Analysis
-
max time kernel
9s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
05-06-2024 05:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f33ceeb95034235396d86b1c9ebbabe55dd6a4573c09a83cd7a3ec1a19027981.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
f33ceeb95034235396d86b1c9ebbabe55dd6a4573c09a83cd7a3ec1a19027981.exe
-
Size
180KB
-
MD5
9269b5748b0c0d5d8d5e25c32e2ea715
-
SHA1
bace2740faf4e0bc3ebd1331ac99cdcd70403d36
-
SHA256
f33ceeb95034235396d86b1c9ebbabe55dd6a4573c09a83cd7a3ec1a19027981
-
SHA512
796b5d93a8ad1e868f606e0268268c93d03540be71f6955df78ed77ff0ef59b9b3b325ffeb3857c6db503561d590152284f24583d17e57237937a2b2becbc919
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+IJPhbMC:PhOm2sI93UufdC67ciJTm5hIC
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/1424-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2740-469-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-490-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-696-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-858-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/540-1144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/884-865-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2708-619-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-606-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2680-560-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-448-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1804-447-0x0000000000250000-0x0000000000279000-memory.dmp family_blackmoon behavioral1/memory/2976-398-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-361-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1240-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/348-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/380-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/924-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/332-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1500-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/280-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2456-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2268-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2152-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 50 IoCs
resource yara_rule behavioral1/memory/1424-69-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2604-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1956-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/868-241-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2068-305-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3048-490-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/264-696-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2704-789-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2472-815-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/884-858-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2340-898-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/828-931-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1968-1110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2496-1233-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2964-1219-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2372-1188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/540-1144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2240-1119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2184-1091-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2340-951-0x0000000000220000-0x0000000000249000-memory.dmp UPX