Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 06:09
Behavioral task
behavioral1
Sample
bb3af1059bcfc5cf4212d6510c4651e1fb4942d0d10383a11db45a7e79c31725.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
-
Target
bb3af1059bcfc5cf4212d6510c4651e1fb4942d0d10383a11db45a7e79c31725.exe
-
Size
369KB
-
MD5
41b85936f8793948c64019bd1703cc37
-
SHA1
13a0e1ff602365d139267a9ba9299944a62893f9
-
SHA256
bb3af1059bcfc5cf4212d6510c4651e1fb4942d0d10383a11db45a7e79c31725
-
SHA512
ece86e48a13855dd0407b96ea22c1ababe881baf79158cbcbfd45877ab699e08d0d55b47b13609516f2b94a4fcd8365d5cd3b0b342e293811464a2d90815cf99
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOFltH4tiAlSpgFZAzwdjcIlSpgFZZr3GSM/xCk5:y4wFHoS3eFplAlSpgFZAKjcIlSpgFZZC
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/2888-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-45-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2700-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1044-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1292-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1808-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2092-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1488-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1112-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/596-480-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1456-568-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3028-606-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-632-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1992-683-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-741-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-1128-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3004-1151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1560-1388-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1532-1439-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2948-1474-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2888-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bbttbt.exe UPX behavioral1/memory/2888-9-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2960-10-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2960-14-0x0000000000220000-0x0000000000247000-memory.dmp UPX C:\rffffrr.exe UPX behavioral1/memory/2960-20-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bnnttt.exe UPX behavioral1/memory/3012-29-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2996-38-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\1jvpv.exe UPX behavioral1/memory/2700-45-0x0000000000220000-0x0000000000247000-memory.dmp UPX behavioral1/memory/2700-48-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\lxlllrx.exe UPX behavioral1/memory/2628-51-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bnnnnh.exe UPX C:\9lrrlxl.exe UPX behavioral1/memory/2752-66-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2496-70-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lxllrrr.exe UPX C:\vjpjv.exe UPX