Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 05:05
Behavioral task
behavioral1
Sample
efb4da44efd6f083271e2b508b10d37819b9cf57e19908f867f68fce3ab6d3a3.exe
Resource
win7-20240419-en
6 signatures
150 seconds
General
-
Target
efb4da44efd6f083271e2b508b10d37819b9cf57e19908f867f68fce3ab6d3a3.exe
-
Size
82KB
-
MD5
c8a780a513ae3f307b849545e668bedb
-
SHA1
a212e13e412729b694a2c4e5bbffa0c1a193266a
-
SHA256
efb4da44efd6f083271e2b508b10d37819b9cf57e19908f867f68fce3ab6d3a3
-
SHA512
d47b8f2e30bd2a021459c6976f54e5e20239c9f0a7c96a756ad218579fa40b95f7d8d8ea2ef3c9aaa5406aef0097acc241dfa6c63e4703a38e45694e67daf9bd
-
SSDEEP
1536:CvQBeOGtrYS3srx93UBWfwC6Ggnouy8AelS7/7VIQHo:ChOmTsF93UYfwC6GIoutAe07zVIqo
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/2084-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2044-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1088-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/620-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1768-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/876-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1312-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-359-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-379-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-412-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-419-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-445-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/780-501-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/880-586-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-675-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/900-731-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-923-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/276-1012-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1168-1096-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-1127-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2696-1184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2084-0-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2084-7-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\1frrxxf.exe UPX behavioral1/memory/1860-9-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\5vdvd.exe UPX behavioral1/memory/1860-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2592-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2592-23-0x0000000000220000-0x0000000000249000-memory.dmp UPX C:\pjvvd.exe UPX behavioral1/memory/2592-29-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\9lllffl.exe UPX behavioral1/memory/2704-37-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2732-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\tnbhtt.exe UPX C:\nhtntb.exe UPX behavioral1/memory/2336-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2732-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\jdpvd.exe UPX behavioral1/memory/2648-66-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2496-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\rfxrffr.exe UPX