Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 01:22
Behavioral task
behavioral1
Sample
8d4feb38daaf4dd837b5ea416d9ad9a5152d6eb45e6e3895ce0dd225d1d604f9.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
-
Target
8d4feb38daaf4dd837b5ea416d9ad9a5152d6eb45e6e3895ce0dd225d1d604f9.exe
-
Size
88KB
-
MD5
47033b05cade1ffa6ee73f3ec1bc5612
-
SHA1
d8bd1e49d64d2f961b023977b5d75b09cac931cc
-
SHA256
8d4feb38daaf4dd837b5ea416d9ad9a5152d6eb45e6e3895ce0dd225d1d604f9
-
SHA512
7c67653504d7d06a0782b8fa3b5adfa7630096a232081a44124cff489067b0de5337688c3f64dcca926a0f6460168c3d627e13fdab359bf68a0cc019487f8fe4
-
SSDEEP
1536:cvQBeOGtrYS3srx93UBWfwC6Ggnouy8mVeygryFU2li0gx4EBbhnyLFW+rX:chOmTsF93UYfwC6GIoutieyhC2lbgGim
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2908-9-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2252-12-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3060-21-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2660-29-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2536-46-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2220-56-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/816-147-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2228-313-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2760-467-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2680-876-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1028-825-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2600-710-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2560-645-0x00000000003C0000-0x00000000003F6000-memory.dmp family_blackmoon behavioral1/memory/2792-617-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/624-536-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1400-500-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1844-476-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2732-450-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2180-441-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/640-434-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2628-402-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2436-364-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2692-326-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/892-294-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/352-262-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1708-243-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2948-234-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2948-227-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1396-224-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/764-215-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2932-179-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2136-157-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1904-136-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2620-118-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2608-108-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2296-84-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1536-66-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2908-0-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2908-9-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2252-12-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x000a000000014f57-8.dat UPX behavioral1/memory/3060-21-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0034000000015662-19.dat UPX behavioral1/files/0x0008000000015b85-27.dat UPX behavioral1/memory/2660-29-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2536-37-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0007000000015c9a-38.dat UPX behavioral1/files/0x0007000000015ca8-48.dat UPX