Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 22:43
Behavioral task
behavioral1
Sample
71a5a933d27b9821901d7b20f81dba0c5a46fcaf53ecc3805a0e540844fe37a1.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
71a5a933d27b9821901d7b20f81dba0c5a46fcaf53ecc3805a0e540844fe37a1.exe
-
Size
440KB
-
MD5
20f7442933011e9196531ee6e0729ab1
-
SHA1
58861e1585b884fd62242ab14a518a00c53944a0
-
SHA256
71a5a933d27b9821901d7b20f81dba0c5a46fcaf53ecc3805a0e540844fe37a1
-
SHA512
0bac84617f81e41fe1e401051bf780972bc79d73397845b443adcf48453414fc211847fe6f5e2bbf24db65f66d3697ecd00acc699017c957879ffa04b0f757df
-
SSDEEP
12288:w4wFHoS9KxbNnidEhjEJd1kNpeUgI95yRoZHVaoJMOxFXnRV4PiGO0hUmH5:kKxbNndhjEJd1kNpeUgI95yRoZHgoJMv
Malware Config
Signatures
-
Detect Blackmoon payload 34 IoCs
resource yara_rule behavioral1/memory/3068-7-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1836-16-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2460-26-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2712-29-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2672-44-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2788-48-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2676-65-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2808-73-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2668-83-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2544-85-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1956-103-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2976-119-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1588-136-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1732-145-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2764-154-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1300-172-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1752-183-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1776-193-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2508-210-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/920-219-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2072-245-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2400-294-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1744-307-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1540-322-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2292-335-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2672-361-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2088-381-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1660-404-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/1636-429-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/556-575-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2164-729-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1776-801-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2392-862-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1652-1023-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/3068-0-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x000a0000000122ec-5.dat UPX behavioral1/memory/3068-7-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/1836-16-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0037000000016c7a-14.dat UPX behavioral1/memory/2460-17-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0008000000016d2c-25.dat UPX behavioral1/memory/2460-26-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2712-29-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0007000000016d3d-36.dat UPX behavioral1/memory/2672-44-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0007000000016d45-45.dat UPX behavioral1/memory/2788-48-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0007000000016d4e-55.dat