behavioral1/memory/1844-906-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1984-891-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2016-751-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2708-619-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2680-560-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2016-516-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2976-398-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2604-361-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2796-296-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1576-293-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1240-284-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2956-267-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2088-240-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1528-223-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/332-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2556-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/280-156-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2784-129-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2456-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2268-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2540-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1424-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2592-51-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2676-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2560-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2944-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2944-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2152-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2136-7-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2136-0-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2152 3nhnth.exe 2944 3jpdv.exe 2560 jdppp.exe 2676 1rrxrfl.exe 2592 hhbtnh.exe 1424 pvvpj.exe 2604 fxffrxr.exe 2468 1rlxllf.exe 2540 ntnbbb.exe 2268 vvjvj.exe 2424 lrxxrff.exe 2456 htthbt.exe 2784 dpddj.exe 760 xxxlrfr.exe 1956 tnnnbh.exe 280 vvvpj.exe 1660 xrfffrr.exe 1796 bnnbhh.exe 1500 vdvdd.exe 2556 flrllxr.exe 332 vpdvd.exe 924 7xxxxfx.exe 380 hnbbbn.exe 1528 ppjvp.exe 2088 frfffrl.exe 868 bbbnhn.exe 348 pvjdd.exe 896 llrxlrl.exe 2956 ntbhbn.exe 1240 jjjvp.exe 1576 vpjjj.exe 2796 btnbnh.exe 2068 9ttbtt.exe 1592 jjvpp.exe 2744 3xllxfl.exe 2964 tthnth.exe 2672 3dvpj.exe 2732 fllxrxx.exe 2324 nhhnbn.exe 2656 hhbtth.exe 2604 vjdjv.exe 2896 pvpjp.exe 272 9lfrfrf.exe 2668 hhbhbt.exe 2756 bnhbbt.exe 2192 vdvvj.exe 2976 fxlrxlx.exe 1628 ttthhb.exe 2004 1tnhtt.exe 1808 ddjvj.exe 280 vvjjv.exe 2880 9frrxxl.exe 1752 hhbntn.exe 1816 nnhnhn.exe 1804 jddjv.exe 264 llrfrfl.exe 644 1xxxlxx.exe 2740 bbnbnb.exe 2140 7jddj.exe 448 xllrfrl.exe 3048 hthhnh.exe 1724 bttbhh.exe 688 jpdpd.exe 2920 xrllfrf.exe -
resource yara_rule behavioral1/memory/1424-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-305-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2740-469-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-490-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-561-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-696-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2704-789-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-815-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-858-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-898-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/828-931-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1968-1110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-1226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-1233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-1219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-1188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-1157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/540-1144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-1119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-1091-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-951-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/1844-906-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-751-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1844-675-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-619-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-586-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