Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 20:09
Behavioral task
behavioral1
Sample
2eb52f1de4a1e20e58b7da3ebf6358892fe2e841789681c68b1d0c369d01e0cf.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
2eb52f1de4a1e20e58b7da3ebf6358892fe2e841789681c68b1d0c369d01e0cf.exe
-
Size
351KB
-
MD5
51d6efde1fe849d030fcbfadc72015de
-
SHA1
eb63ba97f4485542128a0e73198cff2963c36df6
-
SHA256
2eb52f1de4a1e20e58b7da3ebf6358892fe2e841789681c68b1d0c369d01e0cf
-
SHA512
dc701fcbb94c69e1f53369fcd84645f3f666b53601dc311d2f11cfcc3c5d3eced4dc4583de33abc338ba8f9c2f7f89677c628d2f985053a46808e98eee954934
-
SSDEEP
6144:bcm4FmowdHoSgWrXD486jCpoAhlq1mEjBqLyOSlhNFF2C:h4wFHoSgWj168w1VjsyvhNFF2C
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/1916-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/344-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1420-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1152-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1372-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/904-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1484-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/956-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/752-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/944-548-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1440-719-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-841-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-868-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-1416-0x00000000779D0000-0x0000000077AEF000-memory.dmp family_blackmoon behavioral1/memory/2944-7321-0x0000000077AF0000-0x0000000077BEA000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/1916-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1916-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2408-10-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000a000000012286-8.dat UPX behavioral1/files/0x0036000000015670-16.dat UPX behavioral1/memory/1704-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0008000000015b6e-24.dat UPX behavioral1/memory/1704-25-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2644-26-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000015bf4-34.dat UPX behavioral1/memory/2644-33-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0008000000015cb8-41.dat UPX behavioral1/files/0x0007000000015cdf-49.dat UPX behavioral1/memory/2608-48-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000015ce8-56.dat UPX behavioral1/memory/2788-57-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0007000000015cf0-64.dat UPX behavioral1/memory/2528-65-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2672-66-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0008000000015d12-72.dat UPX behavioral1/memory/2532-76-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016581-81.dat UPX behavioral1/files/0x00060000000165e1-88.dat UPX behavioral1/memory/2968-89-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2984-91-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016835-97.dat UPX behavioral1/files/0x0006000000016a8a-104.dat UPX behavioral1/memory/2808-105-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2808-112-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016c52-113.dat UPX behavioral1/files/0x0006000000016c6f-120.dat UPX behavioral1/memory/344-123-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016c78-129.dat