Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 21:30
Behavioral task
behavioral1
Sample
52e99bce8a655504a1f863258411e35d3f5f11878b9a18c263920c3a48317aea.exe
Resource
win7-20240419-en
6 signatures
150 seconds
General
-
Target
52e99bce8a655504a1f863258411e35d3f5f11878b9a18c263920c3a48317aea.exe
-
Size
76KB
-
MD5
0ee137ecbc2743936f07e1e510da7ab6
-
SHA1
796dc40751f3ebe9175e8f16f81f5575159f2221
-
SHA256
52e99bce8a655504a1f863258411e35d3f5f11878b9a18c263920c3a48317aea
-
SHA512
72dc3dc52bc3758b971c48a7f75712444619656ae8b34bc140d0f9758e987eaf407245e2bd25bf21229112b789fa64a6260f0339cf080e0a1a06b6e85f4050f2
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFWoFLAxZhMDzE8H:9hOmTsF93UYfwC6GIoutz5yLpOSDV
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2288-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1596-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/680-217-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2084-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1556-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-278-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2132-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-372-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3012-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/584-508-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2332-547-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-572-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1560-805-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2080-1019-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-1034-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2384-1045-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1504-1070-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1880-1080-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/692-1105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-1317-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2764-1460-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/2288-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000b0000000122ee-5.dat UPX behavioral1/memory/2288-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x003700000001451d-17.dat UPX behavioral1/memory/2300-16-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2260-18-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2260-27-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00080000000146a7-26.dat UPX behavioral1/files/0x000700000001474b-35.dat UPX behavioral1/memory/2728-36-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000700000001475f-43.dat UPX behavioral1/memory/2728-45-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2664-53-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00070000000148af-54.dat UPX behavioral1/files/0x0008000000014a29-61.dat UPX behavioral1/memory/2832-63-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2752-65-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0008000000014c0b-72.dat UPX behavioral1/files/0x0008000000015cc2-79.dat UPX behavioral1/memory/2536-81-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cca-90.dat UPX behavioral1/memory/2608-89-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cd8-97.dat UPX behavioral1/memory/3008-99-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015ce1-107.dat UPX behavioral1/files/0x0006000000015ced-114.dat UPX