Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 04:46
Behavioral task
behavioral1
Sample
aaee35475008872595c4f344442b13e9db8403dd987cf0bd98949442ebc33067.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
aaee35475008872595c4f344442b13e9db8403dd987cf0bd98949442ebc33067.exe
-
Size
199KB
-
MD5
0570e42fa1f7b3c2a975a6f655d36540
-
SHA1
d59eea9971b2da630695ff7101b3645d9415fb21
-
SHA256
aaee35475008872595c4f344442b13e9db8403dd987cf0bd98949442ebc33067
-
SHA512
034ff9d562021c738e1e0aaa4d95afdba36ee8421854e2185a9339b6ae086292f1a2d6843029237b7c81199b0f5603748785eca466249d755706067aa83bbe03
-
SSDEEP
3072:ZhOmTsF93UYfwC6GIoutFza6BhOmTsUm82xpi8rY9AABa1JePQKN1hJClv:Zcm4FmowdHoSha6Bcm4JddW7Y6XJCl
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2488-7-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2464-19-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1988-30-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2728-38-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2728-37-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2116-50-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/3064-60-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2652-58-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/3064-70-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2532-71-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2532-79-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/3024-91-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/3024-90-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/3040-100-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2876-110-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2876-111-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2892-120-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2892-119-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/640-131-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/640-130-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1944-141-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1224-151-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2420-162-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1272-181-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1272-179-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2012-185-0x0000000000220000-0x000000000025F000-memory.dmp family_blackmoon behavioral1/memory/2972-193-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2260-203-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/784-225-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/784-224-0x00000000002D0000-0x000000000030F000-memory.dmp family_blackmoon behavioral1/memory/2396-243-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2396-242-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1508-233-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1552-249-0x0000000000440000-0x000000000047F000-memory.dmp family_blackmoon behavioral1/memory/1552-254-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/340-266-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/952-269-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/952-277-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1792-282-0x0000000000220000-0x000000000025F000-memory.dmp family_blackmoon