UPX behavioral1/files/0x0006000000016cc1-135.dat UPX behavioral1/files/0x0036000000015678-142.dat UPX behavioral1/memory/1420-143-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1152-150-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016ceb-151.dat UPX behavioral1/files/0x0006000000016d17-159.dat UPX behavioral1/memory/1372-158-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2284-166-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d2a-167.dat UPX behavioral1/files/0x0006000000016d32-175.dat UPX behavioral1/memory/2820-174-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d3b-182.dat UPX behavioral1/files/0x0006000000016d43-189.dat UPX behavioral1/memory/904-196-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d4b-197.dat UPX behavioral1/memory/1484-204-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d5f-205.dat UPX behavioral1/files/0x0006000000016d64-213.dat UPX behavioral1/memory/2972-212-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016d68-220.dat UPX behavioral1/files/0x0006000000016d6f-227.dat UPX behavioral1/files/0x0006000000016d8b-235.dat UPX behavioral1/files/0x0006000000016d9f-243.dat UPX behavioral1/memory/2108-242-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/956-251-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016dba-250.dat UPX behavioral1/memory/752-258-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2220-269-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2428-301-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2692-332-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2748-343-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2408 rlrxffx.exe 1704 hthntt.exe 2644 tnbbnt.exe 2744 9jppv.exe 2608 3nbbhh.exe 2788 pjvvd.exe 2528 xlllrxl.exe 2672 tnbhnn.exe 2532 llflrxf.exe 2968 btntnn.exe 2984 dvjjp.exe 2712 7fxrrxf.exe 2808 hbttbh.exe 2956 jvpvj.exe 344 bbtnnh.exe 1696 jdvdd.exe 1420 flllxrl.exe 1152 vppdj.exe 1372 1xrrfrx.exe 2284 hthbbt.exe 2820 dpdjj.exe 2908 frlrrfr.exe 2296 5jvvv.exe 904 3dvdj.exe 1484 nhtbtn.exe 2972 jvvjv.exe 764 1htbnn.exe 2472 7jjpd.exe 2152 rlxffxl.exe 2108 bnnbht.exe 956 rlfxlrl.exe 2888 nnbtht.exe 752 dvjpv.exe 2220 xrllxlf.exe 2176 bnbhnn.exe 2200 3htnhh.exe 3048 jdvpv.exe 2124 llxlxfr.exe 888 fxrfrxf.exe 2428 tntbht.exe 2424 7vdpd.exe 2000 rlflxxf.exe 2360 bnhntt.exe 2172 bbhnth.exe 2796 jjpjp.exe 2700 xxxflrf.exe 2692 btbbhn.exe 2748 jjpdj.exe 2884 jdvjd.exe 2720 3lfxfxl.exe 2196 9httbb.exe 2528 9vppp.exe 2516 5llflxl.exe 2576 flrfxxf.exe 2756 1nnbtb.exe 1904 dvpjp.exe 2600 xrrfrfx.exe 2824 hbhntn.exe 2856 1jjpv.exe 1280 xrffxlx.exe 1908 rlflxlx.exe 344 hhbhhh.exe 804 jvpvp.exe 2160 rlfxffr.exe -
resource yara_rule behavioral1/memory/1916-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1916-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2408-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000012286-8.dat upx behavioral1/files/0x0036000000015670-16.dat upx behavioral1/memory/1704-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015b6e-24.dat upx behavioral1/memory/1704-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2644-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015bf4-34.dat upx behavioral1/memory/2644-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015cb8-41.dat upx behavioral1/files/0x0007000000015cdf-49.dat