behavioral1/memory/2044-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\nbbhtb.exe UPX behavioral1/memory/2044-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1088-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\5bhbbt.exe UPX C:\vpvvd.exe UPX behavioral1/memory/1604-103-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\rrfrlxx.exe UPX C:\fxrfrxl.exe UPX behavioral1/memory/620-128-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\3hbtbh.exe UPX C:\7vpjp.exe UPX behavioral1/memory/1768-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\7jddd.exe UPX C:\rlllrxl.exe UPX C:\nnbhtt.exe UPX C:\tnhhnt.exe UPX behavioral1/memory/2424-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\vpdjv.exe UPX C:\7jdvp.exe UPX behavioral1/memory/2088-189-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2460-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\xfxxffl.exe UPX behavioral1/memory/2796-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\tnbbnt.exe UPX behavioral1/memory/2796-208-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\pjdpv.exe UPX behavioral1/memory/876-217-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\jdvvj.exe UPX C:\frlrxxf.exe UPX C:\bthtbh.exe UPX C:\hthntb.exe UPX behavioral1/memory/1312-249-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2360-251-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\dpddp.exe UPX C:\9xrxflr.exe UPX behavioral1/memory/2036-275-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\nhbhnn.exe UPX behavioral1/memory/1848-278-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\9ttbnn.exe UPX behavioral1/memory/2004-286-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/888-300-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1668-307-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
1frrxxf.exe5vdvd.exepjvvd.exe9lllffl.exetnbhtt.exenhtntb.exejdpvd.exerfxrffr.exenbbhtb.exe5bhbbt.exevpvvd.exerrfrlxx.exefxrfrxl.exe3hbtbh.exe7vpjp.exe7jddd.exerlllrxl.exennbhtt.exetnhhnt.exevpdjv.exe7jdvp.exexfxxffl.exetnbbnt.exepjdpv.exejdvvj.exefrlrxxf.exebthtbh.exehthntb.exedpddp.exe9xrxflr.exenhbhnn.exe9ttbnn.exedvjjv.exe5ffrfll.exexfrrfxx.exenbtnnn.exehbbhnb.exe1jddd.exe7dvvd.exelllfrxf.exexlflxff.exennnbbh.exe3tbnbn.exejdjjj.exefrxffxf.exerlxflrf.exenhtntt.exebthnbh.exedvjpv.exejvdvd.exe9rlflrr.exefxxfxxr.exenhtntt.exepjdjd.exevjdpd.exeffxxxxf.exe9rffrxf.exentbbnn.exetthhnb.exepjvdv.exejvpjv.exexrxflrf.exerlfrffl.exebttbnn.exepid process 1860 1frrxxf.exe 2592 5vdvd.exe 2704 pjvvd.exe 2732 9lllffl.exe 2336 tnbhtt.exe 2648 nhtntb.exe 2496 jdpvd.exe 2044 rfxrffr.exe 1088 nbbhtb.exe 1604 5bhbbt.exe 2468 vpvvd.exe 1584 rrfrlxx.exe 620 fxrfrxl.exe 1768 3hbtbh.exe 2396 7vpjp.exe 760 7jddd.exe 1640 rlllrxl.exe 1484 nnbhtt.exe 2424 tnhhnt.exe 2088 vpdjv.exe 2460 7jdvp.exe 2796 xfxxffl.exe 876 tnbbnt.exe 2880 pjdpv.exe 1848 jdvvj.exe 1680 frlrxxf.exe 1312 bthtbh.exe 2360 hthntb.exe 1184 dpddp.exe 2036 9xrxflr.exe 784 nhbhnn.exe 2004 9ttbnn.exe 888 dvjjv.exe 1668 5ffrfll.exe 2084 xfrrfxx.exe 2840 nbtnnn.exe 3040 hbbhnb.exe 2688 1jddd.exe 2676 7dvvd.exe 2704 lllfrxf.exe 2760 xlflxff.exe 2748 nnnbbh.exe 2536 3tbnbn.exe 2528 jdjjj.exe 2496 frxffxf.exe 2604 rlxflrf.exe 1780 nhtntt.exe 2456 bthnbh.exe 1520 dvjpv.exe 2780 jvdvd.exe 1740 9rlflrr.exe 1268 fxxfxxr.exe 620 nhtntt.exe 900 pjdjd.exe 2388 vjdpd.exe 804 ffxxxxf.exe 760 9rffrxf.exe 1188 ntbbnn.exe 3044 tthhnb.exe 2952 pjvdv.exe 2208 jvpjv.exe 2088 xrxflrf.exe 2232 rlfrffl.exe 780 bttbnn.exe -