behavioral1/memory/1980-292-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1792-288-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1980-297-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/892-307-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/892-309-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1980-298-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2940-314-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2940-312-0x0000000076F00000-0x000000007701F000-memory.dmp family_blackmoon behavioral1/memory/1612-321-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1612-320-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1600-332-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2364-341-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2820-349-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2960-357-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2684-365-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2556-373-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2220-381-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2220-380-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2608-385-0x0000000000220000-0x000000000025F000-memory.dmp family_blackmoon behavioral1/memory/2608-390-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2292-391-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2292-398-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1872-399-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1872-407-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2784-414-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpjpv.exerxrrlll.exe3xrlxrx.exetnbnbb.exexrfxllr.exe5fllrxx.exejdpdj.exe1bnbhn.exexfxxfxf.exe7rllrrx.exedvvjd.exe3frxflr.exe9dpvd.exe1fxllxx.exejdpdv.exejdppd.exepppjv.exe5lrrrfl.exetnthbn.exejdppd.exefrfflrr.exe5thnhb.exefrffllr.exehbnhtb.exe5tnbbt.exe3nbhhn.exepdpjp.exefrrrxrr.exe9vvvv.exe9fxlrxx.exennbhbn.exeddpjv.exebttbhb.exe3jjpj.exefxlrfrr.exebtnbnn.exebnhhhh.exelxxxrrl.exelflflfl.exe9dpdj.exexrrrxrf.exe3htbtt.exevpvjp.exerlflxfl.exe9tbhbh.exe1hnttt.exe3pppv.exefxrxlrx.exenbnttt.exe5tbhhn.exe7pjdj.exejvdvv.exelfrxrxf.exehbnbhh.exebnbhth.exejdjjp.exe7vpvd.exerlxrxxf.exe9thntb.exehbnnbt.exepjppv.exevvjdd.exelfxfrfx.exehbbhtt.exepid process 2464 vpjpv.exe 1988 rxrrlll.exe 2728 3xrlxrx.exe 2116 tnbnbb.exe 2652 xrfxllr.exe 3064 5fllrxx.exe 2532 jdpdj.exe 3024 1bnbhn.exe 3040 xfxxfxf.exe 2876 7rllrrx.exe 2892 dvvjd.exe 640 3frxflr.exe 1944 9dpvd.exe 1224 1fxllxx.exe 2420 jdpdv.exe 628 jdppd.exe 1272 pppjv.exe 2012 5lrrrfl.exe 2972 tnthbn.exe 2260 jdppd.exe 2632 frfflrr.exe 784 5thnhb.exe 1508 frffllr.exe 2396 hbnhtb.exe 1552 5tnbbt.exe 340 3nbhhn.exe 952 pdpjp.exe 1792 frrrxrr.exe 1980 9vvvv.exe 892 9fxlrxx.exe 2940 nnbhbn.exe 1600 ddpjv.exe 2364 bttbhb.exe 2820 3jjpj.exe 2960 fxlrfrr.exe 2684 btnbnn.exe 2556 bnhhhh.exe 2220 lxxxrrl.exe 2608 lflflfl.exe 2292 9dpdj.exe 1872 xrrrxrf.exe 2784 3htbtt.exe 2904 vpvjp.exe 1448 rlflxfl.exe 2492 9tbhbh.exe 1880 1hnttt.exe 1944 3pppv.exe 1460 fxrxlrx.exe 2168 nbnttt.exe 1404 5tbhhn.exe 2060 7pjdj.exe 2304 jvdvv.exe 2308 lfrxrxf.exe 1668 hbnbhh.exe 592 bnbhth.exe 556 jdjjp.exe 1864 7vpvd.exe 1508 rlxrxxf.exe 1408 9thntb.exe 796 hbnnbt.exe 1676 pjppv.exe 2416 vvjdd.exe 1068 lfxfrfx.exe 2272 hbbhtt.exe -
Processes:
resource yara_rule behavioral1/memory/2488-0-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\vpjpv.exe upx behavioral1/memory/2464-10-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2488-7-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2488-6-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\rxrrlll.exe upx behavioral1/memory/2464-19-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/1988-20-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/1988-24-0x0000000000220000-0x000000000025F000-memory.dmp upx C:\3xrlxrx.exe upx behavioral1/memory/1988-30-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2116-40-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\tnbnbb.exe upx behavioral1/memory/2728-38-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2116-44-0x0000000000220000-0x000000000025F000-memory.dmp upx C:\xrfxllr.exe upx behavioral1/memory/2116-50-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/3064-60-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\5fllrxx.exe upx behavioral1/memory/2652-58-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/3064-64-0x00000000002D0000-0x000000000030F000-memory.dmp upx C:\jdpdj.exe upx behavioral1/memory/3064-70-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2532-71-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2532-79-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\1bnbhn.exe upx behavioral1/memory/2532-78-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/3024-82-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\xfxxfxf.exe upx behavioral1/memory/3024-91-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/3040-92-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2876-102-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\7rllrrx.exe upx behavioral1/memory/3040-100-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\dvvjd.exe upx behavioral1/memory/2892-113-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2876-111-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2892-120-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\3frxflr.exe upx behavioral1/memory/640-122-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\9dpvd.exe upx behavioral1/memory/640-131-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/1944-132-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/1944-141-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\1fxllxx.exe upx behavioral1/memory/1224-142-0x0000000000400000-0x000000000043F000-memory.dmp upx C:\jdpdv.exe upx behavioral1/memory/2420-154-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/1224-151-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2420-156-0x00000000002B0000-0x00000000002EF000-memory.dmp upx C:\jdppd.exe upx behavioral1/memory/2420-162-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/628-163-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/628-167-0x0000000001B70000-0x0000000001BAF000-memory.dmp upx C:\pppjv.exe upx C:\5lrrrfl.exe upx behavioral1/memory/1272-181-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2012-185-0x0000000000220000-0x000000000025F000-memory.dmp upx C:\tnthbn.exe upx behavioral1/memory/2972-193-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2260-197-0x00000000003A0000-0x00000000003DF000-memory.dmp upx C:\frfflrr.exe upx behavioral1/memory/2260-203-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2632-204-0x0000000000400000-0x000000000043F000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
