Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 22:14
Behavioral task
behavioral1
Sample
60b7831d24fdd7958ac60f6d65b76fbe12e7449d80113ad5ae526bed587fb9fd.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
60b7831d24fdd7958ac60f6d65b76fbe12e7449d80113ad5ae526bed587fb9fd.exe
-
Size
78KB
-
MD5
33b0ea4003633edb57b2b13005759edf
-
SHA1
2cf7c832c14f4a62484a7d3294723ce4996be19c
-
SHA256
60b7831d24fdd7958ac60f6d65b76fbe12e7449d80113ad5ae526bed587fb9fd
-
SHA512
f6ac1803e127ce6bc06575599c063c24c43439595832eb94c0750d136c9039cc8d399be4f41674ceb520a4c8a65dbd52a713cec151ad954b509ecdbe631e59d2
-
SSDEEP
1536:/vQBeOGtrYS3srx93UBWfwC6Ggnouy8jb5DiLKrb6MxvMnl2/AL:/hOmTsF93UYfwC6GIoutcKbtxN4
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2424-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1020-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/344-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1560-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1824-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1236-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-205-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/688-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/948-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-281-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2064-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1724-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1520-451-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1520-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-535-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-644-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1176-733-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2040-848-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-863-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2168-871-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2424-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2424-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000f00000001214d-5.dat UPX behavioral1/memory/1020-11-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1020-16-0x0000000000220000-0x0000000000247000-memory.dmp UPX behavioral1/files/0x000b000000014198-19.dat UPX behavioral1/memory/3004-28-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000800000001423a-26.dat UPX behavioral1/memory/2400-29-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00070000000142d4-38.dat UPX behavioral1/memory/2400-37-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000014342-44.dat UPX behavioral1/memory/2616-55-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000014354-54.dat UPX behavioral1/files/0x0007000000014388-62.dat UPX behavioral1/memory/2672-64-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2472-66-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0008000000015038-72.dat UPX behavioral1/files/0x000600000001538e-80.dat UPX behavioral1/memory/2732-89-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00060000000153fd-90.dat UPX behavioral1/memory/2468-91-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000600000001542b-98.dat UPX behavioral1/memory/2468-100-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2392-108-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000600000001562c-109.dat UPX behavioral1/files/0x0006000000015679-116.dat UPX