Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 10:42
Behavioral task
behavioral1
Sample
79dce253d33193d70414671e5858558f537736835b19f384706bbe57624f1d38.exe
Resource
win7-20240508-en
General
-
Target
79dce253d33193d70414671e5858558f537736835b19f384706bbe57624f1d38.exe
-
Size
487KB
-
MD5
d0f2ec2c6d797546144da8fd4cebc730
-
SHA1
e3e2e9133122f5a714fb08c8e0d9a0a4c9d2164e
-
SHA256
79dce253d33193d70414671e5858558f537736835b19f384706bbe57624f1d38
-
SHA512
5d02f90c4e37b269916e180de09122fe6ae8916c2ad9cb14b443f6e9ae8719d8f972b1fe855e7d263b451d3d2101d86506a373e7ecaba3bdda139637c592949b
-
SSDEEP
6144:mcm7ImGddXv/VWrXD486jCpoAhlq1mEjBqLyOSlhNFF23yg:I7TcfNWj168w1VjsyvhNFF2ig
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/1632-7-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1792-17-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2700-31-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/3060-28-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2704-41-0x00000000001B0000-0x00000000001DE000-memory.dmp family_blackmoon behavioral1/memory/2724-55-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2956-64-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2448-67-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2016-83-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1496-100-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1368-108-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2740-120-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2116-128-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/316-137-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1720-156-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/844-173-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2872-182-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/664-207-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/628-215-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1720-224-0x00000000001B0000-0x00000000001DE000-memory.dmp family_blackmoon behavioral1/memory/1408-227-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2560-329-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/3004-330-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2612-337-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2612-345-0x0000000000220000-0x000000000024E000-memory.dmp family_blackmoon behavioral1/memory/2032-372-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1716-387-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1648-423-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1532-443-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2920-456-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2192-484-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/300-497-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2368-522-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/644-544-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1576-683-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2928-738-0x0000000000320000-0x000000000034E000-memory.dmp family_blackmoon behavioral1/memory/2888-941-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\5btbnn.exe family_berbew C:\7lxxlxr.exe family_berbew C:\9dvdj.exe family_berbew C:\pvjjv.exe family_berbew C:\5rrrflx.exe family_berbew C:\3pjjv.exe family_berbew C:\bbthth.exe family_berbew C:\nhhtnt.exe family_berbew C:\btntbh.exe family_berbew C:\xrrxrxr.exe family_berbew C:\hhbhbb.exe family_berbew C:\9vpvj.exe family_berbew C:\bbnthh.exe family_berbew C:\fxlxllx.exe family_berbew C:\tnhhnb.exe family_berbew C:\xrllrxf.exe family_berbew C:\vjvvp.exe family_berbew C:\3xxflrl.exe family_berbew C:\pjdpd.exe family_berbew C:\xxrfxxl.exe family_berbew C:\pppdp.exe family_berbew C:\jppvv.exe family_berbew C:\nhbbhh.exe family_berbew C:\fxlrfrr.exe family_berbew \??