behavioral1/memory/2588-84-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lffrrrr.exe UPX behavioral1/memory/2524-92-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tnhnbb.exe UPX C:\9pjvv.exe UPX behavioral1/memory/2808-118-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lxflxff.exe UPX C:\5hbbhb.exe UPX behavioral1/memory/2168-126-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3jppd.exe UPX C:\lfrxfff.exe UPX behavioral1/memory/2564-152-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nhtnbb.exe UPX behavioral1/memory/1044-155-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3jvjp.exe UPX C:\fxlrxfx.exe UPX behavioral1/memory/1388-170-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vpvdp.exe UPX C:\9lfxlfl.exe UPX behavioral1/memory/1292-194-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hbntbb.exe UPX C:\jjpvd.exe UPX behavioral1/memory/1808-205-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7rxxrfl.exe UPX behavioral1/memory/3060-213-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hnbnnb.exe UPX behavioral1/memory/1764-229-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\dvvpp.exe UPX C:\llxxflr.exe UPX behavioral1/memory/2092-238-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xlrrrff.exe UPX behavioral1/memory/1924-249-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\dvjpv.exe UPX C:\lfrrfff.exe UPX behavioral1/memory/1144-266-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\tnhhhh.exe UPX behavioral1/memory/2852-277-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\thnhtn.exe UPX behavioral1/memory/1488-292-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2384-317-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2964-318-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2964-325-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2704-338-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
bbttbt.exerffffrr.exebnnttt.exe1jvpv.exelxlllrx.exebnnnnh.exe9lrrlxl.exelxllrrr.exevjpjv.exelffrrrr.exetnhnbb.exe9pjvv.exelxflxff.exe5hbbhb.exe3jppd.exelfrxfff.exenhtnbb.exe3jvjp.exefxlrxfx.exevpvdp.exe9lfxlfl.exehbntbb.exejjpvd.exe7rxxrfl.exehnbnnb.exedvvpp.exellxxflr.exexlrrrff.exedvjpv.exelfrrfff.exetnhhhh.exethnhtn.exedjdjd.exelfllrrx.exetnhhtn.exethhbbb.exe7ddvp.exe9rxlfrr.exexlllxrl.exentbtnb.exepjvjj.exevddvv.exerflfxrr.exe3rxxrrl.exenhbhth.exejdjdj.exevjppp.exexrxrrrr.exe9frxfxf.exe1bnhnt.exehtntnt.exejvdvv.exerlrrxrr.exe1xrxrlr.exe9htthb.exe3pdvv.exe1djjj.exelxfrrll.exelxffllr.exetnbttt.exejvddv.exevpjvv.exexrfxxxl.exe7hnhhh.exepid process 2960 bbttbt.exe 3012 rffffrr.exe 2996 bnnttt.exe 2700 1jvpv.exe 2628 lxlllrx.exe 2752 bnnnnh.exe 2496 9lrrlxl.exe 2588 lxllrrr.exe 2524 vjpjv.exe 2920 lffrrrr.exe 2036 tnhnbb.exe 2808 9pjvv.exe 2168 lxflxff.exe 936 5hbbhb.exe 1136 3jppd.exe 2564 lfrxfff.exe 1044 nhtnbb.exe 1596 3jvjp.exe 1388 fxlrxfx.exe 688 vpvdp.exe 1292 9lfxlfl.exe 1500 hbntbb.exe 1808 jjpvd.exe 3060 7rxxrfl.exe 1764 hnbnnb.exe 2092 dvvpp.exe 1976 llxxflr.exe 1924 xlrrrff.exe 1856 dvjpv.exe 1144 lfrrfff.exe 