aaee35475008872595c4f344442b13e9db8403dd987cf0bd98949442ebc33067.exevpjpv.exerxrrlll.exe3xrlxrx.exetnbnbb.exexrfxllr.exe5fllrxx.exejdpdj.exe1bnbhn.exexfxxfxf.exe7rllrrx.exedvvjd.exe3frxflr.exe9dpvd.exe1fxllxx.exejdpdv.exedescription pid process target process PID 2488 wrote to memory of 2464 2488 aaee35475008872595c4f344442b13e9db8403dd987cf0bd98949442ebc33067.exe vpjpv.exe PID 2488 wrote to memory of 2464 2488 aaee35475008872595c4f344442b13e9db8403dd987cf0bd98949442ebc33067.exe vpjpv.exe PID 2488 wrote to memory of 2464 2488 aaee35475008872595c4f344442b13e9db8403dd987cf0bd98949442ebc33067.exe vpjpv.exe PID 2488 wrote to memory of 2464 2488 aaee35475008872595c4f344442b13e9db8403dd987cf0bd98949442ebc33067.exe vpjpv.exe PID 2464 wrote to memory of 1988 2464 vpjpv.exe rxrrlll.exe PID 2464 wrote to memory of 1988 2464 vpjpv.exe rxrrlll.exe PID 2464 wrote to memory of 1988 2464 vpjpv.exe rxrrlll.exe PID 2464 wrote to memory of 1988 2464 vpjpv.exe rxrrlll.exe PID 1988 wrote to memory of 2728 1988 rxrrlll.exe 3xrlxrx.exe PID 1988 wrote to memory of 2728 1988 rxrrlll.exe 3xrlxrx.exe PID 1988 wrote to memory of 2728 1988 rxrrlll.exe 3xrlxrx.exe PID 1988 wrote to memory of 2728 1988 rxrrlll.exe 3xrlxrx.exe PID 2728 wrote to memory of 2116 2728 3xrlxrx.exe tnbnbb.exe PID 2728 wrote to memory of 2116 2728 3xrlxrx.exe tnbnbb.exe PID 2728 wrote to memory of 2116 2728 3xrlxrx.exe tnbnbb.exe PID 2728 wrote to memory of 2116 2728 3xrlxrx.exe tnbnbb.exe PID 2116 wrote to memory of 2652 2116 tnbnbb.exe xrfxllr.exe PID 2116 wrote to memory of 2652 2116 tnbnbb.exe xrfxllr.exe PID 2116 wrote to memory of 2652 2116 tnbnbb.exe xrfxllr.exe PID 2116 wrote to memory of 2652 2116 tnbnbb.exe xrfxllr.exe PID 2652 wrote to memory of 3064 2652 xrfxllr.exe 5fllrxx.exe PID 2652 wrote to memory of 3064 2652 xrfxllr.exe 5fllrxx.exe PID 2652 wrote to memory of 3064 2652 xrfxllr.exe 5fllrxx.exe PID 2652 wrote to memory of 3064 2652 xrfxllr.exe 5fllrxx.exe PID 3064 wrote to memory of 2532 3064 5fllrxx.exe jdpdj.exe PID 3064 wrote to memory of 2532 3064 5fllrxx.exe jdpdj.exe PID 3064 wrote to memory of 2532 3064 5fllrxx.exe jdpdj.exe PID 3064 wrote to memory of 2532 3064 5fllrxx.exe jdpdj.exe PID 2532 wrote to memory of 3024 2532 jdpdj.exe 1bnbhn.exe PID 2532 wrote to memory of 3024 2532 jdpdj.exe 1bnbhn.exe PID 2532 wrote to memory of 3024 2532 jdpdj.exe 1bnbhn.exe PID 2532 wrote to memory of 3024 2532 jdpdj.exe 1bnbhn.exe PID 3024 wrote to memory of 3040 3024 1bnbhn.exe xfxxfxf.exe PID 3024 wrote to memory of 3040 3024 1bnbhn.exe xfxxfxf.exe PID 3024 wrote to memory of 3040 3024 1bnbhn.exe xfxxfxf.exe PID 3024 wrote to memory of 3040 3024 1bnbhn.exe xfxxfxf.exe PID 3040 wrote to memory of 2876 3040 xfxxfxf.exe 7rllrrx.exe PID 3040 wrote to memory of 2876 3040 xfxxfxf.exe 7rllrrx.exe PID 3040 wrote to memory of 2876 3040 xfxxfxf.exe 7rllrrx.exe PID 3040 wrote to memory of 2876 3040 xfxxfxf.exe 7rllrrx.exe PID 2876 wrote to memory of 2892 2876 7rllrrx.exe dvvjd.exe PID 2876 wrote to memory of 2892 2876 7rllrrx.exe dvvjd.exe PID 2876 wrote to memory of 2892 2876 7rllrrx.exe dvvjd.exe PID 2876 wrote to memory of 2892 2876 7rllrrx.exe dvvjd.exe PID 2892 wrote to memory of 640 2892 dvvjd.exe 3frxflr.exe PID 2892 wrote to memory of 640 2892 dvvjd.exe 3frxflr.exe PID 2892 wrote to memory of 640 2892 dvvjd.exe 3frxflr.exe PID 2892 wrote to memory of 640 2892 dvvjd.exe 3frxflr.exe PID 640 wrote to memory of 1944 