Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 11:18
Static task
static1
Behavioral task
behavioral1
Sample
ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe
Resource
win7-20240903-en
General
-
Target
ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe
-
Size
75KB
-
MD5
f0985b9122826e1f02a9b5c048e6eee4
-
SHA1
78296346200467974c34120e7d6ea37842c079c1
-
SHA256
ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7
-
SHA512
148b7583855d3c68365ecbd98499f2c6c4fe4959eace5111bb07a2894d81b8e57d2dfade487418bb0abc2fd96a6125556bd2a86273fef7eab01a82a4c76bd51c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmsL:ymb3NkkiQ3mdBjFIvl358nLA89OMFVH1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2128-11-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1456-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1592-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/916-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rlfrlxf.exebhtbht.exeppdjd.exelfxfrxl.exennnhtt.exenhntbh.exevjppv.exefrrxlxf.exebbhhtt.exe9jddp.exefxrxllx.exe1xxrxxf.exenhttbt.exettbhbn.exe1pppv.exevdjdp.exerrxfrxf.exetnbhnn.exe3htbhn.exejvjpd.exedpjjd.exelfffllr.exehhhthb.exe3bhttn.exehtbhtn.exevjvvp.exevpjjj.exelfllrrf.exettnbhh.exepjvvj.exejdpvj.exe1lffrxf.exexffrfxr.exebthtbn.exebthhnt.exe1pvdp.exepvjjp.exerlxlffl.exebtbbbh.exe9btttb.exetnhnnh.exepddvd.exe5frrrxf.exellxfrrf.exe9tnttt.exenhnthh.exehbhhnt.exe1djjj.exe9pddd.exe9xllllr.exe3ffllrf.exenhnthn.exehhhbbh.exejdvdj.exe7dvdj.exepjdjv.exefxrrflr.exelfrxrxf.exehbntbh.exe1nhnnn.exeppvdp.exe7jppp.exefxflllr.exerrlxlrr.exepid process 1964 rlfrlxf.exe 2396 bhtbht.exe 2660 ppdjd.exe 2824 lfxfrxl.exe 2856 nnnhtt.exe 2572 nhntbh.exe 2724 vjppv.exe 2720 frrxlxf.exe 836 bbhhtt.exe 2888 9jddp.exe 776 fxrxllx.exe 1456 1xxrxxf.exe 2808 nhttbt.exe 1592 ttbhbn.exe 1628 1pppv.exe 2968 vdjdp.exe 2168 rrxfrxf.exe 2192 tnbhnn.exe 916 3htbhn.exe 1252 jvjpd.exe 2516 dpjjd.exe 1312 lfffllr.exe 1620 hhhthb.exe 904 3bhttn.exe 1468 htbhtn.exe 984 vjvvp.exe 1564 vpjjj.exe 2332 lfllrrf.exe 1532 ttnbhh.exe 2988 pjvvj.exe 1904 jdpvj.exe 1020 1lffrxf.exe 1864 xffrfxr.exe 2772 bthtbn.exe 2824 bthhnt.exe 2856 1pvdp.exe 2652 pvjjp.exe 2560 rlxlffl.exe 2672 btbbbh.exe 2568 9btttb.exe 2536 tnhnnh.exe 2352 pddvd.exe 2512 5frrrxf.exe 2928 llxfrrf.exe 2804 9tnttt.exe 2896 nhnthh.exe 2808 hbhhnt.exe 2084 1djjj.exe 1440 9pddd.exe 3060 9xllllr.exe 2968 3ffllrf.exe 2232 nhnthn.exe 2056 hhhbbh.exe 916 jdvdj.exe 1224 7dvdj.exe 1252 pjdjv.exe 2388 fxrrflr.exe 1368 lfrxrxf.exe 1956 hbntbh.exe 2520 1nhnnn.exe 1316 ppvdp.exe 1724 7jppp.exe 1784 fxflllr.exe 2020 rrlxlrr.exe -
Processes:
resource yara_rule behavioral1/memory/2128-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2128-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1456-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1592-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/916-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2332-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-304-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