behavioral1/memory/2864-116-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2900-124-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015cf5-125.dat UPX behavioral1/memory/3020-126-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3020-135-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015d02-133.dat UPX behavioral1/files/0x0006000000015d13-142.dat UPX behavioral1/files/0x0006000000015d1e-150.dat UPX behavioral1/files/0x0006000000015d28-160.dat UPX behavioral1/files/0x0006000000015d89-166.dat UPX behavioral1/memory/1596-171-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000015d99-176.dat UPX behavioral1/files/0x0006000000015f40-186.dat UPX behavioral1/files/0x0006000000015fbb-192.dat UPX behavioral1/files/0x0006000000016020-200.dat UPX behavioral1/memory/2520-201-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016126-209.dat UPX behavioral1/files/0x0006000000016228-218.dat UPX behavioral1/files/0x000600000001640f-226.dat UPX behavioral1/memory/2084-228-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x000600000001650f-235.dat UPX behavioral1/files/0x0006000000016591-244.dat UPX behavioral1/memory/1556-243-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x00060000000167e8-252.dat UPX behavioral1/memory/2948-260-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0037000000014525-261.dat UPX behavioral1/files/0x0006000000016a3a-270.dat UPX behavioral1/memory/2236-269-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/files/0x0006000000016c3a-279.dat UPX behavioral1/memory/1876-287-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2132-306-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1616-307-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2684-332-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2708-359-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2600-372-0x0000000000220000-0x0000000000247000-memory.dmp UPX behavioral1/memory/3012-379-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2524-402-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2016-421-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2300 5frrrrr.exe 2260 7bnttt.exe 1456 fxfxlrf.exe 2728 rxxrrfx.exe 2664 tnhhtb.exe 2832 vpjpp.exe 2752 jdvvj.exe 2536 lfflrxx.exe 2608 1hbntb.exe 3008 nbttnh.exe 2524 jdjjp.exe 2864 fffllrr.exe 2900 nhbhtb.exe 3020 hhbnhn.exe 348 dvddp.exe 1704 xrxlrxf.exe 308 hhbbhh.exe 2604 nbhbhh.exe 1596 pppdj.exe 1768 dvjpj.exe 2488 fxlrllr.exe 2520 bttbhb.exe 2936 1dddv.exe 680 vpppv.exe 1268 fxlrffr.exe 2084 hbbnbh.exe 1556 jjdjd.exe 1100 xrfrffl.exe 2948 ttnbnb.exe 2236 nhbbtt.exe 2908 vpdpj.exe 2224 xlflxlx.exe 1876 1bnhnt.exe 1784 7htttb.exe 2132 dvpvd.exe 1616 5vvjv.exe 2240 xrxxllx.exe 2144 tnbhnt.exe 2684 1tnbnn.exe 2768 pjvjv.exe 2728 3dpvv.exe 2272 flfllrf.exe 2740 rrflxrf.exe 2708 1nntbn.exe 2552 9bhttn.exe 2600 jdpdv.exe 3012 jdppv.exe 2304 xffllrf.exe 2624 xlfrrlf.exe 2524 nbnnbh.exe 2636 btnnbb.exe 304 dvppj.exe 2016 vjppj.exe 812 7xlrxxf.exe 1076 3xxxffl.exe 1412 9hhhbt.exe 344 bbnbhn.exe 1748 ddvjp.exe 1152 pjvjv.exe 1564 xrffrrf.exe 1336 5lflrrf.exe 2076 ttnhbh.exe 2248 ddvvv.exe 2244 7dpdd.exe -
