Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 07:15
Behavioral task
behavioral1
Sample
c6d139a695d9529c634b1dbe018d0d29b87751a566e2b7f68c9acbc0f86e5a80.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
c6d139a695d9529c634b1dbe018d0d29b87751a566e2b7f68c9acbc0f86e5a80.exe
-
Size
440KB
-
MD5
8b53bc41a4643fe72619ddcb8f25ed9d
-
SHA1
efecc4025310aba83a59fe6ccc5494d400519429
-
SHA256
c6d139a695d9529c634b1dbe018d0d29b87751a566e2b7f68c9acbc0f86e5a80
-
SHA512
4d95ba4c7ba64aaef06104f8ce8b890f71b64af0c29d44585ad84a8596bea412491d77854564783c50ea58351b32010b110876aafab2781f1cf6d25bdb0616d7
-
SSDEEP
12288:w4wFHoS9KxbNnidEhjEJd1kNpeUgI95yRoZHVaoJMOxFXnRV4PiGO0hUmH91:kKxbNndhjEJd1kNpeUgI95yRoZHgoJMJ
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/2880-8-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1144-18-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2700-27-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2616-30-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2752-45-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2124-48-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2852-57-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2560-67-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2576-82-0x00000000002C0000-0x00000000002F4000-memory.dmp family_blackmoon behavioral1/memory/2564-85-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2848-119-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2476-153-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2204-170-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1588-178-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2900-197-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/856-212-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2484-229-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1776-242-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1852-240-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2924-257-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1712-266-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1520-292-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2932-307-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2880-309-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2072-322-0x00000000001B0000-0x00000000001E4000-memory.dmp family_blackmoon behavioral1/memory/1828-323-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2616-337-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2568-374-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2576-387-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/484-507-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/988-577-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2584-666-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2564-685-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1604-894-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2576-965-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2912-1071-0x0000000000260000-0x0000000000294000-memory.dmp family_blackmoon behavioral1/memory/348-1117-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2880-0-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\nttbnt.exe