behavioral1/memory/2440-118-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015b63-126.dat UPX behavioral1/memory/344-135-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015bc7-132.dat UPX behavioral1/files/0x0006000000015c82-144.dat UPX behavioral1/memory/1560-143-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015c8c-151.dat UPX behavioral1/memory/1824-153-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015caf-161.dat UPX behavioral1/memory/1236-162-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cb7-169.dat UPX behavioral1/memory/1236-171-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cbf-179.dat UPX behavioral1/files/0x0006000000015cd6-186.dat UPX behavioral1/memory/2656-188-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2820-196-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015ce2-197.dat UPX behavioral1/memory/2940-205-0x00000000001B0000-0x00000000001D7000-memory.dmp UPX behavioral1/files/0x0006000000015cea-206.dat UPX behavioral1/memory/688-208-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cf3-215.dat UPX behavioral1/files/0x0006000000015cfd-222.dat UPX behavioral1/files/0x0006000000015d09-231.dat UPX behavioral1/files/0x0006000000015d13-240.dat UPX behavioral1/memory/1984-239-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015d20-248.dat UPX behavioral1/memory/2004-249-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015d42-257.dat UPX behavioral1/files/0x000b0000000141a1-266.dat UPX behavioral1/memory/948-265-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015d72-274.dat UPX behavioral1/files/0x0006000000015d97-283.dat UPX behavioral1/memory/2064-292-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1640-304-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1640-311-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1624-330-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2612-344-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1020 jjjpd.exe 3004 9ffflrl.exe 2400 tbthbh.exe 2780 ddjdd.exe 2616 rrllfxl.exe 2672 ttnhbb.exe 2472 dvdjv.exe 1016 xrrfflf.exe 2732 7hbbnn.exe 2468 hbnbnb.exe 2392 9dvvv.exe 2384 lfxfrrr.exe 2440 nnbbnn.exe 344 nbthtn.exe 1560 ppdpj.exe 1824 lfxfflr.exe 1452 3rrlrrl.exe 1236 btnnbb.exe 2044 9pdjv.exe 2656 7ppjp.exe 2820 lfxxllf.exe 2940 nnhbth.exe 688 pjjdp.exe 632 pdddd.exe 2796 rlflrrf.exe 1984 lfrfrxf.exe 952 dvppv.exe 2004 pjjpv.exe 948 fxflrrf.exe 992 5bbhhn.exe 1716 dvddp.exe 2360 jdvdj.exe 2064 xxlrxlf.exe 2396 rrflxxx.exe 1640 hbnbhh.exe 1532 pdjpp.exe 1504 jddpd.exe 1624 rlxrrrf.exe 3004 ffxfrrf.exe 2660 nhbntb.exe 2612 hbnttb.exe 2688 pdpvd.exe 2572 ddjjp.exe 2756 lxlrxxf.exe 2752 btnthh.exe 2640 jdjjv.exe 2520 pdjjj.exe 2532 fxxfrxf.exe 3012 7fxlrrx.exe 1676 tnnhnh.exe 2264 3dddj.exe 2104 pjvdd.exe 1360 rrxlllr.exe 1828 nhbbbt.exe 1724 bbthhn.exe 1520 dvdpv.exe 2536 pjvjj.exe 1248 rlfrflx.exe 2744 btnnbb.exe 2044 nhnbnt.exe 2720 ddpjv.exe 1952 fxflxxf.exe 2816 rlxxllr.exe 564 1nnntt.exe -
