt.exe 32 PID 2708 wrote to memory of 2620 2708 nhbbnt.exe 32 PID 2620 wrote to memory of 2604 2620 tnnbtb.exe 33 PID 2620 wrote to memory of 2604 2620 tnnbtb.exe 33 PID 2620 wrote to memory of 2604 2620 tnnbtb.exe 33 PID 2620 wrote to memory of 2604 2620 tnnbtb.exe 33 PID 2604 wrote to memory of 2980 2604 5vjvp.exe 34 PID 2604 wrote to memory of 2980 2604 5vjvp.exe 34 PID 2604 wrote to memory of 2980 2604 5vjvp.exe 34 PID 2604 wrote to memory of 2980 2604 5vjvp.exe 34 PID 2980 wrote to memory of 2752 2980 lxrlxxl.exe 35 PID 2980 wrote to memory of 2752 2980 lxrlxxl.exe 35 PID 2980 wrote to memory of 2752 2980 lxrlxxl.exe 35 PID 2980 wrote to memory of 2752 2980 lxrlxxl.exe 35 PID 2752 wrote to memory of 2564 2752 btthbh.exe 36 PID 2752 wrote to memory of 2564 2752 btthbh.exe 36 PID 2752 wrote to memory of 2564 2752 btthbh.exe 36 PID 2752 wrote to memory of 2564 2752 btthbh.exe 36 PID 2564 wrote to memory of 2960 2564 3dddp.exe 37 PID 2564 wrote to memory of 2960 2564 3dddp.exe 37 PID 2564 wrote to memory of 2960 2564 3dddp.exe 37 PID 2564 wrote to memory of 2960 2564 3dddp.exe 37 PID 2960 wrote to memory of 2772 2960 fxrxxfr.exe 38 PID 2960 wrote to memory of 2772 2960 fxrxxfr.exe 38 PID 2960 wrote to memory of 2772 2960 fxrxxfr.exe 38 PID 2960 wrote to memory of 2772 2960 fxrxxfr.exe 38 PID 2772 wrote to memory of 2812 2772 7btthn.exe 39 PID 2772 wrote to memory of 2812 2772 7btthn.exe 39 PID 2772 wrote to memory of 2812 2772 7btthn.exe 39 PID 2772 wrote to memory of 2812 2772 7btthn.exe 39 PID 2812 wrote to memory of 2944 2812 9dpdv.exe 40 PID 2812 wrote to memory of 2944 2812 9dpdv.exe 40 PID 2812 wrote to memory of 2944 2812 9dpdv.exe 40 PID 2812 wrote to memory of 2944 2812 9dpdv.exe 40 PID 2944 wrote to memory of 912 2944 xrlrflf.exe 41 PID 2944 wrote to memory of 912 2944 xrlrflf.exe 41 PID 2944 wrote to memory of 912 2944 xrlrflf.exe 41 PID 2944 wrote to memory of 912 2944 xrlrflf.exe 41 PID 912 wrote to memory of 1756 912 bthbhn.exe 42 PID 912 wrote to memory of 1756 912 bthbhn.exe 42 PID 912 wrote to memory of 1756 912 bthbhn.exe 42 PID 912 wrote to memory of 1756 912 bthbhn.exe 42 PID 1756 wrote to memory of 1820 1756 7djdp.exe 43 PID 1756 wrote to memory of 1820 1756 7djdp.exe 43 PID 1756 wrote to memory of 1820 1756 7djdp.exe 43 PID 1756 wrote to memory of 1820 1756 7djdp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\eca27f580042b0bc46e1398089fadba984c5da2405c0a0106f12d8288f17bd2c.exe"C:\Users\Admin\AppData\Local\Temp\eca27f580042b0bc46e1398089fadba984c5da2405c0a0106f12d8288f17bd2c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\9fxxffl.exec:\9fxxffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\bbtthh.exec:\bbtthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\jdpdj.exec:\jdpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\nhbbnt.exec:\nhbbnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\tnnbtb.exec:\tnnbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\5vjvp.exec:\5vjvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\lxrlxxl.exec:\lxrlxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\btthbh.exec:\btthbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\3dddp.exec:\3dddp