UPX behavioral1/memory/2880-8-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/1144-9-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/1144-18-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\xrlrflr.exe UPX behavioral1/memory/2700-27-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\nnntht.exe UPX behavioral1/memory/2616-30-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\dddjp.exe UPX C:\1pdjj.exe UPX behavioral1/memory/2752-45-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2124-48-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2852-57-0x0000000000400000-0x0000000000434000-memory.dmp UPX \??\c:\ddvjp.exe UPX \??\c:\lffxfrf.exe UPX behavioral1/memory/2560-67-0x0000000000400000-0x0000000000434000-memory.dmp UPX \??\c:\ttthnb.exe UPX C:\pjjjp.exe UPX behavioral1/memory/2564-85-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\3fffrxx.exe UPX C:\hbtbhn.exe UPX C:\rrxfllx.exe UPX C:\ppdvd.exe UPX behavioral1/memory/2848-119-0x0000000000400000-0x0000000000434000-memory.dmp UPX \??\c:\3fxfrxl.exe UPX C:\nhbhbt.exe UPX behavioral1/memory/1448-136-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\5xrlrlx.exe UPX C:\pppjv.exe UPX behavioral1/memory/2476-153-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\rxlfrxx.exe UPX C:\hhbhht.exe UPX behavioral1/memory/2204-170-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\vvpvj.exe UPX behavioral1/memory/1588-178-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\ttnbtt.exe UPX C:\pjdjv.exe UPX behavioral1/memory/2900-197-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\vvvpj.exe UPX C:\1tnttt.exe UPX behavioral1/memory/856-212-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\xrrxxxl.exe UPX behavioral1/memory/2484-229-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\3tnttb.exe UPX C:\rxxlflf.exe UPX behavioral1/memory/1776-242-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/1852-240-0x0000000000400000-0x0000000000434000-memory.dmp UPX \??\c:\nhbhtt.exe UPX behavioral1/memory/2924-257-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\vvppd.exe UPX behavioral1/memory/1712-266-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\tttbnt.exe UPX C:\jdpdv.exe UPX C:\xxlrffr.exe UPX behavioral1/memory/1520-284-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/1520-292-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2932-299-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2932-307-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2880-309-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2072-315-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/1828-323-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2656-330-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral1/memory/2616-337-0x0000000000400000-0x0000000000434000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