Processes:
resource yara_rule behavioral1/memory/2084-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-7-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\1frrxxf.exe upx behavioral1/memory/1860-9-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\5vdvd.exe upx behavioral1/memory/1860-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-23-0x0000000000220000-0x0000000000249000-memory.dmp upx C:\pjvvd.exe upx behavioral1/memory/2592-29-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\9lllffl.exe upx behavioral1/memory/2704-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-39-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\tnbhtt.exe upx C:\nhtntb.exe upx behavioral1/memory/2336-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-48-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\jdpvd.exe upx behavioral1/memory/2648-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-69-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\rfxrffr.exe upx behavioral1/memory/2044-76-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\nbbhtb.exe upx behavioral1/memory/2044-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1088-88-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\5bhbbt.exe upx C:\vpvvd.exe upx behavioral1/memory/1604-103-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\rrfrlxx.exe upx C:\fxrfrxl.exe upx behavioral1/memory/620-128-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\3hbtbh.exe upx C:\7vpjp.exe upx behavioral1/memory/1768-138-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\7jddd.exe upx C:\rlllrxl.exe upx C:\nnbhtt.exe upx C:\tnhhnt.exe upx behavioral1/memory/2424-174-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\vpdjv.exe upx C:\7jdvp.exe upx behavioral1/memory/2088-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-191-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\xfxxffl.exe upx behavioral1/memory/2796-199-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\tnbbnt.exe upx behavioral1/memory/2796-208-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\pjdpv.exe upx behavioral1/memory/876-217-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\jdvvj.exe upx C:\frlrxxf.exe upx C:\bthtbh.exe upx C:\hthntb.exe upx behavioral1/memory/1312-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-251-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\dpddp.exe upx C:\9xrxflr.exe upx behavioral1/memory/2036-275-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\nhbhnn.exe upx behavioral1/memory/1848-278-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\9ttbnn.exe upx behavioral1/memory/2004-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-307-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