2852 tnhhhh.exe 2200 thnhtn.exe 1488 djdjd.exe 1988 lfllrrx.exe 2952 tnhhtn.exe 2384 thhbbb.exe 2964 7ddvp.exe 3024 9rxlfrr.exe 2792 xlllxrl.exe 2704 ntbtnb.exe 2836 pjvjj.exe 2592 vddvv.exe 2500 rflfxrr.exe 2388 3rxxrrl.exe 2788 nhbhth.exe 2520 jdjdj.exe 2548 vjppp.exe 3056 xrxrrrr.exe 2932 9frxfxf.exe 1060 1bnhnt.exe 2176 htntnt.exe 1376 jvdvv.exe 896 rlrrxrr.exe 1112 1xrxrlr.exe 1780 9htthb.exe 2544 3pdvv.exe 2564 1djjj.exe 2944 lxfrrll.exe 1600 lxffllr.exe 2272 tnbttt.exe 596 jvddv.exe 1296 vpjvv.exe 1292 xrfxxxl.exe 1912 7hnhhh.exe -
Processes:
resource yara_rule behavioral1/memory/2888-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbttbt.exe upx behavioral1/memory/2888-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2960-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2960-14-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\rffffrr.exe upx behavioral1/memory/2960-20-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnnttt.exe upx behavioral1/memory/3012-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2996-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1jvpv.exe upx behavioral1/memory/2700-45-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2700-48-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lxlllrx.exe upx behavioral1/memory/2628-51-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnnnnh.exe upx C:\9lrrlxl.exe upx behavioral1/memory/2752-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2496-70-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxllrrr.exe upx C:\vjpjv.exe upx behavioral1/memory/2588-84-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lffrrrr.exe upx behavioral1/memory/2524-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnhnbb.exe upx C:\9pjvv.exe upx behavioral1/memory/2808-118-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxflxff.exe upx C:\5hbbhb.exe upx behavioral1/memory/2168-126-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3jppd.exe upx C:\lfrxfff.exe upx behavioral1/memory/2564-152-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhtnbb.exe upx behavioral1/memory/1044-155-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3jvjp.exe upx C:\fxlrxfx.exe upx behavioral1/memory/1388-170-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpvdp.exe upx C:\9lfxlfl.exe upx behavioral1/memory/1292-194-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbntbb.exe upx C:\jjpvd.exe upx behavioral1/memory/1808-205-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7rxxrfl.exe upx behavioral1/memory/3060-213-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hnbnnb.exe upx behavioral1/memory/1764-229-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvvpp.exe upx C:\llxxflr.exe upx behavioral1/memory/2092-238-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlrrrff.exe upx behavioral1/memory/1924-249-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvjpv.exe upx C:\lfrrfff.exe upx behavioral1/memory/1144-266-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tnhhhh.exe