\c:\bbbttb.exe family_berbew C:\3pddj.exe family_berbew \??\c:\nnnbbn.exe family_berbew C:\5vdjj.exe family_berbew C:\nhbhtt.exe family_berbew C:\1dvdj.exe family_berbew C:\nbbhbn.exe family_berbew C:\3vpdj.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
5btbnn.exe7lxxlxr.exe9dvdj.exepvjjv.exe5rrrflx.exe3pjjv.exebbthth.exenhhtnt.exebtntbh.exexrrxrxr.exehhbhbb.exe9vpvj.exebbnthh.exefxlxllx.exetnhhnb.exexrllrxf.exevjvvp.exe3xxflrl.exepjdpd.exexxrfxxl.exepppdp.exejppvv.exenhbbhh.exefxlrfrr.exebbbttb.exe3pddj.exennnbbn.exe5vdjj.exenhbhtt.exe1dvdj.exenbbhbn.exe3vpdj.exellrllrx.exebtnbth.exejdvdj.exe1lflrrx.exetbthtt.exe1bbbhh.exejjdpd.exe7xxlffr.exehhhnbb.exepvpdv.exe5lffrrx.exe1hhhnt.exevpdpv.exejdvdj.exe1lflllr.exepjjjv.exelfrrxfl.exetthhht.exethbhnn.exe3fxlxxl.exe5xrflrx.exennbhnn.exe3dppv.exerlllrxr.exentthtb.exebbtttt.exepjdjd.exexllfxfl.exe5bntbh.exeddvdj.exepjddp.exerrlrxxf.exepid process 1792 5btbnn.exe 3060 7lxxlxr.exe 2700 9dvdj.exe 2704 pvjjv.exe 2724 5rrrflx.exe 2956 3pjjv.exe 2448 bbthth.exe 2016 nhhtnt.exe 2164 btntbh.exe 1496 xrrxrxr.exe 1368 hhbhbb.exe 2740 9vpvj.exe 2116 bbnthh.exe 316 fxlxllx.exe 344 tnhhnb.exe 1720 xrllrxf.exe 1132 vjvvp.exe 844 3xxflrl.exe 2872 pjdpd.exe 2148 xxrfxxl.exe 1604 pppdp.exe 664 jppvv.exe 628 nhbbhh.exe 1408 fxlrfrr.exe 2660 bbbttb.exe 940 3pddj.exe 340 nnnbbn.exe 896 5vdjj.exe 2840 nhbhtt.exe 1928 1dvdj.exe 1100 nbbhbn.exe 2400 3vpdj.exe 1248 llrllrx.exe 2008 btnbth.exe 2404 jdvdj.exe 1272 1lflrrx.exe 2580 tbthtt.exe 2560 1bbbhh.exe 3004 jjdpd.exe 2612 7xxlffr.exe 2472 hhhnbb.exe 2496 pvpdv.exe 2956 5lffrrx.exe 2888 1hhhnt.exe 2032 vpdpv.exe 1716 jdvdj.exe 1576 1lflllr.exe 2692 pjjjv.exe 1860 lfrrxfl.exe 348 tthhht.exe 1648 thbhnn.exe 800 3fxlxxl.exe 2132 5xrflrx.exe 1532 nnbhnn.exe 1380 3dppv.exe 1424 rlllrxr.exe 2920 ntthtb.exe 2932 bbtttt.exe 2912 pjdjd.exe 2192 xllfxfl.exe 264 5bntbh.exe 1104 ddvdj.exe 300 pjddp.exe 804 rrlrxxf.exe -
Processes:
resource yara_rule behavioral1/memory/1632-7-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1792-9-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1792-17-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/3060-19-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2700-31-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/3060-28-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2724-55-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2956-64-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2448-67-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2016-83-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1496-100-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1368-108-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2740-120-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2116-128-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/316-137-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