Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 23:18
Behavioral task
behavioral1
Sample
82475d709025c6c127103f1644e1a3cb55a9175f3241271f9b829d59d936db81.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
82475d709025c6c127103f1644e1a3cb55a9175f3241271f9b829d59d936db81.exe
-
Size
74KB
-
MD5
a97612fd5a2199ec851146d78f541c25
-
SHA1
e642d7cd451946183114ce2ff6499d86045e432a
-
SHA256
82475d709025c6c127103f1644e1a3cb55a9175f3241271f9b829d59d936db81
-
SHA512
77fa71fd6441b830a7c7aed47f190ca572690307b058fd06e5582c0bb99317343d6ba85d5f63be5755c78f38a867c32a911ff57db0a3775118e6cb611435e46e
-
SSDEEP
1536:CvQBeOGtrYS3srx93UBWfwC6Ggnouy8Aeb3F7:ChOmTsF93UYfwC6GIoutAeb3l
Malware Config
Signatures
-
Detect Blackmoon payload 35 IoCs
resource yara_rule behavioral1/memory/2556-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1212-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/316-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/292-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1296-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/984-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-363-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1708-388-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-389-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2172-414-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1228-433-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-482-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/568-504-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/908-521-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1256-564-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1472-669-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-682-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-1061-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1160-1144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2556-0-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x000a000000012289-5.dat UPX behavioral1/memory/2556-7-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2760-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0033000000015cdf-18.dat UPX behavioral1/memory/2616-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0008000000015d12-24.dat UPX behavioral1/memory/2704-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2704-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0007000000015d3b-36.dat UPX behavioral1/memory/1212-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0007000000015d53-43.dat UPX behavioral1/memory/2512-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0007000000015d73-54.dat UPX behavioral1/files/0x0009000000015d83-61.dat UPX behavioral1/memory/2520-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2492-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0007000000016835-72.dat UPX behavioral1/files/0x0006000000016a8a-81.dat UPX behavioral1/memory/2524-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2948-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1748-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000016c52-91.dat UPX behavioral1/files/0x0006000000016c6f-98.dat UPX behavioral1/memory/2768-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2768-108-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000016c78-109.dat UPX behavioral1/files/0x0006000000016cc1-116.dat