efb4da44efd6f083271e2b508b10d37819b9cf57e19908f867f68fce3ab6d3a3.exe1frrxxf.exe5vdvd.exepjvvd.exe9lllffl.exetnbhtt.exenhtntb.exejdpvd.exerfxrffr.exenbbhtb.exe5bhbbt.exevpvvd.exerrfrlxx.exefxrfrxl.exe3hbtbh.exe7vpjp.exedescription pid process target process PID 2084 wrote to memory of 1860 2084 efb4da44efd6f083271e2b508b10d37819b9cf57e19908f867f68fce3ab6d3a3.exe 1frrxxf.exe PID 2084 wrote to memory of 1860 2084 efb4da44efd6f083271e2b508b10d37819b9cf57e19908f867f68fce3ab6d3a3.exe 1frrxxf.exe PID 2084 wrote to memory of 1860 2084 efb4da44efd6f083271e2b508b10d37819b9cf57e19908f867f68fce3ab6d3a3.exe 1frrxxf.exe PID 2084 wrote to memory of 1860 2084 efb4da44efd6f083271e2b508b10d37819b9cf57e19908f867f68fce3ab6d3a3.exe 1frrxxf.exe PID 1860 wrote to memory of 2592 1860 1frrxxf.exe 5vdvd.exe PID 1860 wrote to memory of 2592 1860 1frrxxf.exe 5vdvd.exe PID 1860 wrote to memory of 2592 1860 1frrxxf.exe 5vdvd.exe PID 1860 wrote to memory of 2592 1860 1frrxxf.exe 5vdvd.exe PID 2592 wrote to memory of 2704 2592 5vdvd.exe pjvvd.exe PID 2592 wrote to memory of 2704 2592 5vdvd.exe pjvvd.exe PID 2592 wrote to memory of 2704 2592 5vdvd.exe pjvvd.exe PID 2592 wrote to memory of 2704 2592 5vdvd.exe pjvvd.exe PID 2704 wrote to memory of 2732 2704 pjvvd.exe 9lllffl.exe PID 2704 wrote to memory of 2732 2704 pjvvd.exe 9lllffl.exe PID 2704 wrote to memory of 2732 2704 pjvvd.exe 9lllffl.exe PID 2704 wrote to memory of 2732 2704 pjvvd.exe 9lllffl.exe PID 2732 wrote to memory of 2336 2732 9lllffl.exe tnbhtt.exe PID 2732 wrote to memory of 2336 2732 9lllffl.exe tnbhtt.exe PID 2732 wrote to memory of 2336 2732 9lllffl.exe tnbhtt.exe PID 2732 wrote to memory of 2336 2732 9lllffl.exe tnbhtt.exe PID 2336 wrote to memory of 2648 2336 tnbhtt.exe nhtntb.exe PID 2336 wrote to memory of 2648 2336 tnbhtt.exe nhtntb.exe PID 2336 wrote to memory of 2648 2336 tnbhtt.exe nhtntb.exe PID 2336 wrote to memory of 2648 2336 tnbhtt.exe nhtntb.exe PID 2648 wrote to memory of 2496 2648 nhtntb.exe jdpvd.exe PID 2648 wrote to memory of 2496 2648 nhtntb.exe jdpvd.exe PID 2648 wrote to memory of 2496 2648 nhtntb.exe jdpvd.exe PID 2648 wrote to memory of 2496 2648 nhtntb.exe jdpvd.exe PID 2496 wrote to memory of 2044 2496 jdpvd.exe rfxrffr.exe PID 2496 wrote to memory of 2044 2496 jdpvd.exe rfxrffr.exe PID 2496 wrote to memory of 2044 2496 jdpvd.exe rfxrffr.exe PID 2496 wrote to memory of 2044 2496 jdpvd.exe rfxrffr.exe PID 2044 wrote to memory of 1088 2044 rfxrffr.exe nbbhtb.exe PID 2044 wrote to memory of 1088 2044 rfxrffr.exe nbbhtb.exe PID 2044 wrote to memory of 1088 2044 rfxrffr.exe nbbhtb.exe PID 2044 wrote to memory of 1088 2044 rfxrffr.exe nbbhtb.exe PID 1088 wrote to memory of 1604 1088 nbbhtb.exe 5bhbbt.exe PID 1088 wrote to memory of 1604 1088 nbbhtb.exe 5bhbbt.exe PID 1088 wrote to memory of 1604 1088 nbbhtb.exe 5bhbbt.exe PID 1088 wrote to memory of 1604 1088 nbbhtb.exe 