upx behavioral1/memory/2852-277-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thnhtn.exe upx behavioral1/memory/1488-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2384-317-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2964-318-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2964-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-338-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bb3af1059bcfc5cf4212d6510c4651e1fb4942d0d10383a11db45a7e79c31725.exebbttbt.exerffffrr.exebnnttt.exe1jvpv.exelxlllrx.exebnnnnh.exe9lrrlxl.exelxllrrr.exevjpjv.exelffrrrr.exetnhnbb.exe9pjvv.exelxflxff.exe5hbbhb.exe3jppd.exedescription pid process target process PID 2888 wrote to memory of 2960 2888 bb3af1059bcfc5cf4212d6510c4651e1fb4942d0d10383a11db45a7e79c31725.exe bbttbt.exe PID 2888 wrote to memory of 2960 2888 bb3af1059bcfc5cf4212d6510c4651e1fb4942d0d10383a11db45a7e79c31725.exe bbttbt.exe PID 2888 wrote to memory of 2960 2888 bb3af1059bcfc5cf4212d6510c4651e1fb4942d0d10383a11db45a7e79c31725.exe bbttbt.exe PID 2888 wrote to memory of 2960 2888 bb3af1059bcfc5cf4212d6510c4651e1fb4942d0d10383a11db45a7e79c31725.exe bbttbt.exe PID 2960 wrote to memory of 3012 2960 bbttbt.exe rffffrr.exe PID 2960 wrote to memory of 3012 2960 bbttbt.exe rffffrr.exe PID 2960 wrote to memory of 3012 2960 bbttbt.exe rffffrr.exe PID 2960 wrote to memory of 3012 2960 bbttbt.exe rffffrr.exe PID 3012 wrote to memory of 2996 3012 rffffrr.exe bnnttt.exe PID 3012 wrote to memory of 2996 3012 rffffrr.exe bnnttt.exe PID 3012 wrote to memory of 2996 3012 rffffrr.exe bnnttt.exe PID 3012 wrote to memory of 2996 3012 rffffrr.exe bnnttt.exe PID 2996 wrote to memory of 2700 2996 bnnttt.exe 1jvpv.exe PID 2996 wrote to memory of 2700 2996 bnnttt.exe 1jvpv.exe PID 2996 wrote to memory of 2700 2996 bnnttt.exe 1jvpv.exe PID 2996 wrote to memory of 2700 2996 bnnttt.exe 1jvpv.exe PID 2700 wrote to memory of 2628 2700 1jvpv.exe lxlllrx.exe PID 2700 wrote to memory of 2628 2700 1jvpv.exe lxlllrx.exe PID 2700 wrote to memory of 2628 2700 1jvpv.exe lxlllrx.exe PID 2700 wrote to memory of 2628 2700 1jvpv.exe lxlllrx.exe PID 2628 wrote to memory of 2752 2628 lxlllrx.exe bnnnnh.exe PID 2628 wrote to memory of 2752 2628 lxlllrx.exe bnnnnh.exe PID 2628 wrote to memory of 2752 2628 lxlllrx.exe bnnnnh.exe PID 2628 wrote to memory of 2752 2628 lxlllrx.exe bnnnnh.exe PID 2752 wrote to memory of 2496 2752 bnnnnh.exe 9lrrlxl.exe PID 2752 wrote to memory of 2496 2752 bnnnnh.exe 9lrrlxl.exe PID 2752 wrote to memory of 2496 2752 bnnnnh.exe 9lrrlxl.exe PID 2752 wrote to memory of 2496 2752 bnnnnh.exe 9lrrlxl.exe PID 2496 wrote to memory of 2588 2496 9lrrlxl.exe lxllrrr.exe PID 2496 wrote to memory of 2588 2496 9lrrlxl.exe lxllrrr.exe PID 2496 wrote to memory of 2588 2496 9lrrlxl.exe lxllrrr.exe PID 2496 wrote to memory of 2588 2496 9lrrlxl.exe lxllrrr.exe PID 2588 wrote to memory of 2524 2588 lxllrrr.exe vjpjv.exe PID 2588 wrote to memory of 2524 2588 lxllrrr.exe vjpjv.exe PID 2588 wrote to memory of 2524 2588 lxllrrr.exe