nttbnt.exexrlrflr.exennntht.exedddjp.exe1pdjj.exeddvjp.exelffxfrf.exettthnb.exepjjjp.exe3fffrxx.exehbtbhn.exerrxfllx.exeppdvd.exe3fxfrxl.exenhbhbt.exe5xrlrlx.exepppjv.exerxlfrxx.exehhbhht.exevvpvj.exettnbtt.exepjdjv.exevvvpj.exe1tnttt.exexrrxxxl.exe3tnttb.exerxxlflf.exenhbhtt.exevvppd.exetttbnt.exejdpdv.exexxlrffr.exe7vvdj.exerrlfrfx.exe1nnbht.exebnhhnt.exejjjjp.exefxxlrxl.exe5bnntb.exevvjvp.exexrrrflr.exelfxrllx.exebtnbhh.exe9dppv.exexrflrxl.exelfxlrlr.exe7bbnbh.exedvpjv.exelllfrfx.exeffxlllr.exe5btnbb.exedvvvv.exepjvvj.exe9rrxffr.exe1bnthn.exe1jpjp.exevdjvp.exexfrfxfr.exenhhnbb.exejdddv.exedpvvd.exe1fflrxl.exenhbnhh.exeddvdj.exepid process 1144 nttbnt.exe 2700 xrlrflr.exe 2616 nnntht.exe 2752 dddjp.exe 2124 1pdjj.exe 2852 ddvjp.exe 2560 lffxfrf.exe 2576 ttthnb.exe 2564 pjjjp.exe 1884 3fffrxx.exe 2776 hbtbhn.exe 2848 rrxfllx.exe 304 ppdvd.exe 1924 3fxfrxl.exe 1448 nhbhbt.exe 2476 5xrlrlx.exe 1584 pppjv.exe 2204 rxlfrxx.exe 1588 hhbhht.exe 2276 vvpvj.exe 2228 ttnbtt.exe 2900 pjdjv.exe 856 vvvpj.exe 1056 1tnttt.exe 2484 xrrxxxl.exe 1852 3tnttb.exe 1776 rxxlflf.exe 2924 nhbhtt.exe 1712 vvppd.exe 1300 tttbnt.exe 1512 jdpdv.exe 1520 xxlrffr.exe 1808 7vvdj.exe 2932 rrlfrfx.exe 2880 1nnbht.exe 2072 bnhhnt.exe 1828 jjjjp.exe 2656 fxxlrxl.exe 2616 5bnntb.exe 2640 vvjvp.exe 2628 xrrrflr.exe 2696 lfxrllx.exe 2540 btnbhh.exe 2568 9dppv.exe 2972 xrflrxl.exe 2576 lfxlrlr.exe 3052 7bbnbh.exe 2684 dvpjv.exe 2824 lllfrfx.exe 2688 ffxlllr.exe 2864 5btnbb.exe 236 dvvvv.exe 1836 pjvvj.exe 2020 9rrxffr.exe 1348 1bnthn.exe 1288 1jpjp.exe 552 vdjvp.exe 1584 xfrfxfr.exe 1568 nhhnbb.exe 2056 jdddv.exe 2248 dpvvd.exe 2276 1fflrxl.exe 2916 nhbnhh.exe 2064 ddvdj.exe -
Processes:
resource yara_rule behavioral1/memory/2880-0-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\nttbnt.exe upx behavioral1/memory/2880-8-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1144-9-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1144-18-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\xrlrflr.exe upx behavioral1/memory/2700-27-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\nnntht.exe upx behavioral1/memory/2616-30-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\dddjp.exe upx C:\1pdjj.exe upx behavioral1/memory/2752-45-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2124-48-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2852-57-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\ddvjp.exe upx \??\c:\lffxfrf.exe upx behavioral1/memory/2560-67-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\ttthnb.exe upx C:\pjjjp.exe upx behavioral1/memory/2564-85-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\3fffrxx.exe upx C:\hbtbhn.exe upx C:\rrxfllx.exe upx C:\ppdvd.exe upx behavioral1/memory/2848-119-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\3fxfrxl.exe upx C:\nhbhbt.exe upx behavioral1/memory/1448-136-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\5xrlrlx.exe upx C:\pppjv.exe upx behavioral1/memory/2476-153-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\rxlfrxx.exe upx C:\hhbhht.exe upx behavioral1/memory/2204-170-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\vvpvj.exe upx behavioral1/memory/1588-178-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\ttnbtt.exe upx C:\pjdjv.exe upx behavioral1/memory/2900-197-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\vvvpj.exe upx C:\1tnttt.exe upx behavioral1/memory/856-212-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\xrrxxxl.exe upx