UPX behavioral1/memory/1536-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000016ceb-125.dat UPX behavioral1/memory/884-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/316-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/316-137-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000016d17-135.dat UPX behavioral1/files/0x0006000000016d2a-145.dat UPX behavioral1/memory/1584-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000016d32-153.dat UPX behavioral1/memory/1584-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000016d3b-164.dat UPX behavioral1/memory/292-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000016d43-171.dat UPX behavioral1/files/0x0006000000016d4b-179.dat UPX behavioral1/files/0x0006000000016d5f-187.dat UPX behavioral1/memory/2436-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000016d64-197.dat UPX behavioral1/files/0x0006000000016d68-204.dat UPX behavioral1/memory/2664-206-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000016d6f-213.dat UPX behavioral1/files/0x0006000000016d8b-221.dat UPX behavioral1/memory/1740-223-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000016d9f-231.dat UPX behavioral1/files/0x0006000000016dba-239.dat UPX behavioral1/memory/1296-241-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/files/0x0006000000016dc8-248.dat UPX behavioral1/files/0x0006000000016dd1-254.dat UPX behavioral1/files/0x0006000000016ddc-264.dat UPX behavioral1/files/0x0006000000016de3-272.dat UPX behavioral1/files/0x0033000000015ce8-280.dat UPX behavioral1/memory/984-288-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/984-295-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2568-315-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2480-363-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1708-388-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2780-389-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2760 xxrxffr.exe 2616 9nnnhn.exe 2704 pvjpp.exe 1212 3xrrrll.exe 2512 tnbnbn.exe 2520 nbhhbh.exe 2492 ddpjj.exe 2948 9pjjj.exe 2524 lfrflrx.exe 1748 hbhhnt.exe 2768 nhbnnt.exe 1536 pjdpp.exe 884 3rlrffr.exe 316 1htthh.exe 1932 1pdvj.exe 1584 3jddj.exe 292 xrlrxxx.exe 1448 hbnhhn.exe 2572 hbnnnh.exe 2436 vjpdp.exe 880 lxflrrl.exe 2664 rfrllrr.exe 1416 thhhbh.exe 1612 vjppv.exe 1740 9dvdp.exe 1252 lxrrxrr.exe 1296 nthhnh.exe 2016 jvpvp.exe 2292 pdpvd.exe 1256 lfrrrrx.exe 2200 3lfffff.exe 1924 ntntht.exe 984 vpdjp.exe 2188 jjdpp.exe 2756 fxlrlrf.exe 2828 frxfrlx.exe 2568 9nnhnn.exe 2992 htbnnh.exe 2700 1vjjp.exe 2600 dppvp.exe 2748 xlxflrl.exe 1212 xlxlxff.exe 2612 nbtttb.exe 2480 nbhtnn.exe 2548 1jdjv.exe 2152 pdppp.exe 2924 xrffffl.exe 1708 lxffllr.exe 2780 bnbtnh.exe 1748 3tnntb.exe 2776 pdppp.exe 2172 3jdpp.exe 2184 5pdvd.exe 884 7flxfff.exe 1228 xlxxrfr.exe 1608 3nbbbh.exe 536 3nbntb.exe 2448 xrxrxfx.exe 1844 5lrfrxx.exe 2944 bthhnn.exe 1448 hbtnbn.exe 2252 dpjdp.exe 2420 jvpdd.exe 2456 lxfflrr.exe -
