Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 21:07
Behavioral task
behavioral1
Sample
492b9047a19951c8a2f461ac47bc45ed776399e6afcb2709d9fb0121f77b033d.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
492b9047a19951c8a2f461ac47bc45ed776399e6afcb2709d9fb0121f77b033d.exe
-
Size
89KB
-
MD5
382f4f3b8ef53fc6f316fc3190d0fb29
-
SHA1
7245451644623cae2928ea76050f7420f035e172
-
SHA256
492b9047a19951c8a2f461ac47bc45ed776399e6afcb2709d9fb0121f77b033d
-
SHA512
4a2ca18c2916c295b07d51dcd80a966f3c1ae29bd15c4a28725f9e156c17f85eb4917e98e5bb22be802f0b247d8c73d663b399f756fe3f6a7fa4ad4baeafcdbd
-
SSDEEP
1536:cvQBeOGtrYS3srx93UBWfwC6Ggnouy8mVeygryFU2li0gx4EBbhnyLFW+YX:chOmTsF93UYfwC6GIoutieyhC2lbgGiN
Malware Config
Signatures
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/1976-1-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2980-21-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2264-17-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2840-52-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2812-56-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2676-73-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2676-71-0x0000000000230000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/1372-94-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2232-84-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2520-81-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1636-102-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2356-117-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2168-127-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1560-130-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1532-146-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2188-154-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1220-166-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1556-239-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2288-250-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2748-296-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2264-311-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1512-318-0x00000000002C0000-0x00000000002F6000-memory.dmp family_blackmoon behavioral1/memory/2588-332-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2744-338-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2684-352-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2148-384-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/236-436-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1704-503-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1588-502-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1744-510-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/900-529-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1780-544-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1680-561-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1844-581-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2324-590-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2000-598-0x00000000002B0000-0x00000000002E6000-memory.dmp family_blackmoon behavioral1/memory/2844-609-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2616-623-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2844-651-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1840-749-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3024-781-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1460-822-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2900-1018-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/memory/1976-1-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x000c00000001226d-6.dat UPX behavioral1/memory/2264-9-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1976-3-0x0000000000230000-0x0000000000266000-memory.dmp