640 3frxflr.exe 9dpvd.exe PID 640 wrote to memory of 1944 640 3frxflr.exe 9dpvd.exe PID 640 wrote to memory of 1944 640 3frxflr.exe 9dpvd.exe PID 640 wrote to memory of 1944 640 3frxflr.exe 9dpvd.exe PID 1944 wrote to memory of 1224 1944 9dpvd.exe 1fxllxx.exe PID 1944 wrote to memory of 1224 1944 9dpvd.exe 1fxllxx.exe PID 1944 wrote to memory of 1224 1944 9dpvd.exe 1fxllxx.exe PID 1944 wrote to memory of 1224 1944 9dpvd.exe 1fxllxx.exe PID 1224 wrote to memory of 2420 1224 1fxllxx.exe jdpdv.exe PID 1224 wrote to memory of 2420 1224 1fxllxx.exe jdpdv.exe PID 1224 wrote to memory of 2420 1224 1fxllxx.exe jdpdv.exe PID 1224 wrote to memory of 2420 1224 1fxllxx.exe jdpdv.exe PID 2420 wrote to memory of 628 2420 jdpdv.exe jdppd.exe PID 2420 wrote to memory of 628 2420 jdpdv.exe jdppd.exe PID 2420 wrote to memory of 628 2420 jdpdv.exe jdppd.exe PID 2420 wrote to memory of 628 2420 jdpdv.exe jdppd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaee35475008872595c4f344442b13e9db8403dd987cf0bd98949442ebc33067.exe"C:\Users\Admin\AppData\Local\Temp\aaee35475008872595c4f344442b13e9db8403dd987cf0bd98949442ebc33067.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\vpjpv.exec:\vpjpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\rxrrlll.exec:\rxrrlll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\3xrlxrx.exec:\3xrlxrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\tnbnbb.exec:\tnbnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\xrfxllr.exec:\xrfxllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\5fllrxx.exec:\5fllrxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\jdpdj.exec:\jdpdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\1bnbhn.exec:\1bnbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\xfxxfxf.exec:\xfxxfxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\7rllrrx.exec:\7rllrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\dvvjd.exec:\dvvjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\3frxflr.exec:\3frxflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\9dpvd.exec:\9dpvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\1fxllxx.exec:\1fxllxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\jdpdv.exec:\jdpdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\jdppd.exec:\jdppd.exe17⤵
- Executes dropped EXE
PID:628 -
\??\c:\pppjv.exec:\pppjv.exe18⤵
- Executes dropped EXE
PID:1272 -
\??\c:\5lrrrfl.exec:\5lrrrfl.exe19⤵
- Executes dropped EXE
PID:2012 -
\??\c:\tnthbn.exec:\tnthbn.exe20⤵
- Executes dropped EXE
PID:2972 -
\??\c:\jdppd.exec:\jdppd.exe21⤵
- Executes dropped EXE
PID:2260 -
\??\c:\frfflrr.exec:\frfflrr.exe22⤵
- Executes dropped EXE
PID:2632 -
\??\c:\5thnhb.exec:\5thnhb.exe23⤵
- Executes dropped EXE
PID:784 -
\??\c:\frffllr.exec:\frffllr.exe24⤵
- Executes dropped EXE
PID:1508 -
\??\c:\hbnhtb.exec:\hbnhtb.exe25⤵
- Executes dropped EXE
PID:2396 -
\??\c:\5tnbbt.exec:\5tnbbt.exe26⤵
- Executes dropped EXE
PID:1552 -
\??\c:\3nbhhn.exec:\3nbhhn.exe27⤵
- Executes dropped EXE
PID:340 -
\??\c:\pdpjp.exec:\pdpjp.exe28⤵
- Executes dropped EXE
PID:952 -
\??\c:\frrrxrr.exec:\frrrxrr.exe29⤵
- Executes dropped EXE
PID:1792 -
\??\c:\9vvvv.exec:\9vvvv.exe30⤵
- Executes dropped EXE
PID:1980 -
\??\c:\9fxlrxx.exec:\9fxlrxx.exe31⤵
- Executes dropped EXE
PID:892 -
\??\c:\nnbhbn.exec:\nnbhbn.exe32⤵
- Executes dropped EXE
PID:2940 -
\??\c:\btbnbh.exec:\btbnbh.exe33⤵PID:1612