resource yara_rule behavioral1/memory/2556-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x000a000000012289-5.dat upx behavioral1/memory/2556-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0033000000015cdf-18.dat upx behavioral1/memory/2616-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0008000000015d12-24.dat upx behavioral1/memory/2704-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0007000000015d3b-36.dat upx behavioral1/memory/1212-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0007000000015d53-43.dat upx behavioral1/memory/2512-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0007000000015d73-54.dat upx behavioral1/files/0x0009000000015d83-61.dat upx behavioral1/memory/2520-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0007000000016835-72.dat upx behavioral1/files/0x0006000000016a8a-81.dat upx behavioral1/memory/2524-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2948-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000016c52-91.dat upx behavioral1/files/0x0006000000016c6f-98.dat upx behavioral1/memory/2768-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000016c78-109.dat upx behavioral1/files/0x0006000000016cc1-116.dat upx behavioral1/memory/1536-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000016ceb-125.dat upx behavioral1/memory/884-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/316-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/316-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000016d17-135.dat upx behavioral1/files/0x0006000000016d2a-145.dat upx behavioral1/memory/1584-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000016d32-153.dat upx behavioral1/memory/1584-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000016d3b-164.dat upx behavioral1/memory/292-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000016d43-171.dat upx behavioral1/files/0x0006000000016d4b-179.dat upx behavioral1/files/0x0006000000016d5f-187.dat upx behavioral1/memory/2436-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000016d64-197.dat upx behavioral1/files/0x0006000000016d68-204.dat upx behavioral1/memory/2664-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000016d6f-213.dat upx behavioral1/files/0x0006000000016d8b-221.dat upx behavioral1/memory/1740-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000016d9f-231.dat upx behavioral1/files/0x0006000000016dba-239.dat upx behavioral1/memory/1296-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/files/0x0006000000016dc8-248.dat upx behavioral1/files/0x0006000000016dd1-254.dat upx behavioral1/files/0x0006000000016ddc-264.dat upx behavioral1/files/0x0006000000016de3-272.dat upx behavioral1/files/0x0033000000015ce8-280.dat upx behavioral1/memory/984-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/984-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-363-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1708-388-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-389-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2556 wrote to memory of 2760 2556 82475d709025c6c127103f1644e1a3cb55a9175f3241271f9b829d59d936db81.exe 28 PID 2556 wrote to memory of 2760 2556 82475d709025c6c127103f1644e1a3cb55a9175f3241271f9b829d59d936db81.exe 28 PID 2556 wrote to memory of 2760 2556 82475d709025c6c127103f1644e1a3cb55a9175f3241271f9b829d59d936db81.exe 28 PID 2556 wrote to memory of 2760 2556 82475d709025c6c127103f1644e1a3cb55a9175f3241271f9b829d59d936db81.exe 28 PID 2760 wrote to memory of 2616 2760 xxrxffr.exe 29 PID 2760 wrote to memory of 2616 2760 xxrxffr.exe 29 PID 2760 wrote to memory of 2616 2760 xxrxffr.exe 29 PID 2760 wrote to memory of 2616 2760 xxrxffr.exe 29 PID 2616 wrote to memory of 2704 2616 9nnnhn.exe 30 PID 2616 wrote to memory of 2704 2616 9nnnhn.exe 30 