UPX behavioral1/files/0x0034000000015b63-19.dat UPX behavioral1/files/0x0008000000015cb7-27.dat UPX behavioral1/memory/2980-21-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2264-17-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0007000000015cd6-36.dat UPX behavioral1/files/0x0007000000015ce2-43.dat UPX behavioral1/memory/2840-44-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0007000000015cea-53.dat UPX behavioral1/memory/2840-52-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2812-56-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0009000000015cf3-62.dat UPX behavioral1/files/0x00080000000162cc-74.dat UPX behavioral1/memory/2676-73-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1372-94-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016824-92.dat UPX behavioral1/memory/2232-84-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x00060000000165d4-83.dat UPX behavioral1/memory/2520-81-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1636-102-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016a7d-101.dat UPX behavioral1/files/0x0006000000016c5d-118.dat UPX behavioral1/memory/2356-117-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016c4a-110.dat UPX behavioral1/files/0x0006000000016c67-124.dat UPX behavioral1/files/0x0006000000016caf-136.dat UPX behavioral1/memory/2168-127-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1560-130-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1532-137-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016cde-144.dat UPX behavioral1/memory/1532-146-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016d05-155.dat UPX behavioral1/memory/2188-154-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1220-166-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016d1a-164.dat UPX behavioral1/files/0x0006000000016d22-173.dat UPX behavioral1/files/0x0006000000016d2b-180.dat UPX behavioral1/files/0x0006000000016d33-189.dat UPX behavioral1/memory/2544-190-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016d3b-198.dat UPX behavioral1/files/0x0006000000016d44-206.dat UPX behavioral1/files/0x0006000000016d4c-213.dat UPX behavioral1/files/0x0006000000016d55-222.dat UPX behavioral1/files/0x0006000000016d68-230.dat UPX behavioral1/memory/1556-231-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016d6c-240.dat UPX behavioral1/memory/1556-239-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016d70-248.dat UPX behavioral1/memory/2288-250-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/files/0x0006000000016d78-258.dat UPX behavioral1/files/0x0034000000015bc7-266.dat UPX behavioral1/files/0x0006000000016da0-274.dat UPX behavioral1/files/0x0006000000016db2-283.dat UPX behavioral1/memory/2748-296-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2264-311-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2588-332-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2744-338-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2684-352-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2920-365-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/2148-384-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral1/memory/1728-409-0x0000000000220000-0x0000000000256000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2264 fxlrxxf.exe 2980 nbhhhh.exe 2712 5ddpp.exe 2580 xrfrflx.exe 2840 5bbhhb.exe 2812 dpddp.exe 2676 5vpvj.exe 2520 tnnttt.exe 2232 nhbhnn.exe 1372 bnbttb.exe 1636 jjvvv.exe 2356 vjvvv.exe 2168 ntthbn.exe 1560 jdpvd.exe 1532 dvjpv.exe 2188 tthnnh.exe 2172 btntth.exe 1220 3fxxffl.exe 2304 xlllflr.exe 2224 7tbhhh.exe 2544 5hhbnh.exe 2340 5vvdd.exe 688 xxlxxfr.exe 1408 rrrfrfx.exe 