behavioral1/memory/2220-47-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2536-46-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1536-57-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2220-56-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x00060000000164ec-102.dat UPX behavioral1/files/0x0006000000016575-110.dat UPX behavioral1/files/0x0006000000016a28-125.dat UPX behavioral1/memory/1904-127-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016c1f-137.dat UPX behavioral1/memory/816-147-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016c30-145.dat UPX behavioral1/files/0x0006000000016c84-162.dat UPX behavioral1/files/0x0006000000016cb5-171.dat UPX behavioral1/files/0x0006000000016cfd-206.dat UPX behavioral1/files/0x0006000000016d18-236.dat UPX behavioral1/files/0x0006000000016d31-263.dat UPX behavioral1/files/0x0006000000016d85-278.dat UPX behavioral1/memory/2228-306-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2228-313-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2324-351-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2632-383-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2760-467-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1416-724-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2536-900-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2432-1073-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1052-1030-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2184-1017-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2324-920-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2416-913-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2484-893-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1028-825-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1684-818-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2864-781-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/476-750-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1836-737-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1272-717-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2600-710-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2560-645-0x00000000003C0000-0x00000000003F6000-memory.dmp UPX behavioral1/memory/2536-618-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2792-617-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2792-610-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1400-500-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1400-493-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1844-476-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2732-450-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2180-441-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/640-434-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2604-427-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2628-402-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2436-364-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2692-326-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/892-294-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016da9-286.dat UPX -
Executes dropped EXE 64 IoCs
pid Process 2252 ffrxllx.exe 3060 lfrxllr.exe 2660 1ttnnb.exe 2536 btnhnh.exe 2220 jvdjv.exe 1536 rlxxlrx.exe 2392 9fffxlx.exe 2296 bbthbh.exe 2232 nhbhbh.exe 1564 jjdvd.exe 2608 9ppdp.exe 2620 9ppvv.exe 2492 rfxlxfx.exe 1904 5hthhn.exe 1880 nhhtbn.exe 816 vjdpd.exe 2136 7vvjd.exe 2732 rrrxlrl.exe 2932 xrrfrxf.exe 2868 btntbh.exe 2032 bbthbh.exe 1844 pdjjv.exe 556 vdvdv.exe 764 3xrxlrx.exe 1396 rrxflrr.exe 2948 nntbbh.exe 1708 nhtbhh.exe 1540 jjdpd.exe 352 frfrrrf.exe 3044 xrlrlll.exe 1656 thntbt.exe 3004 nnhbhh.exe 1912 7dvvj.exe 892 xxrfxlf.exe 1092 5lfrlrx.exe 2228 9bttbh.exe 1500 ntbnht.exe 1620 vvjpj.exe 2692 dpvdv.exe 2740 5fxxffl.exe 2724 lxrxffl.exe 2648 hhhbth.exe 2324 bntbnt.exe 2436 1nhntb.exe 2720 dvdpd.exe 1556 jvdpd.exe 2884 3rlllrx.exe 2632 9rffrxl.exe 2636 hbnbhn.exe 2628 1jdpv.exe 2448 pdvdj.exe 2276 1vjvj.exe 1904 lxrlrlr.exe 1568 vvvjd.exe 2604 jdvvd.exe 640 pdpjd.exe 2180 ddvvd.exe 2732 rfllxxf.exe 2196 rllxffl.exe 2760 fxxffrf.exe 2480 bbnthn.exe 1844 tnntbb.exe 604 bttntt.exe 1176 jdjdv.exe -