UPX behavioral1/files/0x0008000000016d65-64.dat UPX behavioral1/memory/2676-65-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0007000000016d69-74.dat UPX behavioral1/memory/2808-73-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x00070000000186e6-81.dat UPX behavioral1/memory/2668-83-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2544-85-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x00050000000186f1-93.dat UPX behavioral1/files/0x00050000000186ff-102.dat UPX behavioral1/memory/1956-103-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0005000000018739-111.dat UPX behavioral1/memory/2976-119-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0037000000016cc3-120.dat UPX behavioral1/files/0x000500000001873f-128.dat UPX behavioral1/files/0x0005000000018787-137.dat UPX behavioral1/memory/1588-136-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x000500000001878d-146.dat UPX behavioral1/memory/1732-145-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2764-154-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0006000000018bf0-155.dat UPX behavioral1/files/0x0005000000019228-163.dat UPX behavioral1/memory/1300-164-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x000500000001923b-173.dat UPX behavioral1/memory/1300-172-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/1752-174-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/1752-183-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x000500000001925d-182.dat UPX behavioral1/files/0x0005000000019260-191.dat UPX behavioral1/memory/1776-193-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2508-202-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0005000000019275-200.dat UPX behavioral1/memory/2508-210-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0005000000019277-211.dat UPX behavioral1/memory/920-219-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x0005000000019283-220.dat UPX behavioral1/files/0x000500000001933a-228.dat UPX behavioral1/files/0x0005000000019381-236.dat UPX behavioral1/files/0x000500000001939f-242.dat UPX behavioral1/memory/2072-245-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/files/0x00050000000193a5-253.dat UPX behavioral1/files/0x00050000000193b1-261.dat UPX behavioral1/files/0x0005000000019433-269.dat UPX behavioral1/files/0x000500000001943e-277.dat UPX behavioral1/files/0x0005000000019457-286.dat UPX behavioral1/memory/2400-294-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/1744-307-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/1540-322-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2292-335-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2672-361-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2748-374-0x0000000000400000-0x0000000000434000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1836 rrxlfll.exe 2460 5rflrxx.exe 2712 7jjjv.exe 2672 xxlflrf.exe 2788 llfxlrr.exe 2676 xfxrrrl.exe 2808 nbthth.exe 2668 fffxffr.exe 2544 ddpvd.exe 3064 lxfxrxl.exe 1956 5lffxlf.exe 2976 9nhnbh.exe 1736 1tbntt.exe 1588 vpjdd.exe 1732 hbnbhn.exe 2764 7vpvp.exe 2104 7vpdv.exe 1300 lxxlfrl.exe 1752 5pddj.exe 2004 lfxrlrl.exe 1776 flfflxf.exe 2508 nnhbth.exe 920 3hbntb.exe 628 pppdv.exe 872 ppdpv.exe 2072 dpjpj.exe 1664 3dvvj.exe 952 vppdv.exe 2128 vvppj.exe 840 hnhbtb.exe 2504 vdvdp.exe 2400 lxrrlfl.exe 2356 vjjvv.exe 1744 9lrflff.exe 2892 hhbhnn.exe 1952 vvvdv.exe 1540 rlxflrx.exe 2616 bbnnht.exe 2292 jvdjd.exe 2176 fxxlrxl.exe 2148 thbhbh.exe 2672 vvvjd.exe 2840 rfxfxrf.exe 2648 thbbnt.exe 2748 vvjdd.exe 2088 lllrlrl.exe 2560 bbhhhb.exe 1660 lrrlrfl.exe 3048 llxxffx.exe 2872 pvdvp.exe 2972 vvpvv.exe 1636 fxxflrx.exe 1548 3bhthn.exe 2516 3dvdd.exe 1588 7ffxlxl.exe 2772 thbhhb.exe 344 ddjdd.exe 620 9flrflr.exe 2104 bhhbnb.exe 852 1jjpd.exe 760 rllxrrr.exe 1676 bhhttt.exe 2056 dvpjv.exe 1312 jvvjd.exe -