PID 2616 wrote to memory of 2704 2616 9nnnhn.exe 30 PID 2616 wrote to memory of 2704 2616 9nnnhn.exe 30 PID 2704 wrote to memory of 1212 2704 pvjpp.exe 31 PID 2704 wrote to memory of 1212 2704 pvjpp.exe 31 PID 2704 wrote to memory of 1212 2704 pvjpp.exe 31 PID 2704 wrote to memory of 1212 2704 pvjpp.exe 31 PID 1212 wrote to memory of 2512 1212 3xrrrll.exe 32 PID 1212 wrote to memory of 2512 1212 3xrrrll.exe 32 PID 1212 wrote to memory of 2512 1212 3xrrrll.exe 32 PID 1212 wrote to memory of 2512 1212 3xrrrll.exe 32 PID 2512 wrote to memory of 2520 2512 tnbnbn.exe 33 PID 2512 wrote to memory of 2520 2512 tnbnbn.exe 33 PID 2512 wrote to memory of 2520 2512 tnbnbn.exe 33 PID 2512 wrote to memory of 2520 2512 tnbnbn.exe 33 PID 2520 wrote to memory of 2492 2520 nbhhbh.exe 34 PID 2520 wrote to memory of 2492 2520 nbhhbh.exe 34 PID 2520 wrote to memory of 2492 2520 nbhhbh.exe 34 PID 2520 wrote to memory of 2492 2520 nbhhbh.exe 34 PID 2492 wrote to memory of 2948 2492 ddpjj.exe 35 PID 2492 wrote to memory of 2948 2492 ddpjj.exe 35 PID 2492 wrote to memory of 2948 2492 ddpjj.exe 35 PID 2492 wrote to memory of 2948 2492 ddpjj.exe 35 PID 2948 wrote to memory of 2524 2948 9pjjj.exe 36 PID 2948 wrote to memory of 2524 2948 9pjjj.exe 36 PID 2948 wrote to memory of 2524 2948 9pjjj.exe 36 PID 2948 wrote to memory of 2524 2948 9pjjj.exe 36 PID 2524 wrote to memory of 1748 2524 lfrflrx.exe 37 PID 2524 wrote to memory of 1748 2524 lfrflrx.exe 37 PID 2524 wrote to memory of 1748 2524 lfrflrx.exe 37 PID 2524 wrote to memory of 1748 2524 lfrflrx.exe 37 PID 1748 wrote to memory of 2768 1748 hbhhnt.exe 38 PID 1748 wrote to memory of 2768 1748 hbhhnt.exe 38 PID 1748 wrote to memory of 2768 1748 hbhhnt.exe 38 PID 1748 wrote to memory of 2768 1748 hbhhnt.exe 38 PID 2768 wrote to memory of 1536 2768 nhbnnt.exe 39 PID 2768 wrote to memory of 1536 2768 nhbnnt.exe 39 PID 2768 wrote to memory of 1536 2768 nhbnnt.exe 39 PID 2768 wrote to memory of 1536 2768 nhbnnt.exe 39 PID 1536 wrote to memory of 884 1536 pjdpp.exe 40 PID 1536 wrote to memory of 884 1536 pjdpp.exe 40 PID 1536 wrote to memory of 884 1536 pjdpp.exe 40 PID 1536 wrote to memory of 884 1536 pjdpp.exe 40 PID 884 wrote to memory of 316 884 3rlrffr.exe 41 PID 884 wrote to memory of 316 884 3rlrffr.exe 41 PID 884 wrote to memory of 316 884 3rlrffr.exe 41 PID 884 wrote to memory of 316 884 3rlrffr.exe 41 PID 316 wrote to memory of 1932 316 1htthh.exe 42 PID 316 wrote to memory of 1932 316 1htthh.exe 42 PID 316 wrote to memory of 1932 316 1htthh.exe 42 PID 316 wrote to memory of 1932 316 1htthh.exe 42 PID 1932 wrote to memory of 1584 1932 1pdvj.exe 43 PID 1932 wrote to memory of 1584 1932 1pdvj.exe 43 PID 1932 wrote to memory of 1584 1932 1pdvj.exe 43 PID 1932 wrote to memory of 1584 1932 1pdvj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\82475d709025c6c127103f1644e1a3cb55a9175f3241271f9b829d59d936db81.exe"C:\Users\Admin\AppData\Local\Temp\82475d709025c6c127103f1644e1a3cb55a9175f3241271f9b829d59d936db81.