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\fxrxxfr.exec:\fxrxxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\7btthn.exec:\7btthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\9dpdv.exec:\9dpdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\xrlrflf.exec:\xrlrflf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\bthbhn.exec:\bthbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\7djdp.exec:\7djdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\lxrfrxr.exec:\lxrfrxr.exe17⤵
- Executes dropped EXE
PID:1820 -
\??\c:\hhthth.exec:\hhthth.exe18⤵
- Executes dropped EXE
PID:2132 -
\??\c:\dvpdp.exec:\dvpdp.exe19⤵
- Executes dropped EXE
PID:884 -
\??\c:\lfxxflx.exec:\lfxxflx.exe20⤵
- Executes dropped EXE
PID:2308 -
\??\c:\5htntt.exec:\5htntt.exe21⤵
- Executes dropped EXE
PID:2064 -
\??\c:\5jdpd.exec:\5jdpd.exe22⤵
- Executes dropped EXE
PID:2440 -
\??\c:\jdjpj.exec:\jdjpj.exe23⤵
- Executes dropped EXE
PID:2900 -
\??\c:\nhnbbh.exec:\nhnbbh.exe24⤵
- Executes dropped EXE
PID:2052 -
\??\c:\jdpjv.exec:\jdpjv.exe25⤵
- Executes dropped EXE
PID:700 -
\??\c:\vpdvd.exec:\vpdvd.exe26⤵
- Executes dropped EXE
PID:1280 -
\??\c:\xlfrllx.exec:\xlfrllx.exe27⤵
- Executes dropped EXE
PID:1568 -
\??\c:\pvpdj.exec:\pvpdj.exe28⤵
- Executes dropped EXE
PID:1620 -
\??\c:\fxfrlxf.exec:\fxfrlxf.exe29⤵
- Executes dropped EXE
PID:3064 -
\??\c:\tttbth.exec:\tttbth.exe30⤵
- Executes dropped EXE
PID:840 -
\??\c:\nbbbnt.exec:\nbbbnt.exe31⤵
- Executes dropped EXE
PID:1624 -
\??\c:\dpjdj.exec:\dpjdj.exe32⤵
- Executes dropped EXE
PID:568 -
\??\c:\rxflxff.exec:\rxflxff.exe33⤵
- Executes dropped EXE
PID:1392 -
\??\c:\hbntth.exec:\hbntth.exe34⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vjpvj.exec:\vjpvj.exe35⤵
- Executes dropped EXE
PID:2292 -
\??\c:\5xrxflx.exec:\5xrxflx.exe36⤵
- Executes dropped EXE
PID:1524 -
\??\c:\fxrxlrr.exec:\fxrxlrr.exe37⤵
- Executes dropped EXE
PID:2368 -
\??\c:\thbhtt.exec:\thbhtt.exe38⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bntttn.exec:\bntttn.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\ddpvj.exec:\ddpvj.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xrrxxfr.exec:\xrrxxfr.exe41⤵
- Executes dropped EXE
PID:2644 -
\??\c:\fxlxlrf.exec:\fxlxlrf.exe42⤵
- Executes dropped EXE
PID:2496 -
\??\c:\9hnnnn.exec:\9hnnnn.exe43⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pjvjp.exec:\pjvjp.exe44⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rlfxrxl.exec:\rlfxrxl.exe45⤵
- Executes dropped EXE
PID:2172 -
\??\c:\3xrrlxr.exec:\3xrrlxr.exe46⤵
- Executes dropped EXE
PID:2740 -
\??\c:\ntbnhn.exec:\ntbnhn.exe47⤵
- Executes dropped EXE
PID:2956 -
\??\c:\5nbthh.exec:\5nbthh.exe48⤵
- Executes dropped EXE
PID:1896 -
\??\c:\1pdpp.exec:\1pdpp.exe49⤵
- Executes dropped EXE
PID:1808 -
\??\c:\9vpvp.exec:\9vpvp.exe50⤵
- Executes dropped EXE
PID:2664 -
\??\c:\xrrxfxf.exec:\xrrxfxf.exe51⤵
- Executes dropped EXE
PID:2792 -
\??\c:\tttbtt.exec:\tttbtt.exe52⤵
- Executes dropped EXE
PID:2576 -
\??\c:\tnnhtb.exec:\tnnhtb.exe53⤵
- Executes dropped EXE
PID:1272 -
\??\c:\5dppd.exec:\5dppd.exe54⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vpjdp.exec:\vpjdp.exe55⤵
- Executes dropped EXE
PID:2016 -
\??\c:\xlfrrxl.exec:\xlfrrxl.exe56⤵