1720-156-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/844-173-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2872-182-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/664-207-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/628-215-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1408-227-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2008-297-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2560-329-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/3004-330-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2612-337-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2956-359-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2032-372-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1716-379-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1716-387-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1576-388-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2692-396-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1860-403-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1648-416-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1648-423-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2132-430-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1532-443-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2920-456-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2932-464-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2192-477-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2192-484-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/300-497-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2368-522-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1552-530-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/644-537-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/644-544-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/688-545-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2944-559-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1508-584-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2700-610-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2504-636-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2956-649-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2032-662-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1576-683-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1200-755-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2296-763-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1464-795-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1220-809-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/680-822-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1684-847-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2940-860-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2700-897-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2616-910-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2888-941-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2748-960-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
79dce253d33193d70414671e5858558f537736835b19f384706bbe57624f1d38.exe5btbnn.exe7lxxlxr.exe9dvdj.exepvjjv.exe5rrrflx.exe3pjjv.exebbthth.exenhhtnt.exebtntbh.exexrrxrxr.exehhbhbb.exe9vpvj.exebbnthh.exefxlxllx.exetnhhnb.exedescription pid process target process PID 1632 wrote to memory of 1792 1632 79dce253d33193d70414671e5858558f537736835b19f384706bbe57624f1d38.exe 5btbnn.exe PID 1632 wrote to memory of 1792 1632 79dce253d33193d70414671e5858558f537736835b19f384706bbe57624f1d38.exe 5btbnn.exe PID 1632 wrote to memory of 1792 1632 79dce253d33193d70414671e5858558f537736835b19f384706bbe57624f1d38.exe 5btbnn.exe PID 1632 wrote to memory of 1792 1632 79dce253d33193d70414671e5858558f537736835b19f384706bbe57624f1d38.exe 5btbnn.exe PID 1792 wrote to memory of 3060 1792 5btbnn.exe 7lxxlxr.exe PID 1792 wrote to memory of 3060 1792 5btbnn.exe 7lxxlxr.exe PID 1792 wrote to memory of 3060 1792 5btbnn.exe 7lxxlxr.exe PID 1792 wrote to memory of 3060 1792 5btbnn.exe 7lxxlxr.exe PID 3060 wrote to memory of 2700 3060 7lxxlxr.exe 9dvdj.exe PID 3060 wrote to memory of 2700 3060 7lxxlxr.exe 9dvdj.exe PID 3060 wrote to memory of 2700 3060 7lxxlxr.exe 9dvdj.exe PID 3060 wrote to memory of 2700 3060 7lxxlxr.exe 9dvdj.exe PID 2700 wrote to memory of 2704 2700 9dvdj.exe pvjjv.exe PID 2700 wrote to memory of 2704 2700 9dvdj.exe pvjjv.exe PID 2700 wrote to memory of 2704 2700 9dvdj.exe pvjjv.exe PID 2700 wrote to memory of 2704 2700 9dvdj.exe pvjjv.exe PID 2704 wrote to memory of 2724 2704 pvjjv.exe 5rrrflx.exe PID 2704 wrote to memory of 2724 2704 pvjjv.exe 5rrrflx.exe PID 2704 wrote to memory of 2724 2704 pvjjv.exe 5rrrflx.exe PID 2704 wrote to memory of 2724 2704 pvjjv.exe 5rrrflx.exe PID 2724 wrote to memory of 2956 2724 5rrrflx.exe 3pjjv.exe PID 2724 wrote to memory of 2956 2724 5rrrflx.exe 3pjjv.exe PID 2724 wrote to memory of 2956 2724 5rrrflx.exe 3pjjv.exe PID 2724 wrote to memory of 2956 2724 5rrrflx.exe 3pjjv.exe PID 2956 wrote to memory of 2448 2956 3pjjv.exe bbthth.exe PID 2956 wrote to memory of 2448 2956 3pjjv.exe bbthth.exe PID 2956 wrote to memory of 2448 2956 3pjjv.exe bbthth.exe PID 2956 wrote to memory of 2448 2956 3pjjv.exe bbthth.exe PID 2448 wrote to memory of 2016 2448 bbthth.exe nhhtnt.exe PID 2448 wrote to memory of 2016 2448 bbthth.exe nhhtnt.exe PID 2448 wrote to memory of 2016 2448 bbthth.exe nhhtnt.exe PID 2448 wrote to memory of 2016 2448 bbthth.exe nhhtnt.exe PID 2016 wrote to memory of 2164 2016 nhhtnt.exe btntbh.exe PID 2016 wrote to memory of 2164 2016 nhhtnt.exe btntbh.exe PID 2016 wrote to memory of 2164 2016 nhhtnt.exe btntbh.exe PID 2016 wrote to memory of 2164 2016 nhhtnt.exe btntbh.exe PID 2164 wrote to memory of 1496 2164 btntbh.exe xrrxrxr.exe PID 2164 wrote to memory of 1496 2164 btntbh.exe xrrxrxr.exe PID 2164 wrote to memory of 1496 2164 btntbh.exe xrrxrxr.exe PID 2164 wrote to memory of 1496 2164 btntbh.exe xrrxrxr.exe PID 1496 wrote to memory of 1368 1496 xrrxrxr.exe hhbhbb.exe PID 1496 wrote to memory of 1368 1496 xrrxrxr.exe hhbhbb.exe PID 1496 wrote to memory of 1368 1496 xrrxrxr.exe hhbhbb.exe PID 1496 wrote to memory of 1368 1496 xrrxrxr.exe hhbhbb.exe PID 1368 wrote to memory of 2740 1368 hhbhbb.exe 9vpvj.exe PID 1368 wrote to memory of 2740 1368 hhbhbb.exe 9vpvj.exe PID 1368 wrote to memory of 2740 1368 hhbhbb.exe 9vpvj.exe PID 1368 wrote to memory of 2740 1368 hhbhbb.exe 9vpvj.exe PID 2740 wrote to memory of 2116 2740 9vpvj.exe bbnthh.exe PID 2740 wrote to memory of 2116 2740 9vpvj.exe bbnthh.exe PID 2740 wrote to memory of 2116 2740 9vpvj.exe bbnthh.exe PID 2740 wrote to memory of 2116 2740 9vpvj.exe bbnthh.exe PID 2116 wrote to memory of 316 2116 bbnthh.exe