Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 20:37
Static task
static1
Behavioral task
behavioral1
Sample
25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe
Resource
win7-20240903-en
General
-
Target
25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe
-
Size
66KB
-
MD5
b11198e1465010c9290fb7efe872e3a9
-
SHA1
3d8f120bcbf2edd336497cef282e066c0e3d2fea
-
SHA256
25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab
-
SHA512
de6841436df8f6252299d56b6c166bd081d2ac16843876289fb8bc1d9717c33d8c57a7a40a40e05cce0979c104a3e6589ee32a3b96340b87c1ef19a7ea47080e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzkzNMM:ymb3NkkiQ3mdBjFIvlpMM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2372-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3032-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2312-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2736-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7hthht.exevdvjj.exefxlxlrl.exehtbhnt.exenttnbh.exejppvj.exexlfrfrr.exexrrfrxx.exebthhnb.exethbnhh.exevpjvv.exeffxxrxl.exefrxfxxl.exetthnhh.exevvjdv.exejjjvj.exeffxlxxr.exelflrflx.exenthhtt.exedvddj.exexrflxxl.exerxrxxlr.exehthhtt.exe3vvjv.exejjjvv.exefrffxfl.exethtntb.exedddvd.exefxlllrx.exexllxxfr.exehbbhtt.exetnthbn.exeppjdd.exefxrxlll.exexrflrfr.exe9lxrxxf.exetnthhh.exe7thtbb.exe1dpvd.exe7dpjj.exe5xrxllx.exe3fffrlr.exehbttbn.exetntnbb.exevppjp.exe5jvvv.exeppvjd.exeflrxlxf.exerxffllr.exe7nbthb.exebtbhbt.exevpdjv.exevvvdj.exerlflllr.exerfrxrfr.exellrrrrx.exehbthtb.exettbttb.exepjvvd.exe5vpjj.exerfxflrf.exeffxllxr.exebthhbn.exebthbtt.exepid process 2372 7hthht.exe 2472 vdvjj.exe 2416 fxlxlrl.exe 3032 htbhnt.exe 2640 nttnbh.exe 2692 jppvj.exe 2652 xlfrfrr.exe 2556 xrrfrxx.exe 2820 bthhnb.exe 2608 thbnhh.exe 2180 vpjvv.exe 1980 ffxxrxl.exe 400 frxfxxl.exe 1996 tthnhh.exe 2336 vvjdv.exe 2312 jjjvj.exe 1716 ffxlxxr.exe 344 lflrflx.exe 1812 nthhtt.exe 2736 dvddj.exe 2740 xrflxxl.exe 2636 rxrxxlr.exe 1152 hthhtt.exe 844 3vvjv.exe 996 jjjvv.exe 2400 frffxfl.exe 1588 thtntb.exe 584 dddvd.exe 2148 fxlllrx.exe 1712 xllxxfr.exe 3060 hbbhtt.exe 1532 tnthbn.exe 2924 ppjdd.exe 2392 fxrxlll.exe 1072 xrflrfr.exe 1888 9lxrxxf.exe 2804 tnthhh.exe 2640 7thtbb.exe 2684 1dpvd.exe 2540 7dpjj.exe 2672 5xrxllx.exe 2832 3fffrlr.exe 2528 hbttbn.exe 2444 tntnbb.exe 2612 vppjp.exe 2552 5jvvv.exe 3068 ppvjd.exe 1948 flrxlxf.exe 2348 rxffllr.exe 1372 7nbthb.exe 1592 btbhbt.exe 1360 vpdjv.exe 1932 vvvdj.exe 1068 rlflllr.exe 2772 rfrxrfr.exe 2596 llrrrrx.exe 1724 hbthtb.exe 2908 ttbttb.exe 1468 pjvvd.exe 2776 5vpjj.exe 1728 rfxflrf.exe 1304 ffxllxr.exe 1436 bthhbn.exe 848 bthbtt.exe -
Processes:
resource yara_rule behavioral1/memory/2372-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3032-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2312-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2736-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-266-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
