Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03-05-2024 21:30
Behavioral task
behavioral1
Sample
4c6b50afc7759605ef9c7de7655f50a360a8b9e269cbf029cc40554b7bc15063.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
4c6b50afc7759605ef9c7de7655f50a360a8b9e269cbf029cc40554b7bc15063.exe
-
Size
185KB
-
MD5
1c08e3717aa730854c5f4bc299c8ae25
-
SHA1
1a33707b47a79ba6be08311128ab592632f77994
-
SHA256
4c6b50afc7759605ef9c7de7655f50a360a8b9e269cbf029cc40554b7bc15063
-
SHA512
0bbcd8d6ac74079912ac1b40b3cd90a44c79e05ed900c2375ac92f6aa812d5d7f3f161ba774e0f4c31186cf9510d49c670913e06ff7abc77edb0ff8d4859fdc1
-
SSDEEP
3072:3hOmTsF93UYfwC6GIoutw8YcvrqrE66kropO6BWlPFH4tw1D43eMz:3cm4FmowdHoSzhraHcpOFltH4twl43vz
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4944-9-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3864-16-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3832-19-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4400-25-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3468-37-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4024-31-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1164-5-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4860-47-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3088-54-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4420-49-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3060-71-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4864-77-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3108-90-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3092-92-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2432-98-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1516-104-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1308-113-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3084-120-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2704-126-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3076-132-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3676-134-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3104-149-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3472-157-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2828-185-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2920-184-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1492-198-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4828-197-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4328-205-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4464-220-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4024-224-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3848-231-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5000-241-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3944-248-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4368-268-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1060-274-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4492-284-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/8-295-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3516-304-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1132-311-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1936-315-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3220-340-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2220-364-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4400-385-