vjpjv.exe PID 2588 wrote to memory of 2524 2588 lxllrrr.exe vjpjv.exe PID 2524 wrote to memory of 2920 2524 vjpjv.exe lffrrrr.exe PID 2524 wrote to memory of 2920 2524 vjpjv.exe lffrrrr.exe PID 2524 wrote to memory of 2920 2524 vjpjv.exe lffrrrr.exe PID 2524 wrote to memory of 2920 2524 vjpjv.exe lffrrrr.exe PID 2920 wrote to memory of 2036 2920 lffrrrr.exe tnhnbb.exe PID 2920 wrote to memory of 2036 2920 lffrrrr.exe tnhnbb.exe PID 2920 wrote to memory of 2036 2920 lffrrrr.exe tnhnbb.exe PID 2920 wrote to memory of 2036 2920 lffrrrr.exe tnhnbb.exe PID 2036 wrote to memory of 2808 2036 tnhnbb.exe 9pjvv.exe PID 2036 wrote to memory of 2808 2036 tnhnbb.exe 9pjvv.exe PID 2036 wrote to memory of 2808 2036 tnhnbb.exe 9pjvv.exe PID 2036 wrote to memory of 2808 2036 tnhnbb.exe 9pjvv.exe PID 2808 wrote to memory of 2168 2808 9pjvv.exe lxflxff.exe PID 2808 wrote to memory of 2168 2808 9pjvv.exe lxflxff.exe PID 2808 wrote to memory of 2168 2808 9pjvv.exe lxflxff.exe PID 2808 wrote to memory of 2168 2808 9pjvv.exe lxflxff.exe PID 2168 wrote to memory of 936 2168 lxflxff.exe 5hbbhb.exe PID 2168 wrote to memory of 936 2168 lxflxff.exe 5hbbhb.exe PID 2168 wrote to memory of 936 2168 lxflxff.exe 5hbbhb.exe PID 2168 wrote to memory of 936 2168 lxflxff.exe 5hbbhb.exe PID 936 wrote to memory of 1136 936 5hbbhb.exe 3jppd.exe PID 936 wrote to memory of 1136 936 5hbbhb.exe 3jppd.exe PID 936 wrote to memory of 1136 936 5hbbhb.exe 3jppd.exe PID 936 wrote to memory of 1136 936 5hbbhb.exe 3jppd.exe PID 1136 wrote to memory of 2564 1136 3jppd.exe lfrxfff.exe PID 1136 wrote to memory of 2564 1136 3jppd.exe lfrxfff.exe PID 1136 wrote to memory of 2564 1136 3jppd.exe lfrxfff.exe PID 1136 wrote to memory of 2564 1136 3jppd.exe lfrxfff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb3af1059bcfc5cf4212d6510c4651e1fb4942d0d10383a11db45a7e79c31725.exe"C:\Users\Admin\AppData\Local\Temp\bb3af1059bcfc5cf4212d6510c4651e1fb4942d0d10383a11db45a7e79c31725.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\bbttbt.exec:\bbttbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\rffffrr.exec:\rffffrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\bnnttt.exec:\bnnttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\1jvpv.exec:\1jvpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\lxlllrx.exec:\lxlllrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\bnnnnh.exec:\bnnnnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\9lrrlxl.exec:\9lrrlxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\lxllrrr.exec:\lxllrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\vjpjv.exec:\vjpjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\lffrrrr.exec:\lffrrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\tnhnbb.exec:\tnhnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\9pjvv.exec:\9pjvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\lxflxff.exec:\lxflxff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\5hbbhb.exec:\5hbbhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\3jppd.exec:\3jppd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\lfrxfff.exec:\lfrxfff.exe17⤵