lfrrxxf.exe1lfflrx.exeddpdj.exebhtbnt.exevvvdp.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exerlfrlxf.exebhtbht.exeppdjd.exelfxfrxl.exennnhtt.exenhntbh.exevjppv.exefrrxlxf.exebbhhtt.exe9jddp.exefxrxllx.exe1xxrxxf.exenhttbt.exettbhbn.exe1pppv.exedescription pid process target process PID 2128 wrote to memory of 1964 2128 ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe rlfrlxf.exe PID 2128 wrote to memory of 1964 2128 ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe rlfrlxf.exe PID 2128 wrote to memory of 1964 2128 ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe rlfrlxf.exe PID 2128 wrote to memory of 1964 2128 ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe rlfrlxf.exe PID 1964 wrote to memory of 2396 1964 rlfrlxf.exe bhtbht.exe PID 1964 wrote to memory of 2396 1964 rlfrlxf.exe bhtbht.exe PID 1964 wrote to memory of 2396 1964 rlfrlxf.exe bhtbht.exe PID 1964 wrote to memory of 2396 1964 rlfrlxf.exe bhtbht.exe PID 2396 wrote to memory of 2660 2396 bhtbht.exe ppdjd.exe PID 2396 wrote to memory of 2660 2396 bhtbht.exe ppdjd.exe PID 2396 wrote to memory of 2660 2396 bhtbht.exe ppdjd.exe PID 2396 wrote to memory of 2660 2396 bhtbht.exe ppdjd.exe PID 2660 wrote to memory of 2824 2660 ppdjd.exe lfxfrxl.exe PID 2660 wrote to memory of 2824 2660 ppdjd.exe lfxfrxl.exe PID 2660 wrote to memory of 2824 2660 ppdjd.exe lfxfrxl.exe PID 2660 wrote to memory of 2824 2660 ppdjd.exe lfxfrxl.exe PID 2824 wrote to memory of 2856 2824 lfxfrxl.exe nnnhtt.exe PID 2824 wrote to memory of 2856 2824 lfxfrxl.exe nnnhtt.exe PID 2824 wrote to memory of 2856 2824 lfxfrxl.exe nnnhtt.exe PID 2824 wrote to memory of 2856 2824 lfxfrxl.exe nnnhtt.exe PID 2856 wrote to memory of 2572 2856 nnnhtt.exe nhntbh.exe PID 2856 wrote to memory of 2572 2856 nnnhtt.exe nhntbh.exe PID 2856 wrote to memory of 2572 2856 nnnhtt.exe nhntbh.exe PID 2856 wrote to memory of 2572 2856 nnnhtt.exe nhntbh.exe PID 2572 wrote to memory of 2724 2572 nhntbh.exe vjppv.exe PID 2572 wrote to memory of 2724 2572 nhntbh.exe vjppv.exe PID 2572 wrote to memory of 2724 2572 nhntbh.exe vjppv.exe PID 2572 wrote to memory of 2724 2572 nhntbh.exe vjppv.exe PID 2724 wrote to memory of 2720 2724 vjppv.exe frrxlxf.exe PID 2724 wrote to memory of 2720 2724 vjppv.exe frrxlxf.exe PID 2724 wrote to memory of 2720 2724 vjppv.exe frrxlxf.exe PID 2724 wrote to memory of 2720 2724 vjppv.exe frrxlxf.exe PID 2720 wrote to memory of 836 2720 frrxlxf.exe bbhhtt.exe PID 2720 wrote to memory of 836 2720 frrxlxf.exe bbhhtt.exe PID 2720 wrote to memory of 836 2720 frrxlxf.exe bbhhtt.exe PID 2720 wrote to memory of 836 2720 frrxlxf.exe bbhhtt.exe PID 836 wrote to memory of 2888 836 bbhhtt.exe 9jddp.exe PID 836 wrote to memory