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4420-404-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2396-411-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4228-425-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2352-459-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3228-466-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3664-482-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1968-492-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3780-506-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/544-534-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1324-536-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1952-539-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4228-562-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2216-586-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3376-646-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/720-685-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3472-742-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4900-793-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4612-889-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4332-892-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2432-942-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1164-1037-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1164-0-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\lxxlxrl.exe UPX behavioral2/memory/4944-9-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\bhnhnh.exe UPX behavioral2/memory/3864-16-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/3832-19-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\dppjd.exe UPX behavioral2/memory/4400-25-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\vpjvj.exe UPX \??\c:\ffflfxr.exe UPX behavioral2/memory/3468-37-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/4024-31-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\hhhbnh.exe UPX behavioral2/memory/1164-5-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\frxrllf.exe UPX behavioral2/memory/4860-47-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\frrfxrf.exe UPX \??\c:\bnnhtn.exe UPX behavioral2/memory/3088-54-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\tnnbnh.exe UPX behavioral2/memory/2392-59-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/4420-49-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\rflxrlf.exe UPX C:\nhhtnn.exe UPX behavioral2/memory/3060-71-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/4864-72-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/4864-77-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\jpvpv.exe UPX behavioral2/memory/4168-79-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\frxfxrf.exe UPX \??\c:\hnbtnh.exe UPX behavioral2/memory/3108-90-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/3092-92-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\9vpjp.exe UPX behavioral2/memory/2432-98-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\9llxllx.exe UPX behavioral2/memory/1516-104-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\7nbtbt.exe UPX behavioral2/memory/1308-110-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/1308-113-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\nnbthb.exe UPX C:\jddvd.exe UPX behavioral2/memory/3084-120-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\xrrrflf.exe UPX behavioral2/memory/2704-126-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/3076-132-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\djvpj.exe UPX behavioral2/memory/3676-134-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\3jpjj.exe UPX C:\ntbhtn.exe UPX behavioral2/memory/3104-149-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\3bbttn.exe UPX \??