-560-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-516-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/644-455-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1804-448-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2976-398-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1240-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/348-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1528-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/380-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/924-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/332-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1500-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/280-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2456-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2268-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1424-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2152-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-0-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2152 2136 f33ceeb95034235396d86b1c9ebbabe55dd6a4573c09a83cd7a3ec1a19027981.exe 29 PID 2136 wrote to memory of 2152 2136 f33ceeb95034235396d86b1c9ebbabe55dd6a4573c09a83cd7a3ec1a19027981.exe 29 PID 2136 wrote to memory of 2152 2136 f33ceeb95034235396d86b1c9ebbabe55dd6a4573c09a83cd7a3ec1a19027981.exe 29 PID 2136 wrote to memory of 2152 2136 f33ceeb95034235396d86b1c9ebbabe55dd6a4573c09a83cd7a3ec1a19027981.exe 29 PID 2152 wrote to memory of 2944 2152 3nhnth.exe 30 PID 2152 wrote to memory of 2944 2152 3nhnth.exe 30 PID 2152 wrote to memory of 2944 2152 3nhnth.exe 30 PID 2152 wrote to memory of 2944 2152 3nhnth.exe 30 PID 2944 wrote to memory of 2560 2944 3jpdv.exe 31 PID 2944 wrote to memory of 2560 2944 3jpdv.exe 31 PID 2944 wrote to memory of 2560 2944 3jpdv.exe 31 PID 2944 wrote to memory of 2560 2944 3jpdv.exe 31 PID 2560 wrote to memory of 2676 2560 jdppp.exe 32 PID 2560 wrote to memory of 2676 2560 jdppp.exe 32 PID 2560 wrote to memory of 2676 2560 jdppp.exe 32 PID 2560 wrote to memory of 2676 2560 jdppp.exe 32 PID 2676 wrote to memory of 2592 2676 1rrxrfl.exe 581 PID 2676 wrote to memory of 2592 2676 1rrxrfl.exe 581 PID 2676 wrote to memory of 2592 2676 1rrxrfl.exe 581 PID 2676 wrote to memory of 2592 2676 1rrxrfl.exe 581 PID 2592 wrote to memory of 1424 2592 hhbtnh.exe 323 PID 2592 wrote to memory of 1424 2592 hhbtnh.exe 323 PID 2592 wrote to memory of 1424 2592 hhbtnh.exe 323 PID 2592 wrote to memory of 1424 2592 hhbtnh.exe 323 PID 1424 wrote to memory of 2604 1424 pvvpj.exe 35 PID 1424 wrote to memory of 2604 1424 pvvpj.exe 35 PID 1424 wrote to memory of 2604 1424 pvvpj.exe 35 PID 1424 wrote to memory of 2604 1424 pvvpj.exe 35 PID 2604 wrote to memory of 2468 2604 fxffrxr.exe 36 PID 2604 wrote to memory of 2468 2604 fxffrxr.exe 36 PID 2604 wrote to memory of 2468 2604 fxffrxr.exe 36 PID 2604 wrote to memory of 2468 2604 fxffrxr.exe 36 PID 2468 wrote to memory of 2540 2468 1rlxllf.exe 37 PID 2468 wrote to memory of 2540 2468 1rlxllf.exe 37 PID 2468 wrote to memory of 2540 2468 1rlxllf.exe 37 PID 2468 wrote to memory of 2540 2468 1rlxllf.exe 37 PID 2540 wrote to memory of 2268 2540 ntnbbb.exe 38 PID 2540 wrote to memory of 2268 2540 ntnbbb.exe 38 PID 2540 wrote to memory of 2268 2540 ntnbbb.exe 38 PID 2540 wrote to memory of 2268 2540 ntnbbb.exe 38 PID 2268 wrote to memory of 2424 2268 vvjvj.exe 39 PID 2268 wrote to memory of 2424 2268 vvjvj.exe 39 PID 2268 wrote to memory of 2424 2268 vvjvj.exe 39 PID 2268 wrote to memory of 2424 2268 vvjvj.exe 39 PID 2424 wrote to memory of 2456 2424 lrxxrff.exe 40 PID 2424 wrote to memory of 2456 2424 lrxxrff.exe 40 PID 2424 wrote to memory of 2456 2424 lrxxrff.exe 40 PID 2424 wrote to memory of 2456 2424 lrxxrff.exe 40 PID 2456 wrote to memory of 2784 2456 htthbt.exe 41 PID 2456 wrote to memory of 2784 2456 htthbt.exe 41 PID 2456 wrote to memory of 2784 2456 htthbt.exe 41 PID 2456 wrote to memory of 2784 2456 