fxlxllx.exe PID 2116 wrote to memory of 316 2116 bbnthh.exe fxlxllx.exe PID 2116 wrote to memory of 316 2116 bbnthh.exe fxlxllx.exe PID 2116 wrote to memory of 316 2116 bbnthh.exe fxlxllx.exe PID 316 wrote to memory of 344 316 fxlxllx.exe tnhhnb.exe PID 316 wrote to memory of 344 316 fxlxllx.exe tnhhnb.exe PID 316 wrote to memory of 344 316 fxlxllx.exe tnhhnb.exe PID 316 wrote to memory of 344 316 fxlxllx.exe tnhhnb.exe PID 344 wrote to memory of 1720 344 tnhhnb.exe xrllrxf.exe PID 344 wrote to memory of 1720 344 tnhhnb.exe xrllrxf.exe PID 344 wrote to memory of 1720 344 tnhhnb.exe xrllrxf.exe PID 344 wrote to memory of 1720 344 tnhhnb.exe xrllrxf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79dce253d33193d70414671e5858558f537736835b19f384706bbe57624f1d38.exe"C:\Users\Admin\AppData\Local\Temp\79dce253d33193d70414671e5858558f537736835b19f384706bbe57624f1d38.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\5btbnn.exec:\5btbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\7lxxlxr.exec:\7lxxlxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\9dvdj.exec:\9dvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\pvjjv.exec:\pvjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\5rrrflx.exec:\5rrrflx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\3pjjv.exec:\3pjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\bbthth.exec:\bbthth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\nhhtnt.exec:\nhhtnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\btntbh.exec:\btntbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\xrrxrxr.exec:\xrrxrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\hhbhbb.exec:\hhbhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\9vpvj.exec:\9vpvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\bbnthh.exec:\bbnthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\fxlxllx.exec:\fxlxllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\tnhhnb.exec:\tnhhnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\xrllrxf.exec:\xrllrxf.exe17⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vjvvp.exec:\vjvvp.exe18⤵
- Executes dropped EXE
PID:1132 -
\??\c:\3xxflrl.exec:\3xxflrl.exe19⤵
- Executes dropped EXE
PID:844 -
\??\c:\pjdpd.exec:\pjdpd.exe20⤵
- Executes dropped EXE
PID:2872 -
\??\c:\xxrfxxl.exec:\xxrfxxl.exe21⤵
- Executes dropped EXE
PID:2148 -
\??\c:\pppdp.exec:\pppdp.exe22⤵
- Executes dropped EXE
PID:1604 -
\??\c:\jppvv.exec:\jppvv.exe23⤵
- Executes dropped EXE
PID:664 -
\??\c:\nhbbhh.exec:\nhbbhh.exe24⤵
- Executes dropped EXE
PID:628 -
\??\c:\fxlrfrr.exec:\fxlrfrr.exe25⤵
- Executes dropped EXE
PID:1408 -
\??\c:\bbbttb.exec:\bbbttb.exe26⤵
- Executes dropped EXE
PID:2660 -
\??\c:\3pddj.exec:\3pddj.exe27⤵
- Executes dropped EXE
PID:940 -
\??\c:\nnnbbn.exec:\nnnbbn.exe28⤵
- Executes dropped EXE
PID:340 -
\??\c:\5vdjj.exec:\5vdjj.exe29⤵
- Executes dropped EXE
PID:896 -
\??\c:\nhbhtt.exec:\nhbhtt.exe30⤵
- Executes dropped EXE
PID:2840 -
\??\c:\1dvdj.exec:\1dvdj.exe31⤵
- Executes dropped EXE
PID:1928 -
\??\c:\nbbhbn.exec:\nbbhbn.exe32⤵
- Executes dropped EXE
PID:1100 -
\??\c:\3vpdj.exec:\3vpdj.exe33⤵
- Executes dropped EXE
PID:2400 -
\??\c:\llrllrx.exec:\llrllrx.exe34⤵
- Executes dropped EXE
PID:1248 -
\??\c:\btnbth.exec:\btnbth.exe35⤵
- Executes dropped EXE
PID:2008 -
\??\c:\jdvdj.exec:\jdvdj.exe36⤵
- Executes dropped EXE