1784 3hbhnn.exe 1556 3bbtnb.exe 1228 pvdpd.exe 2288 xlxfrxf.exe 1632 7hbhtb.exe 2316 vdvpp.exe 2000 rxlrflf.exe 1436 hbthtb.exe 1908 nhnbhh.exe 2748 jdpvd.exe 2264 1pdjp.exe 1512 xrrlxxr.exe 2700 fxflffx.exe 2608 5hthnt.exe 2588 pvdjv.exe 2744 pjjjv.exe 2684 djvdp.exe 2460 rrlfrff.exe 2504 nnttbb.exe 2920 5jddd.exe 1328 dvjdp.exe 2148 5rxrflr.exe 1252 3xrflrf.exe 1360 bbhbbt.exe 1500 5bntbb.exe 1728 vpjpd.exe 2360 pppdv.exe 1560 xlxfrlx.exe 1452 btnthn.exe 236 3bnthn.exe 796 ppvdv.exe 1588 lxlxxxl.exe 2016 lrxxrrx.exe 2020 9hbhbb.exe 1132 bthnbb.exe 2216 ppdjv.exe 1624 fxxflrf.exe 680 lflrfrx.exe 584 nhthnt.exe 1780 1tbnbn.exe -
resource yara_rule behavioral1/memory/1976-1-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000c00000001226d-6.dat upx behavioral1/memory/2264-9-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1976-3-0x0000000000230000-0x0000000000266000-memory.dmp upx behavioral1/files/0x0034000000015b63-19.dat upx behavioral1/files/0x0008000000015cb7-27.dat upx behavioral1/memory/2980-21-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2264-17-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015cd6-36.dat upx behavioral1/files/0x0007000000015ce2-43.dat upx behavioral1/memory/2840-44-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0007000000015cea-53.dat upx behavioral1/memory/2840-52-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2812-56-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0009000000015cf3-62.dat upx behavioral1/files/0x00080000000162cc-74.dat upx behavioral1/memory/2676-73-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1372-94-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016824-92.dat upx behavioral1/memory/2232-84-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00060000000165d4-83.dat upx behavioral1/memory/2520-81-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1636-102-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016a7d-101.dat upx behavioral1/files/0x0006000000016c5d-118.dat upx behavioral1/memory/2356-117-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016c4a-110.dat upx behavioral1/files/0x0006000000016c67-124.dat upx behavioral1/files/0x0006000000016caf-136.dat upx behavioral1/memory/2168-127-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1560-130-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1532-137-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016cde-144.dat upx behavioral1/memory/1532-146-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d05-155.dat upx behavioral1/memory/2188-154-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1220-166-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d1a-164.dat upx behavioral1/files/0x0006000000016d22-173.dat upx behavioral1/files/0x0006000000016d2b-180.dat upx behavioral1/files/0x0006000000016d33-189.dat upx behavioral1/memory/2544-190-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d3b-198.dat upx behavioral1/files/0x0006000000016d44-206.dat upx behavioral1/files/0x0006000000016d4c-213.dat upx behavioral1/files/0x0006000000016d55-222.dat upx behavioral1/files/0x0006000000016d68-230.dat upx behavioral1/memory/1556-231-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d6c-240.dat upx behavioral1/memory/1556-239-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d70-248.dat upx behavioral1/memory/2288-250-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d78-258.dat upx behavioral1/files/0x0034000000015bc7-266.dat upx behavioral1/files/0x0006000000016da0-274.dat upx behavioral1/files/0x0006000000016db2-283.dat upx