\c:\7dvjv.exe UPX behavioral2/memory/3472-157-0x0000000000400000-0x0000000000432000-memory.dmp UPX C:\rxrfxrf.exe UPX C:\hhnhtn.exe UPX C:\bhbtnh.exe UPX C:\jjjvj.exe UPX C:\7llxlfx.exe UPX behavioral2/memory/2828-185-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/2920-184-0x0000000000400000-0x0000000000432000-memory.dmp UPX \??\c:\thbnbb.exe UPX behavioral2/memory/4828-192-0x0000000000400000-0x0000000000432000-memory.dmp UPX behavioral2/memory/1492-198-0x0000000000400000-0x0000000000432000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
lxxlxrl.exebhnhnh.exehhhbnh.exedppjd.exevpjvj.exeffflfxr.exefrxrllf.exefrrfxrf.exebnnhtn.exetnnbnh.exerflxrlf.exenhhtnn.exejpvpv.exefrxfxrf.exehnbtnh.exe9vpjp.exe9llxllx.exe7nbtbt.exennbthb.exejddvd.exexrrrflf.exedjvpj.exe3jpjj.exentbhtn.exe3bbttn.exe7dvjv.exerxrfxrf.exehhnhtn.exebhbtnh.exejjjvj.exe7llxlfx.exethbnbb.exedjjjv.exe9xfrlfx.exethbtnh.exehhtnhh.exevvppd.exe5djvj.exelfxrflf.exerrxllff.exe5tthbt.exeddpvj.exelfrlxrf.exefflrfrl.exevvjpv.exejpvvj.exerxfxxrr.exexlfxlfr.exe3tnhhb.exebtthnh.exepjdvj.exevpvvp.exe9rflxrx.exenbhbtn.exehhhbnh.exejjdvd.exe5ppjv.exexrrfffx.exe1nnbtn.exenhnnhh.exevppdp.exevjdvj.exe3lfrfxl.exe7xffxxr.exepid process 4944 lxxlxrl.exe 3864 bhnhnh.exe 3832 hhhbnh.exe 4400 dppjd.exe 4024 vpjvj.exe 3468 ffflfxr.exe 4860 frxrllf.exe 4420 frrfxrf.exe 3088 bnnhtn.exe 2392 tnnbnh.exe 3060 rflxrlf.exe 4864 nhhtnn.exe 4168 jpvpv.exe 3108 frxfxrf.exe 3092 hnbtnh.exe 2432 9vpjp.exe 1516 9llxllx.exe 1308 7nbtbt.exe 3084 nnbthb.exe 2704 jddvd.exe 3076 xrrrflf.exe 3676 djvpj.exe 3228 3jpjj.exe 3104 ntbhtn.exe 3132 3bbttn.exe 3472 7dvjv.exe 4340 rxrfxrf.exe 2184 hhnhtn.exe 5084 bhbtnh.exe 2920 jjjvj.exe 2828 7llxlfx.exe 2856 thbnbb.exe 4828 djjjv.exe 1492 9xfrlfx.exe 1532 thbtnh.exe 4328 hhtnhh.exe 2148 vvppd.exe 3196 5djvj.exe 4080 lfxrflf.exe 4464 rrxllff.exe 4916 5tthbt.exe 4024 ddpvj.exe 3848 lfrlxrf.exe 1784 fflrfrl.exe 4764 vvjpv.exe 5000 jpvvj.exe 4420 rxfxxrr.exe 3944 xlfxlfr.exe 640 3tnhhb.exe 3908 btthnh.exe 5060 pjdvj.exe 3088 vpvvp.exe 2452 9rflxrx.exe 4228 nbhbtn.exe 4368 hhhbnh.exe 1060 jjdvd.exe 1544 5ppjv.exe 2320 xrrfffx.exe 4492 1nnbtn.exe 916 nhnnhh.exe 1308 vppdp.exe 1696 vjdvj.exe 8 3lfrfxl.exe 1484 7xffxxr.exe -
Processes:
resource yara_rule behavioral2/memory/1164-0-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\lxxlxrl.exe upx behavioral2/memory/4944-9-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\bhnhnh.exe upx behavioral2/memory/3864-16-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3832-19-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\dppjd.exe upx behavioral2/memory/4400-25-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\vpjvj.exe upx \??\c:\ffflfxr.exe upx behavioral2/memory/3468-37-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4024-31-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\hhhbnh.exe upx behavioral2/memory/1164-5-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\frxrllf.exe upx behavioral2/memory/4860-47-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\frrfxrf.exe upx \??