of 2888 836 bbhhtt.exe 9jddp.exe PID 836 wrote to memory of 2888 836 bbhhtt.exe 9jddp.exe PID 836 wrote to memory of 2888 836 bbhhtt.exe 9jddp.exe PID 2888 wrote to memory of 776 2888 9jddp.exe fxrxllx.exe PID 2888 wrote to memory of 776 2888 9jddp.exe fxrxllx.exe PID 2888 wrote to memory of 776 2888 9jddp.exe fxrxllx.exe PID 2888 wrote to memory of 776 2888 9jddp.exe fxrxllx.exe PID 776 wrote to memory of 1456 776 fxrxllx.exe 1xxrxxf.exe PID 776 wrote to memory of 1456 776 fxrxllx.exe 1xxrxxf.exe PID 776 wrote to memory of 1456 776 fxrxllx.exe 1xxrxxf.exe PID 776 wrote to memory of 1456 776 fxrxllx.exe 1xxrxxf.exe PID 1456 wrote to memory of 2808 1456 1xxrxxf.exe nhttbt.exe PID 1456 wrote to memory of 2808 1456 1xxrxxf.exe nhttbt.exe PID 1456 wrote to memory of 2808 1456 1xxrxxf.exe nhttbt.exe PID 1456 wrote to memory of 2808 1456 1xxrxxf.exe nhttbt.exe PID 2808 wrote to memory of 1592 2808 nhttbt.exe ttbhbn.exe PID 2808 wrote to memory of 1592 2808 nhttbt.exe ttbhbn.exe PID 2808 wrote to memory of 1592 2808 nhttbt.exe ttbhbn.exe PID 2808 wrote to memory of 1592 2808 nhttbt.exe ttbhbn.exe PID 1592 wrote to memory of 1628 1592 ttbhbn.exe 1pppv.exe PID 1592 wrote to memory of 1628 1592 ttbhbn.exe 1pppv.exe PID 1592 wrote to memory of 1628 1592 ttbhbn.exe 1pppv.exe PID 1592 wrote to memory of 1628 1592 ttbhbn.exe 1pppv.exe PID 1628 wrote to memory of 2968 1628 1pppv.exe vdjdp.exe PID 1628 wrote to memory of 2968 1628 1pppv.exe vdjdp.exe PID 1628 wrote to memory of 2968 1628 1pppv.exe vdjdp.exe PID 1628 wrote to memory of 2968 1628 1pppv.exe vdjdp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe"C:\Users\Admin\AppData\Local\Temp\ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\rlfrlxf.exec:\rlfrlxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\bhtbht.exec:\bhtbht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\ppdjd.exec:\ppdjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\nnnhtt.exec:\nnnhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\nhntbh.exec:\nhntbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\vjppv.exec:\vjppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\frrxlxf.exec:\frrxlxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\bbhhtt.exec:\bbhhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\9jddp.exec:\9jddp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\fxrxllx.exec:\fxrxllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\1xxrxxf.exec:\1xxrxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\nhttbt.exec:\nhttbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\ttbhbn.exec:\ttbhbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\1pppv.exec:\1pppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\vdjdp.exec:\vdjdp.exe17⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rrxfrxf.exec:\rrxfrxf.exe18⤵
- Executes dropped EXE
PID:2168 -
\??\c:\tnbhnn.exec:\tnbhnn.exe19⤵