frlfflr.exerfrxxfr.exebhbhnh.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe7hthht.exevdvjj.exefxlxlrl.exehtbhnt.exenttnbh.exejppvj.exexlfrfrr.exexrrfrxx.exebthhnb.exethbnhh.exevpjvv.exeffxxrxl.exefrxfxxl.exetthnhh.exevvjdv.exedescription pid process target process PID 3048 wrote to memory of 2372 3048 25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe 7hthht.exe PID 3048 wrote to memory of 2372 3048 25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe 7hthht.exe PID 3048 wrote to memory of 2372 3048 25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe 7hthht.exe PID 3048 wrote to memory of 2372 3048 25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe 7hthht.exe PID 2372 wrote to memory of 2472 2372 7hthht.exe vdvjj.exe PID 2372 wrote to memory of 2472 2372 7hthht.exe vdvjj.exe PID 2372 wrote to memory of 2472 2372 7hthht.exe vdvjj.exe PID 2372 wrote to memory of 2472 2372 7hthht.exe vdvjj.exe PID 2472 wrote to memory of 2416 2472 vdvjj.exe fxlxlrl.exe PID 2472 wrote to memory of 2416 2472 vdvjj.exe fxlxlrl.exe PID 2472 wrote to memory of 2416 2472 vdvjj.exe fxlxlrl.exe PID 2472 wrote to memory of 2416 2472 vdvjj.exe fxlxlrl.exe PID 2416 wrote to memory of 3032 2416 fxlxlrl.exe htbhnt.exe PID 2416 wrote to memory of 3032 2416 fxlxlrl.exe htbhnt.exe PID 2416 wrote to memory of 3032 2416 fxlxlrl.exe htbhnt.exe PID 2416 wrote to memory of 3032 2416 fxlxlrl.exe htbhnt.exe PID 3032 wrote to memory of 2640 3032 htbhnt.exe nttnbh.exe PID 3032 wrote to memory of 2640 3032 htbhnt.exe nttnbh.exe PID 3032 wrote to memory of 2640 3032 htbhnt.exe nttnbh.exe PID 3032 wrote to memory of 2640 3032 htbhnt.exe nttnbh.exe PID 2640 wrote to memory of 2692 2640 nttnbh.exe jppvj.exe PID 2640 wrote to memory of 2692 2640 nttnbh.exe jppvj.exe PID 2640 wrote to memory of 2692 2640 nttnbh.exe jppvj.exe PID 2640 wrote to memory of 2692 2640 nttnbh.exe jppvj.exe PID 2692 wrote to memory of 2652 2692 jppvj.exe xlfrfrr.exe PID 2692 wrote to memory of 2652 2692 jppvj.exe xlfrfrr.exe PID 2692 wrote to memory of 2652 2692 jppvj.exe xlfrfrr.exe PID 2692 wrote to memory of 2652 2692 jppvj.exe xlfrfrr.exe PID 2652 wrote to memory of 2556 2652 xlfrfrr.exe xrrfrxx.exe PID 2652 wrote to memory of 2556 2652 xlfrfrr.exe xrrfrxx.exe PID 2652 wrote to memory of 2556 2652 xlfrfrr.exe xrrfrxx.exe PID 2652 wrote to memory of 2556 2652 xlfrfrr.exe xrrfrxx.exe PID 2556 wrote to memory of 2820 2556 xrrfrxx.exe bthhnb.exe PID 2556 wrote to memory of 2820 2556 xrrfrxx.exe bthhnb.exe PID 2556 wrote to memory of 2820 2556 xrrfrxx.exe bthhnb.exe PID 2556 wrote to memory of 2820 2556 xrrfrxx.exe bthhnb.exe PID 2820 wrote to memory of 2608 2820 bthhnb.exe thbnhh.exe PID 2820 wrote to memory of 2608 2820 bthhnb.exe thbnhh.exe PID 2820 wrote to memory of 2608 2820 bthhnb.exe thbnhh.exe PID 2820 