resource yara_rule behavioral1/memory/2424-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2424-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000f00000001214d-5.dat upx behavioral1/memory/1020-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1020-16-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000b000000014198-19.dat upx behavioral1/memory/3004-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001423a-26.dat upx behavioral1/memory/2400-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000142d4-38.dat upx behavioral1/memory/2400-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014342-44.dat upx behavioral1/memory/2616-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014354-54.dat upx behavioral1/files/0x0007000000014388-62.dat upx behavioral1/memory/2672-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2472-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015038-72.dat upx behavioral1/files/0x000600000001538e-80.dat upx behavioral1/memory/2732-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000153fd-90.dat upx behavioral1/memory/2468-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001542b-98.dat upx behavioral1/memory/2468-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2392-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001562c-109.dat upx behavioral1/files/0x0006000000015679-116.dat upx behavioral1/memory/2440-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015b63-126.dat upx behavioral1/memory/344-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015bc7-132.dat upx behavioral1/files/0x0006000000015c82-144.dat upx behavioral1/memory/1560-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015c8c-151.dat upx behavioral1/memory/1824-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015caf-161.dat upx behavioral1/memory/1236-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cb7-169.dat upx behavioral1/memory/1236-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cbf-179.dat upx behavioral1/files/0x0006000000015cd6-186.dat upx behavioral1/memory/2656-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2820-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015ce2-197.dat upx behavioral1/memory/2940-205-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x0006000000015cea-206.dat upx behavioral1/memory/688-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cf3-215.dat upx behavioral1/files/0x0006000000015cfd-222.dat upx behavioral1/files/0x0006000000015d09-231.dat upx behavioral1/files/0x0006000000015d13-240.dat upx behavioral1/memory/1984-239-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d20-248.dat upx behavioral1/memory/2004-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d42-257.dat upx behavioral1/files/0x000b0000000141a1-266.dat upx behavioral1/memory/948-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d72-274.dat upx behavioral1/files/0x0006000000015d97-283.dat upx behavioral1/memory/2064-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1640-304-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1640-311-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1624-330-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2612-344-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2424 wrote to memory of 1020 2424 60b7831d24fdd7958ac60f6d65b76fbe12e7449d80113ad5ae526bed587fb9fd.exe 28 PID 2424 wrote to memory of 1020 2424 60b7831d24fdd7958ac60f6d65b76fbe12e7449d80113ad5ae526bed587fb9fd.exe 28 PID 2424 wrote to memory of 1020 2424 60b7831d24fdd7958ac60f6d65b76fbe12e7449d80113ad5ae526bed587fb9fd.exe 28 PID 2424 wrote to memory of 1020 2424 60b7831d24fdd7958ac60f6d65b76fbe12e7449d80113ad5ae526bed587fb9fd.exe 28 PID 1020 wrote to memory of 3004 1020 jjjpd.exe 29 PID 1020 wrote to memory of 3004 1020 jjjpd.exe 29 PID 1020 wrote to memory of 3004 1020 jjjpd.exe 29 PID 1020 wrote to memory of 3004 1020 jjjpd.exe 29 PID 3004 wrote