5bhbbt.exe PID 1604 wrote to memory of 2468 1604 5bhbbt.exe vpvvd.exe PID 1604 wrote to memory of 2468 1604 5bhbbt.exe vpvvd.exe PID 1604 wrote to memory of 2468 1604 5bhbbt.exe vpvvd.exe PID 1604 wrote to memory of 2468 1604 5bhbbt.exe vpvvd.exe PID 2468 wrote to memory of 1584 2468 vpvvd.exe rrfrlxx.exe PID 2468 wrote to memory of 1584 2468 vpvvd.exe rrfrlxx.exe PID 2468 wrote to memory of 1584 2468 vpvvd.exe rrfrlxx.exe PID 2468 wrote to memory of 1584 2468 vpvvd.exe rrfrlxx.exe PID 1584 wrote to memory of 620 1584 rrfrlxx.exe fxrfrxl.exe PID 1584 wrote to memory of 620 1584 rrfrlxx.exe fxrfrxl.exe PID 1584 wrote to memory of 620 1584 rrfrlxx.exe fxrfrxl.exe PID 1584 wrote to memory of 620 1584 rrfrlxx.exe fxrfrxl.exe PID 620 wrote to memory of 1768 620 fxrfrxl.exe 3hbtbh.exe PID 620 wrote to memory of 1768 620 fxrfrxl.exe 3hbtbh.exe PID 620 wrote to memory of 1768 620 fxrfrxl.exe 3hbtbh.exe PID 620 wrote to memory of 1768 620 fxrfrxl.exe 3hbtbh.exe PID 1768 wrote to memory of 2396 1768 3hbtbh.exe 7vpjp.exe PID 1768 wrote to memory of 2396 1768 3hbtbh.exe 7vpjp.exe PID 1768 wrote to memory of 2396 1768 3hbtbh.exe 7vpjp.exe PID 1768 wrote to memory of 2396 1768 3hbtbh.exe 7vpjp.exe PID 2396 wrote to memory of 760 2396 7vpjp.exe 7jddd.exe PID 2396 wrote to memory of 760 2396 7vpjp.exe 7jddd.exe PID 2396 wrote to memory of 760 2396 7vpjp.exe 7jddd.exe PID 2396 wrote to memory of 760 2396 7vpjp.exe 7jddd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efb4da44efd6f083271e2b508b10d37819b9cf57e19908f867f68fce3ab6d3a3.exe"C:\Users\Admin\AppData\Local\Temp\efb4da44efd6f083271e2b508b10d37819b9cf57e19908f867f68fce3ab6d3a3.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\1frrxxf.exec:\1frrxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5vdvd.exec:\5vdvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvvd.exec:\pjvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9lllffl.exec:\9lllffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbhtt.exec:\tnbhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhtntb.exec:\nhtntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdpvd.exec:\jdpvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfxrffr.exec:\rfxrffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbbhtb.exec:\nbbhtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5bhbbt.exec:\5bhbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpvvd.exec:\vpvvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrfrlxx.exec:\rrfrlxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxrfrxl.exec:\fxrfrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3hbtbh.exec:\3hbtbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7vpjp.exec:\7vpjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7jddd.exec:\7jddd.exe17⤵
- Executes dropped EXE
-
\??\c:\rlllrxl.exec:\rlllrxl.exe18⤵
- Executes dropped EXE
-
\??\c:\nnbhtt.exec:\nnbhtt.exe19⤵
- Executes dropped EXE
-
\??\c:\tnhhnt.exec:\tnhhnt.exe20⤵
- Executes dropped EXE
-
\??\c:\vpdjv.exec:\vpdjv.exe21⤵
- Executes dropped EXE