resource yara_rule behavioral1/memory/2908-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2908-9-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2252-12-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000a000000014f57-8.dat upx behavioral1/memory/3060-21-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0034000000015662-19.dat upx behavioral1/files/0x0008000000015b85-27.dat upx behavioral1/memory/2660-29-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2536-37-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015c9a-38.dat upx behavioral1/files/0x0007000000015ca8-48.dat upx behavioral1/memory/2220-47-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2536-46-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1536-57-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2220-56-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00060000000164ec-102.dat upx behavioral1/files/0x0006000000016575-110.dat upx behavioral1/files/0x0006000000016a28-125.dat upx behavioral1/memory/1904-127-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016c1f-137.dat upx behavioral1/memory/816-147-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016c30-145.dat upx behavioral1/files/0x0006000000016c84-162.dat upx behavioral1/files/0x0006000000016cb5-171.dat upx behavioral1/files/0x0006000000016cfd-206.dat upx behavioral1/files/0x0006000000016d18-236.dat upx behavioral1/files/0x0006000000016d31-263.dat upx behavioral1/files/0x0006000000016d85-278.dat upx behavioral1/memory/2228-306-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2228-313-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2324-351-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2632-383-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2760-467-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1416-724-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2536-900-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2432-1073-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1052-1030-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2184-1017-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2324-920-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2416-913-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2484-893-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1028-825-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1684-818-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2864-781-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/476-750-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1836-737-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1272-717-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2600-710-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2560-645-0x00000000003C0000-0x00000000003F6000-memory.dmp upx behavioral1/memory/2536-618-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2792-617-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2792-610-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1400-500-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1400-493-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1844-476-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2732-450-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2180-441-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/640-434-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2604-427-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2628-402-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2436-364-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2692-326-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/892-294-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016da9-286.