behavioral1/memory/2484-229-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\3tnttb.exe upx C:\rxxlflf.exe upx behavioral1/memory/1776-242-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1852-240-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\nhbhtt.exe upx behavioral1/memory/2924-257-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\vvppd.exe upx behavioral1/memory/1712-266-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\tttbnt.exe upx C:\jdpdv.exe upx C:\xxlrffr.exe upx behavioral1/memory/1520-284-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1520-292-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2932-299-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2932-307-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2880-309-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2072-315-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1828-323-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2656-330-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2616-337-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c6d139a695d9529c634b1dbe018d0d29b87751a566e2b7f68c9acbc0f86e5a80.exenttbnt.exexrlrflr.exennntht.exedddjp.exe1pdjj.exeddvjp.exelffxfrf.exettthnb.exepjjjp.exe3fffrxx.exehbtbhn.exerrxfllx.exeppdvd.exe3fxfrxl.exenhbhbt.exedescription pid process target process PID 2880 wrote to memory of 1144 2880 c6d139a695d9529c634b1dbe018d0d29b87751a566e2b7f68c9acbc0f86e5a80.exe nttbnt.exe PID 2880 wrote to memory of 1144 2880 c6d139a695d9529c634b1dbe018d0d29b87751a566e2b7f68c9acbc0f86e5a80.exe nttbnt.exe PID 2880 wrote to memory of 1144 2880 c6d139a695d9529c634b1dbe018d0d29b87751a566e2b7f68c9acbc0f86e5a80.exe nttbnt.exe PID 2880 wrote to memory of 1144 2880 c6d139a695d9529c634b1dbe018d0d29b87751a566e2b7f68c9acbc0f86e5a80.exe nttbnt.exe PID 1144 wrote to memory of 2700 1144 nttbnt.exe xrlrflr.exe PID 1144 wrote to memory of 2700 1144 nttbnt.exe xrlrflr.exe PID 1144 wrote to memory of 2700 1144 nttbnt.exe xrlrflr.exe PID 1144 wrote to memory of 2700 1144 nttbnt.exe xrlrflr.exe PID 2700 wrote to memory of 2616 2700 xrlrflr.exe nnntht.exe PID 2700 wrote to memory of 2616 2700 xrlrflr.exe nnntht.exe PID 2700 wrote to memory of 2616 2700 xrlrflr.exe nnntht.exe PID 2700 wrote to memory of 2616 2700 xrlrflr.exe nnntht.exe PID 2616 wrote to memory of 2752 2616 nnntht.exe dddjp.exe PID 2616 wrote to memory of 2752 2616 nnntht.exe dddjp.exe PID 2616 wrote to memory of 2752 2616 nnntht.exe dddjp.exe PID 2616 wrote to memory of 2752 2616 nnntht.exe dddjp.exe PID 2752 wrote to memory of 2124 2752 dddjp.exe 1pdjj.exe PID 2752 wrote to memory of 2124 2752 dddjp.exe 1pdjj.exe PID 2752 wrote to memory of 2124 2752 dddjp.exe 1pdjj.exe PID 2752 wrote to memory of 2124 2752 dddjp.exe 1pdjj.exe PID 2124 wrote to memory of 2852 2124 1pdjj.exe ddvjp.exe PID 2124 wrote to memory of 2852 2124 1pdjj.exe ddvjp.exe PID 2124 wrote to memory of 2852 2124 1pdjj.exe ddvjp.exe PID 2124 wrote to memory of 2852 2124 1pdjj.exe ddvjp.exe PID 2852 wrote to memory of 2560 2852 ddvjp.exe lffxfrf.exe PID 2852 wrote to memory of 2560 2852 ddvjp.exe lffxfrf.exe PID 2852 wrote to memory of 2560 2852 ddvjp.exe lffxfrf.exe PID 2852 wrote to memory