behavioral1/memory/2748-296-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2264-311-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2588-332-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2744-338-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2684-352-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2920-365-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2148-384-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1728-409-0x0000000000220000-0x0000000000256000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2264 1976 492b9047a19951c8a2f461ac47bc45ed776399e6afcb2709d9fb0121f77b033d.exe 28 PID 1976 wrote to memory of 2264 1976 492b9047a19951c8a2f461ac47bc45ed776399e6afcb2709d9fb0121f77b033d.exe 28 PID 1976 wrote to memory of 2264 1976 492b9047a19951c8a2f461ac47bc45ed776399e6afcb2709d9fb0121f77b033d.exe 28 PID 1976 wrote to memory of 2264 1976 492b9047a19951c8a2f461ac47bc45ed776399e6afcb2709d9fb0121f77b033d.exe 28 PID 2264 wrote to memory of 2980 2264 fxlrxxf.exe 29 PID 2264 wrote to memory of 2980 2264 fxlrxxf.exe 29 PID 2264 wrote to memory of 2980 2264 fxlrxxf.exe 29 PID 2264 wrote to memory of 2980 2264 fxlrxxf.exe 29 PID 2980 wrote to memory of 2712 2980 nbhhhh.exe 30 PID 2980 wrote to memory of 2712 2980 nbhhhh.exe 30 PID 2980 wrote to memory of 2712 2980 nbhhhh.exe 30 PID 2980 wrote to memory of 2712 2980 nbhhhh.exe 30 PID 2712 wrote to memory of 2580 2712 5ddpp.exe 31 PID 2712 wrote to memory of 2580 2712 5ddpp.exe 31 PID 2712 wrote to memory of 2580 2712 5ddpp.exe 31 PID 2712 wrote to memory of 2580 2712 5ddpp.exe 31 PID 2580 wrote to memory of 2840 2580 xrfrflx.exe 32 PID 2580 wrote to memory of 2840 2580 xrfrflx.exe 32 PID 2580 wrote to memory of 2840 2580 xrfrflx.exe 32 PID 2580 wrote to memory of 2840 2580 xrfrflx.exe 32 PID 2840 wrote to memory of 2812 2840 5bbhhb.exe 33 PID 2840 wrote to memory of 2812 2840 5bbhhb.exe 33 PID 2840 wrote to memory of 2812 2840 5bbhhb.exe 33 PID 2840 wrote to memory of 2812 2840 5bbhhb.exe 33 PID 2812 wrote to memory of 2676 2812 dpddp.exe 34 PID 2812 wrote to memory of 2676 2812 dpddp.exe 34 PID 2812 wrote to memory of 2676 2812 dpddp.exe 34 PID 2812 wrote to memory of 2676 2812 dpddp.exe 34 PID 2676 wrote to memory of 2520 2676 5vpvj.exe 35 PID 2676 wrote to memory of 2520 2676 5vpvj.exe 35 PID 2676 wrote to memory of 2520 2676 5vpvj.exe 35 PID 2676 wrote to memory of 2520 2676 5vpvj.exe 35 PID 2520 wrote to memory of 2232 2520 tnnttt.exe 36 PID 2520 wrote to memory of 2232 2520 tnnttt.exe 36 PID 2520 wrote to memory of 2232 2520 tnnttt.exe 36 PID 2520 wrote to memory of 2232 2520 tnnttt.exe 36 PID 2232 wrote to memory of 1372 2232 nhbhnn.exe 37 PID 2232 wrote to memory of 1372 2232 nhbhnn.exe 37 PID 2232 wrote to memory of 1372 2232 nhbhnn.exe 37 PID 2232 wrote to memory of 1372 2232 nhbhnn.exe 37 PID 1372 wrote to memory of 1636 1372 bnbttb.exe 38 PID 1372 wrote to memory of 1636 1372 bnbttb.exe 38 PID 1372 wrote to memory of 1636 1372 bnbttb.exe 38 PID 1372 wrote to memory of 1636 1372 bnbttb.exe 38 PID 1636 wrote to memory of 2356 1636 jjvvv.exe 39 PID 1636 wrote to memory of 2356 1636 jjvvv.exe 39 PID 1636 wrote to memory of 2356 1636 jjvvv.exe 39 PID 1636 wrote to memory of 2356 1636 jjvvv.exe 39 PID 2356 wrote to memory of 2168 2356 vjvvv.exe 40 PID 2356 wrote to memory of 2168 2356 vjvvv.exe 40 PID 2356 wrote to memory of 2168 2356 vjvvv.exe 40 PID 2356 wrote to memory of 2168 2356 vjvvv.exe 40 PID 2168 wrote to memory of 1560 2168 ntthbn.exe 41 PID 2168 wrote to memory of 1560 2168 ntthbn.exe 41 PID 2168 wrote to memory of 1560 2168 ntthbn.exe 41 PID 2168 wrote to memory of 1560 2168 ntthbn.exe 41 PID 1560 wrote to memory of 1532 1560 jdpvd.exe 42 PID 1560 wrote to memory of 1532 1560 jdpvd.exe 42 PID 1560 wrote to memory of 1532 1560 jdpvd.exe 42 PID 1560 wrote to memory of 1532 1560 