wrote to memory of 2608 2820 bthhnb.exe thbnhh.exe PID 2608 wrote to memory of 2180 2608 thbnhh.exe vpjvv.exe PID 2608 wrote to memory of 2180 2608 thbnhh.exe vpjvv.exe PID 2608 wrote to memory of 2180 2608 thbnhh.exe vpjvv.exe PID 2608 wrote to memory of 2180 2608 thbnhh.exe vpjvv.exe PID 2180 wrote to memory of 1980 2180 vpjvv.exe ffxxrxl.exe PID 2180 wrote to memory of 1980 2180 vpjvv.exe ffxxrxl.exe PID 2180 wrote to memory of 1980 2180 vpjvv.exe ffxxrxl.exe PID 2180 wrote to memory of 1980 2180 vpjvv.exe ffxxrxl.exe PID 1980 wrote to memory of 400 1980 ffxxrxl.exe frxfxxl.exe PID 1980 wrote to memory of 400 1980 ffxxrxl.exe frxfxxl.exe PID 1980 wrote to memory of 400 1980 ffxxrxl.exe frxfxxl.exe PID 1980 wrote to memory of 400 1980 ffxxrxl.exe frxfxxl.exe PID 400 wrote to memory of 1996 400 frxfxxl.exe tthnhh.exe PID 400 wrote to memory of 1996 400 frxfxxl.exe tthnhh.exe PID 400 wrote to memory of 1996 400 frxfxxl.exe tthnhh.exe PID 400 wrote to memory of 1996 400 frxfxxl.exe tthnhh.exe PID 1996 wrote to memory of 2336 1996 tthnhh.exe vvjdv.exe PID 1996 wrote to memory of 2336 1996 tthnhh.exe vvjdv.exe PID 1996 wrote to memory of 2336 1996 tthnhh.exe vvjdv.exe PID 1996 wrote to memory of 2336 1996 tthnhh.exe vvjdv.exe PID 2336 wrote to memory of 2312 2336 vvjdv.exe jjjvj.exe PID 2336 wrote to memory of 2312 2336 vvjdv.exe jjjvj.exe PID 2336 wrote to memory of 2312 2336 vvjdv.exe jjjvj.exe PID 2336 wrote to memory of 2312 2336 vvjdv.exe jjjvj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe"C:\Users\Admin\AppData\Local\Temp\25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\7hthht.exec:\7hthht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\vdvjj.exec:\vdvjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\fxlxlrl.exec:\fxlxlrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\htbhnt.exec:\htbhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\nttnbh.exec:\nttnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\jppvj.exec:\jppvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\xlfrfrr.exec:\xlfrfrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\xrrfrxx.exec:\xrrfrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\bthhnb.exec:\bthhnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\thbnhh.exec:\thbnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\vpjvv.exec:\vpjvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\ffxxrxl.exec:\ffxxrxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\frxfxxl.exec:\frxfxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\tthnhh.exec:\tthnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\vvjdv.exec:\vvjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\jjjvj.exec:\jjjvj.exe17⤵
- Executes dropped EXE
PID:2312 -
\??\c:\ffxlxxr.exec:\ffxlxxr.exe18⤵
- Executes dropped EXE
PID:1716 -
\??\c:\lflrflx.exec:\lflrflx.exe19⤵
- Executes dropped EXE
PID:344 -