to memory of 2400 3004 9ffflrl.exe 30 PID 3004 wrote to memory of 2400 3004 9ffflrl.exe 30 PID 3004 wrote to memory of 2400 3004 9ffflrl.exe 30 PID 3004 wrote to memory of 2400 3004 9ffflrl.exe 30 PID 2400 wrote to memory of 2780 2400 tbthbh.exe 31 PID 2400 wrote to memory of 2780 2400 tbthbh.exe 31 PID 2400 wrote to memory of 2780 2400 tbthbh.exe 31 PID 2400 wrote to memory of 2780 2400 tbthbh.exe 31 PID 2780 wrote to memory of 2616 2780 ddjdd.exe 32 PID 2780 wrote to memory of 2616 2780 ddjdd.exe 32 PID 2780 wrote to memory of 2616 2780 ddjdd.exe 32 PID 2780 wrote to memory of 2616 2780 ddjdd.exe 32 PID 2616 wrote to memory of 2672 2616 rrllfxl.exe 33 PID 2616 wrote to memory of 2672 2616 rrllfxl.exe 33 PID 2616 wrote to memory of 2672 2616 rrllfxl.exe 33 PID 2616 wrote to memory of 2672 2616 rrllfxl.exe 33 PID 2672 wrote to memory of 2472 2672 ttnhbb.exe 34 PID 2672 wrote to memory of 2472 2672 ttnhbb.exe 34 PID 2672 wrote to memory of 2472 2672 ttnhbb.exe 34 PID 2672 wrote to memory of 2472 2672 ttnhbb.exe 34 PID 2472 wrote to memory of 1016 2472 dvdjv.exe 35 PID 2472 wrote to memory of 1016 2472 dvdjv.exe 35 PID 2472 wrote to memory of 1016 2472 dvdjv.exe 35 PID 2472 wrote to memory of 1016 2472 dvdjv.exe 35 PID 1016 wrote to memory of 2732 1016 xrrfflf.exe 36 PID 1016 wrote to memory of 2732 1016 xrrfflf.exe 36 PID 1016 wrote to memory of 2732 1016 xrrfflf.exe 36 PID 1016 wrote to memory of 2732 1016 xrrfflf.exe 36 PID 2732 wrote to memory of 2468 2732 7hbbnn.exe 37 PID 2732 wrote to memory of 2468 2732 7hbbnn.exe 37 PID 2732 wrote to memory of 2468 2732 7hbbnn.exe 37 PID 2732 wrote to memory of 2468 2732 7hbbnn.exe 37 PID 2468 wrote to memory of 2392 2468 hbnbnb.exe 38 PID 2468 wrote to memory of 2392 2468 hbnbnb.exe 38 PID 2468 wrote to memory of 2392 2468 hbnbnb.exe 38 PID 2468 wrote to memory of 2392 2468 hbnbnb.exe 38 PID 2392 wrote to memory of 2384 2392 9dvvv.exe 39 PID 2392 wrote to memory of 2384 2392 9dvvv.exe 39 PID 2392 wrote to memory of 2384 2392 9dvvv.exe 39 PID 2392 wrote to memory of 2384 2392 9dvvv.exe 39 PID 2384 wrote to memory of 2440 2384 lfxfrrr.exe 40 PID 2384 wrote to memory of 2440 2384 lfxfrrr.exe 40 PID 2384 wrote to memory of 2440 2384 lfxfrrr.exe 40 PID 2384 wrote to memory of 2440 2384 lfxfrrr.exe 40 PID 2440 wrote to memory of 344 2440 nnbbnn.exe 41 PID 2440 wrote to memory of 344 2440 nnbbnn.exe 41 PID 2440 wrote to memory of 344 2440 nnbbnn.exe 41 PID 2440 wrote to memory of 344 2440 nnbbnn.exe 41 PID 344 wrote to memory of 1560 344 nbthtn.exe 42 PID 344 wrote to memory of 1560 344 nbthtn.exe 42 PID 344 wrote to memory of 1560 344 nbthtn.exe 42 PID 344 wrote to memory of 1560 344 nbthtn.exe 42 PID 1560 wrote to memory of 1824 1560 ppdpj.exe 43 PID 1560 wrote to memory of 1824 1560 ppdpj.exe 43 PID 1560 wrote to memory of 1824 1560 ppdpj.exe 43 PID 1560 wrote to memory of 1824 1560 ppdpj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\60b7831d24fdd7958ac60f6d65b76fbe12e7449d80113ad5ae526bed587fb9fd.exe"C:\Users\Admin\AppData\Local\Temp\60b7831d24fdd7958ac60f6d65b76fbe12e7449d80113ad5ae526bed587fb9fd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\jjjpd.exec:\jjjpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\9ffflrl.exec:\9ffflrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\tbthbh.exec:\tbthbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\ddjdd.exec:\ddjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