of 2560 2852 ddvjp.exe lffxfrf.exe PID 2560 wrote to memory of 2576 2560 lffxfrf.exe ttthnb.exe PID 2560 wrote to memory of 2576 2560 lffxfrf.exe ttthnb.exe PID 2560 wrote to memory of 2576 2560 lffxfrf.exe ttthnb.exe PID 2560 wrote to memory of 2576 2560 lffxfrf.exe ttthnb.exe PID 2576 wrote to memory of 2564 2576 ttthnb.exe pjjjp.exe PID 2576 wrote to memory of 2564 2576 ttthnb.exe pjjjp.exe PID 2576 wrote to memory of 2564 2576 ttthnb.exe pjjjp.exe PID 2576 wrote to memory of 2564 2576 ttthnb.exe pjjjp.exe PID 2564 wrote to memory of 1884 2564 pjjjp.exe 3fffrxx.exe PID 2564 wrote to memory of 1884 2564 pjjjp.exe 3fffrxx.exe PID 2564 wrote to memory of 1884 2564 pjjjp.exe 3fffrxx.exe PID 2564 wrote to memory of 1884 2564 pjjjp.exe 3fffrxx.exe PID 1884 wrote to memory of 2776 1884 3fffrxx.exe hbtbhn.exe PID 1884 wrote to memory of 2776 1884 3fffrxx.exe hbtbhn.exe PID 1884 wrote to memory of 2776 1884 3fffrxx.exe hbtbhn.exe PID 1884 wrote to memory of 2776 1884 3fffrxx.exe hbtbhn.exe PID 2776 wrote to memory of 2848 2776 hbtbhn.exe rrxfllx.exe PID 2776 wrote to memory of 2848 2776 hbtbhn.exe rrxfllx.exe PID 2776 wrote to memory of 2848 2776 hbtbhn.exe rrxfllx.exe PID 2776 wrote to memory of 2848 2776 hbtbhn.exe rrxfllx.exe PID 2848 wrote to memory of 304 2848 rrxfllx.exe ppdvd.exe PID 2848 wrote to memory of 304 2848 rrxfllx.exe ppdvd.exe PID 2848 wrote to memory of 304 2848 rrxfllx.exe ppdvd.exe PID 2848 wrote to memory of 304 2848 rrxfllx.exe ppdvd.exe PID 304 wrote to memory of 1924 304 ppdvd.exe 3fxfrxl.exe PID 304 wrote to memory of 1924 304 ppdvd.exe 3fxfrxl.exe PID 304 wrote to memory of 1924 304 ppdvd.exe 3fxfrxl.exe PID 304 wrote to memory of 1924 304 ppdvd.exe 3fxfrxl.exe PID 1924 wrote to memory of 1448 1924 3fxfrxl.exe nhbhbt.exe PID 1924 wrote to memory of 1448 1924 3fxfrxl.exe nhbhbt.exe PID 1924 wrote to memory of 1448 1924 3fxfrxl.exe nhbhbt.exe PID 1924 wrote to memory of 1448 1924 3fxfrxl.exe nhbhbt.exe PID 1448 wrote to memory of 2476 1448 nhbhbt.exe 5xrlrlx.exe PID 1448 wrote to memory of 2476 1448 nhbhbt.exe 5xrlrlx.exe PID 1448 wrote to memory of 2476 1448 nhbhbt.exe 5xrlrlx.exe PID 1448 wrote to memory of 2476 1448 nhbhbt.exe 5xrlrlx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6d139a695d9529c634b1dbe018d0d29b87751a566e2b7f68c9acbc0f86e5a80.exe"C:\Users\Admin\AppData\Local\Temp\c6d139a695d9529c634b1dbe018d0d29b87751a566e2b7f68c9acbc0f86e5a80.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\nttbnt.exec:\nttbnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\xrlrflr.exec:\xrlrflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\nnntht.exec:\nnntht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\dddjp.exec:\dddjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\1pdjj.exec:\1pdjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\ddvjp.exec:\ddvjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\lffxfrf.exec:\lffxfrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\ttthnb.exec:\ttthnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\pjjjp.exec:\pjjjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\3fffrxx.exec:\3fffrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\hbtbhn.exec:\hbtbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\rrxfllx.exec:\rrxfllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\ppdvd.exec:\ppdvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:304 -