-
\??\c:\7jdvp.exec:\7jdvp.exe22⤵
- Executes dropped EXE
-
\??\c:\xfxxffl.exec:\xfxxffl.exe23⤵
- Executes dropped EXE
-
\??\c:\tnbbnt.exec:\tnbbnt.exe24⤵
- Executes dropped EXE
-
\??\c:\pjdpv.exec:\pjdpv.exe25⤵
- Executes dropped EXE
-
\??\c:\jdvvj.exec:\jdvvj.exe26⤵
- Executes dropped EXE
-
\??\c:\frlrxxf.exec:\frlrxxf.exe27⤵
- Executes dropped EXE
-
\??\c:\bthtbh.exec:\bthtbh.exe28⤵
- Executes dropped EXE
-
\??\c:\hthntb.exec:\hthntb.exe29⤵
- Executes dropped EXE
-
\??\c:\dpddp.exec:\dpddp.exe30⤵
- Executes dropped EXE
-
\??\c:\9xrxflr.exec:\9xrxflr.exe31⤵
- Executes dropped EXE
-
\??\c:\nhbhnn.exec:\nhbhnn.exe32⤵
- Executes dropped EXE
-
\??\c:\9ttbnn.exec:\9ttbnn.exe33⤵
- Executes dropped EXE
-
\??\c:\dvjjv.exec:\dvjjv.exe34⤵
- Executes dropped EXE
-
\??\c:\5ffrfll.exec:\5ffrfll.exe35⤵
- Executes dropped EXE
-
\??\c:\xfrrfxx.exec:\xfrrfxx.exe36⤵
- Executes dropped EXE
-
\??\c:\nbtnnn.exec:\nbtnnn.exe37⤵
- Executes dropped EXE
-
\??\c:\hbbhnb.exec:\hbbhnb.exe38⤵
- Executes dropped EXE
-
\??\c:\1jddd.exec:\1jddd.exe39⤵
- Executes dropped EXE
-
\??\c:\7dvvd.exec:\7dvvd.exe40⤵
- Executes dropped EXE
-
\??\c:\lllfrxf.exec:\lllfrxf.exe41⤵
- Executes dropped EXE
-
\??\c:\xlflxff.exec:\xlflxff.exe42⤵
- Executes dropped EXE
-
\??\c:\nnnbbh.exec:\nnnbbh.exe43⤵
- Executes dropped EXE
-
\??\c:\3tbnbn.exec:\3tbnbn.exe44⤵
- Executes dropped EXE
-
\??\c:\jdjjj.exec:\jdjjj.exe45⤵
- Executes dropped EXE
-
\??\c:\frxffxf.exec:\frxffxf.exe46⤵
- Executes dropped EXE
-
\??\c:\rlxflrf.exec:\rlxflrf.exe47⤵
- Executes dropped EXE
-
\??\c:\nhtntt.exec:\nhtntt.exe48⤵
- Executes dropped EXE
-
\??\c:\bthnbh.exec:\bthnbh.exe49⤵
- Executes dropped EXE
-
\??\c:\dvjpv.exec:\dvjpv.exe50⤵
- Executes dropped EXE
-
\??\c:\jvdvd.exec:\jvdvd.exe51⤵
- Executes dropped EXE
-
\??\c:\9rlflrr.exec:\9rlflrr.exe52⤵
- Executes dropped EXE
-
\??\c:\fxxfxxr.exec:\fxxfxxr.exe53⤵
- Executes dropped EXE
-
\??\c:\nhtntt.exec:\nhtntt.exe54⤵
- Executes dropped EXE
-
\??\c:\pjdjd.exec:\pjdjd.exe55⤵
- Executes dropped EXE
-
\??\c:\vjdpd.exec:\vjdpd.exe56⤵
- Executes dropped EXE
-
\??\c:\ffxxxxf.exec:\ffxxxxf.exe57⤵
- Executes dropped EXE
-
\??\c:\9rffrxf.exec:\9rffrxf.exe58⤵
- Executes dropped EXE
-
\??\c:\ntbbnn.exec:\ntbbnn.exe59⤵
- Executes dropped EXE
-
\??\c:\tthhnb.exec:\tthhnb.exe60⤵
- Executes dropped EXE
-
\??\c:\pjvdv.exec:\pjvdv.exe61⤵
- Executes dropped EXE
-
\??\c:\jvpjv.exec:\jvpjv.exe62⤵
- Executes dropped EXE
-
\??\c:\xrxflrf.exec:\xrxflrf.exe63⤵
- Executes dropped EXE
-
\??\c:\rlfrffl.exec:\rlfrffl.exe64⤵
- Executes dropped EXE
-
\??\c:\bttbnn.exec:\bttbnn.exe65⤵
- Executes dropped EXE
-
\??\c:\5nhnnn.exec:\5nhnnn.exe66⤵
-
\??\c:\vdvjp.exec:\vdvjp.exe67⤵
-
\??\c:\7djdp.exec:\7djdp.exe68⤵
-
\??\c:\1llfrrl.exec:\1llfrrl.exe69⤵
-
\??\c:\rlflflx.exec:\rlflflx.exe70⤵
-
\??\c:\nbnnnt.exec:\nbnnnt.exe71⤵
-
\??\c:\7hbnbb.exec:\7hbnbb.exe72⤵
-
\??\c:\pjdpv.exec:\pjdpv.exe73⤵
-
\??\c:\dpjjv.exec:\dpjjv.exe74⤵
-
\??\c:\3lffrrx.exec:\3lffrrx.exe75⤵
-
\??\c:\5lxxxxl.exec:\5lxxxxl.exe76⤵
-
\??\c:\bbthhh.exec:\bbthhh.exe77⤵