- Executes dropped EXE
PID:2192 -
\??\c:\3htbhn.exec:\3htbhn.exe20⤵
- Executes dropped EXE
PID:916 -
\??\c:\jvjpd.exec:\jvjpd.exe21⤵
- Executes dropped EXE
PID:1252 -
\??\c:\dpjjd.exec:\dpjjd.exe22⤵
- Executes dropped EXE
PID:2516 -
\??\c:\lfffllr.exec:\lfffllr.exe23⤵
- Executes dropped EXE
PID:1312 -
\??\c:\hhhthb.exec:\hhhthb.exe24⤵
- Executes dropped EXE
PID:1620 -
\??\c:\3bhttn.exec:\3bhttn.exe25⤵
- Executes dropped EXE
PID:904 -
\??\c:\htbhtn.exec:\htbhtn.exe26⤵
- Executes dropped EXE
PID:1468 -
\??\c:\vjvvp.exec:\vjvvp.exe27⤵
- Executes dropped EXE
PID:984 -
\??\c:\vpjjj.exec:\vpjjj.exe28⤵
- Executes dropped EXE
PID:1564 -
\??\c:\lfllrrf.exec:\lfllrrf.exe29⤵
- Executes dropped EXE
PID:2332 -
\??\c:\ttnbhh.exec:\ttnbhh.exe30⤵
- Executes dropped EXE
PID:1532 -
\??\c:\pjvvj.exec:\pjvvj.exe31⤵
- Executes dropped EXE
PID:2988 -
\??\c:\jdpvj.exec:\jdpvj.exe32⤵
- Executes dropped EXE
PID:1904 -
\??\c:\1lffrxf.exec:\1lffrxf.exe33⤵
- Executes dropped EXE
PID:1020 -
\??\c:\xffrfxr.exec:\xffrfxr.exe34⤵
- Executes dropped EXE
PID:1864 -
\??\c:\bthtbn.exec:\bthtbn.exe35⤵
- Executes dropped EXE
PID:2772 -
\??\c:\bthhnt.exec:\bthhnt.exe36⤵
- Executes dropped EXE
PID:2824 -
\??\c:\1pvdp.exec:\1pvdp.exe37⤵
- Executes dropped EXE
PID:2856 -
\??\c:\pvjjp.exec:\pvjjp.exe38⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rlxlffl.exec:\rlxlffl.exe39⤵
- Executes dropped EXE
PID:2560 -
\??\c:\btbbbh.exec:\btbbbh.exe40⤵
- Executes dropped EXE
PID:2672 -
\??\c:\9btttb.exec:\9btttb.exe41⤵
- Executes dropped EXE
PID:2568 -
\??\c:\tnhnnh.exec:\tnhnnh.exe42⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pddvd.exec:\pddvd.exe43⤵
- Executes dropped EXE
PID:2352 -
\??\c:\5frrrxf.exec:\5frrrxf.exe44⤵
- Executes dropped EXE
PID:2512 -
\??\c:\llxfrrf.exec:\llxfrrf.exe45⤵
- Executes dropped EXE
PID:2928 -
\??\c:\9tnttt.exec:\9tnttt.exe46⤵
- Executes dropped EXE
PID:2804 -
\??\c:\nhnthh.exec:\nhnthh.exe47⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hbhhnt.exec:\hbhhnt.exe48⤵
- Executes dropped EXE
PID:2808 -
\??\c:\1djjj.exec:\1djjj.exe49⤵
- Executes dropped EXE
PID:2084 -
\??\c:\9pddd.exec:\9pddd.exe50⤵
- Executes dropped EXE
PID:1440 -
\??\c:\9xllllr.exec:\9xllllr.exe51⤵
- Executes dropped EXE
PID:3060 -
\??\c:\3ffllrf.exec:\3ffllrf.exe52⤵
- Executes dropped EXE
PID:2968 -
\??\c:\nhnthn.exec:\nhnthn.exe53⤵
- Executes dropped EXE
PID:2232 -
\??\c:\hhhbbh.exec:\hhhbbh.exe54⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jdvdj.exec:\jdvdj.exe55⤵
- Executes dropped EXE
PID:916 -
\??\c:\7dvdj.exec:\7dvdj.exe56⤵
- Executes dropped EXE
PID:1224 -
\??\c:\pjdjv.exec:\pjdjv.exe57⤵
- Executes dropped EXE
PID:1252 -
\??\c:\fxrrflr.exec:\fxrrflr.exe58⤵
- Executes dropped EXE
PID:2388 -
\??\c:\lfrxrxf.exec:\lfrxrxf.exe59⤵
- Executes dropped EXE
PID:1368 -
\??\c:\hbntbh.exec:\hbntbh.exe60⤵
- Executes dropped EXE
PID:1956 -
\??\c:\1nhnnn.exec:\1nhnnn.exe61⤵