upx behavioral1/memory/2608-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015ce8-56.dat upx behavioral1/memory/2788-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015cf0-64.dat upx behavioral1/memory/2528-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2672-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d12-72.dat upx behavioral1/memory/2532-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016581-81.dat upx behavioral1/files/0x00060000000165e1-88.dat upx behavioral1/memory/2968-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2984-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016835-97.dat upx behavioral1/files/0x0006000000016a8a-104.dat upx behavioral1/memory/2808-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2808-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c52-113.dat upx behavioral1/files/0x0006000000016c6f-120.dat upx behavioral1/memory/344-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c78-129.dat upx behavioral1/files/0x0006000000016cc1-135.dat upx behavioral1/files/0x0036000000015678-142.dat upx behavioral1/memory/1420-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1152-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ceb-151.dat upx behavioral1/files/0x0006000000016d17-159.dat upx behavioral1/memory/1372-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2284-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d2a-167.dat upx behavioral1/files/0x0006000000016d32-175.dat upx behavioral1/memory/2820-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d3b-182.dat upx behavioral1/files/0x0006000000016d43-189.dat upx behavioral1/memory/904-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d4b-197.dat upx behavioral1/memory/1484-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d5f-205.dat upx behavioral1/files/0x0006000000016d64-213.dat upx behavioral1/memory/2972-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d68-220.dat upx behavioral1/files/0x0006000000016d6f-227.dat upx behavioral1/files/0x0006000000016d8b-235.dat upx behavioral1/files/0x0006000000016d9f-243.dat upx behavioral1/memory/2108-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/956-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dba-250.dat upx behavioral1/memory/752-258-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2220-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2428-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2692-332-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2748-343-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1916 wrote to memory of 2408 1916 2eb52f1de4a1e20e58b7da3ebf6358892fe2e841789681c68b1d0c369d01e0cf.exe 28 PID 1916 wrote to memory of 2408 1916 2eb52f1de4a1e20e58b7da3ebf6358892fe2e841789681c68b1d0c369d01e0cf.exe 28 PID 1916 wrote to memory of 2408 1916 2eb52f1de4a1e20e58b7da3ebf6358892fe2e841789681c68b1d0c369d01e0cf.exe 28 PID 1916 wrote to memory of 2408 1916 2eb52f1de4a1e20e58b7da3ebf6358892fe2e841789681c68b1d0c369d01e0cf.exe 28 PID 2408 wrote to memory of 1704 2408 rlrxffx.exe 29 PID 2408 wrote to memory of 1704 2408 rlrxffx.exe 29 PID 2408 wrote to memory of 1704 2408 rlrxffx.exe 29 PID 2408 wrote to memory of 1704 2408 rlrxffx.exe 29 PID 1704 wrote to memory of 2644 1704 hthntt.exe 30 PID 1704 wrote to memory of 2644 1704 hthntt.exe 30 PID 1704 wrote to memory of 