htthbt.exe 41 PID 2784 wrote to memory of 760 2784 dpddj.exe 42 PID 2784 wrote to memory of 760 2784 dpddj.exe 42 PID 2784 wrote to memory of 760 2784 dpddj.exe 42 PID 2784 wrote to memory of 760 2784 dpddj.exe 42 PID 760 wrote to memory of 1956 760 xxxlrfr.exe 43 PID 760 wrote to memory of 1956 760 xxxlrfr.exe 43 PID 760 wrote to memory of 1956 760 xxxlrfr.exe 43 PID 760 wrote to memory of 1956 760 xxxlrfr.exe 43 PID 1956 wrote to memory of 280 1956 tnnnbh.exe 44 PID 1956 wrote to memory of 280 1956 tnnnbh.exe 44 PID 1956 wrote to memory of 280 1956 tnnnbh.exe 44 PID 1956 wrote to memory of 280 1956 tnnnbh.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\f33ceeb95034235396d86b1c9ebbabe55dd6a4573c09a83cd7a3ec1a19027981.exe"C:\Users\Admin\AppData\Local\Temp\f33ceeb95034235396d86b1c9ebbabe55dd6a4573c09a83cd7a3ec1a19027981.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\3nhnth.exec:\3nhnth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\3jpdv.exec:\3jpdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\jdppp.exec:\jdppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\1rrxrfl.exec:\1rrxrfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\hhbtnh.exec:\hhbtnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\pvvpj.exec:\pvvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\fxffrxr.exec:\fxffrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\1rlxllf.exec:\1rlxllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\ntnbbb.exec:\ntnbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\vvjvj.exec:\vvjvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\lrxxrff.exec:\lrxxrff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\htthbt.exec:\htthbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\dpddj.exec:\dpddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\xxxlrfr.exec:\xxxlrfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\tnnnbh.exec:\tnnnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\vvvpj.exec:\vvvpj.exe17⤵
- Executes dropped EXE
PID:280 -
\??\c:\xrfffrr.exec:\xrfffrr.exe18⤵
- Executes dropped EXE
PID:1660 -
\??\c:\bnnbhh.exec:\bnnbhh.exe19⤵
- Executes dropped EXE
PID:1796 -
\??\c:\vdvdd.exec:\vdvdd.exe20⤵
- Executes dropped EXE
PID:1500 -
\??\c:\flrllxr.exec:\flrllxr.exe21⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vpdvd.exec:\vpdvd.exe22⤵
- Executes dropped EXE
PID:332 -
\??\c:\7xxxxfx.exec:\7xxxxfx.exe23⤵
- Executes dropped EXE
PID:924 -
\??\c:\hnbbbn.exec:\hnbbbn.exe24⤵
- Executes dropped EXE
PID:380 -
\??\c:\ppjvp.exec:\ppjvp.exe25⤵
- Executes dropped EXE
PID:1528 -
\??\c:\frfffrl.exec:\frfffrl.exe26⤵
- Executes dropped EXE
PID:2088 -
\??\c:\bbbnhn.exec:\bbbnhn.exe27⤵
- Executes dropped EXE
PID:868 -
\??\c:\pvjdd.exec:\pvjdd.exe28⤵
- Executes dropped EXE
PID:348 -
\??\c:\llrxlrl.exec:\llrxlrl.exe29⤵
- Executes dropped EXE
PID:896 -
\??\c:\ntbhbn.exec:\ntbhbn.exe30⤵
- Executes dropped EXE
PID:2956 -
\??\c:\jjjvp.exec:\jjjvp.exe31⤵
- Executes dropped EXE
PID:1240 -
\??\c:\vpjjj.exec:\vpjjj.exe32⤵
- Executes dropped EXE
PID:1576 -
\??\c:\btnbnh.exec:\btnbnh.exe33⤵
- Executes dropped EXE
PID:2796 -
\??\c:\9ttbtt.exec:\9ttbtt.exe34⤵
- Executes dropped EXE
PID:2068 -
\??\c:\jjvpp.exec:\jjvpp.exe35⤵
- Executes dropped EXE
PID:1592 -
\??\c:\3xllxfl.exec:\3xllxfl.exe36⤵
- Executes dropped EXE
PID:2744 -
\??\c:\tthnth.exec:\tthnth.exe37⤵
- Executes dropped EXE
PID:2964 -
\??\c:\3dvpj.exec:\3dvpj.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\fllxrxx.exec:\fllxrxx.exe39⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nhhnbn.exec:\nhhnbn.exe40⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hhbtth.exec:\hhbtth.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vjdjv.exec:\vjdjv.exe42⤵
- Executes dropped EXE
PID:2604 -
\??\c:\pvpjp.exec:\pvpjp.exe43⤵
- Executes dropped EXE
PID:2896 -
\??\c:\9lfrfrf.exec:\9lfrfrf.exe44⤵
- Executes dropped EXE
PID:272 -
\??\c:\hhbhbt.exec:\hhbhbt.exe45⤵
- Executes dropped EXE
PID:2668 -