resource yara_rule behavioral1/memory/2288-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b0000000122ee-5.dat upx behavioral1/memory/2288-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x003700000001451d-17.dat upx behavioral1/memory/2300-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2260-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2260-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000146a7-26.dat upx behavioral1/files/0x000700000001474b-35.dat upx behavioral1/memory/2728-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001475f-43.dat upx behavioral1/memory/2728-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2664-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000148af-54.dat upx behavioral1/files/0x0008000000014a29-61.dat upx behavioral1/memory/2832-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2752-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000014c0b-72.dat upx behavioral1/files/0x0008000000015cc2-79.dat upx behavioral1/memory/2536-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cca-90.dat upx behavioral1/memory/2608-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cd8-97.dat upx behavioral1/memory/3008-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015ce1-107.dat upx behavioral1/files/0x0006000000015ced-114.dat upx behavioral1/memory/2864-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cf5-125.dat upx behavioral1/memory/3020-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3020-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d02-133.dat upx behavioral1/files/0x0006000000015d13-142.dat upx behavioral1/files/0x0006000000015d1e-150.dat upx behavioral1/files/0x0006000000015d28-160.dat upx behavioral1/files/0x0006000000015d89-166.dat upx behavioral1/memory/1596-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d99-176.dat upx behavioral1/files/0x0006000000015f40-186.dat upx behavioral1/files/0x0006000000015fbb-192.dat upx behavioral1/files/0x0006000000016020-200.dat upx behavioral1/memory/2520-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016126-209.dat upx behavioral1/files/0x0006000000016228-218.dat upx behavioral1/files/0x000600000001640f-226.dat upx behavioral1/memory/2084-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001650f-235.dat upx behavioral1/files/0x0006000000016591-244.dat upx behavioral1/memory/1556-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000167e8-252.dat upx behavioral1/memory/2948-260-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0037000000014525-261.dat upx behavioral1/files/0x0006000000016a3a-270.dat upx behavioral1/memory/2236-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c3a-279.dat upx behavioral1/memory/1876-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2132-306-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1616-307-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-332-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2708-359-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2600-372-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/3012-379-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2524-402-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2016-421-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2288 wrote to memory of 2300 2288 52e99bce8a655504a1f863258411e35d3f5f11878b9a18c263920c3a48317aea.exe 28 PID 2288 wrote to memory of 2300 2288 52e99bce8a655504a1f863258411e35d3f5f11878b9a18c263920c3a48317aea.exe 28 PID 2288 wrote to memory of 2300 2288 52e99bce8a655504a1f863258411e35d3f5f11878b9a18c263920c3a48317aea.exe 28 PID 2288 wrote to memory of 2300 2288 52e99bce8a655504a1f863258411e35d3f5f11878b9a18c263920c3a48317aea.exe 28 PID 2300 wrote to memory of 2260 2300 5frrrrr.exe 29 PID 2300 wrote to memory of 2260 2300 5frrrrr.exe 29 PID 2300 wrote to memory of 2260 2300 