resource yara_rule behavioral1/memory/3068-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000a0000000122ec-5.dat upx behavioral1/memory/3068-7-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1836-16-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0037000000016c7a-14.dat upx behavioral1/memory/2460-17-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0008000000016d2c-25.dat upx behavioral1/memory/2460-26-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2712-29-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000016d3d-36.dat upx behavioral1/memory/2672-44-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000016d45-45.dat upx behavioral1/memory/2788-48-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000016d4e-55.dat upx behavioral1/files/0x0008000000016d65-64.dat upx behavioral1/memory/2676-65-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000016d69-74.dat upx behavioral1/memory/2808-73-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x00070000000186e6-81.dat upx behavioral1/memory/2668-83-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2544-85-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x00050000000186f1-93.dat upx behavioral1/files/0x00050000000186ff-102.dat upx behavioral1/memory/1956-103-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0005000000018739-111.dat upx behavioral1/memory/2976-119-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0037000000016cc3-120.dat upx behavioral1/files/0x000500000001873f-128.dat upx behavioral1/files/0x0005000000018787-137.dat upx behavioral1/memory/1588-136-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000500000001878d-146.dat upx behavioral1/memory/1732-145-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2764-154-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000018bf0-155.dat upx behavioral1/files/0x0005000000019228-163.dat upx behavioral1/memory/1300-164-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000500000001923b-173.dat upx behavioral1/memory/1300-172-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1752-174-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1752-183-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000500000001925d-182.dat upx behavioral1/files/0x0005000000019260-191.dat upx behavioral1/memory/1776-193-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2508-202-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0005000000019275-200.dat upx behavioral1/memory/2508-210-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0005000000019277-211.dat upx behavioral1/memory/920-219-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0005000000019283-220.dat upx behavioral1/files/0x000500000001933a-228.dat upx behavioral1/files/0x0005000000019381-236.dat upx behavioral1/files/0x000500000001939f-242.dat upx behavioral1/memory/2072-245-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x00050000000193a5-253.dat upx behavioral1/files/0x00050000000193b1-261.dat upx behavioral1/files/0x0005000000019433-269.dat upx behavioral1/files/0x000500000001943e-277.dat upx behavioral1/files/0x0005000000019457-286.dat upx behavioral1/memory/2400-294-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1744-307-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1540-322-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2292-335-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2672-361-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2748-374-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3068 