\rrllfxl.exec:\rrllfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\ttnhbb.exec:\ttnhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\dvdjv.exec:\dvdjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\xrrfflf.exec:\xrrfflf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\7hbbnn.exec:\7hbbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\hbnbnb.exec:\hbnbnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\9dvvv.exec:\9dvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\lfxfrrr.exec:\lfxfrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\nnbbnn.exec:\nnbbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\nbthtn.exec:\nbthtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\ppdpj.exec:\ppdpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\lfxfflr.exec:\lfxfflr.exe17⤵
- Executes dropped EXE
PID:1824 -
\??\c:\3rrlrrl.exec:\3rrlrrl.exe18⤵
- Executes dropped EXE
PID:1452 -
\??\c:\btnnbb.exec:\btnnbb.exe19⤵
- Executes dropped EXE
PID:1236 -
\??\c:\9pdjv.exec:\9pdjv.exe20⤵
- Executes dropped EXE
PID:2044 -
\??\c:\7ppjp.exec:\7ppjp.exe21⤵
- Executes dropped EXE
PID:2656 -
\??\c:\lfxxllf.exec:\lfxxllf.exe22⤵
- Executes dropped EXE
PID:2820 -
\??\c:\nnhbth.exec:\nnhbth.exe23⤵
- Executes dropped EXE
PID:2940 -
\??\c:\pjjdp.exec:\pjjdp.exe24⤵
- Executes dropped EXE
PID:688 -
\??\c:\pdddd.exec:\pdddd.exe25⤵
- Executes dropped EXE
PID:632 -
\??\c:\rlflrrf.exec:\rlflrrf.exe26⤵
- Executes dropped EXE
PID:2796 -
\??\c:\lfrfrxf.exec:\lfrfrxf.exe27⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dvppv.exec:\dvppv.exe28⤵
- Executes dropped EXE
PID:952 -
\??\c:\pjjpv.exec:\pjjpv.exe29⤵
- Executes dropped EXE
PID:2004 -
\??\c:\fxflrrf.exec:\fxflrrf.exe30⤵
- Executes dropped EXE
PID:948 -
\??\c:\5bbhhn.exec:\5bbhhn.exe31⤵
- Executes dropped EXE
PID:992 -
\??\c:\dvddp.exec:\dvddp.exe32⤵
- Executes dropped EXE
PID:1716 -
\??\c:\jdvdj.exec:\jdvdj.exe33⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xxlrxlf.exec:\xxlrxlf.exe34⤵
- Executes dropped EXE
PID:2064 -
\??\c:\rrflxxx.exec:\rrflxxx.exe35⤵
- Executes dropped EXE
PID:2396 -
\??\c:\hbnbhh.exec:\hbnbhh.exe36⤵
- Executes dropped EXE
PID:1640 -
\??\c:\pdjpp.exec:\pdjpp.exe37⤵
- Executes dropped EXE
PID:1532 -
\??\c:\jddpd.exec:\jddpd.exe38⤵
- Executes dropped EXE
PID:1504 -
\??\c:\rlxrrrf.exec:\rlxrrrf.exe39⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ffxfrrf.exec:\ffxfrrf.exe40⤵
- Executes dropped EXE
PID:3004 -
\??\c:\nhbntb.exec:\nhbntb.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hbnttb.exec:\hbnttb.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\pdpvd.exec:\pdpvd.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\ddjjp.exec:\ddjjp.exe44⤵
- Executes dropped EXE
PID:2572 -
\??\c:\lxlrxxf.exec:\lxlrxxf.exe45⤵
- Executes dropped EXE
PID:2756 -
\??\c:\btnthh.exec:\btnthh.exe46⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jdjjv.exec:\jdjjv.exe47⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pdjjj.exec:\pdjjj.exe48⤵
- Executes dropped EXE
PID:2520 -
\??\c:\fxxfrxf.exec:\fxxfrxf.exe49⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7fxlrrx.exec:\7fxlrrx.exe50⤵
- Executes dropped EXE
PID:3012 -
\??\c:\tnnhnh.exec:\tnnhnh.exe51⤵
- Executes dropped EXE
PID:1676 -
\??\c:\3dddj.exec:\3dddj.exe52⤵
- Executes dropped EXE
PID:2264 -
\??\c:\pjvdd.exec:\pjvdd.exe53⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rrxlllr.exec:\rrxlllr.exe54⤵