\??\c:\3fxfrxl.exec:\3fxfrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\nhbhbt.exec:\nhbhbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\5xrlrlx.exec:\5xrlrlx.exe17⤵
- Executes dropped EXE
PID:2476 -
\??\c:\pppjv.exec:\pppjv.exe18⤵
- Executes dropped EXE
PID:1584 -
\??\c:\rxlfrxx.exec:\rxlfrxx.exe19⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hhbhht.exec:\hhbhht.exe20⤵
- Executes dropped EXE
PID:1588 -
\??\c:\vvpvj.exec:\vvpvj.exe21⤵
- Executes dropped EXE
PID:2276 -
\??\c:\ttnbtt.exec:\ttnbtt.exe22⤵
- Executes dropped EXE
PID:2228 -
\??\c:\pjdjv.exec:\pjdjv.exe23⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vvvpj.exec:\vvvpj.exe24⤵
- Executes dropped EXE
PID:856 -
\??\c:\1tnttt.exec:\1tnttt.exe25⤵
- Executes dropped EXE
PID:1056 -
\??\c:\xrrxxxl.exec:\xrrxxxl.exe26⤵
- Executes dropped EXE
PID:2484 -
\??\c:\3tnttb.exec:\3tnttb.exe27⤵
- Executes dropped EXE
PID:1852 -
\??\c:\rxxlflf.exec:\rxxlflf.exe28⤵
- Executes dropped EXE
PID:1776 -
\??\c:\nhbhtt.exec:\nhbhtt.exe29⤵
- Executes dropped EXE
PID:2924 -
\??\c:\vvppd.exec:\vvppd.exe30⤵
- Executes dropped EXE
PID:1712 -
\??\c:\tttbnt.exec:\tttbnt.exe31⤵
- Executes dropped EXE
PID:1300 -
\??\c:\jdpdv.exec:\jdpdv.exe32⤵
- Executes dropped EXE
PID:1512 -
\??\c:\xxlrffr.exec:\xxlrffr.exe33⤵
- Executes dropped EXE
PID:1520 -
\??\c:\7vvdj.exec:\7vvdj.exe34⤵
- Executes dropped EXE
PID:1808 -
\??\c:\rrlfrfx.exec:\rrlfrfx.exe35⤵
- Executes dropped EXE
PID:2932 -
\??\c:\1nnbht.exec:\1nnbht.exe36⤵
- Executes dropped EXE
PID:2880 -
\??\c:\bnhhnt.exec:\bnhhnt.exe37⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jjjjp.exec:\jjjjp.exe38⤵
- Executes dropped EXE
PID:1828 -
\??\c:\fxxlrxl.exec:\fxxlrxl.exe39⤵
- Executes dropped EXE
PID:2656 -
\??\c:\5bnntb.exec:\5bnntb.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vvjvp.exec:\vvjvp.exe41⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xrrrflr.exec:\xrrrflr.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\lfxrllx.exec:\lfxrllx.exe43⤵
- Executes dropped EXE
PID:2696 -
\??\c:\btnbhh.exec:\btnbhh.exe44⤵
- Executes dropped EXE
PID:2540 -
\??\c:\9dppv.exec:\9dppv.exe45⤵
- Executes dropped EXE
PID:2568 -
\??\c:\xrflrxl.exec:\xrflrxl.exe46⤵
- Executes dropped EXE
PID:2972 -
\??\c:\lfxlrlr.exec:\lfxlrlr.exe47⤵
- Executes dropped EXE
PID:2576 -
\??\c:\7bbnbh.exec:\7bbnbh.exe48⤵
- Executes dropped EXE
PID:3052 -
\??\c:\dvpjv.exec:\dvpjv.exe49⤵
- Executes dropped EXE
PID:2684 -
\??\c:\lllfrfx.exec:\lllfrfx.exe50⤵
- Executes dropped EXE
PID:2824 -
\??\c:\ffxlllr.exec:\ffxlllr.exe51⤵
- Executes dropped EXE
PID:2688 -
\??\c:\5btnbb.exec:\5btnbb.exe52⤵
- Executes dropped EXE
PID:2864 -
\??\c:\dvvvv.exec:\dvvvv.exe53⤵
- Executes dropped EXE
PID:236 -
\??\c:\pjvvj.exec:\pjvvj.exe54⤵
- Executes dropped EXE
PID:1836 -
\??\c:\9rrxffr.exec:\9rrxffr.exe55⤵
- Executes dropped EXE
PID:2020 -
\??\c:\1bnthn.exec:\1bnthn.exe56⤵
- Executes dropped EXE
PID:1348 -
\??\c:\1jpjp.exec:\1jpjp.exe57⤵
- Executes dropped EXE