2644 1704 hthntt.exe 30 PID 1704 wrote to memory of 2644 1704 hthntt.exe 30 PID 2644 wrote to memory of 2744 2644 tnbbnt.exe 31 PID 2644 wrote to memory of 2744 2644 tnbbnt.exe 31 PID 2644 wrote to memory of 2744 2644 tnbbnt.exe 31 PID 2644 wrote to memory of 2744 2644 tnbbnt.exe 31 PID 2744 wrote to memory of 2608 2744 9jppv.exe 32 PID 2744 wrote to memory of 2608 2744 9jppv.exe 32 PID 2744 wrote to memory of 2608 2744 9jppv.exe 32 PID 2744 wrote to memory of 2608 2744 9jppv.exe 32 PID 2608 wrote to memory of 2788 2608 3nbbhh.exe 33 PID 2608 wrote to memory of 2788 2608 3nbbhh.exe 33 PID 2608 wrote to memory of 2788 2608 3nbbhh.exe 33 PID 2608 wrote to memory of 2788 2608 3nbbhh.exe 33 PID 2788 wrote to memory of 2528 2788 pjvvd.exe 34 PID 2788 wrote to memory of 2528 2788 pjvvd.exe 34 PID 2788 wrote to memory of 2528 2788 pjvvd.exe 34 PID 2788 wrote to memory of 2528 2788 pjvvd.exe 34 PID 2528 wrote to memory of 2672 2528 xlllrxl.exe 35 PID 2528 wrote to memory of 2672 2528 xlllrxl.exe 35 PID 2528 wrote to memory of 2672 2528 xlllrxl.exe 35 PID 2528 wrote to memory of 2672 2528 xlllrxl.exe 35 PID 2672 wrote to memory of 2532 2672 tnbhnn.exe 36 PID 2672 wrote to memory of 2532 2672 tnbhnn.exe 36 PID 2672 wrote to memory of 2532 2672 tnbhnn.exe 36 PID 2672 wrote to memory of 2532 2672 tnbhnn.exe 36 PID 2532 wrote to memory of 2968 2532 llflrxf.exe 37 PID 2532 wrote to memory of 2968 2532 llflrxf.exe 37 PID 2532 wrote to memory of 2968 2532 llflrxf.exe 37 PID 2532 wrote to memory of 2968 2532 llflrxf.exe 37 PID 2968 wrote to memory of 2984 2968 btntnn.exe 38 PID 2968 wrote to memory of 2984 2968 btntnn.exe 38 PID 2968 wrote to memory of 2984 2968 btntnn.exe 38 PID 2968 wrote to memory of 2984 2968 btntnn.exe 38 PID 2984 wrote to memory of 2712 2984 dvjjp.exe 39 PID 2984 wrote to memory of 2712 2984 dvjjp.exe 39 PID 2984 wrote to memory of 2712 2984 dvjjp.exe 39 PID 2984 wrote to memory of 2712 2984 dvjjp.exe 39 PID 2712 wrote to memory of 2808 2712 7fxrrxf.exe 40 PID 2712 wrote to memory of 2808 2712 7fxrrxf.exe 40 PID 2712 wrote to memory of 2808 2712 7fxrrxf.exe 40 PID 2712 wrote to memory of 2808 2712 7fxrrxf.exe 40 PID 2808 wrote to memory of 2956 2808 hbttbh.exe 41 PID 2808 wrote to memory of 2956 2808 hbttbh.exe 41 PID 2808 wrote to memory of 2956 2808 hbttbh.exe 41 PID 2808 wrote to memory of 2956 2808 hbttbh.exe 41 PID 2956 wrote to memory of 344 2956 jvpvj.exe 42 PID 2956 wrote to memory of 344 2956 jvpvj.exe 42 PID 2956 wrote to memory of 344 2956 jvpvj.exe 42 PID 2956 wrote to memory of 344 2956 jvpvj.exe 42 PID 344 wrote to memory of 1696 344 bbtnnh.exe 43 PID 344 wrote to memory of 1696 344 bbtnnh.exe 43 PID 344 wrote to memory of 1696 344 bbtnnh.exe 43 PID 344 wrote to memory of 1696 344 bbtnnh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2eb52f1de4a1e20e58b7da3ebf6358892fe2e841789681c68b1d0c369d01e0cf.exe"C:\Users\Admin\AppData\Local\Temp\2eb52f1de4a1e20e58b7da3ebf6358892fe2e841789681c68b1d0c369d01e0cf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\rlrxffx.exec:\rlrxffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\hthntt.exec:\hthntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\tnbbnt.exec:\tnbbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\9jppv.exec:\9jppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\3nbbhh.exec:\3nbbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