5frrrrr.exe 29 PID 2300 wrote to memory of 2260 2300 5frrrrr.exe 29 PID 2260 wrote to memory of 1456 2260 7bnttt.exe 30 PID 2260 wrote to memory of 1456 2260 7bnttt.exe 30 PID 2260 wrote to memory of 1456 2260 7bnttt.exe 30 PID 2260 wrote to memory of 1456 2260 7bnttt.exe 30 PID 1456 wrote to memory of 2728 1456 fxfxlrf.exe 31 PID 1456 wrote to memory of 2728 1456 fxfxlrf.exe 31 PID 1456 wrote to memory of 2728 1456 fxfxlrf.exe 31 PID 1456 wrote to memory of 2728 1456 fxfxlrf.exe 31 PID 2728 wrote to memory of 2664 2728 rxxrrfx.exe 32 PID 2728 wrote to memory of 2664 2728 rxxrrfx.exe 32 PID 2728 wrote to memory of 2664 2728 rxxrrfx.exe 32 PID 2728 wrote to memory of 2664 2728 rxxrrfx.exe 32 PID 2664 wrote to memory of 2832 2664 tnhhtb.exe 33 PID 2664 wrote to memory of 2832 2664 tnhhtb.exe 33 PID 2664 wrote to memory of 2832 2664 tnhhtb.exe 33 PID 2664 wrote to memory of 2832 2664 tnhhtb.exe 33 PID 2832 wrote to memory of 2752 2832 vpjpp.exe 34 PID 2832 wrote to memory of 2752 2832 vpjpp.exe 34 PID 2832 wrote to memory of 2752 2832 vpjpp.exe 34 PID 2832 wrote to memory of 2752 2832 vpjpp.exe 34 PID 2752 wrote to memory of 2536 2752 jdvvj.exe 35 PID 2752 wrote to memory of 2536 2752 jdvvj.exe 35 PID 2752 wrote to memory of 2536 2752 jdvvj.exe 35 PID 2752 wrote to memory of 2536 2752 jdvvj.exe 35 PID 2536 wrote to memory of 2608 2536 lfflrxx.exe 36 PID 2536 wrote to memory of 2608 2536 lfflrxx.exe 36 PID 2536 wrote to memory of 2608 2536 lfflrxx.exe 36 PID 2536 wrote to memory of 2608 2536 lfflrxx.exe 36 PID 2608 wrote to memory of 3008 2608 1hbntb.exe 37 PID 2608 wrote to memory of 3008 2608 1hbntb.exe 37 PID 2608 wrote to memory of 3008 2608 1hbntb.exe 37 PID 2608 wrote to memory of 3008 2608 1hbntb.exe 37 PID 3008 wrote to memory of 2524 3008 nbttnh.exe 38 PID 3008 wrote to memory of 2524 3008 nbttnh.exe 38 PID 3008 wrote to memory of 2524 3008 nbttnh.exe 38 PID 3008 wrote to memory of 2524 3008 nbttnh.exe 38 PID 2524 wrote to memory of 2864 2524 jdjjp.exe 39 PID 2524 wrote to memory of 2864 2524 jdjjp.exe 39 PID 2524 wrote to memory of 2864 2524 jdjjp.exe 39 PID 2524 wrote to memory of 2864 2524 jdjjp.exe 39 PID 2864 wrote to memory of 2900 2864 fffllrr.exe 40 PID 2864 wrote to memory of 2900 2864 fffllrr.exe 40 PID 2864 wrote to memory of 2900 2864 fffllrr.exe 40 PID 2864 wrote to memory of 2900 2864 fffllrr.exe 40 PID 2900 wrote to memory of 3020 2900 nhbhtb.exe 41 PID 2900 wrote to memory of 3020 2900 nhbhtb.exe 41 PID 2900 wrote to memory of 3020 2900 nhbhtb.exe 41 PID 2900 wrote to memory of 3020 2900 nhbhtb.exe 41 PID 3020 wrote to memory of 348 3020 hhbnhn.exe 42 PID 3020 wrote to memory of 348 3020 hhbnhn.exe 42 PID 3020 wrote to memory of 348 3020 hhbnhn.exe 42 PID 3020 wrote to memory of 348 3020 hhbnhn.exe 42 PID 348 wrote to memory of 1704 348 dvddp.exe 43 PID 348 wrote to memory of 1704 348 dvddp.exe 43 PID 348 wrote to memory of 1704 348 dvddp.exe 43 PID 348 wrote to memory of 1704 348 dvddp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\52e99bce8a655504a1f863258411e35d3f5f11878b9a18c263920c3a48317aea.exe"C:\Users\Admin\AppData\Local\Temp\52e99bce8a655504a1f863258411e35d3f5f11878b9a18c263920c3a48317aea.