\c:\bnnhtn.exe upx behavioral2/memory/3088-54-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\tnnbnh.exe upx behavioral2/memory/2392-59-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4420-49-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\rflxrlf.exe upx C:\nhhtnn.exe upx behavioral2/memory/3060-71-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4864-72-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4864-77-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\jpvpv.exe upx behavioral2/memory/4168-79-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\frxfxrf.exe upx \??\c:\hnbtnh.exe upx behavioral2/memory/3108-90-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3092-92-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\9vpjp.exe upx behavioral2/memory/2432-98-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\9llxllx.exe upx behavioral2/memory/1516-104-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\7nbtbt.exe upx behavioral2/memory/1308-110-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/1308-113-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\nnbthb.exe upx C:\jddvd.exe upx behavioral2/memory/3084-120-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\xrrrflf.exe upx behavioral2/memory/2704-126-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3076-132-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\djvpj.exe upx behavioral2/memory/3676-134-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\3jpjj.exe upx C:\ntbhtn.exe upx behavioral2/memory/3104-149-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\3bbttn.exe upx \??\c:\7dvjv.exe upx behavioral2/memory/3472-157-0x0000000000400000-0x0000000000432000-memory.dmp upx C:\rxrfxrf.exe upx C:\hhnhtn.exe upx C:\bhbtnh.exe upx C:\jjjvj.exe upx C:\7llxlfx.exe upx behavioral2/memory/2828-185-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/2920-184-0x0000000000400000-0x0000000000432000-memory.dmp upx \??\c:\thbnbb.exe upx behavioral2/memory/4828-192-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/1492-198-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4c6b50afc7759605ef9c7de7655f50a360a8b9e269cbf029cc40554b7bc15063.exelxxlxrl.exebhnhnh.exehhhbnh.exedppjd.exevpjvj.exeffflfxr.exefrxrllf.exefrrfxrf.exebnnhtn.exetnnbnh.exerflxrlf.exenhhtnn.exejpvpv.exefrxfxrf.exehnbtnh.exe9vpjp.exe9llxllx.exe7nbtbt.exennbthb.exejddvd.exexrrrflf.exedescription pid process target process PID 1164 wrote to memory of 4944 1164 4c6b50afc7759605ef9c7de7655f50a360a8b9e269cbf029cc40554b7bc15063.exe lxxlxrl.exe PID 1164 wrote to memory of 4944 1164 4c6b50afc7759605ef9c7de7655f50a360a8b9e269cbf029cc40554b7bc15063.exe lxxlxrl.exe PID 1164 wrote to memory of 4944 1164 4c6b50afc7759605ef9c7de7655f50a360a8b9e269cbf029cc40554b7bc15063.exe lxxlxrl.exe PID 4944 wrote to memory of 3864 4944 lxxlxrl.exe bhnhnh.exe PID 4944 wrote to memory of 3864 4944 lxxlxrl.exe bhnhnh.exe PID 4944 wrote to memory of 3864 4944 lxxlxrl.exe bhnhnh.exe PID 3864 wrote to memory of 3832 3864 bhnhnh.exe hhhbnh.exe PID 3864 wrote to memory of 3832 3864 bhnhnh.exe hhhbnh.exe PID 3864 wrote to memory of 3832 3864 bhnhnh.exe hhhbnh.exe PID 3832 wrote to memory of 4400 3832 hhhbnh.exe dppjd.exe PID 3832 wrote to memory of 4400 3832 hhhbnh.exe dppjd.exe PID 3832 wrote