\pjvvd.exec:\pjvvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\xlllrxl.exec:\xlllrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\tnbhnn.exec:\tnbhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\llflrxf.exec:\llflrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\btntnn.exec:\btntnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\dvjjp.exec:\dvjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\7fxrrxf.exec:\7fxrrxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\hbttbh.exec:\hbttbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\jvpvj.exec:\jvpvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\bbtnnh.exec:\bbtnnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\jdvdd.exec:\jdvdd.exe17⤵
- Executes dropped EXE
PID:1696 -
\??\c:\flllxrl.exec:\flllxrl.exe18⤵
- Executes dropped EXE
PID:1420 -
\??\c:\vppdj.exec:\vppdj.exe19⤵
- Executes dropped EXE
PID:1152 -
\??\c:\1xrrfrx.exec:\1xrrfrx.exe20⤵
- Executes dropped EXE
PID:1372 -
\??\c:\hthbbt.exec:\hthbbt.exe21⤵
- Executes dropped EXE
PID:2284 -
\??\c:\dpdjj.exec:\dpdjj.exe22⤵
- Executes dropped EXE
PID:2820 -
\??\c:\frlrrfr.exec:\frlrrfr.exe23⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5jvvv.exec:\5jvvv.exe24⤵
- Executes dropped EXE
PID:2296 -
\??\c:\3dvdj.exec:\3dvdj.exe25⤵
- Executes dropped EXE
PID:904 -
\??\c:\nhtbtn.exec:\nhtbtn.exe26⤵
- Executes dropped EXE
PID:1484 -
\??\c:\jvvjv.exec:\jvvjv.exe27⤵
- Executes dropped EXE
PID:2972 -
\??\c:\1htbnn.exec:\1htbnn.exe28⤵
- Executes dropped EXE
PID:764 -
\??\c:\7jjpd.exec:\7jjpd.exe29⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rlxffxl.exec:\rlxffxl.exe30⤵
- Executes dropped EXE
PID:2152 -
\??\c:\bnnbht.exec:\bnnbht.exe31⤵
- Executes dropped EXE
PID:2108 -
\??\c:\rlfxlrl.exec:\rlfxlrl.exe32⤵
- Executes dropped EXE
PID:956 -
\??\c:\nnbtht.exec:\nnbtht.exe33⤵
- Executes dropped EXE
PID:2888 -
\??\c:\dvjpv.exec:\dvjpv.exe34⤵
- Executes dropped EXE
PID:752 -
\??\c:\xrllxlf.exec:\xrllxlf.exe35⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bnbhnn.exec:\bnbhnn.exe36⤵
- Executes dropped EXE
PID:2176 -
\??\c:\3htnhh.exec:\3htnhh.exe37⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jdvpv.exec:\jdvpv.exe38⤵
- Executes dropped EXE
PID:3048 -
\??\c:\llxlxfr.exec:\llxlxfr.exe39⤵
- Executes dropped EXE
PID:2124 -
\??\c:\fxrfrxf.exec:\fxrfrxf.exe40⤵
- Executes dropped EXE
PID:888 -
\??\c:\tntbht.exec:\tntbht.exe41⤵
- Executes dropped EXE
PID:2428 -
\??\c:\7vdpd.exec:\7vdpd.exe42⤵
- Executes dropped EXE
PID:2424 -
\??\c:\rlflxxf.exec:\rlflxxf.exe43⤵
- Executes dropped EXE
PID:2000 -
\??\c:\bnhntt.exec:\bnhntt.exe44⤵
- Executes dropped EXE
PID:2360 -
\??\c:\bbhnth.exec:\bbhnth.exe45⤵
- Executes dropped EXE
PID:2172 -
\??\c:\jjpjp.exec:\jjpjp.exe46⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xxxflrf.exec:\xxxflrf.exe47⤵
- Executes dropped EXE
PID:2700 -
\??\c:\btbbhn.exec:\btbbhn.exe48⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jjpdj.exec:\jjpdj.exe49⤵
- Executes dropped EXE
PID:2748 -
\??\c:\jdvjd.exec:\jdvjd.exe50⤵
- Executes dropped EXE
PID:2884 -
\??\c:\3lfxfxl.exec:\3lfxfxl.exe51⤵
- Executes dropped EXE
PID:2720 -
\??\c:\9httbb.exec:\9httbb.exe52⤵
- Executes dropped EXE
PID:2196 -
\??\c:\9vppp.exec:\9vppp.exe53⤵
- Executes dropped EXE
PID:2528 -
\??\c:\5llflxl.exec:\5llflxl.exe54⤵
- Executes dropped EXE