PID:2404 -
\??\c:\1lflrrx.exec:\1lflrrx.exe37⤵
- Executes dropped EXE
PID:1272 -
\??\c:\tbthtt.exec:\tbthtt.exe38⤵
- Executes dropped EXE
PID:2580 -
\??\c:\1bbbhh.exec:\1bbbhh.exe39⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jjdpd.exec:\jjdpd.exe40⤵
- Executes dropped EXE
PID:3004 -
\??\c:\7xxlffr.exec:\7xxlffr.exe41⤵
- Executes dropped EXE
PID:2612 -
\??\c:\hhhnbb.exec:\hhhnbb.exe42⤵
- Executes dropped EXE
PID:2472 -
\??\c:\pvpdv.exec:\pvpdv.exe43⤵
- Executes dropped EXE
PID:2496 -
\??\c:\5lffrrx.exec:\5lffrrx.exe44⤵
- Executes dropped EXE
PID:2956 -
\??\c:\1hhhnt.exec:\1hhhnt.exe45⤵
- Executes dropped EXE
PID:2888 -
\??\c:\vpdpv.exec:\vpdpv.exe46⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jdvdj.exec:\jdvdj.exe47⤵
- Executes dropped EXE
PID:1716 -
\??\c:\1lflllr.exec:\1lflllr.exe48⤵
- Executes dropped EXE
PID:1576 -
\??\c:\pjjjv.exec:\pjjjv.exe49⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lfrrxfl.exec:\lfrrxfl.exe50⤵
- Executes dropped EXE
PID:1860 -
\??\c:\tthhht.exec:\tthhht.exe51⤵
- Executes dropped EXE
PID:348 -
\??\c:\thbhnn.exec:\thbhnn.exe52⤵
- Executes dropped EXE
PID:1648 -
\??\c:\3fxlxxl.exec:\3fxlxxl.exe53⤵
- Executes dropped EXE
PID:800 -
\??\c:\5xrflrx.exec:\5xrflrx.exe54⤵
- Executes dropped EXE
PID:2132 -
\??\c:\nnbhnn.exec:\nnbhnn.exe55⤵
- Executes dropped EXE
PID:1532 -
\??\c:\3dppv.exec:\3dppv.exe56⤵
- Executes dropped EXE
PID:1380 -
\??\c:\rlllrxr.exec:\rlllrxr.exe57⤵
- Executes dropped EXE
PID:1424 -
\??\c:\ntthtb.exec:\ntthtb.exe58⤵
- Executes dropped EXE
PID:2920 -
\??\c:\bbtttt.exec:\bbtttt.exe59⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pjdjd.exec:\pjdjd.exe60⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xllfxfl.exec:\xllfxfl.exe61⤵
- Executes dropped EXE
PID:2192 -
\??\c:\5bntbh.exec:\5bntbh.exe62⤵
- Executes dropped EXE
PID:264 -
\??\c:\ddvdj.exec:\ddvdj.exe63⤵
- Executes dropped EXE
PID:1104 -
\??\c:\pjddp.exec:\pjddp.exe64⤵
- Executes dropped EXE
PID:300 -
\??\c:\rrlrxxf.exec:\rrlrxxf.exe65⤵
- Executes dropped EXE
PID:804 -
\??\c:\ntthbh.exec:\ntthbh.exe66⤵PID:1408
-
\??\c:\pjdpp.exec:\pjdpp.exe67⤵PID:2368
-
\??\c:\jpvjd.exec:\jpvjd.exe68⤵PID:924
-
\??\c:\flxfxxl.exec:\flxfxxl.exe69⤵PID:1552
-
\??\c:\9hbnbh.exec:\9hbnbh.exe70⤵PID:644
-
\??\c:\3djpp.exec:\3djpp.exe71⤵PID:688
-
\??\c:\lrffrxl.exec:\lrffrxl.exe72⤵PID:2844
-
\??\c:\1hhtbh.exec:\1hhtbh.exe73⤵PID:2944
-
\??\c:\ddvjd.exec:\ddvjd.exe74⤵PID:1100
-
\??\c:\9lfllxf.exec:\9lfllxf.exe75⤵PID:2940
-
\??\c:\lfrlrxf.exec:\lfrlrxf.exe76⤵PID:2784
-
\??\c:\ntnhtb.exec:\ntnhtb.exe77⤵PID:1508
-
\??\c:\dvdjp.exec:\dvdjp.exe78⤵PID:2632
-
\??\c:\flflrfl.exec:\flflrfl.exe79⤵PID:1088
-
\??\c:\frxflrl.exec:\frxflrl.exe80⤵PID:2680
-
\??\c:\ntnbtb.exec:\ntnbtb.exe81⤵PID:2700
-
\??\c:\9vppv.exec:\9vppv.exe82⤵PID:2600
-
\??\c:\fxfllrf.exec:\fxfllrf.exe83⤵PID:2744
-
\??\c:\1bthtb.exec:\1bthtb.exe84⤵PID:1944
-
\??\c:\bthhbn.exec:\bthhbn.exe85⤵PID:2504
-
\??\c:\djvdj.exec:\djvdj.exe86⤵PID:2496
-
\??\c:\fxrxffl.exec:\fxrxffl.exe87⤵PID:2956
-
\??\c:\hhhhtn.exec:\hhhhtn.exe88⤵PID:2888
-
\??\c:\bthnnn.exec:\bthnnn.exe89⤵PID:2032
-
\??\c:\djjjp.exec:\djjjp.exe90⤵PID:2124
-
\??\c:\1jvdp.exec:\1jvdp.exe91⤵PID:1576
-
\??\c:\5rfllxr.exec:\5rfllxr.exe92⤵PID:2128
-
\??\c:\bbtnhh.exec:\bbtnhh.exe93⤵PID:2740
-
\??\c:\5pjpd.exec:\5pjpd.exe94⤵PID:2112
-
\??\c:\lxlxxfl.exec:\lxlxxfl.exe95⤵PID:1624