jdpvd.exe 42 PID 1532 wrote to memory of 2188 1532 dvjpv.exe 43 PID 1532 wrote to memory of 2188 1532 dvjpv.exe 43 PID 1532 wrote to memory of 2188 1532 dvjpv.exe 43 PID 1532 wrote to memory of 2188 1532 dvjpv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\492b9047a19951c8a2f461ac47bc45ed776399e6afcb2709d9fb0121f77b033d.exe"C:\Users\Admin\AppData\Local\Temp\492b9047a19951c8a2f461ac47bc45ed776399e6afcb2709d9fb0121f77b033d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\nbhhhh.exec:\nbhhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\5ddpp.exec:\5ddpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\xrfrflx.exec:\xrfrflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\5bbhhb.exec:\5bbhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\dpddp.exec:\dpddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\5vpvj.exec:\5vpvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\tnnttt.exec:\tnnttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\nhbhnn.exec:\nhbhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\bnbttb.exec:\bnbttb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\jjvvv.exec:\jjvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\vjvvv.exec:\vjvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\ntthbn.exec:\ntthbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\jdpvd.exec:\jdpvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\dvjpv.exec:\dvjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\tthnnh.exec:\tthnnh.exe17⤵
- Executes dropped EXE
PID:2188 -
\??\c:\btntth.exec:\btntth.exe18⤵
- Executes dropped EXE
PID:2172 -
\??\c:\3fxxffl.exec:\3fxxffl.exe19⤵
- Executes dropped EXE
PID:1220 -
\??\c:\xlllflr.exec:\xlllflr.exe20⤵
- Executes dropped EXE
PID:2304 -
\??\c:\7tbhhh.exec:\7tbhhh.exe21⤵
- Executes dropped EXE
PID:2224 -
\??\c:\5hhbnh.exec:\5hhbnh.exe22⤵
- Executes dropped EXE
PID:2544 -
\??\c:\5vvdd.exec:\5vvdd.exe23⤵
- Executes dropped EXE
PID:2340 -
\??\c:\xxlxxfr.exec:\xxlxxfr.exe24⤵
- Executes dropped EXE
PID:688 -
\??\c:\rrrfrfx.exec:\rrrfrfx.exe25⤵
- Executes dropped EXE
PID:1408 -
\??\c:\3hbhnn.exec:\3hbhnn.exe26⤵
- Executes dropped EXE
PID:1784 -
\??\c:\3bbtnb.exec:\3bbtnb.exe27⤵
- Executes dropped EXE
PID:1556 -
\??\c:\pvdpd.exec:\pvdpd.exe28⤵
- Executes dropped EXE
PID:1228 -
\??\c:\xlxfrxf.exec:\xlxfrxf.exe29⤵
- Executes dropped EXE
PID:2288 -
\??\c:\7hbhtb.exec:\7hbhtb.exe30⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vdvpp.exec:\vdvpp.exe31⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rxlrflf.exec:\rxlrflf.exe32⤵
- Executes dropped EXE
PID:2000 -
\??\c:\hbthtb.exec:\hbthtb.exe33⤵
- Executes dropped EXE
PID:1436 -
\??\c:\nhnbhh.exec:\nhnbhh.exe34⤵
- Executes dropped EXE
PID:1908 -
\??\c:\jdpvd.exec:\jdpvd.exe35⤵
- Executes dropped EXE
PID:2748 -
\??\c:\1pdjp.exec:\1pdjp.exe36⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe37⤵
- Executes dropped EXE
PID:1512 -
\??\c:\fxflffx.exec:\fxflffx.exe38⤵
- Executes dropped EXE
PID:2700 -
\??\c:\5hthnt.exec:\5hthnt.exe39⤵
- Executes dropped EXE
PID:2608 -
\??\c:\pvdjv.exec:\pvdjv.exe40⤵
- Executes dropped EXE
PID:2588 -
\??\c:\pjjjv.exec:\pjjjv.exe41⤵
- Executes dropped EXE
PID:2744 -
\??\c:\djvdp.exec:\djvdp.exe42⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rrlfrff.exec:\rrlfrff.exe43⤵
- Executes dropped EXE
PID:2460 -
\??\c:\nnttbb.exec:\nnttbb.exe44⤵
- Executes dropped EXE
PID:2504 -
\??\c:\5jddd.exec:\5jddd.exe45⤵
- Executes dropped EXE
PID:2920 -
\??\c:\dvjdp.exec:\dvjdp.exe46⤵
- Executes dropped EXE
PID:1328 -
\??\c:\5rxrflr.exec:\5rxrflr.exe47⤵
- Executes dropped EXE
PID:2148 -
\??\c:\3xrflrf.exec:\3xrflrf.exe48⤵
- Executes dropped EXE
PID:1252 -
\??\c:\bbhbbt.exec:\bbhbbt.exe49⤵