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2252 2908 8d4feb38daaf4dd837b5ea416d9ad9a5152d6eb45e6e3895ce0dd225d1d604f9.exe 28 PID 2908 wrote to memory of 2252 2908 8d4feb38daaf4dd837b5ea416d9ad9a5152d6eb45e6e3895ce0dd225d1d604f9.exe 28 PID 2908 wrote to memory of 2252 2908 8d4feb38daaf4dd837b5ea416d9ad9a5152d6eb45e6e3895ce0dd225d1d604f9.exe 28 PID 2908 wrote to memory of 2252 2908 8d4feb38daaf4dd837b5ea416d9ad9a5152d6eb45e6e3895ce0dd225d1d604f9.exe 28 PID 2252 wrote to memory of 3060 2252 ffrxllx.exe 109 PID 2252 wrote to memory of 3060 2252 ffrxllx.exe 109 PID 2252 wrote to memory of 3060 2252 ffrxllx.exe 109 PID 2252 wrote to memory of 3060 2252 ffrxllx.exe 109 PID 3060 wrote to memory of 2660 3060 lfrxllr.exe 155 PID 3060 wrote to memory of 2660 3060 lfrxllr.exe 155 PID 3060 wrote to memory of 2660 3060 lfrxllr.exe 155 PID 3060 wrote to memory of 2660 3060 lfrxllr.exe 155 PID 2660 wrote to memory of 2536 2660 1ttnnb.exe 112 PID 2660 wrote to memory of 2536 2660 1ttnnb.exe 112 PID 2660 wrote to memory of 2536 2660 1ttnnb.exe 112 PID 2660 wrote to memory of 2536 2660 1ttnnb.exe 112 PID 2536 wrote to memory of 2220 2536 btnhnh.exe 32 PID 2536 wrote to memory of 2220 2536 btnhnh.exe 32 PID 2536 wrote to memory of 2220 2536 btnhnh.exe 32 PID 2536 wrote to memory of 2220 2536 btnhnh.exe 32 PID 2220 wrote to memory of 1536 2220 jvdjv.exe 297 PID 2220 wrote to memory of 1536 2220 jvdjv.exe 297 PID 2220 wrote to memory of 1536 2220 jvdjv.exe 297 PID 2220 wrote to memory of 1536 2220 jvdjv.exe 297 PID 1536 wrote to memory of 2392 1536 rlxxlrx.exe 34 PID 1536 wrote to memory of 2392 1536 rlxxlrx.exe 34 PID 1536 wrote to memory of 2392 1536 rlxxlrx.exe 34 PID 1536 wrote to memory of 2392 1536 rlxxlrx.exe 34 PID 2392 wrote to memory of 2296 2392 9fffxlx.exe 35 PID 2392 wrote to memory of 2296 2392 9fffxlx.exe 35 PID 2392 wrote to memory of 2296 2392 9fffxlx.exe 35 PID 2392 wrote to memory of 2296 2392 9fffxlx.exe 35 PID 2296 wrote to memory of 2232 2296 bbthbh.exe 36 PID 2296 wrote to memory of 2232 2296 bbthbh.exe 36 PID 2296 wrote to memory of 2232 2296 bbthbh.exe 36 PID 2296 wrote to memory of 2232 2296 bbthbh.exe 36 PID 2232 wrote to memory of 1564 2232 nhbhbh.exe 37 PID 2232 wrote to memory of 1564 2232 nhbhbh.exe 37 PID 2232 wrote to memory of 1564 2232 nhbhbh.exe 37 PID 2232 wrote to memory of 1564 2232 nhbhbh.exe 37 PID 1564 wrote to memory of 2608 1564 jjdvd.exe 38 PID 1564 wrote to memory of 2608 1564 jjdvd.exe 38 PID 1564 wrote to memory of 2608 1564 jjdvd.exe 38 PID 1564 wrote to memory of 2608 1564 jjdvd.exe 38 PID 2608 wrote to memory of 2620 2608 9ppdp.exe 39 PID 2608 wrote to memory of 2620 2608 9ppdp.exe 39 PID 2608 wrote to memory of 2620 2608 9ppdp.exe 39 PID 2608 wrote to memory of 2620 2608 9ppdp.exe 39 PID 2620 wrote to memory of 2492 2620 9ppvv.exe 40 PID 2620 wrote to memory of 2492 2620 9ppvv.exe 40 PID 2620 wrote to memory of 2492 2620 9ppvv.exe 40 PID 2620 wrote to memory of 2492 2620 9ppvv.exe 40 PID 2492 wrote to memory of 1904 2492 rfxlxfx.exe 41 PID 2492 wrote to memory of 1904 2492 rfxlxfx.exe 41 PID 2492 wrote to memory of 1904 2492 rfxlxfx.exe 41 PID 2492 wrote to memory of 1904 2492 rfxlxfx.exe 41 PID 1904 wrote to memory of 1880 1904 5hthhn.exe 42 PID 1904 wrote to memory of 1880 1904 5hthhn.exe 42 PID 1904 wrote to memory of 1880 1904 5hthhn.exe 42 PID 1904 wrote to memory of 1880 1904 5hthhn.exe 42 PID 1880 wrote to memory of 816 1880 nhhtbn.exe 43 PID 