-
\??\c:\ddpjv.exec:\ddpjv.exe34⤵
- Executes dropped EXE
PID:1600 -
\??\c:\bttbhb.exec:\bttbhb.exe35⤵
- Executes dropped EXE
PID:2364 -
\??\c:\3jjpj.exec:\3jjpj.exe36⤵
- Executes dropped EXE
PID:2820 -
\??\c:\fxlrfrr.exec:\fxlrfrr.exe37⤵
- Executes dropped EXE
PID:2960 -
\??\c:\btnbnn.exec:\btnbnn.exe38⤵
- Executes dropped EXE
PID:2684 -
\??\c:\bnhhhh.exec:\bnhhhh.exe39⤵
- Executes dropped EXE
PID:2556 -
\??\c:\lxxxrrl.exec:\lxxxrrl.exe40⤵
- Executes dropped EXE
PID:2220 -
\??\c:\lflflfl.exec:\lflflfl.exe41⤵
- Executes dropped EXE
PID:2608 -
\??\c:\9dpdj.exec:\9dpdj.exe42⤵
- Executes dropped EXE
PID:2292 -
\??\c:\xrrrxrf.exec:\xrrrxrf.exe43⤵
- Executes dropped EXE
PID:1872 -
\??\c:\3htbtt.exec:\3htbtt.exe44⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vpvjp.exec:\vpvjp.exe45⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rlflxfl.exec:\rlflxfl.exe46⤵
- Executes dropped EXE
PID:1448 -
\??\c:\9tbhbh.exec:\9tbhbh.exe47⤵
- Executes dropped EXE
PID:2492 -
\??\c:\1hnttt.exec:\1hnttt.exe48⤵
- Executes dropped EXE
PID:1880 -
\??\c:\3pppv.exec:\3pppv.exe49⤵
- Executes dropped EXE
PID:1944 -
\??\c:\fxrxlrx.exec:\fxrxlrx.exe50⤵
- Executes dropped EXE
PID:1460 -
\??\c:\nbnttt.exec:\nbnttt.exe51⤵
- Executes dropped EXE
PID:2168 -
\??\c:\5tbhhn.exec:\5tbhhn.exe52⤵
- Executes dropped EXE
PID:1404 -
\??\c:\7pjdj.exec:\7pjdj.exe53⤵
- Executes dropped EXE
PID:2060 -
\??\c:\jvdvv.exec:\jvdvv.exe54⤵
- Executes dropped EXE
PID:2304 -
\??\c:\lfrxrxf.exec:\lfrxrxf.exe55⤵
- Executes dropped EXE
PID:2308 -
\??\c:\hbnbhh.exec:\hbnbhh.exe56⤵
- Executes dropped EXE
PID:1668 -
\??\c:\bnbhth.exec:\bnbhth.exe57⤵
- Executes dropped EXE
PID:592 -
\??\c:\jdjjp.exec:\jdjjp.exe58⤵
- Executes dropped EXE
PID:556 -
\??\c:\7vpvd.exec:\7vpvd.exe59⤵
- Executes dropped EXE
PID:1864 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe60⤵
- Executes dropped EXE
PID:1508 -
\??\c:\9thntb.exec:\9thntb.exe61⤵
- Executes dropped EXE
PID:1408 -
\??\c:\hbnnbt.exec:\hbnnbt.exe62⤵
- Executes dropped EXE
PID:796 -
\??\c:\pjppv.exec:\pjppv.exe63⤵
- Executes dropped EXE
PID:1676 -
\??\c:\vvjdd.exec:\vvjdd.exe64⤵
- Executes dropped EXE
PID:2416 -
\??\c:\lfxfrfx.exec:\lfxfrfx.exe65⤵
- Executes dropped EXE
PID:1068 -
\??\c:\hbbhtt.exec:\hbbhtt.exe66⤵
- Executes dropped EXE
PID:2272 -
\??\c:\bbtnbb.exec:\bbtnbb.exe67⤵PID:1292
-
\??\c:\jjvvj.exec:\jjvvj.exe68⤵PID:2996
-
\??\c:\vjddd.exec:\vjddd.exe69⤵PID:2224
-
\??\c:\lfxxrrx.exec:\lfxxrrx.exe70⤵PID:2424
-
\??\c:\5thnnt.exec:\5thnnt.exe71⤵PID:2644
-
\??\c:\nhtnbb.exec:\nhtnbb.exe72⤵PID:2104
-
\??\c:\jdjjp.exec:\jdjjp.exe73⤵PID:2160
-
\??\c:\lfxfrlx.exec:\lfxfrlx.exe74⤵PID:2148
-
\??\c:\7lxxfrf.exec:\7lxxfrf.exe75⤵PID:2776
-
\??\c:\tthnbb.exec:\tthnbb.exe76⤵PID:2712
-
\??\c:\ppppd.exec:\ppppd.exe77⤵PID:2548
-
\??\c:\djddd.exec:\djddd.exe78⤵PID:2564
-
\??\c:\rlxfrrr.exec:\rlxfrrr.exe79⤵PID:2584
-
\??\c:\lfrxffx.exec:\lfrxffx.exe80⤵PID:2088
-
\??\c:\ttbhtt.exec:\ttbhtt.exe81⤵PID:2860
-
\??\c:\ththbh.exec:\ththbh.exe82⤵PID:2848
-
\??\c:\dvjpv.exec:\dvjpv.exe83⤵PID:1528
-
\??\c:\vpjvj.exec:\vpjvj.exe84⤵PID:1540
-
\??\c:\xrffrrx.exec:\xrffrrx.exe85⤵PID:1636
-
\??\c:\nhttbh.exec:\nhttbh.exe86⤵PID:2812
-
\??\c:\7htbnn.exec:\7htbnn.exe87⤵PID:1544
-
\??\c:\3pjpp.exec:\3pjpp.exe88⤵PID:1452
-
\??\c:\dvpdd.exec:\dvpdd.exe89⤵PID:2572
-
\??\c:\9frrllr.exec:\9frrllr.exe90⤵PID:1972
-
\??\c:\3htnhh.exec:\3htnhh.exe91⤵PID:2276