-
\??\c:\9tbtbt.exec:\9tbtbt.exe78⤵
-
\??\c:\pjdvv.exec:\pjdvv.exe79⤵
-
\??\c:\jdpvv.exec:\jdpvv.exe80⤵
-
\??\c:\lffrlrf.exec:\lffrlrf.exe81⤵
-
\??\c:\xrrxlfx.exec:\xrrxlfx.exe82⤵
-
\??\c:\thtthh.exec:\thtthh.exe83⤵
-
\??\c:\9bnbhb.exec:\9bnbhb.exe84⤵
-
\??\c:\3dvjp.exec:\3dvjp.exe85⤵
-
\??\c:\dvjpd.exec:\dvjpd.exe86⤵
-
\??\c:\lfrxxxf.exec:\lfrxxxf.exe87⤵
-
\??\c:\rlrrxrr.exec:\rlrrxrr.exe88⤵
-
\??\c:\llxffll.exec:\llxffll.exe89⤵
-
\??\c:\9tnnht.exec:\9tnnht.exe90⤵
-
\??\c:\nhhbhh.exec:\nhhbhh.exe91⤵
-
\??\c:\dvpjj.exec:\dvpjj.exe92⤵
-
\??\c:\jjddj.exec:\jjddj.exe93⤵
-
\??\c:\1flflrx.exec:\1flflrx.exe94⤵
-
\??\c:\ntbnhb.exec:\ntbnhb.exe95⤵
-
\??\c:\nhhnbt.exec:\nhhnbt.exe96⤵
-
\??\c:\dpdvv.exec:\dpdvv.exe97⤵
-
\??\c:\7jjpv.exec:\7jjpv.exe98⤵
-
\??\c:\9lxrxxf.exec:\9lxrxxf.exe99⤵
-
\??\c:\9fxlrrr.exec:\9fxlrrr.exe100⤵
-
\??\c:\nhnntb.exec:\nhnntb.exe101⤵
-
\??\c:\nbbbnb.exec:\nbbbnb.exe102⤵
-
\??\c:\9jvvv.exec:\9jvvv.exe103⤵
-
\??\c:\pjdjv.exec:\pjdjv.exe104⤵
-
\??\c:\xlfffll.exec:\xlfffll.exe105⤵
-
\??\c:\xxlfxxx.exec:\xxlfxxx.exe106⤵
-
\??\c:\hthhnh.exec:\hthhnh.exe107⤵
-
\??\c:\nhbhtn.exec:\nhbhtn.exe108⤵
-
\??\c:\vjppj.exec:\vjppj.exe109⤵
-
\??\c:\1vjjp.exec:\1vjjp.exe110⤵
-
\??\c:\5pvvj.exec:\5pvvj.exe111⤵
-
\??\c:\xlxflll.exec:\xlxflll.exe112⤵
-
\??\c:\5thbnh.exec:\5thbnh.exe113⤵
-
\??\c:\bntbbt.exec:\bntbbt.exe114⤵
-
\??\c:\thbbhb.exec:\thbbhb.exe115⤵
-
\??\c:\7vvpp.exec:\7vvpp.exe116⤵
-
\??\c:\dvjvj.exec:\dvjvj.exe117⤵
-
\??\c:\rrlfrlr.exec:\rrlfrlr.exe118⤵
-
\??\c:\9lrrxlr.exec:\9lrrxlr.exe119⤵
-
\??\c:\tnttbb.exec:\tnttbb.exe120⤵
-
\??\c:\jdvdp.exec:\jdvdp.exe121⤵
-
\??\c:\vpddj.exec:\vpddj.exe122⤵
-
\??\c:\9lflrrx.exec:\9lflrrx.exe123⤵
-
\??\c:\9xrxlrx.exec:\9xrxlrx.exe124⤵
-
\??\c:\tnbthh.exec:\tnbthh.exe125⤵
-
\??\c:\hbnttt.exec:\hbnttt.exe126⤵
-
\??\c:\thtbbb.exec:\thtbbb.exe127⤵
-
\??\c:\vpjvd.exec:\vpjvd.exe128⤵
-
\??\c:\pvpvv.exec:\pvpvv.exe129⤵
-
\??\c:\5llrxxl.exec:\5llrxxl.exe130⤵
-
\??\c:\7xlxxxx.exec:\7xlxxxx.exe131⤵
-
\??\c:\thbhnt.exec:\thbhnt.exe132⤵
-
\??\c:\pvdpp.exec:\pvdpp.exe133⤵
-
\??\c:\vjvvv.exec:\vjvvv.exe134⤵
-
\??\c:\5lrlffr.exec:\5lrlffr.exe135⤵
-
\??\c:\fxlrflr.exec:\fxlrflr.exe136⤵
-
\??\c:\7hbhtt.exec:\7hbhtt.exe137⤵
-
\??\c:\btnhnb.exec:\btnhnb.exe138⤵
-
\??\c:\pjpvj.exec:\pjpvj.exe139⤵
-
\??\c:\pdddj.exec:\pdddj.exe140⤵
-
\??\c:\xrxxffl.exec:\xrxxffl.exe141⤵
-
\??\c:\rrxlrrx.exec:\rrxlrrx.exe142⤵
-
\??\c:\llfxlrx.exec:\llfxlrx.exe143⤵
-
\??\c:\bbntht.exec:\bbntht.exe144⤵
-
\??\c:\bntbhh.exec:\bntbhh.exe145⤵
-
\??\c:\dvpvp.exec:\dvpvp.exe146⤵
-
\??\c:\7djpp.exec:\7djpp.exe147⤵
-
\??\c:\1bntbb.exec:\1bntbb.exe148⤵
-
\??\c:\dvdjv.exec:\dvdjv.exe149⤵
-
\??\c:\vpppp.exec:\vpppp.exe150⤵
-
\??\c:\pjddd.exec:\pjddd.exe151⤵
-
\??\c:\rfrxflr.exec:\rfrxflr.exe152⤵
-
\??\c:\lxrrxrx.exec:\lxrrxrx.exe153⤵
-
\??\c:\htnnhn.exec:\htnnhn.exe154⤵
-
\??\c:\thtbbt.exec:\thtbbt.exe155⤵
-
\??\c:\1jdpd.exec:\1jdpd.exe156⤵
-
\??\c:\5vdjv.exec:\5vdjv.exe157⤵
-
\??\c:\5frxxxf.exec:\5frxxxf.exe158⤵
-
\??\c:\rlrflrx.exec:\rlrflrx.exe159⤵
-