PID:1288 -
\??\c:\vdjvp.exec:\vdjvp.exe58⤵
- Executes dropped EXE
PID:552 -
\??\c:\xfrfxfr.exec:\xfrfxfr.exe59⤵
- Executes dropped EXE
PID:1584 -
\??\c:\nhhnbb.exec:\nhhnbb.exe60⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jdddv.exec:\jdddv.exe61⤵
- Executes dropped EXE
PID:2056 -
\??\c:\dpvvd.exec:\dpvvd.exe62⤵
- Executes dropped EXE
PID:2248 -
\??\c:\1fflrxl.exec:\1fflrxl.exe63⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nhbnhh.exec:\nhbnhh.exe64⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ddvdj.exec:\ddvdj.exe65⤵
- Executes dropped EXE
PID:2064 -
\??\c:\ddppd.exec:\ddppd.exe66⤵PID:484
-
\??\c:\fxrxlrx.exec:\fxrxlrx.exe67⤵PID:1320
-
\??\c:\nnhnth.exec:\nnhnth.exe68⤵PID:1056
-
\??\c:\dvpvd.exec:\dvpvd.exe69⤵PID:2136
-
\??\c:\rlflrrf.exec:\rlflrrf.exe70⤵PID:1556
-
\??\c:\hnhtbn.exec:\hnhtbn.exe71⤵PID:1864
-
\??\c:\bbbhtb.exec:\bbbhtb.exe72⤵PID:1696
-
\??\c:\jjvjp.exec:\jjvjp.exe73⤵PID:1872
-
\??\c:\xrrxlrf.exec:\xrrxlrf.exe74⤵PID:960
-
\??\c:\bbnbhn.exec:\bbnbhn.exe75⤵PID:1792
-
\??\c:\nntbnt.exec:\nntbnt.exe76⤵PID:556
-
\??\c:\fxrxxfl.exec:\fxrxxfl.exe77⤵PID:984
-
\??\c:\3rrlflx.exec:\3rrlflx.exe78⤵PID:988
-
\??\c:\ttnbtt.exec:\ttnbtt.exe79⤵PID:2884
-
\??\c:\5vvvp.exec:\5vvvp.exe80⤵PID:2232
-
\??\c:\fffrxlx.exec:\fffrxlx.exe81⤵PID:1608
-
\??\c:\5tnnbb.exec:\5tnnbb.exe82⤵PID:1212
-
\??\c:\nnbhtb.exec:\nnbhtb.exe83⤵PID:2604
-
\??\c:\vvpvj.exec:\vvpvj.exe84⤵PID:1828
-
\??\c:\1rfxxxf.exec:\1rfxxxf.exe85⤵PID:2748
-
\??\c:\5hbnth.exec:\5hbnth.exe86⤵PID:2736
-
\??\c:\5tbtnb.exec:\5tbtnb.exe87⤵PID:1736
-
\??\c:\vpdjj.exec:\vpdjj.exe88⤵PID:2796
-
\??\c:\7lxflxl.exec:\7lxflxl.exe89⤵PID:2960
-
\??\c:\lfrxxxl.exec:\lfrxxxl.exe90⤵PID:2708
-
\??\c:\1bbbhn.exec:\1bbbhn.exe91⤵PID:2508
-
\??\c:\jdvvj.exec:\jdvvj.exe92⤵PID:2584
-
\??\c:\9lfxfll.exec:\9lfxfll.exe93⤵PID:2028
-
\??\c:\9frflrx.exec:\9frflrx.exe94⤵PID:2564
-
\??\c:\tnhntb.exec:\tnhntb.exe95⤵PID:2820
-
\??\c:\pppjp.exec:\pppjp.exe96⤵PID:2860
-
\??\c:\xxrflrf.exec:\xxrflrf.exe97⤵PID:2984
-
\??\c:\ttthtt.exec:\ttthtt.exe98⤵PID:2864
-
\??\c:\jjddp.exec:\jjddp.exe99⤵PID:236
-
\??\c:\fxxlxfx.exec:\fxxlxfx.exe100⤵PID:1820
-
\??\c:\lxllrrx.exec:\lxllrrx.exe101⤵PID:1924
-
\??\c:\nhbnbh.exec:\nhbnbh.exe102⤵PID:1348
-
\??\c:\ddddp.exec:\ddddp.exe103⤵PID:1088
-
\??\c:\fxlrrxl.exec:\fxlrrxl.exe104⤵PID:552
-
\??\c:\xlfrxlr.exec:\xlfrxlr.exe105⤵PID:1636
-
\??\c:\hbtbnb.exec:\hbtbnb.exe106⤵PID:1568
-
\??\c:\pjddd.exec:\pjddd.exe107⤵PID:2056
-
\??\c:\3rlrxxl.exec:\3rlrxxl.exe108⤵PID:1188
-
\??\c:\tnbttt.exec:\tnbttt.exe109⤵PID:2492
-
\??\c:\bbtbbh.exec:\bbtbbh.exe110⤵PID:2900
-
\??\c:\1vvvd.exec:\1vvvd.exe111⤵PID:1296
-
\??\c:\rrffllx.exec:\rrffllx.exe112⤵PID:1856
-
\??\c:\lfrlxrx.exec:\lfrlxrx.exe113⤵PID:2348
-
\??\c:\tnnbnn.exec:\tnnbnn.exe114⤵PID:2368
-
\??\c:\vvpvp.exec:\vvpvp.exe115⤵PID:2376
-
\??\c:\9llrrll.exec:\9llrrll.exe116⤵PID:1556
-
\??\c:\ppjpd.exec:\ppjpd.exe117⤵PID:1864
-
\??\c:\xrlrxlr.exec:\xrlrxlr.exe118⤵PID:1876
-
\??\c:\bbnthh.exec:\bbnthh.exe119⤵PID:576
-
\??\c:\9dvdj.exec:\9dvdj.exe120⤵PID:2416
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe121⤵PID:2180
-
\??\c:\9rlxxxl.exec:\9rlxxxl.exe122⤵PID:1624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-