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\5frrrrr.exec:\5frrrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\7bnttt.exec:\7bnttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\fxfxlrf.exec:\fxfxlrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\rxxrrfx.exec:\rxxrrfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\tnhhtb.exec:\tnhhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\vpjpp.exec:\vpjpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\jdvvj.exec:\jdvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\lfflrxx.exec:\lfflrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\1hbntb.exec:\1hbntb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\nbttnh.exec:\nbttnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\jdjjp.exec:\jdjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\fffllrr.exec:\fffllrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\nhbhtb.exec:\nhbhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\hhbnhn.exec:\hhbnhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\dvddp.exec:\dvddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\xrxlrxf.exec:\xrxlrxf.exe17⤵
- Executes dropped EXE
PID:1704 -
\??\c:\hhbbhh.exec:\hhbbhh.exe18⤵
- Executes dropped EXE
PID:308 -
\??\c:\nbhbhh.exec:\nbhbhh.exe19⤵
- Executes dropped EXE
PID:2604 -
\??\c:\pppdj.exec:\pppdj.exe20⤵
- Executes dropped EXE
PID:1596 -
\??\c:\dvjpj.exec:\dvjpj.exe21⤵
- Executes dropped EXE
PID:1768 -
\??\c:\fxlrllr.exec:\fxlrllr.exe22⤵
- Executes dropped EXE
PID:2488 -
\??\c:\bttbhb.exec:\bttbhb.exe23⤵
- Executes dropped EXE
PID:2520 -
\??\c:\1dddv.exec:\1dddv.exe24⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vpppv.exec:\vpppv.exe25⤵
- Executes dropped EXE
PID:680 -
\??\c:\fxlrffr.exec:\fxlrffr.exe26⤵
- Executes dropped EXE
PID:1268 -
\??\c:\hbbnbh.exec:\hbbnbh.exe27⤵
- Executes dropped EXE
PID:2084 -
\??\c:\jjdjd.exec:\jjdjd.exe28⤵
- Executes dropped EXE
PID:1556 -
\??\c:\xrfrffl.exec:\xrfrffl.exe29⤵
- Executes dropped EXE
PID:1100 -
\??\c:\ttnbnb.exec:\ttnbnb.exe30⤵
- Executes dropped EXE
PID:2948 -
\??\c:\nhbbtt.exec:\nhbbtt.exe31⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vpdpj.exec:\vpdpj.exe32⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xlflxlx.exec:\xlflxlx.exe33⤵
- Executes dropped EXE
PID:2224 -
\??\c:\1bnhnt.exec:\1bnhnt.exe34⤵
- Executes dropped EXE
PID:1876 -
\??\c:\7htttb.exec:\7htttb.exe35⤵
- Executes dropped EXE
PID:1784 -
\??\c:\dvpvd.exec:\dvpvd.exe36⤵
- Executes dropped EXE
PID:2132 -
\??\c:\5vvjv.exec:\5vvjv.exe37⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xrxxllx.exec:\xrxxllx.exe38⤵
- Executes dropped EXE
PID:2240 -
\??\c:\tnbhnt.exec:\tnbhnt.exe39⤵
- Executes dropped EXE
PID:2144 -
\??\c:\1tnbnn.exec:\1tnbnn.exe40⤵
- Executes dropped EXE
PID:2684 -
\??\c:\pjvjv.exec:\pjvjv.exe41⤵
- Executes dropped EXE
PID:2768 -
\??\c:\3dpvv.exec:\3dpvv.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\flfllrf.exec:\flfllrf.exe43⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rrflxrf.exec:\rrflxrf.exe44⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1nntbn.exec:\1nntbn.exe45⤵
- Executes dropped EXE
PID:2708 -
\??\c:\9bhttn.exec:\9bhttn.exe46⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jdpdv.exec:\jdpdv.exe47⤵
- Executes dropped EXE
PID:2600 -
\??\c:\jdppv.exec:\jdppv.exe48⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xffllrf.exec:\xffllrf.exe49⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xlfrrlf.exec:\xlfrrlf.exe50⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nbnnbh.exec:\nbnnbh.exe51⤵
- Executes dropped EXE
PID:2524 -
\??\c:\btnnbb.exec:\btnnbb.exe52⤵
- Executes dropped EXE
PID:2636 -
\??\c:\dvppj.exec:\dvppj.exe53⤵