-
\??\c:\7bnhtb.exec:\7bnhtb.exe92⤵PID:1924
-
\??\c:\pjvdj.exec:\pjvdj.exe93⤵PID:2120
-
\??\c:\rrllxff.exec:\rrllxff.exe94⤵PID:332
-
\??\c:\1xxlxfl.exec:\1xxlxfl.exe95⤵PID:592
-
\??\c:\bthbnt.exec:\bthbnt.exe96⤵PID:2384
-
\??\c:\thtbbb.exec:\thtbbb.exe97⤵PID:2396
-
\??\c:\5pjjd.exec:\5pjjd.exe98⤵PID:2476
-
\??\c:\dvddp.exec:\dvddp.exe99⤵PID:1552
-
\??\c:\rlrxxxf.exec:\rlrxxxf.exe100⤵PID:964
-
\??\c:\1xffllr.exec:\1xffllr.exe101⤵PID:1676
-
\??\c:\9tntbh.exec:\9tntbh.exe102⤵PID:1128
-
\??\c:\7dppp.exec:\7dppp.exe103⤵PID:2252
-
\??\c:\pdppd.exec:\pdppd.exe104⤵PID:2428
-
\??\c:\rlxfrrx.exec:\rlxfrrx.exe105⤵PID:892
-
\??\c:\xrlxffl.exec:\xrlxffl.exe106⤵PID:2840
-
\??\c:\1tntnb.exec:\1tntnb.exe107⤵PID:1588
-
\??\c:\hbnnnn.exec:\hbnnnn.exe108⤵PID:2108
-
\??\c:\7pjdp.exec:\7pjdp.exe109⤵PID:2744
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe110⤵PID:2688
-
\??\c:\rlrxffl.exec:\rlrxffl.exe111⤵PID:2944
-
\??\c:\btnnbb.exec:\btnnbb.exe112⤵PID:2560
-
\??\c:\nnhtbb.exec:\nnhtbb.exe113⤵PID:2832
-
\??\c:\ddvvv.exec:\ddvvv.exe114⤵PID:2712
-
\??\c:\rlxrffl.exec:\rlxrffl.exe115⤵PID:2532
-
\??\c:\fxlrffl.exec:\fxlrffl.exe116⤵PID:3028
-
\??\c:\nbhhnh.exec:\nbhhnh.exe117⤵PID:2852
-
\??\c:\btnnnt.exec:\btnnnt.exe118⤵PID:2292
-
\??\c:\pjppd.exec:\pjppd.exe119⤵PID:2784
-
\??\c:\pppvd.exec:\pppvd.exe120⤵PID:2876
-
\??\c:\9xrrffl.exec:\9xrrffl.exe121⤵PID:2888
-
\??\c:\3fxxflr.exec:\3fxxflr.exe122⤵PID:2036
-
\??\c:\3tnhhn.exec:\3tnhhn.exe123⤵PID:768
-
\??\c:\jvjdj.exec:\jvjdj.exe124⤵PID:1516
-
\??\c:\vjpjp.exec:\vjpjp.exe125⤵PID:1560
-
\??\c:\3fllrxf.exec:\3fllrxf.exe126⤵PID:1308
-
\??\c:\9rllxff.exec:\9rllxff.exe127⤵PID:1256
-
\??\c:\9hbtbn.exec:\9hbtbn.exe128⤵PID:1960
-
\??\c:\jdvpd.exec:\jdvpd.exe129⤵PID:2636
-
\??\c:\1xxrxrx.exec:\1xxrxrx.exe130⤵PID:2968
-
\??\c:\rlxlxrx.exec:\rlxlxrx.exe131⤵PID:604
-
\??\c:\nhhhtb.exec:\nhhhtb.exe132⤵PID:1496
-
\??\c:\3hbhtb.exec:\3hbhtb.exe133⤵PID:1492
-
\??\c:\jdppv.exec:\jdppv.exe134⤵PID:1340
-
\??\c:\3xlfrxx.exec:\3xlfrxx.exe135⤵PID:1356
-
\??\c:\lfrlxxl.exec:\lfrlxxl.exe136⤵PID:1876
-
\??\c:\9jpvj.exec:\9jpvj.exe137⤵PID:2964
-
\??\c:\vpjvp.exec:\vpjvp.exe138⤵PID:772
-
\??\c:\fxllxfl.exec:\fxllxfl.exe139⤵PID:568
-
\??\c:\xlrlrrx.exec:\xlrlrrx.exe140⤵PID:2436
-
\??\c:\thnntt.exec:\thnntt.exe141⤵PID:1768
-
\??\c:\7djjd.exec:\7djjd.exe142⤵PID:2296
-
\??\c:\jdjdj.exec:\jdjdj.exe143⤵PID:2272
-
\??\c:\frlllrf.exec:\frlllrf.exe144⤵PID:1608
-
\??\c:\3rlrrxl.exec:\3rlrrxl.exe145⤵PID:2316
-
\??\c:\btbttt.exec:\btbttt.exe146⤵PID:2928
-
\??\c:\nhbntt.exec:\nhbntt.exe147⤵PID:2448
-
\??\c:\vddpj.exec:\vddpj.exe148⤵PID:2348
-
\??\c:\5vjpv.exec:\5vjpv.exe149⤵PID:2764
-
\??\c:\rfxxlll.exec:\rfxxlll.exe150⤵PID:2948
-
\??\c:\lxffrlr.exec:\lxffrlr.exe151⤵PID:2688
-
\??\c:\btbhbb.exec:\btbhbb.exe152⤵PID:2212
-
\??\c:\nhbhnn.exec:\nhbhnn.exe153⤵PID:2684
-
\??\c:\jdjdj.exec:\jdjdj.exe154⤵PID:2648
-
\??\c:\pdjdj.exec:\pdjdj.exe155⤵PID:2832
-
\??\c:\7xrrflr.exec:\7xrrflr.exe156⤵PID:3068
-
\??\c:\1bnthb.exec:\1bnthb.exe157⤵PID:2564
-
\??\c:\nhtbhn.exec:\nhtbhn.exe158⤵PID:2340
-
\??\c:\dvjdj.exec:\dvjdj.exe159⤵PID:324
-
\??\c:\dvdvv.exec:\dvdvv.exe160⤵PID:2788
-
\??\c:\fxrrffl.exec:\fxrrffl.exe161⤵PID:2920
-
\??\c:\xrxxlll.exec:\xrxxlll.exe162⤵PID:2808
-
\??\c:\tnnnbh.exec:\tnnnbh.exe163⤵PID:1432
-
\??\c:\9vpjp.exec:\9vpjp.exe164⤵PID:1828
-
\??\c:\jjdjp.exec:\jjdjp.exe165⤵PID:1328
-
\??\c:\llxxflx.exec:\llxxflx.exe166⤵PID:2024