- Executes dropped EXE
PID:1360 -
\??\c:\5bntbb.exec:\5bntbb.exe50⤵
- Executes dropped EXE
PID:1500 -
\??\c:\vpjpd.exec:\vpjpd.exe51⤵
- Executes dropped EXE
PID:1728 -
\??\c:\pppdv.exec:\pppdv.exe52⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xlxfrlx.exec:\xlxfrlx.exe53⤵
- Executes dropped EXE
PID:1560 -
\??\c:\btnthn.exec:\btnthn.exe54⤵
- Executes dropped EXE
PID:1452 -
\??\c:\3bnthn.exec:\3bnthn.exe55⤵
- Executes dropped EXE
PID:236 -
\??\c:\ppvdv.exec:\ppvdv.exe56⤵
- Executes dropped EXE
PID:796 -
\??\c:\lxlxxxl.exec:\lxlxxxl.exe57⤵
- Executes dropped EXE
PID:1588 -
\??\c:\lrxxrrx.exec:\lrxxrrx.exe58⤵
- Executes dropped EXE
PID:2016 -
\??\c:\9hbhbb.exec:\9hbhbb.exe59⤵
- Executes dropped EXE
PID:2020 -
\??\c:\bthnbb.exec:\bthnbb.exe60⤵
- Executes dropped EXE
PID:1132 -
\??\c:\ppdjv.exec:\ppdjv.exe61⤵
- Executes dropped EXE
PID:2216 -
\??\c:\fxxflrf.exec:\fxxflrf.exe62⤵
- Executes dropped EXE
PID:1624 -
\??\c:\lflrfrx.exec:\lflrfrx.exe63⤵
- Executes dropped EXE
PID:680 -
\??\c:\nhthnt.exec:\nhthnt.exe64⤵
- Executes dropped EXE
PID:584 -
\??\c:\1tbnbn.exec:\1tbnbn.exe65⤵
- Executes dropped EXE
PID:1780 -
\??\c:\3djpd.exec:\3djpd.exe66⤵PID:1704
-
\??\c:\3xxxlrf.exec:\3xxxlrf.exe67⤵PID:1744
-
\??\c:\fxrfflr.exec:\fxrfflr.exe68⤵PID:1792
-
\??\c:\tnbhtt.exec:\tnbhtt.exe69⤵PID:900
-
\??\c:\thtbnt.exec:\thtbnt.exe70⤵PID:1228
-
\??\c:\djjpd.exec:\djjpd.exe71⤵PID:2288
-
\??\c:\dvjpp.exec:\dvjpp.exe72⤵PID:300
-
\??\c:\fxfrrxr.exec:\fxfrrxr.exe73⤵PID:1912
-
\??\c:\3btbnn.exec:\3btbnn.exe74⤵PID:1680
-
\??\c:\hbhnbb.exec:\hbhnbb.exe75⤵PID:2000
-
\??\c:\1pvdp.exec:\1pvdp.exe76⤵PID:2008
-
\??\c:\jdvvp.exec:\jdvvp.exe77⤵PID:1908
-
\??\c:\xrflrrx.exec:\xrflrrx.exe78⤵PID:1844
-
\??\c:\5btbht.exec:\5btbht.exe79⤵PID:2324
-
\??\c:\5nntbb.exec:\5nntbb.exe80⤵PID:1548
-
\??\c:\ppddj.exec:\ppddj.exe81⤵PID:2844
-
\??\c:\jjvjd.exec:\jjvjd.exe82⤵PID:2668
-
\??\c:\ffxlfxl.exec:\ffxlfxl.exe83⤵PID:2616
-
\??\c:\lfxxffl.exec:\lfxxffl.exe84⤵PID:2592
-
\??\c:\3nhthb.exec:\3nhthb.exe85⤵PID:2840
-
\??\c:\3dvdv.exec:\3dvdv.exe86⤵PID:2532
-
\??\c:\pjdvd.exec:\pjdvd.exe87⤵PID:2520
-
\??\c:\1xxfxfr.exec:\1xxfxfr.exe88⤵PID:2920
-
\??\c:\lllxflr.exec:\lllxflr.exe89⤵PID:2928
-
\??\c:\1bttnt.exec:\1bttnt.exe90⤵PID:2148
-
\??\c:\bthnhn.exec:\bthnhn.exe91⤵PID:1568
-
\??\c:\jddjp.exec:\jddjp.exe92⤵PID:1260
-
\??\c:\pjdpp.exec:\pjdpp.exe93⤵PID:2364
-
\??\c:\xlxfrrf.exec:\xlxfrrf.exe94⤵PID:2136
-
\??\c:\lllrrfl.exec:\lllrrfl.exe95⤵PID:2168
-
\??\c:\bbhttb.exec:\bbhttb.exe96⤵PID:1520
-
\??\c:\7tbnbh.exec:\7tbnbh.exe97⤵PID:1772
-
\??\c:\jdvdp.exec:\jdvdp.exe98⤵PID:2772
-
\??\c:\jpppv.exec:\jpppv.exe99⤵PID:2788
-
\??\c:\xrrxxfl.exec:\xrrxxfl.exe100⤵PID:2032
-
\??\c:\1frxlxf.exec:\1frxlxf.exe101⤵PID:1692
-
\??\c:\5hbntb.exec:\5hbntb.exe102⤵PID:2276
-
\??\c:\9nnhnn.exec:\9nnhnn.exe103⤵PID:2304
-
\??\c:\hbhtth.exec:\hbhtth.exe104⤵PID:1840
-
\??\c:\jdjpv.exec:\jdjpv.exe105⤵PID:2552
-
\??\c:\xlxfflr.exec:\xlxfflr.exe106⤵PID:2340
-
\??\c:\frflxxf.exec:\frflxxf.exe107⤵PID:768
-
\??\c:\1fxfxrf.exec:\1fxfxrf.exe108⤵PID:584
-
\??\c:\jdjpj.exec:\jdjpj.exe109⤵PID:3024
-
\??\c:\9jjvd.exec:\9jjvd.exe110⤵PID:1704
-
\??\c:\fxxfrxl.exec:\fxxfrxl.exe111⤵PID:2440
-
\??\c:\btbnbt.exec:\btbnbt.exe112⤵PID:1556
-
\??\c:\nhtbtb.exec:\nhtbtb.exe113⤵PID:2084
-
\??\c:\ppjpv.exec:\ppjpv.exe114⤵PID:2028
-
\??\c:\pdddd.exec:\pdddd.exe115⤵PID:1460
-
\??\c:\7lrlrfr.exec:\7lrlrfr.exe116⤵PID:1644
-
\??\c:\frfllxl.exec:\frfllxl.exe117⤵PID:3008
-
\??\c:\hhhnbn.exec:\hhhnbn.exe118⤵PID:884
-
\??\c:\dvjpv.exec:\dvjpv.exe119⤵PID:1904
-
\??\c:\vpvpp.exec:\vpvpp.exe120⤵PID:2008
-
\??\c:\xrlflfl.exec:\xrlflfl.exe121⤵PID:2584
-
\??\c:\lrfffxr.exec:\lrfffxr.exe122⤵PID:2876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-