- Executes dropped EXE
PID:2520 -
\??\c:\ppvdp.exec:\ppvdp.exe62⤵
- Executes dropped EXE
PID:1316 -
\??\c:\7jppp.exec:\7jppp.exe63⤵
- Executes dropped EXE
PID:1724 -
\??\c:\fxflllr.exec:\fxflllr.exe64⤵
- Executes dropped EXE
PID:1784 -
\??\c:\rrlxlrr.exec:\rrlxlrr.exe65⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nnnbht.exec:\nnnbht.exe66⤵PID:2200
-
\??\c:\dvjjp.exec:\dvjjp.exe67⤵PID:2064
-
\??\c:\lfxlrfr.exec:\lfxlrfr.exe68⤵PID:1532
-
\??\c:\ffxxrxl.exec:\ffxxrxl.exe69⤵PID:2988
-
\??\c:\btnbhn.exec:\btnbhn.exe70⤵PID:1664
-
\??\c:\3bbhnn.exec:\3bbhnn.exe71⤵PID:2700
-
\??\c:\5vpdj.exec:\5vpdj.exe72⤵PID:2708
-
\??\c:\ppddj.exec:\ppddj.exe73⤵PID:2760
-
\??\c:\rfxlfxl.exec:\rfxlfxl.exe74⤵PID:2764
-
\??\c:\1xrflrl.exec:\1xrflrl.exe75⤵PID:2796
-
\??\c:\nnhnth.exec:\nnhnth.exe76⤵PID:2776
-
\??\c:\nbhtbb.exec:\nbhtbb.exe77⤵PID:2604
-
\??\c:\7ppvj.exec:\7ppvj.exe78⤵PID:2548
-
\??\c:\7pjpv.exec:\7pjpv.exe79⤵PID:2672
-
\??\c:\1xxlxlx.exec:\1xxlxlx.exe80⤵PID:2944
-
\??\c:\tnttbb.exec:\tnttbb.exe81⤵PID:2016
-
\??\c:\tnnntb.exec:\tnnntb.exe82⤵PID:2888
-
\??\c:\dvdjp.exec:\dvdjp.exe83⤵PID:236
-
\??\c:\djvdp.exec:\djvdp.exe84⤵PID:2296
-
\??\c:\3lxflrx.exec:\3lxflrx.exe85⤵PID:2816
-
\??\c:\llxlflr.exec:\llxlflr.exe86⤵PID:1612
-
\??\c:\5nhbht.exec:\5nhbht.exe87⤵PID:2912
-
\??\c:\nhbnbb.exec:\nhbnbb.exe88⤵PID:2084
-
\??\c:\3jpvd.exec:\3jpvd.exe89⤵PID:1440
-
\??\c:\pdpvv.exec:\pdpvv.exe90⤵PID:1208
-
\??\c:\lllrrxf.exec:\lllrrxf.exe91⤵PID:556
-
\??\c:\rrflxll.exec:\rrflxll.exe92⤵PID:2176
-
\??\c:\hbnntt.exec:\hbnntt.exe93⤵PID:1408
-
\??\c:\bhtnbn.exec:\bhtnbn.exe94⤵PID:916
-
\??\c:\dpddd.exec:\dpddd.exe95⤵PID:1300
-
\??\c:\jdjjv.exec:\jdjjv.exe96⤵PID:1556
-
\??\c:\lfrrflx.exec:\lfrrflx.exe97⤵PID:2032
-
\??\c:\9rlrxfx.exec:\9rlrxfx.exe98⤵PID:2276
-
\??\c:\hthnbh.exec:\hthnbh.exe99⤵PID:884
-
\??\c:\bthntb.exec:\bthntb.exe100⤵PID:1152
-
\??\c:\ddvpp.exec:\ddvpp.exe101⤵PID:2208
-
\??\c:\pjdjp.exec:\pjdjp.exe102⤵PID:1724
-
\??\c:\pjppv.exec:\pjppv.exe103⤵PID:2320
-
\??\c:\lflrrlr.exec:\lflrrlr.exe104⤵PID:2332
-
\??\c:\xrlxrxr.exec:\xrlxrxr.exe105⤵PID:1964
-
\??\c:\httbhb.exec:\httbhb.exe106⤵PID:2644
-
\??\c:\vjvpp.exec:\vjvpp.exe107⤵PID:1868
-
\??\c:\ppjpd.exec:\ppjpd.exe108⤵PID:2768
-
\??\c:\3dpjj.exec:\3dpjj.exe109⤵PID:2416
-
\??\c:\rrffrrf.exec:\rrffrrf.exe110⤵PID:3016
-
\??\c:\rrxllxf.exec:\rrxllxf.exe111⤵PID:2660
-
\??\c:\hhbnhb.exec:\hhbnhb.exe112⤵PID:2800
-
\??\c:\tntnnh.exec:\tntnnh.exe113⤵PID:2576
-
\??\c:\5jjjv.exec:\5jjjv.exe114⤵PID:1212
-
\??\c:\pjppv.exec:\pjppv.exe115⤵PID:2160
-
\??\c:\frffffl.exec:\frffffl.exe116⤵PID:2220
-
\??\c:\xfrxlxl.exec:\xfrxlxl.exe117⤵PID:1984
-
\??\c:\ttthhb.exec:\ttthhb.exe118⤵PID:2104
-
\??\c:\ppdjp.exec:\ppdjp.exe119⤵PID:788
-
\??\c:\jdjjv.exec:\jdjjv.exe120⤵PID:2068
-
\??\c:\1frrfff.exec:\1frrfff.exe121⤵PID:336
-
\??\c:\lfxfffr.exec:\lfxfffr.exe122⤵PID:2900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-