-
\??\c:\3lxxfxx.exec:\3lxxfxx.exe167⤵PID:1880
-
\??\c:\nntbtb.exec:\nntbtb.exe168⤵PID:2724
-
\??\c:\thnhtt.exec:\thnhtt.exe169⤵PID:844
-
\??\c:\dvjpp.exec:\dvjpp.exe170⤵PID:1460
-
\??\c:\1jvpp.exec:\1jvpp.exe171⤵PID:1404
-
\??\c:\lxfxfxf.exec:\lxfxfxf.exe172⤵PID:1964
-
\??\c:\tntbtt.exec:\tntbtt.exe173⤵PID:1236
-
\??\c:\bthtnt.exec:\bthtnt.exe174⤵PID:2716
-
\??\c:\1djpp.exec:\1djpp.exe175⤵PID:532
-
\??\c:\5pjpj.exec:\5pjpj.exe176⤵PID:688
-
\??\c:\7xrllfl.exec:\7xrllfl.exe177⤵PID:604
-
\??\c:\1ffrffl.exec:\1ffrffl.exe178⤵PID:704
-
\??\c:\hhbhth.exec:\hhbhth.exe179⤵PID:592
-
\??\c:\7btbhh.exec:\7btbhh.exe180⤵PID:1332
-
\??\c:\dpddp.exec:\dpddp.exe181⤵PID:2084
-
\??\c:\vvddj.exec:\vvddj.exe182⤵PID:1340
-
\??\c:\frffllr.exec:\frffllr.exe183⤵PID:1356
-
\??\c:\httnnh.exec:\httnnh.exe184⤵PID:1756
-
\??\c:\3tnhnb.exec:\3tnhnb.exe185⤵PID:912
-
\??\c:\nhbbtn.exec:\nhbbtn.exe186⤵PID:3008
-
\??\c:\dvvdv.exec:\dvvdv.exe187⤵PID:2112
-
\??\c:\xlrxfll.exec:\xlrxfll.exe188⤵PID:2004
-
\??\c:\rrxxlrx.exec:\rrxxlrx.exe189⤵PID:1524
-
\??\c:\bththh.exec:\bththh.exe190⤵PID:2124
-
\??\c:\7htttt.exec:\7htttt.exe191⤵PID:1808
-
\??\c:\1vppd.exec:\1vppd.exe192⤵PID:1724
-
\??\c:\dpjjp.exec:\dpjjp.exe193⤵PID:2836
-
\??\c:\xrllxfr.exec:\xrllxfr.exe194⤵PID:1612
-
\??\c:\1rxfffl.exec:\1rxfffl.exe195⤵PID:2676
-
\??\c:\7tnbht.exec:\7tnbht.exe196⤵PID:2740
-
\??\c:\hhnthb.exec:\hhnthb.exe197⤵PID:2760
-
\??\c:\jjjjv.exec:\jjjjv.exe198⤵PID:2764
-
\??\c:\7rrfllr.exec:\7rrfllr.exe199⤵PID:2132
-
\??\c:\lfllrrx.exec:\lfllrrx.exe200⤵PID:2148
-
\??\c:\nbhhtn.exec:\nbhhtn.exe201⤵PID:2696
-
\??\c:\tnhnth.exec:\tnhnth.exe202⤵PID:2556
-
\??\c:\vpdjv.exec:\vpdjv.exe203⤵PID:2844
-
\??\c:\1vjjp.exec:\1vjjp.exe204⤵PID:2832
-
\??\c:\7rllxxl.exec:\7rllxxl.exe205⤵PID:3024
-
\??\c:\xrxlllr.exec:\xrxlllr.exe206⤵PID:3036
-
\??\c:\1btbhb.exec:\1btbhb.exe207⤵PID:2880
-
\??\c:\7nhbhh.exec:\7nhbhh.exe208⤵PID:2088
-
\??\c:\dpddp.exec:\dpddp.exe209⤵PID:2932
-
\??\c:\pjppp.exec:\pjppp.exe210⤵PID:2892
-
\??\c:\1lffllr.exec:\1lffllr.exe211⤵PID:640
-
\??\c:\nhtbhh.exec:\nhtbhh.exe212⤵PID:1432
-
\??\c:\nbnbhh.exec:\nbnbhh.exe213⤵PID:1996
-
\??\c:\pdpjp.exec:\pdpjp.exe214⤵PID:1328
-
\??\c:\jdpjd.exec:\jdpjd.exe215⤵PID:2520
-
\??\c:\7fflfxl.exec:\7fflfxl.exe216⤵PID:1124
-
\??\c:\xxlxlfr.exec:\xxlxlfr.exe217⤵PID:2592
-
\??\c:\9tntth.exec:\9tntth.exe218⤵PID:1648
-
\??\c:\5thhhb.exec:\5thhhb.exe219⤵PID:1248
-
\??\c:\vpddp.exec:\vpddp.exe220⤵PID:2064
-
\??\c:\vpddd.exec:\vpddd.exe221⤵PID:2304
-
\??\c:\rlffrlr.exec:\rlffrlr.exe222⤵PID:1924
-
\??\c:\xxfrrlr.exec:\xxfrrlr.exe223⤵PID:2140
-
\??\c:\tnhhbh.exec:\tnhhbh.exe224⤵PID:532
-
\??\c:\vpddj.exec:\vpddj.exe225⤵PID:688
-
\??\c:\vpvvj.exec:\vpvvj.exe226⤵PID:776
-
\??\c:\dvdjv.exec:\dvdjv.exe227⤵PID:1864
-
\??\c:\rflffff.exec:\rflffff.exe228⤵PID:2052
-
\??\c:\lfffffr.exec:\lfffffr.exe229⤵PID:1508
-
\??\c:\5nbhhh.exec:\5nbhhh.exe230⤵PID:2396
-
\??\c:\3bhntb.exec:\3bhntb.exe231⤵PID:808
-
\??\c:\dvdjj.exec:\dvdjj.exe232⤵PID:1044
-
\??\c:\jdjpd.exec:\jdjpd.exe233⤵PID:820
-
\??\c:\lflfffl.exec:\lflfffl.exe234⤵PID:772
-
\??\c:\tnbbtt.exec:\tnbbtt.exe235⤵PID:2008
-
\??\c:\tnhhtt.exec:\tnhhtt.exe236⤵PID:2028
-
\??\c:\tnhnbh.exec:\tnhnbh.exe237⤵PID:1200
-
\??\c:\vdvvv.exec:\vdvvv.exe238⤵PID:904
-
\??\c:\rrflxrx.exec:\rrflxrx.exe239⤵PID:2232
-
\??\c:\fxrlrlx.exec:\fxrlrlx.exe240⤵PID:2988
-
\??\c:\xrffllr.exec:\xrffllr.exe241⤵PID:2224
-