wrote to memory of 1836 3068 71a5a933d27b9821901d7b20f81dba0c5a46fcaf53ecc3805a0e540844fe37a1.exe 28 PID 3068 wrote to memory of 1836 3068 71a5a933d27b9821901d7b20f81dba0c5a46fcaf53ecc3805a0e540844fe37a1.exe 28 PID 3068 wrote to memory of 1836 3068 71a5a933d27b9821901d7b20f81dba0c5a46fcaf53ecc3805a0e540844fe37a1.exe 28 PID 3068 wrote to memory of 1836 3068 71a5a933d27b9821901d7b20f81dba0c5a46fcaf53ecc3805a0e540844fe37a1.exe 28 PID 1836 wrote to memory of 2460 1836 rrxlfll.exe 29 PID 1836 wrote to memory of 2460 1836 rrxlfll.exe 29 PID 1836 wrote to memory of 2460 1836 rrxlfll.exe 29 PID 1836 wrote to memory of 2460 1836 rrxlfll.exe 29 PID 2460 wrote to memory of 2712 2460 5rflrxx.exe 30 PID 2460 wrote to memory of 2712 2460 5rflrxx.exe 30 PID 2460 wrote to memory of 2712 2460 5rflrxx.exe 30 PID 2460 wrote to memory of 2712 2460 5rflrxx.exe 30 PID 2712 wrote to memory of 2672 2712 7jjjv.exe 31 PID 2712 wrote to memory of 2672 2712 7jjjv.exe 31 PID 2712 wrote to memory of 2672 2712 7jjjv.exe 31 PID 2712 wrote to memory of 2672 2712 7jjjv.exe 31 PID 2672 wrote to memory of 2788 2672 xxlflrf.exe 32 PID 2672 wrote to memory of 2788 2672 xxlflrf.exe 32 PID 2672 wrote to memory of 2788 2672 xxlflrf.exe 32 PID 2672 wrote to memory of 2788 2672 xxlflrf.exe 32 PID 2788 wrote to memory of 2676 2788 llfxlrr.exe 33 PID 2788 wrote to memory of 2676 2788 llfxlrr.exe 33 PID 2788 wrote to memory of 2676 2788 llfxlrr.exe 33 PID 2788 wrote to memory of 2676 2788 llfxlrr.exe 33 PID 2676 wrote to memory of 2808 2676 xfxrrrl.exe 34 PID 2676 wrote to memory of 2808 2676 xfxrrrl.exe 34 PID 2676 wrote to memory of 2808 2676 xfxrrrl.exe 34 PID 2676 wrote to memory of 2808 2676 xfxrrrl.exe 34 PID 2808 wrote to memory of 2668 2808 nbthth.exe 35 PID 2808 wrote to memory of 2668 2808 nbthth.exe 35 PID 2808 wrote to memory of 2668 2808 nbthth.exe 35 PID 2808 wrote to memory of 2668 2808 nbthth.exe 35 PID 2668 wrote to memory of 2544 2668 fffxffr.exe 36 PID 2668 wrote to memory of 2544 2668 fffxffr.exe 36 PID 2668 wrote to memory of 2544 2668 fffxffr.exe 36 PID 2668 wrote to memory of 2544 2668 fffxffr.exe 36 PID 2544 wrote to memory of 3064 2544 ddpvd.exe 37 PID 2544 wrote to memory of 3064 2544 ddpvd.exe 37 PID 2544 wrote to memory of 3064 2544 ddpvd.exe 37 PID 2544 wrote to memory of 3064 2544 ddpvd.exe 37 PID 3064 wrote to memory of 1956 3064 lxfxrxl.exe 38 PID 3064 wrote to memory of 1956 3064 lxfxrxl.exe 38 PID 3064 wrote to memory of 1956 3064 lxfxrxl.exe 38 PID 3064 wrote to memory of 1956 3064 lxfxrxl.exe 38 PID 1956 wrote to memory of 2976 1956 5lffxlf.exe 39 PID 1956 wrote to memory of 2976 1956 5lffxlf.exe 39 PID 1956 wrote to memory of 2976 1956 5lffxlf.exe 39 PID 1956 wrote to memory of 2976 1956 5lffxlf.exe 39 PID 2976 wrote to memory of 1736 2976 9nhnbh.exe 40 PID 2976 wrote to memory of 1736 2976 9nhnbh.exe 40 PID 2976 wrote to memory of 1736 2976 9nhnbh.exe 40 PID 2976 wrote to memory of 1736 2976 9nhnbh.exe 40 PID 1736 wrote to memory of 1588 1736 1tbntt.exe 41 PID 1736 wrote to memory of 1588 1736 1tbntt.exe 41 PID 1736 wrote to memory of 1588 1736 1tbntt.exe 41 PID 1736 wrote to memory of 1588 1736 1tbntt.exe 41 PID 1588 wrote to memory of 1732 1588 vpjdd.exe 42 PID 1588 wrote to memory of 1732 1588 vpjdd.exe 42 PID 1588 wrote to memory of 1732 1588 vpjdd.exe 42 PID 1588 wrote to memory of 1732 1588 vpjdd.exe 42 PID 1732 wrote to memory of 2764 1732 hbnbhn.exe 43 PID 1732 wrote to memory of 2764 1732 hbnbhn.exe 43 PID 1732 wrote to memory of 2764 1732 hbnbhn.exe 43 PID 1732 wrote to memory of 2764 1732 