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\xxrxffr.exec:\xxrxffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\9nnnhn.exec:\9nnnhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\pvjpp.exec:\pvjpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\3xrrrll.exec:\3xrrrll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\tnbnbn.exec:\tnbnbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\nbhhbh.exec:\nbhhbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\ddpjj.exec:\ddpjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\9pjjj.exec:\9pjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\lfrflrx.exec:\lfrflrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\hbhhnt.exec:\hbhhnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\nhbnnt.exec:\nhbnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\pjdpp.exec:\pjdpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\3rlrffr.exec:\3rlrffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\1htthh.exec:\1htthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\1pdvj.exec:\1pdvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\3jddj.exec:\3jddj.exe17⤵
- Executes dropped EXE
PID:1584 -
\??\c:\xrlrxxx.exec:\xrlrxxx.exe18⤵
- Executes dropped EXE
PID:292 -
\??\c:\hbnhhn.exec:\hbnhhn.exe19⤵
- Executes dropped EXE
PID:1448 -
\??\c:\hbnnnh.exec:\hbnnnh.exe20⤵
- Executes dropped EXE
PID:2572 -
\??\c:\vjpdp.exec:\vjpdp.exe21⤵
- Executes dropped EXE
PID:2436 -
\??\c:\lxflrrl.exec:\lxflrrl.exe22⤵
- Executes dropped EXE
PID:880 -
\??\c:\rfrllrr.exec:\rfrllrr.exe23⤵
- Executes dropped EXE
PID:2664 -
\??\c:\thhhbh.exec:\thhhbh.exe24⤵
- Executes dropped EXE
PID:1416 -
\??\c:\vjppv.exec:\vjppv.exe25⤵
- Executes dropped EXE
PID:1612 -
\??\c:\9dvdp.exec:\9dvdp.exe26⤵
- Executes dropped EXE
PID:1740 -
\??\c:\lxrrxrr.exec:\lxrrxrr.exe27⤵
- Executes dropped EXE
PID:1252 -
\??\c:\nthhnh.exec:\nthhnh.exe28⤵
- Executes dropped EXE
PID:1296 -
\??\c:\jvpvp.exec:\jvpvp.exe29⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pdpvd.exec:\pdpvd.exe30⤵
- Executes dropped EXE
PID:2292 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe31⤵
- Executes dropped EXE
PID:1256 -
\??\c:\3lfffff.exec:\3lfffff.exe32⤵
- Executes dropped EXE
PID:2200 -
\??\c:\ntntht.exec:\ntntht.exe33⤵
- Executes dropped EXE
PID:1924 -
\??\c:\vpdjp.exec:\vpdjp.exe34⤵
- Executes dropped EXE
PID:984 -
\??\c:\jjdpp.exec:\jjdpp.exe35⤵
- Executes dropped EXE
PID:2188 -
\??\c:\fxlrlrf.exec:\fxlrlrf.exe36⤵
- Executes dropped EXE
PID:2756 -
\??\c:\frxfrlx.exec:\frxfrlx.exe37⤵
- Executes dropped EXE
PID:2828 -
\??\c:\9nnhnn.exec:\9nnhnn.exe38⤵
- Executes dropped EXE
PID:2568 -
\??\c:\htbnnh.exec:\htbnnh.exe39⤵
- Executes dropped EXE
PID:2992 -
\??\c:\1vjjp.exec:\1vjjp.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\dppvp.exec:\dppvp.exe41⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xlxflrl.exec:\xlxflrl.exe42⤵
- Executes dropped EXE
PID:2748 -
\??\c:\xlxlxff.exec:\xlxlxff.exe43⤵
- Executes dropped EXE
PID:1212 -
\??\c:\nbtttb.exec:\nbtttb.exe44⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nbhtnn.exec:\nbhtnn.exe45⤵
- Executes dropped EXE
PID:2480 -
\??\c:\1jdjv.exec:\1jdjv.exe46⤵
- Executes dropped EXE
PID:2548 -
\??\c:\pdppp.exec:\pdppp.exe47⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xrffffl.exec:\xrffffl.exe48⤵
- Executes dropped EXE
PID:2924 -
\??\c:\lxffllr.exec:\lxffllr.exe49⤵
- Executes dropped EXE
PID:1708 -
\??\c:\bnbtnh.exec:\bnbtnh.exe50⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3tnntb.exec:\3tnntb.exe51⤵
- Executes dropped EXE
PID:1748 -
\??\c:\pdppp.exec:\pdppp.exe52⤵
- Executes dropped EXE
PID:2776 -
\??\c:\3jdpp.exec:\3jdpp.exe53⤵
- Executes dropped EXE
PID:2172 -
\??\c:\5pdvd.exec:\5pdvd.exe54⤵