-
\??\c:\rrlrxfx.exec:\rrlrxfx.exe96⤵PID:316
-
\??\c:\bbbtth.exec:\bbbtth.exe97⤵PID:760
-
\??\c:\djdpj.exec:\djdpj.exe98⤵PID:2868
-
\??\c:\vvjvv.exec:\vvjvv.exe99⤵PID:1372
-
\??\c:\xrrrflr.exec:\xrrrflr.exe100⤵PID:2928
-
\??\c:\httnnh.exec:\httnnh.exe101⤵PID:1288
-
\??\c:\pjvdj.exec:\pjvdj.exe102⤵PID:2196
-
\??\c:\vdpvj.exec:\vdpvj.exe103⤵PID:1200
-
\??\c:\lrfrflx.exec:\lrfrflx.exe104⤵PID:2296
-
\??\c:\bthhnn.exec:\bthhnn.exe105⤵PID:572
-
\??\c:\1vjdp.exec:\1vjdp.exe106⤵PID:664
-
\??\c:\fxlrrxf.exec:\fxlrrxf.exe107⤵PID:1724
-
\??\c:\ttthtt.exec:\ttthtt.exe108⤵PID:336
-
\??\c:\jjdjp.exec:\jjdjp.exe109⤵PID:1464
-
\??\c:\rlfflrx.exec:\rlfflrx.exe110⤵PID:1956
-
\??\c:\7vvvv.exec:\7vvvv.exe111⤵PID:1220
-
\??\c:\7fxrxfl.exec:\7fxrxfl.exe112⤵PID:2288
-
\??\c:\llfrxlr.exec:\llfrxlr.exe113⤵PID:680
-
\??\c:\hbtbhn.exec:\hbtbhn.exe114⤵PID:1968
-
\??\c:\dpvvj.exec:\dpvvj.exe115⤵PID:2536
-
\??\c:\xrfflrf.exec:\xrfflrf.exe116⤵PID:2020
-
\??\c:\llxflxr.exec:\llxflxr.exe117⤵PID:1684
-
\??\c:\hntbtt.exec:\hntbtt.exe118⤵PID:1680
-
\??\c:\jjjjd.exec:\jjjjd.exe119⤵PID:2940
-
\??\c:\xxllxxl.exec:\xxllxxl.exe120⤵PID:1632
-
\??\c:\ffxlxfl.exec:\ffxlxfl.exe121⤵PID:1480
-
\??\c:\ttnbht.exec:\ttnbht.exe122⤵PID:3028
-
\??\c:\bthhtn.exec:\bthhtn.exe123⤵PID:2668
-
\??\c:\vdpvp.exec:\vdpvp.exe124⤵PID:3060
-
\??\c:\ffxffrx.exec:\ffxffrx.exe125⤵PID:2700
-
\??\c:\5hhtbh.exec:\5hhtbh.exe126⤵PID:2456
-
\??\c:\7tnntb.exec:\7tnntb.exe127⤵PID:2616
-
\??\c:\ppjjv.exec:\ppjjv.exe128⤵PID:2444
-
\??\c:\7rlrfxl.exec:\7rlrfxl.exe129⤵PID:2476
-
\??\c:\xxrxlrl.exec:\xxrxlrl.exe130⤵PID:2892
-
\??\c:\1nbhbb.exec:\1nbhbb.exe131⤵PID:2956
-
\??\c:\pppdp.exec:\pppdp.exe132⤵PID:2888
-
\??\c:\1pdpp.exec:\1pdpp.exe133⤵PID:2032
-
\??\c:\3llflrf.exec:\3llflrf.exe134⤵PID:2520
-
\??\c:\nhbhnb.exec:\nhbhnb.exe135⤵PID:2748
-
\??\c:\jdvvj.exec:\jdvvj.exe136⤵PID:352
-
\??\c:\rlrxlxl.exec:\rlrxlxl.exe137⤵PID:1556
-
\??\c:\rlfrfrf.exec:\rlfrfrf.exe138⤵PID:1848
-
\??\c:\ttnntb.exec:\ttnntb.exe139⤵PID:1856
-
\??\c:\jdppd.exec:\jdppd.exe140⤵PID:2248
-
\??\c:\jddpv.exec:\jddpv.exe141⤵PID:2084
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe142⤵PID:1412
-
\??\c:\tnbhtb.exec:\tnbhtb.exe143⤵PID:2092
-
\??\c:\7tntbh.exec:\7tntbh.exe144⤵PID:1280
-
\??\c:\pjdjj.exec:\pjdjj.exe145⤵PID:2184
-
\??\c:\1rrxlrf.exec:\1rrxlrf.exe146⤵PID:2172
-
\??\c:\7frrffl.exec:\7frrffl.exe147⤵PID:2204
-
\??\c:\tthhth.exec:\tthhth.exe148⤵PID:480
-
\??\c:\ppvdj.exec:\ppvdj.exe149⤵PID:1668
-
\??\c:\fxrxfff.exec:\fxrxfff.exe150⤵PID:1656
-
\??\c:\5xrxflr.exec:\5xrxflr.exe151⤵PID:1468
-
\??\c:\tbbnbh.exec:\tbbnbh.exe152⤵PID:1700
-
\??\c:\jdppp.exec:\jdppp.exe153⤵PID:2372
-
\??\c:\jdvdp.exec:\jdvdp.exe154⤵PID:2356
-
\??\c:\rllrxff.exec:\rllrxff.exe155⤵PID:1332
-
\??\c:\nnhnbn.exec:\nnhnbn.exe156⤵PID:1832
-
\??\c:\hhhhnn.exec:\hhhhnn.exe157⤵PID:1760
-
\??\c:\7ddjv.exec:\7ddjv.exe158⤵PID:644
-
\??\c:\rfxxllx.exec:\rfxxllx.exe159⤵PID:680
-
\??\c:\lxrfxfr.exec:\lxrfxfr.exe160⤵PID:2840
-
\??\c:\hnhthn.exec:\hnhthn.exe161⤵PID:980
-
\??\c:\7tbtht.exec:\7tbtht.exe162⤵PID:876
-
\??\c:\pjpvp.exec:\pjpvp.exe163⤵PID:1684
-
\??\c:\rlfrxlf.exec:\rlfrxlf.exe164⤵PID:1500
-
\??\c:\rxrfxxx.exec:\rxrfxxx.exe165⤵PID:2732
-
\??\c:\bbtbhn.exec:\bbtbhn.exe166⤵PID:1632
-
\??\c:\ddvdp.exec:\ddvdp.exe167⤵PID:1184
-
\??\c:\rlfrfrf.exec:\rlfrfrf.exe168⤵PID:2672
-
\??\c:\bthtbb.exec:\bthtbb.exe169⤵PID:2580
-