- Executes dropped EXE
PID:1360 -
\??\c:\nhbbbt.exec:\nhbbbt.exe55⤵
- Executes dropped EXE
PID:1828 -
\??\c:\bbthhn.exec:\bbthhn.exe56⤵
- Executes dropped EXE
PID:1724 -
\??\c:\dvdpv.exec:\dvdpv.exe57⤵
- Executes dropped EXE
PID:1520 -
\??\c:\pjvjj.exec:\pjvjj.exe58⤵
- Executes dropped EXE
PID:2536 -
\??\c:\rlfrflx.exec:\rlfrflx.exe59⤵
- Executes dropped EXE
PID:1248 -
\??\c:\btnnbb.exec:\btnnbb.exe60⤵
- Executes dropped EXE
PID:2744 -
\??\c:\nhnbnt.exec:\nhnbnt.exe61⤵
- Executes dropped EXE
PID:2044 -
\??\c:\ddpjv.exec:\ddpjv.exe62⤵
- Executes dropped EXE
PID:2720 -
\??\c:\fxflxxf.exec:\fxflxxf.exe63⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rlxxllr.exec:\rlxxllr.exe64⤵
- Executes dropped EXE
PID:2816 -
\??\c:\1nnntt.exec:\1nnntt.exe65⤵
- Executes dropped EXE
PID:564 -
\??\c:\7httht.exec:\7httht.exe66⤵PID:688
-
\??\c:\djpjj.exec:\djpjj.exe67⤵PID:836
-
\??\c:\xlxxxll.exec:\xlxxxll.exe68⤵PID:2020
-
\??\c:\3frxllr.exec:\3frxllr.exe69⤵PID:868
-
\??\c:\3hhbnt.exec:\3hhbnt.exe70⤵PID:1984
-
\??\c:\nhbbhh.exec:\nhbbhh.exe71⤵PID:1980
-
\??\c:\5vjvd.exec:\5vjvd.exe72⤵PID:900
-
\??\c:\jvdpp.exec:\jvdpp.exe73⤵PID:1744
-
\??\c:\5lffllr.exec:\5lffllr.exe74⤵PID:1620
-
\??\c:\tthbht.exec:\tthbht.exe75⤵PID:1808
-
\??\c:\tnbttb.exec:\tnbttb.exe76⤵PID:1212
-
\??\c:\vpppj.exec:\vpppj.exe77⤵PID:2788
-
\??\c:\xllrrxl.exec:\xllrrxl.exe78⤵PID:2916
-
\??\c:\9ffxxlr.exec:\9ffxxlr.exe79⤵PID:1904
-
\??\c:\hbthtb.exec:\hbthtb.exe80⤵PID:2372
-
\??\c:\hbbtnh.exec:\hbbtnh.exe81⤵PID:1644
-
\??\c:\5jvjj.exec:\5jvjj.exe82⤵PID:1852
-
\??\c:\frlrrxx.exec:\frlrrxx.exe83⤵PID:1504
-
\??\c:\9lxflxx.exec:\9lxflxx.exe84⤵PID:2868
-
\??\c:\hbhbnb.exec:\hbhbnb.exe85⤵PID:1976
-
\??\c:\bntbhn.exec:\bntbhn.exe86⤵PID:2660
-
\??\c:\pddjp.exec:\pddjp.exe87⤵PID:2624
-
\??\c:\dvjjp.exec:\dvjjp.exe88⤵PID:2688
-
\??\c:\rxfrxrx.exec:\rxfrxrx.exe89⤵PID:2572
-
\??\c:\hbthtn.exec:\hbthtn.exe90⤵PID:2756
-
\??\c:\httttt.exec:\httttt.exe91⤵PID:2752
-
\??\c:\vjvvj.exec:\vjvvj.exe92⤵PID:2640
-
\??\c:\5lfxrll.exec:\5lfxrll.exe93⤵PID:2496
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe94⤵PID:2524
-
\??\c:\bntbtb.exec:\bntbtb.exe95⤵PID:1712
-
\??\c:\tnbntt.exec:\tnbntt.exe96⤵PID:2972
-
\??\c:\dvdpp.exec:\dvdpp.exe97⤵PID:2164
-
\??\c:\lflxxlr.exec:\lflxxlr.exe98⤵PID:2356
-
\??\c:\xxlfflf.exec:\xxlfflf.exe99⤵PID:344
-
\??\c:\5xxflrx.exec:\5xxflrx.exe100⤵PID:296
-
\??\c:\7tnbhb.exec:\7tnbhb.exe101⤵PID:1932
-
\??\c:\jdjjv.exec:\jdjjv.exe102⤵PID:1176
-
\??\c:\pvvjd.exec:\pvvjd.exe103⤵PID:860
-
\??\c:\rxxrrlx.exec:\rxxrrlx.exe104⤵PID:1684
-
\??\c:\lxflrlr.exec:\lxflrlr.exe105⤵PID:2728
-
\??\c:\tnbhtb.exec:\tnbhtb.exe106⤵PID:2976
-
\??\c:\5tttbh.exec:\5tttbh.exe107⤵PID:1960
-
\??\c:\jjvjv.exec:\jjvjv.exe108⤵PID:2844
-
\??\c:\3pvjd.exec:\3pvjd.exe109⤵PID:1952
-
\??\c:\rlfrfxf.exec:\rlfrfxf.exe110⤵PID:2816
-
\??\c:\fxfrxfl.exec:\fxfrxfl.exe111⤵PID:792
-
\??\c:\tntntb.exec:\tntntb.exe112⤵PID:688
-
\??\c:\thtttb.exec:\thtttb.exe113⤵PID:984
-
\??\c:\vjvvd.exec:\vjvvd.exe114⤵PID:2020
-
\??\c:\jjpdd.exec:\jjpdd.exe115⤵PID:1596
-
\??\c:\lxxxxlf.exec:\lxxxxlf.exe116⤵PID:1544
-
\??\c:\rlxrffl.exec:\rlxrffl.exe117⤵PID:348
-
\??\c:\tnbntn.exec:\tnbntn.exe118⤵PID:880
-
\??\c:\1htbbh.exec:\1htbbh.exe119⤵PID:948
-
\??\c:\7ddjp.exec:\7ddjp.exe120⤵PID:1204
-
\??\c:\5vjpj.exec:\5vjpj.exe121⤵PID:2040
-
\??\c:\9rrfrlf.exec:\9rrfrlf.exe122⤵PID:2244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-