- Executes dropped EXE
PID:2184 -
\??\c:\7flxfff.exec:\7flxfff.exe55⤵
- Executes dropped EXE
PID:884 -
\??\c:\xlxxrfr.exec:\xlxxrfr.exe56⤵
- Executes dropped EXE
PID:1228 -
\??\c:\3nbbbh.exec:\3nbbbh.exe57⤵
- Executes dropped EXE
PID:1608 -
\??\c:\3nbntb.exec:\3nbntb.exe58⤵
- Executes dropped EXE
PID:536 -
\??\c:\xrxrxfx.exec:\xrxrxfx.exe59⤵
- Executes dropped EXE
PID:2448 -
\??\c:\5lrfrxx.exec:\5lrfrxx.exe60⤵
- Executes dropped EXE
PID:1844 -
\??\c:\bthhnn.exec:\bthhnn.exe61⤵
- Executes dropped EXE
PID:2944 -
\??\c:\hbtnbn.exec:\hbtnbn.exe62⤵
- Executes dropped EXE
PID:1448 -
\??\c:\dpjdp.exec:\dpjdp.exe63⤵
- Executes dropped EXE
PID:2252 -
\??\c:\jvpdd.exec:\jvpdd.exe64⤵
- Executes dropped EXE
PID:2420 -
\??\c:\lxfflrr.exec:\lxfflrr.exe65⤵
- Executes dropped EXE
PID:2456 -
\??\c:\xlrrrxx.exec:\xlrrrxx.exe66⤵PID:1208
-
\??\c:\3bnttn.exec:\3bnttn.exe67⤵PID:2028
-
\??\c:\bnbbtt.exec:\bnbbtt.exe68⤵PID:568
-
\??\c:\vpppj.exec:\vpppj.exe69⤵PID:1744
-
\??\c:\djvvv.exec:\djvvv.exe70⤵PID:908
-
\??\c:\3rrrxlr.exec:\3rrrxlr.exe71⤵PID:1692
-
\??\c:\1xlxfrr.exec:\1xlxfrr.exe72⤵PID:1572
-
\??\c:\thbntb.exec:\thbntb.exe73⤵PID:1012
-
\??\c:\btbtnh.exec:\btbtnh.exe74⤵PID:2296
-
\??\c:\dpjvd.exec:\dpjvd.exe75⤵PID:2164
-
\??\c:\pddvj.exec:\pddvj.exe76⤵PID:1852
-
\??\c:\3jdvd.exec:\3jdvd.exe77⤵PID:1256
-
\??\c:\rrlfffr.exec:\rrlfffr.exe78⤵PID:2200
-
\??\c:\lxrxfxx.exec:\lxrxfxx.exe79⤵PID:2864
-
\??\c:\7hbntb.exec:\7hbntb.exe80⤵PID:1660
-
\??\c:\pdppp.exec:\pdppp.exe81⤵PID:2072
-
\??\c:\pjdjj.exec:\pjdjj.exe82⤵PID:2996
-
\??\c:\dpvdj.exec:\dpvdj.exe83⤵PID:2356
-
\??\c:\1fxxxxl.exec:\1fxxxxl.exe84⤵PID:2624
-
\??\c:\lfrfrxx.exec:\lfrfrxx.exe85⤵PID:2696
-
\??\c:\hthhhn.exec:\hthhhn.exe86⤵PID:2844
-
\??\c:\1hhnhn.exec:\1hhnhn.exe87⤵PID:2708
-
\??\c:\5dddd.exec:\5dddd.exe88⤵PID:2732
-
\??\c:\jvpjv.exec:\jvpjv.exe89⤵PID:2500
-
\??\c:\jdjpv.exec:\jdjpv.exe90⤵PID:2476
-
\??\c:\rfxffxf.exec:\rfxffxf.exe91⤵PID:2472
-
\??\c:\btthnh.exec:\btthnh.exe92⤵PID:2496
-
\??\c:\htbhnt.exec:\htbhnt.exe93⤵PID:2528
-
\??\c:\pjdvd.exec:\pjdvd.exe94⤵PID:1604
-
\??\c:\vpjvd.exec:\vpjvd.exe95⤵PID:1472
-
\??\c:\9vvdd.exec:\9vvdd.exe96⤵PID:344
-
\??\c:\5lfrrrr.exec:\5lfrrrr.exe97⤵PID:2712
-
\??\c:\1frrflx.exec:\1frrflx.exe98⤵PID:2196
-
\??\c:\7btbtn.exec:\7btbtn.exe99⤵PID:1216
-
\??\c:\dvpvj.exec:\dvpvj.exe100⤵PID:800
-
\??\c:\pjvjd.exec:\pjvjd.exe101⤵PID:1872
-
\??\c:\vjvdp.exec:\vjvdp.exe102⤵PID:2208
-
\??\c:\3xllrlf.exec:\3xllrlf.exe103⤵PID:1552
-
\??\c:\rlxfxlr.exec:\rlxfxlr.exe104⤵PID:536
-
\??\c:\7nnbnb.exec:\7nnbnb.exe105⤵PID:1452
-
\??\c:\pdjpv.exec:\pdjpv.exe106⤵PID:292
-
\??\c:\ddpdj.exec:\ddpdj.exe107⤵PID:3040
-
\??\c:\9xfrrff.exec:\9xfrrff.exe108⤵PID:2900
-
\??\c:\rxlxfff.exec:\rxlxfff.exe109⤵PID:988
-
\??\c:\9bnbhh.exec:\9bnbhh.exe110⤵PID:2248
-
\??\c:\tnbhtb.exec:\tnbhtb.exe111⤵PID:2788
-
\??\c:\dvjpj.exec:\dvjpj.exe112⤵PID:1076
-
\??\c:\jvppp.exec:\jvppp.exe113⤵PID:692
-
\??\c:\xfrlrrr.exec:\xfrlrrr.exe114⤵PID:2108
-
\??\c:\lxlxflf.exec:\lxlxflf.exe115⤵PID:288
-
\??\c:\tbhhnh.exec:\tbhhnh.exe116⤵PID:948
-
\??\c:\ntbbtt.exec:\ntbbtt.exe117⤵PID:1464
-
\??\c:\1nbhht.exec:\1nbhht.exe118⤵PID:1692
-
\??\c:\jdjpd.exec:\jdjpd.exe119⤵PID:852
-
\??\c:\djpvv.exec:\djpvv.exe120⤵PID:1008
-
\??\c:\xlfrrxf.exec:\xlfrrxf.exe121⤵PID:632
-
\??\c:\3frrffl.exec:\3frrffl.exe122⤵PID:592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-