to memory of 4400 3832 hhhbnh.exe dppjd.exe PID 4400 wrote to memory of 4024 4400 dppjd.exe vpjvj.exe PID 4400 wrote to memory of 4024 4400 dppjd.exe vpjvj.exe PID 4400 wrote to memory of 4024 4400 dppjd.exe vpjvj.exe PID 4024 wrote to memory of 3468 4024 vpjvj.exe ffflfxr.exe PID 4024 wrote to memory of 3468 4024 vpjvj.exe ffflfxr.exe PID 4024 wrote to memory of 3468 4024 vpjvj.exe ffflfxr.exe PID 3468 wrote to memory of 4860 3468 ffflfxr.exe frxrllf.exe PID 3468 wrote to memory of 4860 3468 ffflfxr.exe frxrllf.exe PID 3468 wrote to memory of 4860 3468 ffflfxr.exe frxrllf.exe PID 4860 wrote to memory of 4420 4860 frxrllf.exe frrfxrf.exe PID 4860 wrote to memory of 4420 4860 frxrllf.exe frrfxrf.exe PID 4860 wrote to memory of 4420 4860 frxrllf.exe frrfxrf.exe PID 4420 wrote to memory of 3088 4420 frrfxrf.exe bnnhtn.exe PID 4420 wrote to memory of 3088 4420 frrfxrf.exe bnnhtn.exe PID 4420 wrote to memory of 3088 4420 frrfxrf.exe bnnhtn.exe PID 3088 wrote to memory of 2392 3088 bnnhtn.exe tnnbnh.exe PID 3088 wrote to memory of 2392 3088 bnnhtn.exe tnnbnh.exe PID 3088 wrote to memory of 2392 3088 bnnhtn.exe tnnbnh.exe PID 2392 wrote to memory of 3060 2392 tnnbnh.exe rflxrlf.exe PID 2392 wrote to memory of 3060 2392 tnnbnh.exe rflxrlf.exe PID 2392 wrote to memory of 3060 2392 tnnbnh.exe rflxrlf.exe PID 3060 wrote to memory of 4864 3060 rflxrlf.exe nhhtnn.exe PID 3060 wrote to memory of 4864 3060 rflxrlf.exe nhhtnn.exe PID 3060 wrote to memory of 4864 3060 rflxrlf.exe nhhtnn.exe PID 4864 wrote to memory of 4168 4864 nhhtnn.exe jpvpv.exe PID 4864 wrote to memory of 4168 4864 nhhtnn.exe jpvpv.exe PID 4864 wrote to memory of 4168 4864 nhhtnn.exe jpvpv.exe PID 4168 wrote to memory of 3108 4168 jpvpv.exe frxfxrf.exe PID 4168 wrote to memory of 3108 4168 jpvpv.exe frxfxrf.exe PID 4168 wrote to memory of 3108 4168 jpvpv.exe frxfxrf.exe PID 3108 wrote to memory of 3092 3108 frxfxrf.exe hnbtnh.exe PID 3108 wrote to memory of 3092 3108 frxfxrf.exe hnbtnh.exe PID 3108 wrote to memory of 3092 3108 frxfxrf.exe hnbtnh.exe PID 3092 wrote to memory of 2432 3092 hnbtnh.exe 9vpjp.exe PID 3092 wrote to memory of 2432 3092 hnbtnh.exe 9vpjp.exe PID 3092 wrote to memory of 2432 3092 hnbtnh.exe 9vpjp.exe PID 2432 wrote to memory of 1516 2432 9vpjp.exe 9llxllx.exe PID 2432 wrote to memory of 1516 2432 9vpjp.exe 9llxllx.exe PID 2432 wrote to memory of 1516 2432 9vpjp.exe 9llxllx.exe PID 1516 wrote to memory of 1308 1516 9llxllx.exe 7nbtbt.exe PID 1516 wrote to memory of 1308 1516 9llxllx.exe 7nbtbt.exe PID 1516 wrote to memory of 1308 1516 9llxllx.exe 7nbtbt.exe PID 1308 wrote to memory of 3084 1308 7nbtbt.exe nnbthb.exe PID 1308 wrote to memory of 3084 1308 7nbtbt.exe nnbthb.exe PID 1308 wrote to memory of 3084 1308 7nbtbt.exe nnbthb.exe PID 3084 wrote to memory of 2704 3084 nnbthb.exe jddvd.exe PID 3084 wrote to memory of 2704 3084 nnbthb.exe jddvd.exe PID 3084 wrote to memory of 2704 3084 nnbthb.exe jddvd.exe PID 2704 wrote to memory of 3076 2704 jddvd.exe xrrrflf.exe PID 2704 wrote to memory of 3076 2704 jddvd.exe xrrrflf.exe PID 2704 wrote to memory of 3076 2704 jddvd.exe xrrrflf.exe PID 3076 wrote to memory of 3676 3076 xrrrflf.exe djvpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c6b50afc7759605ef9c7de7655f50a360a8b9e269cbf029cc40554b7bc15063.exe"C:\Users\Admin\AppData\Local\Temp\4c6b50afc7759605ef9c7de7655f50a360a8b9e269cbf029cc40554b7bc15063.