- Executes dropped EXE
PID:2044 -
\??\c:\5hnttt.exec:\5hnttt.exe57⤵
- Executes dropped EXE
PID:1820 -
\??\c:\btbttb.exec:\btbttb.exe58⤵
- Executes dropped EXE
PID:2132 -
\??\c:\pjvvd.exec:\pjvvd.exe59⤵
- Executes dropped EXE
PID:1680 -
\??\c:\9pdjp.exec:\9pdjp.exe60⤵
- Executes dropped EXE
PID:1556 -
\??\c:\xfrffxr.exec:\xfrffxr.exe61⤵
- Executes dropped EXE
PID:2060 -
\??\c:\bbthbn.exec:\bbthbn.exe62⤵
- Executes dropped EXE
PID:2072 -
\??\c:\tbhbtn.exec:\tbhbtn.exe63⤵
- Executes dropped EXE
PID:1196 -
\??\c:\jdpjp.exec:\jdpjp.exe64⤵
- Executes dropped EXE
PID:2888 -
\??\c:\1dvjp.exec:\1dvjp.exe65⤵
- Executes dropped EXE
PID:2720 -
\??\c:\5rrrxxf.exec:\5rrrxxf.exe66⤵PID:1256
-
\??\c:\3lflrxl.exec:\3lflrxl.exe67⤵PID:580
-
\??\c:\hbntbb.exec:\hbntbb.exe68⤵PID:1800
-
\??\c:\bttbnb.exec:\bttbnb.exe69⤵PID:308
-
\??\c:\vpjvv.exec:\vpjvv.exe70⤵PID:1396
-
\??\c:\9fxfxxr.exec:\9fxfxxr.exe71⤵PID:2864
-
\??\c:\fxrxlfx.exec:\fxrxlfx.exe72⤵PID:1868
-
\??\c:\7tthbh.exec:\7tthbh.exe73⤵PID:556
-
\??\c:\1hbhnn.exec:\1hbhnn.exe74⤵PID:880
-
\??\c:\pjdpd.exec:\pjdpd.exe75⤵PID:2036
-
\??\c:\ddvvd.exec:\ddvvd.exe76⤵PID:2264
-
\??\c:\5lxxflr.exec:\5lxxflr.exe77⤵PID:1708
-
\??\c:\5lfxlrx.exec:\5lfxlrx.exe78⤵PID:3004
-
\??\c:\7btnnt.exec:\7btnnt.exe79⤵PID:2996
-
\??\c:\hthntb.exec:\hthntb.exe80⤵PID:2568
-
\??\c:\7jddp.exec:\7jddp.exe81⤵PID:2572
-
\??\c:\jjvvp.exec:\jjvvp.exe82⤵PID:2768
-
\??\c:\fxllrlx.exec:\fxllrlx.exe83⤵PID:3040
-
\??\c:\rxlxffl.exec:\rxlxffl.exe84⤵PID:2696
-
\??\c:\hbbbnn.exec:\hbbbnn.exe85⤵PID:2636
-
\??\c:\hbtbnt.exec:\hbtbnt.exe86⤵PID:2880
-
\??\c:\9jdjv.exec:\9jdjv.exe87⤵PID:2756
-
\??\c:\ppjjv.exec:\ppjjv.exe88⤵PID:2516
-
\??\c:\rlflflx.exec:\rlflflx.exe89⤵PID:2604
-
\??\c:\3bnnhn.exec:\3bnnhn.exe90⤵PID:2484
-
\??\c:\3bnbht.exec:\3bnbht.exe91⤵PID:2608
-
\??\c:\ddpjv.exec:\ddpjv.exe92⤵PID:2984
-
\??\c:\rrrrxrf.exec:\rrrrxrf.exe93⤵PID:848
-
\??\c:\rlrlflr.exec:\rlrlflr.exe94⤵PID:2808
-
\??\c:\tttntb.exec:\tttntb.exe95⤵PID:2556
-
\??\c:\ddjpp.exec:\ddjpp.exe96⤵PID:2940
-
\??\c:\jdddp.exec:\jdddp.exe97⤵PID:1292
-
\??\c:\5xxxflx.exec:\5xxxflx.exe98⤵PID:1976
-
\??\c:\1rlflrx.exec:\1rlflrx.exe99⤵PID:1648
-
\??\c:\hbbnhh.exec:\hbbnhh.exe100⤵PID:1724
-
\??\c:\tnnhtb.exec:\tnnhtb.exe101⤵PID:2276
-
\??\c:\1djpv.exec:\1djpv.exe102⤵PID:2380
-
\??\c:\ddvvj.exec:\ddvvj.exe103⤵PID:2180
-
\??\c:\7rrxfrx.exec:\7rrxfrx.exe104⤵PID:884
-
\??\c:\bthhnb.exec:\bthhnb.exe105⤵PID:2308
-
\??\c:\ttntbn.exec:\ttntbn.exe106⤵PID:2252
-
\??\c:\vvpdp.exec:\vvpdp.exe107⤵PID:1312
-
\??\c:\pjjdj.exec:\pjjdj.exe108⤵PID:1720
-
\??\c:\1frrxxr.exec:\1frrxxr.exe109⤵PID:1504
-
\??\c:\nnhbhn.exec:\nnhbhn.exe110⤵PID:484
-
\??\c:\bbbtnh.exec:\bbbtnh.exe111⤵PID:2052
-
\??\c:\dvvdd.exec:\dvvdd.exe112⤵PID:1100
-
\??\c:\rlfxrxl.exec:\rlfxrxl.exe113⤵PID:2108
-
\??\c:\btnthb.exec:\btnthb.exe114⤵PID:1548
-
\??\c:\bthnbn.exec:\bthnbn.exe115⤵PID:1264
-
\??\c:\jjvpj.exec:\jjvpj.exe116⤵PID:1620
-
\??\c:\9pdvp.exec:\9pdvp.exe117⤵PID:1652
-
\??\c:\xxrlxlx.exec:\xxrlxlx.exe118⤵PID:2148
-
\??\c:\3bntbn.exec:\3bntbn.exe119⤵PID:2188
-
\??\c:\bthnbt.exec:\bthnbt.exe120⤵PID:2920
-
\??\c:\vdvjj.exec:\vdvjj.exe121⤵PID:568
-
\??\c:\vvjvd.exec:\vvjvd.exe122⤵PID:1252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-