\??\c:\hbbhnn.exec:\hbbhnn.exe160⤵
-
\??\c:\hthhtt.exec:\hthhtt.exe161⤵
-
\??\c:\hbtbnt.exec:\hbtbnt.exe162⤵
-
\??\c:\jdjvd.exec:\jdjvd.exe163⤵
-
\??\c:\ppdjv.exec:\ppdjv.exe164⤵
-
\??\c:\xlxfffl.exec:\xlxfffl.exe165⤵
-
\??\c:\xxxfllx.exec:\xxxfllx.exe166⤵
-
\??\c:\ntttth.exec:\ntttth.exe167⤵
-
\??\c:\dvdjv.exec:\dvdjv.exe168⤵
-
\??\c:\pjppd.exec:\pjppd.exe169⤵
-
\??\c:\pjvjv.exec:\pjvjv.exe170⤵
-
\??\c:\ffxfxxl.exec:\ffxfxxl.exe171⤵
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe172⤵
-
\??\c:\hbnhbh.exec:\hbnhbh.exe173⤵
-
\??\c:\1bhtbb.exec:\1bhtbb.exe174⤵
-
\??\c:\jvjpp.exec:\jvjpp.exe175⤵
-
\??\c:\vpjjp.exec:\vpjjp.exe176⤵
-
\??\c:\7xffllx.exec:\7xffllx.exe177⤵
-
\??\c:\7lxlrrr.exec:\7lxlrrr.exe178⤵
-
\??\c:\hhnhbh.exec:\hhnhbh.exe179⤵
-
\??\c:\bthntt.exec:\bthntt.exe180⤵
-
\??\c:\dpjpv.exec:\dpjpv.exe181⤵
-
\??\c:\7vjpp.exec:\7vjpp.exe182⤵
-
\??\c:\1jdjv.exec:\1jdjv.exe183⤵
-
\??\c:\rlxfrlf.exec:\rlxfrlf.exe184⤵
-
\??\c:\rfrfffl.exec:\rfrfffl.exe185⤵
-
\??\c:\nhhnbb.exec:\nhhnbb.exe186⤵
-
\??\c:\hbnthn.exec:\hbnthn.exe187⤵
-
\??\c:\pdppp.exec:\pdppp.exe188⤵
-
\??\c:\dpjpv.exec:\dpjpv.exe189⤵
-
\??\c:\xlflflr.exec:\xlflflr.exe190⤵
-
\??\c:\fxrfrrx.exec:\fxrfrrx.exe191⤵
-
\??\c:\bthhtt.exec:\bthhtt.exe192⤵
-
\??\c:\bthntt.exec:\bthntt.exe193⤵
-
\??\c:\vjvvd.exec:\vjvvd.exe194⤵
-
\??\c:\pdddp.exec:\pdddp.exe195⤵
-
\??\c:\fxxxllr.exec:\fxxxllr.exe196⤵
-
\??\c:\7fxfllr.exec:\7fxfllr.exe197⤵
-
\??\c:\nhtnnt.exec:\nhtnnt.exe198⤵
-
\??\c:\9nhhnn.exec:\9nhhnn.exe199⤵
-
\??\c:\jdvjv.exec:\jdvjv.exe200⤵
-
\??\c:\1djvv.exec:\1djvv.exe201⤵
-
\??\c:\llxxflr.exec:\llxxflr.exe202⤵
-
\??\c:\9xllxfl.exec:\9xllxfl.exe203⤵
-
\??\c:\nbntbb.exec:\nbntbb.exe204⤵
-
\??\c:\dpdjp.exec:\dpdjp.exe205⤵
-
\??\c:\3fxflxx.exec:\3fxflxx.exe206⤵
-
\??\c:\3rlxrxx.exec:\3rlxrxx.exe207⤵
-
\??\c:\5bnthh.exec:\5bnthh.exe208⤵
-
\??\c:\vvpvv.exec:\vvpvv.exe209⤵
-
\??\c:\dvjpp.exec:\dvjpp.exe210⤵
-
\??\c:\fxllxxf.exec:\fxllxxf.exe211⤵
-
\??\c:\fxlrflx.exec:\fxlrflx.exe212⤵
-
\??\c:\hbnnbb.exec:\hbnnbb.exe213⤵
-
\??\c:\nbtthb.exec:\nbtthb.exe214⤵
-
\??\c:\1pjvv.exec:\1pjvv.exe215⤵
-
\??\c:\vpvdv.exec:\vpvdv.exe216⤵
-
\??\c:\fxfxrll.exec:\fxfxrll.exe217⤵
-
\??\c:\xlxflrl.exec:\xlxflrl.exe218⤵
-
\??\c:\rllrfxr.exec:\rllrfxr.exe219⤵
-
\??\c:\bnbhnn.exec:\bnbhnn.exe220⤵
-
\??\c:\1hbbbb.exec:\1hbbbb.exe221⤵
-
\??\c:\9pddp.exec:\9pddp.exe222⤵
-
\??\c:\jvjjv.exec:\jvjjv.exe223⤵
-
\??\c:\jdppd.exec:\jdppd.exe224⤵
-
\??\c:\xlxfrrx.exec:\xlxfrrx.exe225⤵
-
\??\c:\frfrxxx.exec:\frfrxxx.exe226⤵
-
\??\c:\hbnbnt.exec:\hbnbnt.exe227⤵
-
\??\c:\bthnnn.exec:\bthnnn.exe228⤵
-
\??\c:\7jvvd.exec:\7jvvd.exe229⤵
-
\??\c:\jpvpp.exec:\jpvpp.exe230⤵
-
\??\c:\jvddp.exec:\jvddp.exe231⤵
-
\??\c:\lfllrrx.exec:\lfllrrx.exe232⤵
-
\??\c:\7rlrxrl.exec:\7rlrxrl.exe233⤵
-
\??\c:\nhhntt.exec:\nhhntt.exe234⤵
-
\??\c:\3tbbht.exec:\3tbbht.exe235⤵
-
\??\c:\9pdvd.exec:\9pdvd.exe236⤵
-
\??\c:\5pppv.exec:\5pppv.exe237⤵
-
\??\c:\ffrxxfl.exec:\ffrxxfl.exe238⤵
-
\??\c:\rrfxxfl.exec:\rrfxxfl.exe239⤵
-
\??\c:\nhbnbh.exec:\nhbnbh.exe240⤵
-
\??\c:\thbbbb.exec:\thbbbb.exe241⤵