\??\c:\nthhtt.exec:\nthhtt.exe20⤵
- Executes dropped EXE
PID:1812 -
\??\c:\dvddj.exec:\dvddj.exe21⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xrflxxl.exec:\xrflxxl.exe22⤵
- Executes dropped EXE
PID:2740 -
\??\c:\rxrxxlr.exec:\rxrxxlr.exe23⤵
- Executes dropped EXE
PID:2636 -
\??\c:\hthhtt.exec:\hthhtt.exe24⤵
- Executes dropped EXE
PID:1152 -
\??\c:\3vvjv.exec:\3vvjv.exe25⤵
- Executes dropped EXE
PID:844 -
\??\c:\jjjvv.exec:\jjjvv.exe26⤵
- Executes dropped EXE
PID:996 -
\??\c:\frffxfl.exec:\frffxfl.exe27⤵
- Executes dropped EXE
PID:2400 -
\??\c:\thtntb.exec:\thtntb.exe28⤵
- Executes dropped EXE
PID:1588 -
\??\c:\dddvd.exec:\dddvd.exe29⤵
- Executes dropped EXE
PID:584 -
\??\c:\fxlllrx.exec:\fxlllrx.exe30⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xllxxfr.exec:\xllxxfr.exe31⤵
- Executes dropped EXE
PID:1712 -
\??\c:\hbbhtt.exec:\hbbhtt.exe32⤵
- Executes dropped EXE
PID:3060 -
\??\c:\tnthbn.exec:\tnthbn.exe33⤵
- Executes dropped EXE
PID:1532 -
\??\c:\ppjdd.exec:\ppjdd.exe34⤵
- Executes dropped EXE
PID:2924 -
\??\c:\fxrxlll.exec:\fxrxlll.exe35⤵
- Executes dropped EXE
PID:2392 -
\??\c:\xrflrfr.exec:\xrflrfr.exe36⤵
- Executes dropped EXE
PID:1072 -
\??\c:\9lxrxxf.exec:\9lxrxxf.exe37⤵
- Executes dropped EXE
PID:1888 -
\??\c:\tnthhh.exec:\tnthhh.exe38⤵
- Executes dropped EXE
PID:2804 -
\??\c:\7thtbb.exec:\7thtbb.exe39⤵
- Executes dropped EXE
PID:2640 -
\??\c:\1dpvd.exec:\1dpvd.exe40⤵
- Executes dropped EXE
PID:2684 -
\??\c:\7dpjj.exec:\7dpjj.exe41⤵
- Executes dropped EXE
PID:2540 -
\??\c:\5xrxllx.exec:\5xrxllx.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\3fffrlr.exec:\3fffrlr.exe43⤵
- Executes dropped EXE
PID:2832 -
\??\c:\hbttbn.exec:\hbttbn.exe44⤵
- Executes dropped EXE
PID:2528 -
\??\c:\tntnbb.exec:\tntnbb.exe45⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vppjp.exec:\vppjp.exe46⤵
- Executes dropped EXE
PID:2612 -
\??\c:\5jvvv.exec:\5jvvv.exe47⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ppvjd.exec:\ppvjd.exe48⤵
- Executes dropped EXE
PID:3068 -
\??\c:\flrxlxf.exec:\flrxlxf.exe49⤵
- Executes dropped EXE
PID:1948 -
\??\c:\rxffllr.exec:\rxffllr.exe50⤵
- Executes dropped EXE
PID:2348 -
\??\c:\7nbthb.exec:\7nbthb.exe51⤵
- Executes dropped EXE
PID:1372 -
\??\c:\btbhbt.exec:\btbhbt.exe52⤵
- Executes dropped EXE
PID:1592 -
\??\c:\vpdjv.exec:\vpdjv.exe53⤵
- Executes dropped EXE
PID:1360 -
\??\c:\vvvdj.exec:\vvvdj.exe54⤵
- Executes dropped EXE
PID:1932 -
\??\c:\rlflllr.exec:\rlflllr.exe55⤵
- Executes dropped EXE
PID:1068 -
\??\c:\rfrxrfr.exec:\rfrxrfr.exe56⤵
- Executes dropped EXE
PID:2772 -
\??\c:\llrrrrx.exec:\llrrrrx.exe57⤵
- Executes dropped EXE
PID:2596 -
\??\c:\hbthtb.exec:\hbthtb.exe58⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ttbttb.exec:\ttbttb.exe59⤵
- Executes dropped EXE
PID:2908 -
\??\c:\pjvvd.exec:\pjvvd.exe60⤵
- Executes dropped EXE
PID:1468 -