PID:2516 -
\??\c:\flrfxxf.exec:\flrfxxf.exe55⤵
- Executes dropped EXE
PID:2576 -
\??\c:\1nnbtb.exec:\1nnbtb.exe56⤵
- Executes dropped EXE
PID:2756 -
\??\c:\dvpjp.exec:\dvpjp.exe57⤵
- Executes dropped EXE
PID:1904 -
\??\c:\xrrfrfx.exec:\xrrfrfx.exe58⤵
- Executes dropped EXE
PID:2600 -
\??\c:\hbhntn.exec:\hbhntn.exe59⤵
- Executes dropped EXE
PID:2824 -
\??\c:\1jjpv.exec:\1jjpv.exe60⤵
- Executes dropped EXE
PID:2856 -
\??\c:\xrffxlx.exec:\xrffxlx.exe61⤵
- Executes dropped EXE
PID:1280 -
\??\c:\rlflxlx.exec:\rlflxlx.exe62⤵
- Executes dropped EXE
PID:1908 -
\??\c:\hhbhhh.exec:\hhbhhh.exe63⤵
- Executes dropped EXE
PID:344 -
\??\c:\jvpvp.exec:\jvpvp.exe64⤵
- Executes dropped EXE
PID:804 -
\??\c:\rlfxffr.exec:\rlfxffr.exe65⤵
- Executes dropped EXE
PID:2160 -
\??\c:\fxlxllx.exec:\fxlxllx.exe66⤵PID:624
-
\??\c:\hnhbnt.exec:\hnhbnt.exe67⤵PID:1320
-
\??\c:\vvvpv.exec:\vvvpv.exe68⤵PID:2056
-
\??\c:\3xxxxxl.exec:\3xxxxxl.exe69⤵PID:1224
-
\??\c:\nnnbnb.exec:\nnnbnb.exe70⤵PID:2060
-
\??\c:\pjdvd.exec:\pjdvd.exe71⤵PID:1724
-
\??\c:\1jjpd.exec:\1jjpd.exe72⤵PID:2900
-
\??\c:\5xrxllf.exec:\5xrxllf.exe73⤵PID:2908
-
\??\c:\1tbntb.exec:\1tbntb.exe74⤵PID:784
-
\??\c:\btnttb.exec:\btnttb.exe75⤵PID:1476
-
\??\c:\jddvp.exec:\jddvp.exe76⤵PID:1096
-
\??\c:\llflxlx.exec:\llflxlx.exe77⤵PID:1844
-
\??\c:\3fflxrx.exec:\3fflxrx.exe78⤵PID:1760
-
\??\c:\nnbbhh.exec:\nnbbhh.exe79⤵PID:1076
-
\??\c:\jjddp.exec:\jjddp.exe80⤵PID:2448
-
\??\c:\ddvvd.exec:\ddvvd.exe81⤵PID:2372
-
\??\c:\1xxflxr.exec:\1xxflxr.exe82⤵PID:2152
-
\??\c:\tbnnbb.exec:\tbnnbb.exe83⤵PID:1788
-
\??\c:\jdvjv.exec:\jdvjv.exe84⤵PID:2920
-
\??\c:\lrxlrlf.exec:\lrxlrlf.exe85⤵PID:2916
-
\??\c:\tnnbht.exec:\tnnbht.exe86⤵PID:1048
-
\??\c:\bbthbt.exec:\bbthbt.exe87⤵PID:944
-
\??\c:\3dvvd.exec:\3dvvd.exe88⤵PID:2008
-
\??\c:\flxfffr.exec:\flxfffr.exe89⤵PID:2036
-
\??\c:\xrlfrrf.exec:\xrlfrrf.exe90⤵PID:1488
-
\??\c:\nnhtnn.exec:\nnhtnn.exe91⤵PID:3048
-
\??\c:\tnbnbn.exec:\tnbnbn.exe92⤵PID:1748
-
\??\c:\dddvd.exec:\dddvd.exe93⤵PID:2988
-
\??\c:\rllxxxl.exec:\rllxxxl.exe94⤵PID:2140
-
\??\c:\bbtnhn.exec:\bbtnhn.exe95⤵PID:2868
-
\??\c:\nbbhbb.exec:\nbbhbb.exe96⤵PID:3036
-
\??\c:\1pjvd.exec:\1pjvd.exe97⤵PID:1584
-
\??\c:\9rflxfl.exec:\9rflxfl.exe98⤵PID:2632
-
\??\c:\tnnbhb.exec:\tnnbhb.exe99⤵PID:2732
-
\??\c:\btbbtb.exec:\btbbtb.exe100⤵PID:2660
-
\??\c:\vjdjv.exec:\vjdjv.exe101⤵PID:2508
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe102⤵PID:2880
-
\??\c:\5tttht.exec:\5tttht.exe103⤵PID:2536
-
\??\c:\dpjpp.exec:\dpjpp.exe104⤵PID:2836
-
\??\c:\vddjp.exec:\vddjp.exe105⤵PID:2768
-
\??\c:\rlfrxlx.exec:\rlfrxlx.exe106⤵PID:2500
-
\??\c:\btntbh.exec:\btntbh.exe107⤵PID:2572
-
\??\c:\jdvdj.exec:\jdvdj.exe108⤵PID:2332
-
\??\c:\jpjpd.exec:\jpjpd.exe109⤵PID:1636
-
\??\c:\3llrrfl.exec:\3llrrfl.exe110⤵PID:2680
-
\??\c:\nhbbht.exec:\nhbbht.exe111⤵PID:2816
-
\??\c:\9dvvd.exec:\9dvvd.exe112⤵PID:2712
-
\??\c:\xfrllrr.exec:\xfrllrr.exe113⤵PID:2940
-
\??\c:\xrffrrx.exec:\xrffrrx.exe114⤵PID:2856
-
\??\c:\tnbnnn.exec:\tnbnnn.exe115⤵PID:1956
-
\??\c:\3pjdd.exec:\3pjdd.exe116⤵PID:2392
-
\??\c:\dpppj.exec:\dpppj.exe117⤵PID:2568
-
\??\c:\9lffxxl.exec:\9lffxxl.exe118⤵PID:2396
-
\??\c:\ttbbnt.exec:\ttbbnt.exe119⤵PID:1420
-
\??\c:\ddvdj.exec:\ddvdj.exe120⤵PID:1440
-
\??\c:\xrfrflx.exec:\xrfrflx.exe121⤵PID:2080
-
\??\c:\btnbhn.exec:\btnbhn.exe122⤵PID:2084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-