- Executes dropped EXE
PID:2564 -
\??\c:\nhtnbb.exec:\nhtnbb.exe18⤵
- Executes dropped EXE
PID:1044 -
\??\c:\3jvjp.exec:\3jvjp.exe19⤵
- Executes dropped EXE
PID:1596 -
\??\c:\fxlrxfx.exec:\fxlrxfx.exe20⤵
- Executes dropped EXE
PID:1388 -
\??\c:\vpvdp.exec:\vpvdp.exe21⤵
- Executes dropped EXE
PID:688 -
\??\c:\9lfxlfl.exec:\9lfxlfl.exe22⤵
- Executes dropped EXE
PID:1292 -
\??\c:\hbntbb.exec:\hbntbb.exe23⤵
- Executes dropped EXE
PID:1500 -
\??\c:\jjpvd.exec:\jjpvd.exe24⤵
- Executes dropped EXE
PID:1808 -
\??\c:\7rxxrfl.exec:\7rxxrfl.exe25⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hnbnnb.exec:\hnbnnb.exe26⤵
- Executes dropped EXE
PID:1764 -
\??\c:\dvvpp.exec:\dvvpp.exe27⤵
- Executes dropped EXE
PID:2092 -
\??\c:\llxxflr.exec:\llxxflr.exe28⤵
- Executes dropped EXE
PID:1976 -
\??\c:\xlrrrff.exec:\xlrrrff.exe29⤵
- Executes dropped EXE
PID:1924 -
\??\c:\dvjpv.exec:\dvjpv.exe30⤵
- Executes dropped EXE
PID:1856 -
\??\c:\lfrrfff.exec:\lfrrfff.exe31⤵
- Executes dropped EXE
PID:1144 -
\??\c:\tnhhhh.exec:\tnhhhh.exe32⤵
- Executes dropped EXE
PID:2852 -
\??\c:\thnhtn.exec:\thnhtn.exe33⤵
- Executes dropped EXE
PID:2200 -
\??\c:\djdjd.exec:\djdjd.exe34⤵
- Executes dropped EXE
PID:1488 -
\??\c:\lfllrrx.exec:\lfllrrx.exe35⤵
- Executes dropped EXE
PID:1988 -
\??\c:\tnhhtn.exec:\tnhhtn.exe36⤵
- Executes dropped EXE
PID:2952 -
\??\c:\thhbbb.exec:\thhbbb.exe37⤵
- Executes dropped EXE
PID:2384 -
\??\c:\7ddvp.exec:\7ddvp.exe38⤵
- Executes dropped EXE
PID:2964 -
\??\c:\9rxlfrr.exec:\9rxlfrr.exe39⤵
- Executes dropped EXE
PID:3024 -
\??\c:\xlllxrl.exec:\xlllxrl.exe40⤵
- Executes dropped EXE
PID:2792 -
\??\c:\ntbtnb.exec:\ntbtnb.exe41⤵
- Executes dropped EXE
PID:2704 -
\??\c:\pjvjj.exec:\pjvjj.exe42⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vddvv.exec:\vddvv.exe43⤵
- Executes dropped EXE
PID:2592 -
\??\c:\rflfxrr.exec:\rflfxrr.exe44⤵
- Executes dropped EXE
PID:2500 -
\??\c:\3rxxrrl.exec:\3rxxrrl.exe45⤵
- Executes dropped EXE
PID:2388 -
\??\c:\nhbhth.exec:\nhbhth.exe46⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jdjdj.exec:\jdjdj.exe47⤵
- Executes dropped EXE
PID:2520 -
\??\c:\vjppp.exec:\vjppp.exe48⤵
- Executes dropped EXE
PID:2548 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe49⤵
- Executes dropped EXE
PID:3056 -
\??\c:\9frxfxf.exec:\9frxfxf.exe50⤵
- Executes dropped EXE
PID:2932 -
\??\c:\1bnhnt.exec:\1bnhnt.exe51⤵
- Executes dropped EXE
PID:1060 -
\??\c:\htntnt.exec:\htntnt.exe52⤵
- Executes dropped EXE
PID:2176 -
\??\c:\jvdvv.exec:\jvdvv.exe53⤵
- Executes dropped EXE
PID:1376 -
\??\c:\rlrrxrr.exec:\rlrrxrr.exe54⤵
- Executes dropped EXE
PID:896 -
\??\c:\1xrxrlr.exec:\1xrxrlr.exe55⤵
- Executes dropped EXE
PID:1112 -
\??\c:\9htthb.exec:\9htthb.exe56⤵
- Executes dropped EXE
PID:1780 -
\??\c:\3pdvv.exec:\3pdvv.exe57⤵
- Executes dropped EXE
PID:2544 -
\??\c:\1djjj.exec:\1djjj.exe58⤵
- Executes dropped EXE
PID:2564 -
\??\c:\lxfrrll.exec:\lxfrrll.exe59⤵