hbnbhn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\71a5a933d27b9821901d7b20f81dba0c5a46fcaf53ecc3805a0e540844fe37a1.exe"C:\Users\Admin\AppData\Local\Temp\71a5a933d27b9821901d7b20f81dba0c5a46fcaf53ecc3805a0e540844fe37a1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\rrxlfll.exec:\rrxlfll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\5rflrxx.exec:\5rflrxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\7jjjv.exec:\7jjjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\xxlflrf.exec:\xxlflrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\llfxlrr.exec:\llfxlrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\xfxrrrl.exec:\xfxrrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\nbthth.exec:\nbthth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\fffxffr.exec:\fffxffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\ddpvd.exec:\ddpvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\lxfxrxl.exec:\lxfxrxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\5lffxlf.exec:\5lffxlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\9nhnbh.exec:\9nhnbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\1tbntt.exec:\1tbntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\vpjdd.exec:\vpjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\hbnbhn.exec:\hbnbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\7vpvp.exec:\7vpvp.exe17⤵
- Executes dropped EXE
PID:2764 -
\??\c:\7vpdv.exec:\7vpdv.exe18⤵
- Executes dropped EXE
PID:2104 -
\??\c:\lxxlfrl.exec:\lxxlfrl.exe19⤵
- Executes dropped EXE
PID:1300 -
\??\c:\5pddj.exec:\5pddj.exe20⤵
- Executes dropped EXE
PID:1752 -
\??\c:\lfxrlrl.exec:\lfxrlrl.exe21⤵
- Executes dropped EXE
PID:2004 -
\??\c:\flfflxf.exec:\flfflxf.exe22⤵
- Executes dropped EXE
PID:1776 -
\??\c:\nnhbth.exec:\nnhbth.exe23⤵
- Executes dropped EXE
PID:2508 -
\??\c:\3hbntb.exec:\3hbntb.exe24⤵
- Executes dropped EXE
PID:920 -
\??\c:\pppdv.exec:\pppdv.exe25⤵
- Executes dropped EXE
PID:628 -
\??\c:\ppdpv.exec:\ppdpv.exe26⤵
- Executes dropped EXE
PID:872 -
\??\c:\dpjpj.exec:\dpjpj.exe27⤵
- Executes dropped EXE
PID:2072 -
\??\c:\3dvvj.exec:\3dvvj.exe28⤵
- Executes dropped EXE
PID:1664 -
\??\c:\vppdv.exec:\vppdv.exe29⤵
- Executes dropped EXE
PID:952 -
\??\c:\vvppj.exec:\vvppj.exe30⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hnhbtb.exec:\hnhbtb.exe31⤵
- Executes dropped EXE
PID:840 -
\??\c:\vdvdp.exec:\vdvdp.exe32⤵
- Executes dropped EXE
PID:2504 -
\??\c:\lxrrlfl.exec:\lxrrlfl.exe33⤵
- Executes dropped EXE
PID:2400 -
\??\c:\vjjvv.exec:\vjjvv.exe34⤵
- Executes dropped EXE
PID:2356 -
\??\c:\9lrflff.exec:\9lrflff.exe35⤵
- Executes dropped EXE
PID:1744 -
\??\c:\hhbhnn.exec:\hhbhnn.exe36⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vvvdv.exec:\vvvdv.exe37⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rlxflrx.exec:\rlxflrx.exe38⤵
- Executes dropped EXE
PID:1540 -
\??\c:\bbnnht.exec:\bbnnht.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jvdjd.exec:\jvdjd.exe40⤵
- Executes dropped EXE
PID:2292 -
\??\c:\fxxlrxl.exec:\fxxlrxl.exe41⤵
- Executes dropped EXE
PID:2176 -
\??\c:\thbhbh.exec:\thbhbh.exe42⤵
- Executes dropped EXE
PID:2148 -
\??\c:\vvvjd.exec:\vvvjd.exe43⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rfxfxrf.exec:\rfxfxrf.exe44⤵
- Executes dropped EXE
PID:2840 -
\??\c:\thbbnt.exec:\thbbnt.exe45⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vvjdd.exec:\vvjdd.exe46⤵
- Executes dropped EXE
PID:2748 -
\??\c:\lllrlrl.exec:\lllrlrl.exe47⤵
- Executes dropped EXE
PID:2088 -
\??\c:\bbhhhb.exec:\bbhhhb.exe48⤵
- Executes dropped EXE
PID:2560 -
\??\c:\lrrlrfl.exec:\lrrlrfl.exe49⤵
- Executes dropped EXE
PID:1660 -
\??\c:\llxxffx.exec:\llxxffx.exe50⤵