1880 wrote to memory of 816 1880 nhhtbn.exe 43 PID 1880 wrote to memory of 816 1880 nhhtbn.exe 43 PID 1880 wrote to memory of 816 1880 nhhtbn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d4feb38daaf4dd837b5ea416d9ad9a5152d6eb45e6e3895ce0dd225d1d604f9.exe"C:\Users\Admin\AppData\Local\Temp\8d4feb38daaf4dd837b5ea416d9ad9a5152d6eb45e6e3895ce0dd225d1d604f9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\ffrxllx.exec:\ffrxllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\lfrxllr.exec:\lfrxllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\1ttnnb.exec:\1ttnnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\btnhnh.exec:\btnhnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\jvdjv.exec:\jvdjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\rlxxlrx.exec:\rlxxlrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\9fffxlx.exec:\9fffxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\bbthbh.exec:\bbthbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\nhbhbh.exec:\nhbhbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\jjdvd.exec:\jjdvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\9ppdp.exec:\9ppdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\9ppvv.exec:\9ppvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\rfxlxfx.exec:\rfxlxfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\5hthhn.exec:\5hthhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\nhhtbn.exec:\nhhtbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\vjdpd.exec:\vjdpd.exe17⤵
- Executes dropped EXE
PID:816 -
\??\c:\7vvjd.exec:\7vvjd.exe18⤵
- Executes dropped EXE
PID:2136 -
\??\c:\rrrxlrl.exec:\rrrxlrl.exe19⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xrrfrxf.exec:\xrrfrxf.exe20⤵
- Executes dropped EXE
PID:2932 -
\??\c:\btntbh.exec:\btntbh.exe21⤵
- Executes dropped EXE
PID:2868 -
\??\c:\bbthbh.exec:\bbthbh.exe22⤵
- Executes dropped EXE
PID:2032 -
\??\c:\pdjjv.exec:\pdjjv.exe23⤵
- Executes dropped EXE
PID:1844 -
\??\c:\vdvdv.exec:\vdvdv.exe24⤵
- Executes dropped EXE
PID:556 -
\??\c:\3xrxlrx.exec:\3xrxlrx.exe25⤵
- Executes dropped EXE
PID:764 -
\??\c:\rrxflrr.exec:\rrxflrr.exe26⤵
- Executes dropped EXE
PID:1396 -
\??\c:\nntbbh.exec:\nntbbh.exe27⤵
- Executes dropped EXE
PID:2948 -
\??\c:\nhtbhh.exec:\nhtbhh.exe28⤵
- Executes dropped EXE
PID:1708 -
\??\c:\jjdpd.exec:\jjdpd.exe29⤵
- Executes dropped EXE
PID:1540 -
\??\c:\frfrrrf.exec:\frfrrrf.exe30⤵
- Executes dropped EXE
PID:352 -
\??\c:\xrlrlll.exec:\xrlrlll.exe31⤵
- Executes dropped EXE
PID:3044 -
\??\c:\thntbt.exec:\thntbt.exe32⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nnhbhh.exec:\nnhbhh.exe33⤵
- Executes dropped EXE
PID:3004 -
\??\c:\7dvvj.exec:\7dvvj.exe34⤵
- Executes dropped EXE
PID:1912 -
\??\c:\xxrfxlf.exec:\xxrfxlf.exe35⤵
- Executes dropped EXE
PID:892 -
\??\c:\5lfrlrx.exec:\5lfrlrx.exe36⤵
- Executes dropped EXE
PID:1092 -
\??\c:\9bttbh.exec:\9bttbh.exe37⤵
- Executes dropped EXE
PID:2228 -
\??\c:\ntbnht.exec:\ntbnht.exe38⤵
- Executes dropped EXE
PID:1500 -
\??\c:\vvjpj.exec:\vvjpj.exe39⤵
- Executes dropped EXE
PID:1620 -
\??\c:\dpvdv.exec:\dpvdv.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\5fxxffl.exec:\5fxxffl.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\lxrxffl.exec:\lxrxffl.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\hhhbth.exec:\hhhbth.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\bntbnt.exec:\bntbnt.exe44⤵
- Executes dropped EXE
PID:2324 -
\??\c:\1nhntb.exec:\1nhntb.exe45⤵
- Executes dropped EXE
PID:2436 -
\??\c:\dvdpd.exec:\dvdpd.exe46⤵
- Executes dropped EXE
PID:2720 -
\??\c:\jvdpd.exec:\jvdpd.exe47⤵
- Executes dropped EXE
PID:1556 -
\??\c:\3rlllrx.exec:\3rlllrx.exe48⤵
- Executes dropped EXE
PID:2884 -
\??\c:\9rffrxl.exec:\9rffrxl.exe49⤵