\??\c:\bnhbbt.exec:\bnhbbt.exe46⤵
- Executes dropped EXE
PID:2756 -
\??\c:\vdvvj.exec:\vdvvj.exe47⤵
- Executes dropped EXE
PID:2192 -
\??\c:\fxlrxlx.exec:\fxlrxlx.exe48⤵
- Executes dropped EXE
PID:2976 -
\??\c:\ttthhb.exec:\ttthhb.exe49⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1tnhtt.exec:\1tnhtt.exe50⤵
- Executes dropped EXE
PID:2004 -
\??\c:\ddjvj.exec:\ddjvj.exe51⤵
- Executes dropped EXE
PID:1808 -
\??\c:\vvjjv.exec:\vvjjv.exe52⤵
- Executes dropped EXE
PID:280 -
\??\c:\9frrxxl.exec:\9frrxxl.exe53⤵
- Executes dropped EXE
PID:2880 -
\??\c:\hhbntn.exec:\hhbntn.exe54⤵
- Executes dropped EXE
PID:1752 -
\??\c:\nnhnhn.exec:\nnhnhn.exe55⤵
- Executes dropped EXE
PID:1816 -
\??\c:\jddjv.exec:\jddjv.exe56⤵
- Executes dropped EXE
PID:1804 -
\??\c:\llrfrfl.exec:\llrfrfl.exe57⤵
- Executes dropped EXE
PID:264 -
\??\c:\1xxxlxx.exec:\1xxxlxx.exe58⤵
- Executes dropped EXE
PID:644 -
\??\c:\bbnbnb.exec:\bbnbnb.exe59⤵
- Executes dropped EXE
PID:2740 -
\??\c:\7jddj.exec:\7jddj.exe60⤵
- Executes dropped EXE
PID:2140 -
\??\c:\xllrfrl.exec:\xllrfrl.exe61⤵
- Executes dropped EXE
PID:448 -
\??\c:\hthhnh.exec:\hthhnh.exe62⤵
- Executes dropped EXE
PID:3048 -
\??\c:\bttbhh.exec:\bttbhh.exe63⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jpdpd.exec:\jpdpd.exe64⤵
- Executes dropped EXE
PID:688 -
\??\c:\xrllfrf.exec:\xrllfrf.exe65⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nhbnbn.exec:\nhbnbn.exe66⤵PID:2000
-
\??\c:\ppdjd.exec:\ppdjd.exe67⤵PID:2016
-
\??\c:\dvpdp.exec:\dvpdp.exe68⤵PID:2372
-
\??\c:\rlxfllx.exec:\rlxfllx.exe69⤵PID:1184
-
\??\c:\hnbbnh.exec:\hnbbnh.exe70⤵PID:1776
-
\??\c:\vvjdv.exec:\vvjdv.exe71⤵PID:2152
-
\??\c:\jpjdv.exec:\jpjdv.exe72⤵PID:2932
-
\??\c:\rrfllfx.exec:\rrfllfx.exe73⤵PID:2680
-
\??\c:\nbbbhb.exec:\nbbbhb.exe74⤵PID:2476
-
\??\c:\bhbbbt.exec:\bhbbbt.exe75⤵PID:2672
-
\??\c:\djdvv.exec:\djdvv.exe76⤵PID:2732
-
\??\c:\pdjdd.exec:\pdjdd.exe77⤵PID:2632
-
\??\c:\5xrrxxf.exec:\5xrrxxf.exe78⤵PID:2892
-
\??\c:\hhnnhb.exec:\hhnnhb.exe79⤵PID:2604
-
\??\c:\ntbtbh.exec:\ntbtbh.exe80⤵PID:2896
-
\??\c:\ppjdd.exec:\ppjdd.exe81⤵PID:1572
-
\??\c:\5xrrxff.exec:\5xrrxff.exe82⤵PID:2708
-
\??\c:\rllllff.exec:\rllllff.exe83⤵PID:1212
-
\??\c:\hbbntn.exec:\hbbntn.exe84⤵PID:2208
-
\??\c:\nbtnnb.exec:\nbtnnb.exe85⤵PID:1748
-
\??\c:\pvdvv.exec:\pvdvv.exe86⤵PID:1644
-
\??\c:\ffllxxf.exec:\ffllxxf.exe87⤵PID:328
-
\??\c:\nbnbbn.exec:\nbnbbn.exe88⤵PID:1812
-
\??\c:\nnnttb.exec:\nnnttb.exe89⤵PID:280
-
\??\c:\pvpvj.exec:\pvpvj.exe90⤵PID:2880
-
\??\c:\9dpvj.exec:\9dpvj.exe91⤵PID:1752
-
\??\c:\xfxrrff.exec:\xfxrrff.exe92⤵PID:1844
-
\??\c:\nhbhth.exec:\nhbhth.exe93⤵PID:1804
-
\??\c:\5bthtb.exec:\5bthtb.exe94⤵PID:264
-
\??\c:\jjjvp.exec:\jjjvp.exe95⤵PID:644
-
\??\c:\frrfrfl.exec:\frrfrfl.exe96⤵PID:540
-
\??\c:\xxrrxxr.exec:\xxrrxxr.exe97⤵PID:1852
-
\??\c:\tbbnhb.exec:\tbbnhb.exe98⤵PID:3056
-
\??\c:\9pjpp.exec:\9pjpp.exe99⤵PID:768
-
\??\c:\pjdpv.exec:\pjdpv.exe100⤵PID:1792
-
\??\c:\flxxlrl.exec:\flxxlrl.exe101⤵PID:1632
-
\??\c:\bbtbth.exec:\bbtbth.exe102⤵PID:1296
-
\??\c:\9tnbnb.exec:\9tnbnb.exe103⤵PID:2308
-
\??\c:\jddpj.exec:\jddpj.exe104⤵PID:2016
-
\??\c:\pvdvj.exec:\pvdvj.exe105⤵PID:2144
-
\??\c:\flxllxr.exec:\flxllxr.exe106⤵PID:2876
-
\??\c:\bbhbbt.exec:\bbhbbt.exe107⤵PID:1776
-
\??\c:\3vvvp.exec:\3vvvp.exe108⤵PID:2152
-
\??\c:\ppppp.exec:\ppppp.exe109⤵PID:2932
-
\??\c:\xxflffx.exec:\xxflffx.exe110⤵PID:2704
-
\??\c:\tnbbbn.exec:\tnbbbn.exe111⤵PID:2492
-
\??\c:\bbbnth.exec:\bbbnth.exe112⤵PID:2728
-
\??\c:\djjpv.exec:\djjpv.exe113⤵PID:2464
-
\??\c:\7rffffr.exec:\7rffffr.exe114⤵PID:2472
-
\??\c:\bbtnbn.exec:\bbtnbn.exe115⤵PID:2872
-
\??\c:\jjdpd.exec:\jjdpd.exe116⤵PID:1664
-
\??\c:\jjpvv.exec:\jjpvv.exe117⤵PID:1556
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe118⤵PID:2124
-
\??\c:\rrfxrfl.exec:\rrfxrfl.exe119⤵PID:2620
-
\??\c:\nnhbht.exec:\nnhbht.exe120⤵PID:1640
-
\??\c:\vjjjv.exec:\vjjjv.exe121⤵PID:884
-
\??\c:\jvdvj.exec:\jvdvj.exe122⤵PID:2184
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-