- Executes dropped EXE
PID:3048 -
\??\c:\pvdvp.exec:\pvdvp.exe51⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vvpvv.exec:\vvpvv.exe52⤵
- Executes dropped EXE
PID:2972 -
\??\c:\fxxflrx.exec:\fxxflrx.exe53⤵
- Executes dropped EXE
PID:1636 -
\??\c:\3bhthn.exec:\3bhthn.exe54⤵
- Executes dropped EXE
PID:1548 -
\??\c:\3dvdd.exec:\3dvdd.exe55⤵
- Executes dropped EXE
PID:2516 -
\??\c:\7ffxlxl.exec:\7ffxlxl.exe56⤵
- Executes dropped EXE
PID:1588 -
\??\c:\thbhhb.exec:\thbhhb.exe57⤵
- Executes dropped EXE
PID:2772 -
\??\c:\ddjdd.exec:\ddjdd.exe58⤵
- Executes dropped EXE
PID:344 -
\??\c:\9flrflr.exec:\9flrflr.exe59⤵
- Executes dropped EXE
PID:620 -
\??\c:\bhhbnb.exec:\bhhbnb.exe60⤵
- Executes dropped EXE
PID:2104 -
\??\c:\1jjpd.exec:\1jjpd.exe61⤵
- Executes dropped EXE
PID:852 -
\??\c:\rllxrrr.exec:\rllxrrr.exe62⤵
- Executes dropped EXE
PID:760 -
\??\c:\bhhttt.exec:\bhhttt.exe63⤵
- Executes dropped EXE
PID:1676 -
\??\c:\dvpjv.exec:\dvpjv.exe64⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jvvjd.exec:\jvvjd.exe65⤵
- Executes dropped EXE
PID:1312 -
\??\c:\5lflrxf.exec:\5lflrxf.exe66⤵PID:1256
-
\??\c:\bhbhbh.exec:\bhbhbh.exe67⤵PID:580
-
\??\c:\dpvvj.exec:\dpvvj.exe68⤵PID:920
-
\??\c:\rlfrflf.exec:\rlfrflf.exe69⤵PID:448
-
\??\c:\7nhnnt.exec:\7nhnnt.exe70⤵PID:1704
-
\??\c:\9jdpp.exec:\9jdpp.exe71⤵PID:1748
-
\??\c:\xlrrrll.exec:\xlrrrll.exe72⤵PID:1904
-
\??\c:\fxlrllx.exec:\fxlrllx.exe73⤵PID:948
-
\??\c:\7bnhnt.exec:\7bnhnt.exe74⤵PID:1780
-
\??\c:\ppjdp.exec:\ppjdp.exe75⤵PID:1292
-
\??\c:\frxrrlr.exec:\frxrrlr.exe76⤵PID:556
-
\??\c:\rlflrfl.exec:\rlflrfl.exe77⤵PID:2428
-
\??\c:\1nnhbh.exec:\1nnhbh.exe78⤵PID:2096
-
\??\c:\pjvdj.exec:\pjvdj.exe79⤵PID:780
-
\??\c:\lrrlffx.exec:\lrrlffx.exe80⤵PID:2120
-
\??\c:\tbbtnb.exec:\tbbtnb.exe81⤵PID:1744
-
\??\c:\vvjvv.exec:\vvjvv.exe82⤵PID:2892
-
\??\c:\xrrxrrl.exec:\xrrxrrl.exe83⤵PID:2420
-
\??\c:\bhhbtn.exec:\bhhbtn.exe84⤵PID:2360
-
\??\c:\1nhnbh.exec:\1nhnbh.exe85⤵PID:1276
-
\??\c:\fxllflx.exec:\fxllflx.exe86⤵PID:2272
-
\??\c:\nttbnt.exec:\nttbnt.exe87⤵PID:2732
-
\??\c:\7jpjv.exec:\7jpjv.exe88⤵PID:2900
-
\??\c:\xxlrllx.exec:\xxlrllx.exe89⤵PID:2720
-
\??\c:\5dvpv.exec:\5dvpv.exe90⤵PID:2536
-
\??\c:\7fxfrxl.exec:\7fxfrxl.exe91⤵PID:2860
-
\??\c:\1thhtt.exec:\1thhtt.exe92⤵PID:2576
-
\??\c:\ddvjv.exec:\ddvjv.exe93⤵PID:2524
-
\??\c:\9llrlrf.exec:\9llrlrf.exe94⤵PID:2668
-
\??\c:\7thttb.exec:\7thttb.exe95⤵PID:2064
-
\??\c:\jpjdv.exec:\jpjdv.exe96⤵PID:3064
-
\??\c:\rfllfrr.exec:\rfllfrr.exe97⤵PID:3008
-
\??\c:\rlfxlrx.exec:\rlfxlrx.exe98⤵PID:1520
-
\??\c:\hhhbtb.exec:\hhhbtb.exe99⤵PID:2984
-
\??\c:\jpjpv.exec:\jpjpv.exe100⤵PID:2164
-
\??\c:\frlxfxf.exec:\frlxfxf.exe101⤵PID:2588
-
\??\c:\bhnhth.exec:\bhnhth.exe102⤵PID:1628
-
\??\c:\jjpdv.exec:\jjpdv.exe103⤵PID:1500
-
\??\c:\rfxllfx.exec:\rfxllfx.exe104⤵PID:2772
-
\??\c:\bnnthb.exec:\bnnthb.exe105⤵PID:1488
-
\??\c:\dvppj.exec:\dvppj.exe106⤵PID:2100
-
\??\c:\vddjp.exec:\vddjp.exe107⤵PID:1708
-
\??\c:\xrllxff.exec:\xrllxff.exe108⤵PID:292
-
\??\c:\ddpvd.exec:\ddpvd.exe109⤵PID:2512
-
\??\c:\5flxlxr.exec:\5flxlxr.exe110⤵PID:2916
-
\??\c:\tbtbnh.exec:\tbtbnh.exe111⤵PID:1776
-
\??\c:\vppjp.exec:\vppjp.exe112⤵PID:2020
-
\??\c:\flxrxlx.exec:\flxrxlx.exe113⤵PID:1844
-
\??\c:\tbhtth.exec:\tbhtth.exe114⤵PID:1104
-
\??\c:\dpvvv.exec:\dpvvv.exe115⤵PID:1092
-
\??\c:\ddpjp.exec:\ddpjp.exe116⤵PID:2388
-
\??\c:\lfflfrr.exec:\lfflfrr.exe117⤵PID:1348
-
\??\c:\nbtthh.exec:\nbtthh.exe118⤵PID:1760
-
\??\c:\dpddp.exec:\dpddp.exe119⤵PID:1904
-
\??\c:\xffrflf.exec:\xffrflf.exe120⤵PID:2708
-
\??\c:\llfrrfr.exec:\llfrrfr.exe121⤵PID:1980
-
\??\c:\9hbbth.exec:\9hbbth.exe122⤵PID:2392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-