- Executes dropped EXE
PID:2632 -
\??\c:\hbnbhn.exec:\hbnbhn.exe50⤵
- Executes dropped EXE
PID:2636 -
\??\c:\1jdpv.exec:\1jdpv.exe51⤵
- Executes dropped EXE
PID:2628 -
\??\c:\pdvdj.exec:\pdvdj.exe52⤵
- Executes dropped EXE
PID:2448 -
\??\c:\1vjvj.exec:\1vjvj.exe53⤵
- Executes dropped EXE
PID:2276 -
\??\c:\lxrlrlr.exec:\lxrlrlr.exe54⤵
- Executes dropped EXE
PID:1904 -
\??\c:\vvvjd.exec:\vvvjd.exe55⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jdvvd.exec:\jdvvd.exe56⤵
- Executes dropped EXE
PID:2604 -
\??\c:\pdpjd.exec:\pdpjd.exe57⤵
- Executes dropped EXE
PID:640 -
\??\c:\ddvvd.exec:\ddvvd.exe58⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rfllxxf.exec:\rfllxxf.exe59⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rllxffl.exec:\rllxffl.exe60⤵
- Executes dropped EXE
PID:2196 -
\??\c:\fxxffrf.exec:\fxxffrf.exe61⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bbnthn.exec:\bbnthn.exe62⤵
- Executes dropped EXE
PID:2480 -
\??\c:\tnntbb.exec:\tnntbb.exe63⤵
- Executes dropped EXE
PID:1844 -
\??\c:\bttntt.exec:\bttntt.exe64⤵
- Executes dropped EXE
PID:604 -
\??\c:\jdjdv.exec:\jdjdv.exe65⤵
- Executes dropped EXE
PID:1176 -
\??\c:\jdpvv.exec:\jdpvv.exe66⤵PID:1400
-
\??\c:\frlxflx.exec:\frlxflx.exe67⤵PID:320
-
\??\c:\7lxrxff.exec:\7lxrxff.exe68⤵PID:1596
-
\??\c:\3lxffrf.exec:\3lxffrf.exe69⤵PID:2464
-
\??\c:\5ntttn.exec:\5ntttn.exe70⤵PID:560
-
\??\c:\nbbtnh.exec:\nbbtnh.exe71⤵PID:912
-
\??\c:\ddvdj.exec:\ddvdj.exe72⤵PID:624
-
\??\c:\vpvvj.exec:\vpvvj.exe73⤵PID:1684
-
\??\c:\5rfxxxx.exec:\5rfxxxx.exe74⤵PID:1184
-
\??\c:\xlllrrr.exec:\xlllrrr.exe75⤵PID:1292
-
\??\c:\9xfrxxl.exec:\9xfrxxl.exe76⤵PID:1908
-
\??\c:\bthntt.exec:\bthntt.exe77⤵PID:964
-
\??\c:\bntntn.exec:\bntntn.exe78⤵PID:1716
-
\??\c:\nbnhbb.exec:\nbnhbb.exe79⤵PID:2908
-
\??\c:\jvdvv.exec:\jvdvv.exe80⤵PID:876
-
\??\c:\pddvv.exec:\pddvv.exe81⤵PID:1688
-
\??\c:\9vdvv.exec:\9vdvv.exe82⤵PID:2532
-
\??\c:\3frrxxf.exec:\3frrxxf.exe83⤵PID:3060
-
\??\c:\frffrxx.exec:\frffrxx.exe84⤵PID:2796
-
\??\c:\5frrrrr.exec:\5frrrrr.exe85⤵PID:2792
-
\??\c:\thbbbt.exec:\thbbbt.exe86⤵PID:2536
-
\??\c:\3htntn.exec:\3htntn.exe87⤵PID:2920
-
\??\c:\tbthhb.exec:\tbthhb.exe88⤵PID:2588
-
\??\c:\dvjdd.exec:\dvjdd.exe89⤵PID:2324
-
\??\c:\pjpdv.exec:\pjpdv.exe90⤵PID:2560
-
\??\c:\dpvpp.exec:\dpvpp.exe91⤵PID:2808
-
\??\c:\xllflff.exec:\xllflff.exe92⤵PID:1852
-
\??\c:\1ffffxr.exec:\1ffffxr.exe93⤵PID:2232
-
\??\c:\xrrflxr.exec:\xrrflxr.exe94⤵PID:2608
-
\??\c:\tnhbbb.exec:\tnhbbb.exe95⤵PID:1864
-
\??\c:\hntnhn.exec:\hntnhn.exe96⤵PID:2468
-
\??\c:\bnthbt.exec:\bnthbt.exe97⤵PID:1680
-
\??\c:\djppv.exec:\djppv.exe98⤵PID:1892
-
\??\c:\5dpdv.exec:\5dpdv.exe99⤵PID:2752
-
\??\c:\jppjv.exec:\jppjv.exe100⤵PID:2460
-
\??\c:\rlxxffl.exec:\rlxxffl.exe101⤵PID:2600
-
\??\c:\xlxfllx.exec:\xlxfllx.exe102⤵PID:1272
-
\??\c:\nhbhhn.exec:\nhbhhn.exe103⤵PID:1416
-
\??\c:\5nttbt.exec:\5nttbt.exe104⤵PID:3000
-
\??\c:\htbnnn.exec:\htbnnn.exe105⤵PID:1836
-
\??\c:\jdpvd.exec:\jdpvd.exe106⤵PID:2760
-
\??\c:\vpjvv.exec:\vpjvv.exe107⤵PID:476
-
\??\c:\dvjjp.exec:\dvjjp.exe108⤵PID:1360
-
\??\c:\1lxlxrx.exec:\1lxlxrx.exe109⤵PID:2728
-
\??\c:\rfllffl.exec:\rfllffl.exe110⤵PID:1176
-
\??\c:\5lxrrrr.exec:\5lxrrrr.exe111⤵PID:1400
-
\??\c:\3thhtt.exec:\3thhtt.exe112⤵PID:2864
-
\??\c:\btbbbb.exec:\btbbbb.exe113⤵PID:1708
-
\??\c:\5hthtn.exec:\5hthtn.exe114⤵PID:1792
-
\??\c:\vpvjp.exec:\vpvjp.exe115⤵PID:1572
-
\??\c:\dpdpv.exec:\dpdpv.exe116⤵PID:2356
-
\??\c:\9ddjp.exec:\9ddjp.exe117⤵PID:2264
-
\??\c:\rfxrfxx.exec:\rfxrfxx.exe118⤵PID:1684
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe119⤵PID:1028
-
\??\c:\1xrfrfl.exec:\1xrfrfl.exe120⤵PID:2348
-
\??\c:\lfxflrx.exec:\lfxflrx.exe121⤵PID:1908
-
\??\c:\9thhnn.exec:\9thhnn.exe122⤵PID:1912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-