\??\c:\5vpjj.exec:\5vpjj.exe61⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rfxflrf.exec:\rfxflrf.exe62⤵
- Executes dropped EXE
PID:1728 -
\??\c:\ffxllxr.exec:\ffxllxr.exe63⤵
- Executes dropped EXE
PID:1304 -
\??\c:\bthhbn.exec:\bthhbn.exe64⤵
- Executes dropped EXE
PID:1436 -
\??\c:\bthbtt.exec:\bthbtt.exe65⤵
- Executes dropped EXE
PID:848 -
\??\c:\jvjpv.exec:\jvjpv.exe66⤵PID:2208
-
\??\c:\7pddj.exec:\7pddj.exe67⤵PID:2140
-
\??\c:\vjppv.exec:\vjppv.exe68⤵PID:936
-
\??\c:\xrfflrf.exec:\xrfflrf.exe69⤵PID:576
-
\??\c:\3rflxxx.exec:\3rflxxx.exe70⤵PID:784
-
\??\c:\bnhhhh.exec:\bnhhhh.exe71⤵PID:2152
-
\??\c:\htbntb.exec:\htbntb.exe72⤵PID:1792
-
\??\c:\htbhtb.exec:\htbhtb.exe73⤵PID:2380
-
\??\c:\9jddj.exec:\9jddj.exe74⤵PID:2396
-
\??\c:\7dppp.exec:\7dppp.exe75⤵PID:2924
-
\??\c:\lfrxlxl.exec:\lfrxlxl.exe76⤵PID:2392
-
\??\c:\lxlrfxl.exec:\lxlrfxl.exe77⤵PID:1072
-
\??\c:\nnbhnh.exec:\nnbhnh.exe78⤵PID:2056
-
\??\c:\pdjpd.exec:\pdjpd.exe79⤵PID:2936
-
\??\c:\jdjjv.exec:\jdjjv.exe80⤵PID:2816
-
\??\c:\9xxrrxf.exec:\9xxrrxf.exe81⤵PID:2836
-
\??\c:\9tbbth.exec:\9tbbth.exe82⤵PID:2868
-
\??\c:\thbbbt.exec:\thbbbt.exe83⤵PID:3064
-
\??\c:\jvjvd.exec:\jvjvd.exe84⤵PID:2592
-
\??\c:\rxfflfl.exec:\rxfflfl.exe85⤵PID:2580
-
\??\c:\7lxfrrf.exec:\7lxfrrf.exe86⤵PID:688
-
\??\c:\1lxflrf.exec:\1lxflrf.exe87⤵PID:1128
-
\??\c:\nhtbnt.exec:\nhtbnt.exe88⤵PID:1744
-
\??\c:\hthntb.exec:\hthntb.exe89⤵PID:3068
-
\??\c:\jdvjp.exec:\jdvjp.exe90⤵PID:708
-
\??\c:\rlffrlr.exec:\rlffrlr.exe91⤵PID:1364
-
\??\c:\1ffflrr.exec:\1ffflrr.exe92⤵PID:2308
-
\??\c:\hbttnt.exec:\hbttnt.exe93⤵PID:1592
-
\??\c:\vdjpj.exec:\vdjpj.exe94⤵PID:1704
-
\??\c:\pdppp.exec:\pdppp.exe95⤵PID:1904
-
\??\c:\lfxllrr.exec:\lfxllrr.exe96⤵PID:2744
-
\??\c:\fxrllfl.exec:\fxrllfl.exe97⤵PID:2756
-
\??\c:\hnhhnn.exec:\hnhhnn.exe98⤵PID:2712
-
\??\c:\3dvpv.exec:\3dvpv.exe99⤵PID:2952
-
\??\c:\pdjjj.exec:\pdjjj.exe100⤵PID:2136
-
\??\c:\7dpjj.exec:\7dpjj.exe101⤵PID:2636
-
\??\c:\xfxrffl.exec:\xfxrffl.exe102⤵PID:1560
-
\??\c:\rrlxfff.exec:\rrlxfff.exe103⤵PID:1928
-
\??\c:\btbhnn.exec:\btbhnn.exe104⤵PID:1180
-
\??\c:\nhbnbh.exec:\nhbnbh.exe105⤵PID:272
-
\??\c:\dvpvd.exec:\dvpvd.exe106⤵PID:2288
-
\??\c:\xllrrxl.exec:\xllrrxl.exe107⤵PID:2248
-
\??\c:\rllrxxr.exec:\rllrxxr.exe108⤵PID:584
-
\??\c:\7nhthb.exec:\7nhthb.exe109⤵PID:892
-
\??\c:\3bbbtb.exec:\3bbbtb.exe110⤵PID:2116
-
\??\c:\djvvv.exec:\djvvv.exe111⤵PID:1528
-
\??\c:\xlxxffx.exec:\xlxxffx.exe112⤵PID:1972
-
\??\c:\btnnht.exec:\btnnht.exe113⤵PID:1500
-
\??\c:\bnttnt.exec:\bnttnt.exe114⤵PID:2616
-
\??\c:\9vjpp.exec:\9vjpp.exe115⤵PID:1856
-
\??\c:\dpjpv.exec:\dpjpv.exe116⤵PID:2752
-
\??\c:\7xrflrr.exec:\7xrflrr.exe117⤵PID:3032
-
\??\c:\fxlrrxx.exec:\fxlrrxx.exe118⤵PID:2788
-
\??\c:\btbhbt.exec:\btbhbt.exe119⤵PID:2644
-
\??\c:\tbttbh.exec:\tbttbh.exe120⤵PID:2676
-
\??\c:\bbnttn.exec:\bbnttn.exe121⤵PID:2696
-
\??\c:\ppdvv.exec:\ppdvv.exe122⤵PID:2196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-