- Executes dropped EXE
PID:2944 -
\??\c:\lxffllr.exec:\lxffllr.exe60⤵
- Executes dropped EXE
PID:1600 -
\??\c:\tnbttt.exec:\tnbttt.exe61⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jvddv.exec:\jvddv.exe62⤵
- Executes dropped EXE
PID:596 -
\??\c:\vpjvv.exec:\vpjvv.exe63⤵
- Executes dropped EXE
PID:1296 -
\??\c:\xrfxxxl.exec:\xrfxxxl.exe64⤵
- Executes dropped EXE
PID:1292 -
\??\c:\7hnhhh.exec:\7hnhhh.exe65⤵
- Executes dropped EXE
PID:1912 -
\??\c:\nbnhhh.exec:\nbnhhh.exe66⤵PID:680
-
\??\c:\5dddv.exec:\5dddv.exe67⤵PID:1028
-
\??\c:\7xlfxrr.exec:\7xlfxrr.exe68⤵PID:3060
-
\??\c:\xlllffl.exec:\xlllffl.exe69⤵PID:1456
-
\??\c:\tnbntt.exec:\tnbntt.exe70⤵PID:1804
-
\??\c:\bthnnt.exec:\bthnnt.exe71⤵PID:1920
-
\??\c:\vjvjj.exec:\vjvjj.exe72⤵PID:1888
-
\??\c:\vpvpp.exec:\vpvpp.exe73⤵PID:900
-
\??\c:\3flxrll.exec:\3flxrll.exe74⤵PID:1664
-
\??\c:\hbntnh.exec:\hbntnh.exe75⤵PID:1700
-
\??\c:\btnhhh.exec:\btnhhh.exe76⤵PID:1564
-
\??\c:\dpvvd.exec:\dpvvd.exe77⤵PID:2840
-
\??\c:\lxlfrlr.exec:\lxlfrlr.exe78⤵PID:872
-
\??\c:\ffrxlll.exec:\ffrxlll.exe79⤵PID:1652
-
\??\c:\htbttn.exec:\htbttn.exe80⤵PID:2312
-
\??\c:\3htbbb.exec:\3htbbb.exe81⤵PID:1728
-
\??\c:\dddjj.exec:\dddjj.exe82⤵PID:2948
-
\??\c:\lxfxfxx.exec:\lxfxfxx.exe83⤵PID:3028
-
\??\c:\frfffff.exec:\frfffff.exe84⤵PID:3012
-
\??\c:\bnttbb.exec:\bnttbb.exe85⤵PID:2604
-
\??\c:\nbhtth.exec:\nbhtth.exe86⤵PID:2716
-
\??\c:\9dpdv.exec:\9dpdv.exe87⤵PID:2600
-
\??\c:\lflxrfr.exec:\lflxrfr.exe88⤵PID:2632
-
\??\c:\xlxffxf.exec:\xlxffxf.exe89⤵PID:2576
-
\??\c:\nnnbnt.exec:\nnnbnt.exe90⤵PID:2640
-
\??\c:\9vdvv.exec:\9vdvv.exe91⤵PID:2748
-
\??\c:\vjjdd.exec:\vjjdd.exe92⤵PID:2724
-
\??\c:\frxllff.exec:\frxllff.exe93⤵PID:2928
-
\??\c:\frxxfff.exec:\frxxfff.exe94⤵PID:1992
-
\??\c:\htntnt.exec:\htntnt.exe95⤵PID:2512
-
\??\c:\dppvd.exec:\dppvd.exe96⤵PID:2680
-
\??\c:\jpdvv.exec:\jpdvv.exe97⤵PID:1984
-
\??\c:\7xffxxx.exec:\7xffxxx.exe98⤵PID:1816
-
\??\c:\nbhhhb.exec:\nbhhhb.exe99⤵PID:816
-
\??\c:\9tbbbt.exec:\9tbbbt.exe100⤵PID:1320
-
\??\c:\jjvpv.exec:\jjvpv.exe101⤵PID:1332
-
\??\c:\ffrlrff.exec:\ffrlrff.exe102⤵PID:2428
-
\??\c:\fxlflll.exec:\fxlflll.exe103⤵PID:1640
-
\??\c:\btntbt.exec:\btntbt.exe104⤵PID:2564
-
\??\c:\1vvdj.exec:\1vvdj.exe105⤵PID:2292
-
\??\c:\vjppj.exec:\vjppj.exe106⤵PID:2652
-
\??\c:\frlllrr.exec:\frlllrr.exe107⤵PID:1204
-
\??\c:\fxrxxfl.exec:\fxrxxfl.exe108⤵PID:2452
-
\??\c:\httnnt.exec:\httnnt.exe109⤵PID:1296
-
\??\c:\vjvdd.exec:\vjvdd.exe110⤵PID:348
-
\??\c:\jvvvv.exec:\jvvvv.exe111⤵PID:2336
-
\??\c:\1ffrrxr.exec:\1ffrrxr.exe112⤵PID:680
-
\??\c:\7hhbbb.exec:\7hhbbb.exe113⤵PID:1160
-
\??\c:\1nnnhh.exec:\1nnnhh.exe114⤵PID:1560
-
\??\c:\vjvpp.exec:\vjvpp.exe115⤵PID:1456
-
\??\c:\rflfxrr.exec:\rflfxrr.exe116⤵PID:1804
-
\??\c:\rllrfxx.exec:\rllrfxx.exe117⤵PID:1860
-
\??\c:\tntthh.exec:\tntthh.exe118⤵PID:1924
-
\??\c:\5djjv.exec:\5djjv.exe119⤵PID:2264
-
\??\c:\ddjpp.exec:\ddjpp.exe120⤵PID:2212
-
\??\c:\7xffxxr.exec:\7xffxxr.exe121⤵PID:3064
-
\??\c:\xlrxfxx.exec:\xlrxfxx.exe122⤵PID:1564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-