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\lxxlxrl.exec:\lxxlxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhnhnh.exec:\bhnhnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhbnh.exec:\hhhbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dppjd.exec:\dppjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjvj.exec:\vpjvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffflfxr.exec:\ffflfxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frxrllf.exec:\frxrllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frrfxrf.exec:\frrfxrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnnhtn.exec:\bnnhtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnnbnh.exec:\tnnbnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rflxrlf.exec:\rflxrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhtnn.exec:\nhhtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpvpv.exec:\jpvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frxfxrf.exec:\frxfxrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnbtnh.exec:\hnbtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9vpjp.exec:\9vpjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9llxllx.exec:\9llxllx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7nbtbt.exec:\7nbtbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnbthb.exec:\nnbthb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jddvd.exec:\jddvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrrrflf.exec:\xrrrflf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djvpj.exec:\djvpj.exe23⤵
- Executes dropped EXE
-
\??\c:\3jpjj.exec:\3jpjj.exe24⤵
- Executes dropped EXE
-
\??\c:\ntbhtn.exec:\ntbhtn.exe25⤵
- Executes dropped EXE
-
\??\c:\3bbttn.exec:\3bbttn.exe26⤵
- Executes dropped EXE
-
\??\c:\7dvjv.exec:\7dvjv.exe27⤵
- Executes dropped EXE
-
\??\c:\rxrfxrf.exec:\rxrfxrf.exe28⤵
- Executes dropped EXE
-
\??\c:\hhnhtn.exec:\hhnhtn.exe29⤵
- Executes dropped EXE
-
\??\c:\bhbtnh.exec:\bhbtnh.exe30⤵
- Executes dropped EXE
-
\??\c:\jjjvj.exec:\jjjvj.exe31⤵
- Executes dropped EXE
-
\??\c:\7llxlfx.exec:\7llxlfx.exe32⤵
- Executes dropped EXE
-
\??\c:\thbnbb.exec:\thbnbb.exe33⤵
- Executes dropped EXE
-
\??\c:\djjjv.exec:\djjjv.exe34⤵
- Executes dropped EXE
-
\??\c:\9xfrlfx.exec:\9xfrlfx.exe35⤵
- Executes dropped EXE
-
\??\c:\thbtnh.exec:\thbtnh.exe36⤵
- Executes dropped EXE
-
\??\c:\hhtnhh.exec:\hhtnhh.exe37⤵
- Executes dropped EXE
-
\??\c:\vvppd.exec:\vvppd.exe38⤵
- Executes dropped EXE
-
\??\c:\5djvj.exec:\5djvj.exe39⤵
- Executes dropped EXE
-
\??\c:\lfxrflf.exec:\lfxrflf.exe40⤵
- Executes dropped EXE
-
\??\c:\rrxllff.exec:\rrxllff.exe41⤵
- Executes dropped EXE
-
\??\c:\5tthbt.exec:\5tthbt.exe42⤵
- Executes dropped EXE
-
\??\c:\ddpvj.exec:\ddpvj.exe43⤵
- Executes dropped EXE
-
\??\c:\lfrlxrf.exec:\lfrlxrf.exe44⤵
- Executes dropped EXE
-
\??\c:\fflrfrl.exec:\fflrfrl.exe45⤵
- Executes dropped EXE
-
\??\c:\vvjpv.exec:\vvjpv.exe46⤵
- Executes dropped EXE
-
\??\c:\jpvvj.exec:\jpvvj.exe47⤵
- Executes dropped EXE
-
\??\c:\rxfxxrr.exec:\rxfxxrr.exe48⤵
- Executes dropped EXE
-
\??\c:\xlfxlfr.exec:\xlfxlfr.exe49⤵
- Executes dropped EXE
-
\??\c:\3tnhhb.exec:\3tnhhb.exe50⤵
- Executes dropped EXE
-
\??\c:\btthnh.exec:\btthnh.exe51⤵
- Executes dropped EXE
-
\??\c:\pjdvj.exec:\pjdvj.exe52⤵
- Executes dropped EXE
-
\??\c:\vpvvp.exec:\vpvvp.exe53⤵
- Executes dropped EXE
-