\??\c:\hhtbhh.exec:\hhtbhh.exe170⤵PID:3004
-
\??\c:\pjvvd.exec:\pjvvd.exe171⤵PID:2636
-
\??\c:\lrlxrxr.exec:\lrlxrxr.exe172⤵PID:2620
-
\??\c:\3frxxxf.exec:\3frxxxf.exe173⤵PID:2616
-
\??\c:\hhbntt.exec:\hhbntt.exe174⤵PID:2528
-
\??\c:\7pjjv.exec:\7pjjv.exe175⤵PID:1992
-
\??\c:\dvpvv.exec:\dvpvv.exe176⤵PID:992
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe177⤵PID:1584
-
\??\c:\nnhhnn.exec:\nnhhnn.exe178⤵PID:1536
-
\??\c:\pdjpd.exec:\pdjpd.exe179⤵PID:2124
-
\??\c:\pvjvv.exec:\pvjvv.exe180⤵PID:2512
-
\??\c:\xlflrxl.exec:\xlflrxl.exe181⤵PID:2748
-
\??\c:\tthtnh.exec:\tthtnh.exe182⤵PID:2436
-
\??\c:\vpjpv.exec:\vpjpv.exe183⤵PID:1556
-
\??\c:\vjddj.exec:\vjddj.exe184⤵PID:2756
-
\??\c:\1rllxrf.exec:\1rllxrf.exe185⤵PID:276
-
\??\c:\hhtbnt.exec:\hhtbnt.exe186⤵PID:2772
-
\??\c:\hbnntt.exec:\hbnntt.exe187⤵PID:1428
-
\??\c:\djpdp.exec:\djpdp.exe188⤵PID:1692
-
\??\c:\xlxfrrf.exec:\xlxfrrf.exe189⤵PID:2928
-
\??\c:\rrrfrxr.exec:\rrrfrxr.exe190⤵PID:1280
-
\??\c:\hhbthn.exec:\hhbthn.exe191⤵PID:2184
-
\??\c:\ddvvv.exec:\ddvvv.exe192⤵PID:2172
-
\??\c:\dvvdj.exec:\dvvdj.exe193⤵PID:2284
-
\??\c:\5frfrrf.exec:\5frfrrf.exe194⤵PID:2812
-
\??\c:\tnntbh.exec:\tnntbh.exe195⤵PID:572
-
\??\c:\jjdpd.exec:\jjdpd.exe196⤵PID:664
-
\??\c:\1pjjj.exec:\1pjjj.exe197⤵PID:1724
-
\??\c:\1rfrxxl.exec:\1rfrxxl.exe198⤵PID:2224
-
\??\c:\llxxflr.exec:\llxxflr.exe199⤵PID:2336
-
\??\c:\tnbhnt.exec:\tnbhnt.exe200⤵PID:1520
-
\??\c:\ddvdp.exec:\ddvdp.exe201⤵PID:948
-
\??\c:\ffflflx.exec:\ffflflx.exe202⤵PID:1332
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe203⤵PID:3052
-
\??\c:\nnhbhb.exec:\nnhbhb.exe204⤵PID:1972
-
\??\c:\ddjvp.exec:\ddjvp.exe205⤵PID:644
-
\??\c:\ppdjv.exec:\ppdjv.exe206⤵PID:1560
-
\??\c:\xxrfrxf.exec:\xxrfrxf.exe207⤵PID:2844
-
\??\c:\fxfrfrf.exec:\fxfrfrf.exe208⤵PID:2432
-
\??\c:\hnhnhh.exec:\hnhnhh.exe209⤵PID:1980
-
\??\c:\jjjvd.exec:\jjjvd.exe210⤵PID:1748
-
\??\c:\9ddpd.exec:\9ddpd.exe211⤵PID:1512
-
\??\c:\lffxlrf.exec:\lffxlrf.exe212⤵PID:2404
-
\??\c:\tbthnt.exec:\tbthnt.exe213⤵PID:2696
-
\??\c:\hbthnt.exec:\hbthnt.exe214⤵PID:1272
-
\??\c:\5vppp.exec:\5vppp.exe215⤵PID:2792
-
\??\c:\1xrxlxf.exec:\1xrxlxf.exe216⤵PID:2568
-
\??\c:\nnthbh.exec:\nnthbh.exe217⤵PID:2484
-
\??\c:\nthtbh.exec:\nthtbh.exe218⤵PID:2744
-
\??\c:\5dvdp.exec:\5dvdp.exe219⤵PID:2460
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe220⤵PID:2508
-
\??\c:\lrrrfrf.exec:\lrrrfrf.exe221⤵PID:2480
-
\??\c:\1hbhhh.exec:\1hbhhh.exe222⤵PID:2528
-
\??\c:\1jjpv.exec:\1jjpv.exe223⤵PID:2016
-
\??\c:\3pjjj.exec:\3pjjj.exe224⤵PID:1884
-
\??\c:\ffxrffl.exec:\ffxrffl.exe225⤵PID:1496
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe226⤵PID:1536
-
\??\c:\nnhnth.exec:\nnhnth.exe227⤵PID:1676
-
\??\c:\ddddj.exec:\ddddj.exe228⤵PID:2128
-
\??\c:\xrlxlrr.exec:\xrlxlrr.exe229⤵PID:2112
-
\??\c:\flfllxr.exec:\flfllxr.exe230⤵PID:1924
-
\??\c:\hbnbbh.exec:\hbnbbh.exe231⤵PID:1864
-
\??\c:\djppv.exec:\djppv.exe232⤵PID:2332
-
\??\c:\vjdjv.exec:\vjdjv.exe233⤵PID:2248
-
\??\c:\rxrxllr.exec:\rxrxllr.exe234⤵PID:1380
-
\??\c:\bhbbnb.exec:\bhbbnb.exe235⤵PID:1372
-
\??\c:\ppdjj.exec:\ppdjj.exe236⤵PID:2880
-
\??\c:\3pvpp.exec:\3pvpp.exe237⤵PID:1288
-
\??\c:\fxfrffx.exec:\fxfrffx.exe238⤵PID:2872
-
\??\c:\9tntbh.exec:\9tntbh.exe239⤵PID:2192
-
\??\c:\1hhntb.exec:\1hhntb.exe240⤵PID:2064
-
\??\c:\vvjvp.exec:\vvjvp.exe241⤵PID:1084
-
\??\c:\rxlxlrf.exec:\rxlxlrf.exe242⤵PID:628