- Executes dropped EXE
PID:304 -
\??\c:\vjppj.exec:\vjppj.exe54⤵
- Executes dropped EXE
PID:2016 -
\??\c:\7xlrxxf.exec:\7xlrxxf.exe55⤵
- Executes dropped EXE
PID:812 -
\??\c:\3xxxffl.exec:\3xxxffl.exe56⤵
- Executes dropped EXE
PID:1076 -
\??\c:\9hhhbt.exec:\9hhhbt.exe57⤵
- Executes dropped EXE
PID:1412 -
\??\c:\bbnbhn.exec:\bbnbhn.exe58⤵
- Executes dropped EXE
PID:344 -
\??\c:\ddvjp.exec:\ddvjp.exe59⤵
- Executes dropped EXE
PID:1748 -
\??\c:\pjvjv.exec:\pjvjv.exe60⤵
- Executes dropped EXE
PID:1152 -
\??\c:\xrffrrf.exec:\xrffrrf.exe61⤵
- Executes dropped EXE
PID:1564 -
\??\c:\5lflrrf.exec:\5lflrrf.exe62⤵
- Executes dropped EXE
PID:1336 -
\??\c:\ttnhbh.exec:\ttnhbh.exe63⤵
- Executes dropped EXE
PID:2076 -
\??\c:\ddvvv.exec:\ddvvv.exe64⤵
- Executes dropped EXE
PID:2248 -
\??\c:\7dpdd.exec:\7dpdd.exe65⤵
- Executes dropped EXE
PID:2244 -
\??\c:\fxlrlrx.exec:\fxlrlrx.exe66⤵PID:3068
-
\??\c:\rllrxxf.exec:\rllrxxf.exe67⤵PID:1168
-
\??\c:\bbbhnn.exec:\bbbhnn.exe68⤵PID:584
-
\??\c:\btnhtn.exec:\btnhtn.exe69⤵PID:2956
-
\??\c:\vppdp.exec:\vppdp.exe70⤵PID:2084
-
\??\c:\5xrrxfl.exec:\5xrrxfl.exe71⤵PID:1380
-
\??\c:\fxflrfl.exec:\fxflrfl.exe72⤵PID:1276
-
\??\c:\7thbhn.exec:\7thbhn.exe73⤵PID:1100
-
\??\c:\nhbnnn.exec:\nhbnnn.exe74⤵PID:572
-
\??\c:\dvjpp.exec:\dvjpp.exe75⤵PID:2332
-
\??\c:\dpddd.exec:\dpddd.exe76⤵PID:1240
-
\??\c:\xrllrrf.exec:\xrllrrf.exe77⤵PID:2912
-
\??\c:\5xrxrxf.exec:\5xrxrxf.exe78⤵PID:1724
-
\??\c:\3nhbnt.exec:\3nhbnt.exe79⤵PID:1708
-
\??\c:\1tbnbb.exec:\1tbnbb.exe80⤵PID:1328
-
\??\c:\vvdpd.exec:\vvdpd.exe81⤵PID:1620
-
\??\c:\llffffl.exec:\llffffl.exe82⤵PID:1256
-
\??\c:\lfrxffr.exec:\lfrxffr.exe83⤵PID:2356
-
\??\c:\5bbnbt.exec:\5bbnbt.exe84⤵PID:2640
-
\??\c:\9ntnbt.exec:\9ntnbt.exe85⤵PID:2724
-
\??\c:\3vpvj.exec:\3vpvj.exe86⤵PID:2668
-
\??\c:\vppvj.exec:\vppvj.exe87⤵PID:2104
-
\??\c:\lfxffrl.exec:\lfxffrl.exe88⤵PID:380
-
\??\c:\lfrxlrx.exec:\lfrxlrx.exe89⤵PID:2824
-
\??\c:\nhttbh.exec:\nhttbh.exe90⤵PID:2548
-
\??\c:\9bnbnb.exec:\9bnbnb.exe91⤵PID:2568
-
\??\c:\jdpdj.exec:\jdpdj.exe92⤵PID:3004
-
\??\c:\pjvdd.exec:\pjvdd.exe93⤵PID:3024
-
\??\c:\fxlllrx.exec:\fxlllrx.exe94⤵PID:2176
-
\??\c:\9llrflf.exec:\9llrflf.exe95⤵PID:2856
-
\??\c:\1btbnn.exec:\1btbnn.exe96⤵PID:2624
-
\??\c:\hbntnn.exec:\hbntnn.exe97⤵PID:3000
-
\??\c:\jjvjp.exec:\jjvjp.exe98⤵PID:2992
-
\??\c:\3ddjp.exec:\3ddjp.exe99⤵PID:1048
-
\??\c:\rlllxxl.exec:\rlllxxl.exe100⤵PID:1040
-
\??\c:\frfffff.exec:\frfffff.exe101⤵PID:1200
-
\??\c:\3tnhtn.exec:\3tnhtn.exe102⤵PID:1760
-
\??\c:\tnhnnn.exec:\tnhnnn.exe103⤵PID:1412
-
\??\c:\7pdjj.exec:\7pdjj.exe104⤵PID:316
-
\??\c:\vpdjj.exec:\vpdjj.exe105⤵PID:1696
-
\??\c:\7rrxllr.exec:\7rrxllr.exe106⤵PID:1592
-
\??\c:\lxflflx.exec:\lxflflx.exe107⤵PID:2136
-
\??\c:\7tntnh.exec:\7tntnh.exe108⤵PID:2904
-
\??\c:\hbnthh.exec:\hbnthh.exe109⤵PID:2076
-
\??\c:\7bthhn.exec:\7bthhn.exe110⤵PID:2520
-
\??\c:\vjppd.exec:\vjppd.exe111⤵PID:2244
-
\??\c:\vppvj.exec:\vppvj.exe112⤵PID:868
-
\??\c:\llrlrxf.exec:\llrlrxf.exe113⤵PID:600
-
\??\c:\frffllr.exec:\frffllr.exe114⤵PID:1268
-
\??\c:\tnntbb.exec:\tnntbb.exe115⤵PID:1568
-
\??\c:\nnthnh.exec:\nnthnh.exe116⤵PID:1560
-
\??\c:\jdppd.exec:\jdppd.exe117⤵PID:2120
-
\??\c:\5jpvd.exec:\5jpvd.exe118⤵PID:1276
-
\??\c:\1lrlllx.exec:\1lrlllx.exe119⤵PID:2256
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe120⤵PID:1736
-
\??\c:\tnhnhh.exec:\tnhnhh.exe121⤵PID:2352
-
\??\c:\7hbhnn.exec:\7hbhnn.exe122⤵PID:2128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-