\??\c:\9rflxrx.exec:\9rflxrx.exe54⤵
- Executes dropped EXE
-
\??\c:\nbhbtn.exec:\nbhbtn.exe55⤵
- Executes dropped EXE
-
\??\c:\hhhbnh.exec:\hhhbnh.exe56⤵
- Executes dropped EXE
-
\??\c:\jjdvd.exec:\jjdvd.exe57⤵
- Executes dropped EXE
-
\??\c:\5ppjv.exec:\5ppjv.exe58⤵
- Executes dropped EXE
-
\??\c:\xrrfffx.exec:\xrrfffx.exe59⤵
- Executes dropped EXE
-
\??\c:\1nnbtn.exec:\1nnbtn.exe60⤵
- Executes dropped EXE
-
\??\c:\nhnnhh.exec:\nhnnhh.exe61⤵
- Executes dropped EXE
-
\??\c:\vppdp.exec:\vppdp.exe62⤵
- Executes dropped EXE
-
\??\c:\vjdvj.exec:\vjdvj.exe63⤵
- Executes dropped EXE
-
\??\c:\3lfrfxl.exec:\3lfrfxl.exe64⤵
- Executes dropped EXE
-
\??\c:\7xffxxr.exec:\7xffxxr.exe65⤵
- Executes dropped EXE
-
\??\c:\3thbbh.exec:\3thbbh.exe66⤵
-
\??\c:\hhbtnn.exec:\hhbtnn.exe67⤵
-
\??\c:\ppdvp.exec:\ppdvp.exe68⤵
-
\??\c:\rxrlxrl.exec:\rxrlxrl.exe69⤵
-
\??\c:\httthh.exec:\httthh.exe70⤵
-
\??\c:\tbbbht.exec:\tbbbht.exe71⤵
-
\??\c:\pvvvp.exec:\pvvvp.exe72⤵
-
\??\c:\djjdp.exec:\djjdp.exe73⤵
-
\??\c:\rxrlxlx.exec:\rxrlxlx.exe74⤵
-
\??\c:\rllxfrl.exec:\rllxfrl.exe75⤵
-
\??\c:\thbtnh.exec:\thbtnh.exe76⤵
-
\??\c:\dpdjd.exec:\dpdjd.exe77⤵
-
\??\c:\vppjd.exec:\vppjd.exe78⤵
-
\??\c:\lrrfxfx.exec:\lrrfxfx.exe79⤵
-
\??\c:\lrxfrlf.exec:\lrxfrlf.exe80⤵
-
\??\c:\7nnbth.exec:\7nnbth.exe81⤵
-
\??\c:\vjdpd.exec:\vjdpd.exe82⤵
-
\??\c:\7lrlxrl.exec:\7lrlxrl.exe83⤵
-
\??\c:\htnhtt.exec:\htnhtt.exe84⤵
-
\??\c:\bnhhbt.exec:\bnhhbt.exe85⤵
-
\??\c:\dvvjv.exec:\dvvjv.exe86⤵
-
\??\c:\pjdjv.exec:\pjdjv.exe87⤵
-
\??\c:\lfxrffx.exec:\lfxrffx.exe88⤵
-
\??\c:\bbbthb.exec:\bbbthb.exe89⤵
-
\??\c:\hbhthn.exec:\hbhthn.exe90⤵
-
\??\c:\7jjdv.exec:\7jjdv.exe91⤵
-
\??\c:\5jjvj.exec:\5jjvj.exe92⤵
-
\??\c:\xrfrrll.exec:\xrfrrll.exe93⤵
-
\??\c:\frlfffr.exec:\frlfffr.exe94⤵
-
\??\c:\7ttnbb.exec:\7ttnbb.exe95⤵
-
\??\c:\3pddp.exec:\3pddp.exe96⤵
-
\??\c:\rfllxfx.exec:\rfllxfx.exe97⤵
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe98⤵
-
\??\c:\tnhthh.exec:\tnhthh.exe99⤵
-
\??\c:\bbttnn.exec:\bbttnn.exe100⤵
-
\??\c:\5vpdp.exec:\5vpdp.exe101⤵
-
\??\c:\1jjvv.exec:\1jjvv.exe102⤵
-
\??\c:\rlfxllr.exec:\rlfxllr.exe103⤵
-
\??\c:\nhhbnh.exec:\nhhbnh.exe104⤵
-
\??\c:\jdpvp.exec:\jdpvp.exe105⤵
-
\??\c:\vjdvp.exec:\vjdvp.exe106⤵
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe107⤵
-
\??\c:\rflffxf.exec:\rflffxf.exe108⤵
-
\??\c:\nhnnhb.exec:\nhnnhb.exe109⤵
-
\??\c:\hhtnbt.exec:\hhtnbt.exe110⤵
-
\??\c:\ddppd.exec:\ddppd.exe111⤵
-
\??\c:\djjdv.exec:\djjdv.exe112⤵
-
\??\c:\9lfrffr.exec:\9lfrffr.exe113⤵
-
\??\c:\frrlfxr.exec:\frrlfxr.exe114⤵
-
\??\c:\nnhtnh.exec:\nnhtnh.exe115⤵
-
\??\c:\1nnbnh.exec:\1nnbnh.exe116⤵
-
\??\c:\9jvjv.exec:\9jvjv.exe117⤵
-
\??\c:\rflrxxl.exec:\rflrxxl.exe118⤵
-
\??\c:\9bbtbb.exec:\9bbtbb.exe119⤵
-
\??\c:\5htnhn.exec:\5htnhn.exe120⤵
-
\??\c:\7jjdv.exec:\7jjdv.exe121⤵
-
\??\c:\7pjdv.exec:\7pjdv.exe122⤵
-
\??\c:\7rrlrlf.exec:\7rrlrlf.exe123⤵
-
\??\c:\7htnnh.exec:\7htnnh.exe124⤵
-
\??\c:\nnnbnn.exec:\nnnbnn.exe125⤵
-
\??\c:\1xxlxxr.exec:\1xxlxxr.exe126⤵
-
\??\c:\bnnhbb.exec:\bnnhbb.exe127⤵
-
\??\c:\3hhbnn.exec:\3hhbnn.exe128⤵
-
\??\c:\jpjdv.exec:\jpjdv.exe129⤵
-
\??\c:\pppdj.exec:\pppdj.exe130⤵
-
\??\c:\xrfxlfr.exec:\xrfxlfr.exe131⤵
-
\??\c:\ttnhtt.exec:\ttnhtt.exe132⤵
-
\??\c:\3bnhhb.exec:\3bnhhb.exe133⤵
-
\??\c:\htnntn.exec:\htnntn.exe134⤵
-
\??\c:\pvpjp.exec:\pvpjp.exe135⤵
-
\??\c:\jjvpv.exec:\jjvpv.exe136⤵
-
\??\c:\rlllxfx.exec:\rlllxfx.exe137⤵
-
\??\c:\lrlxrlf.exec:\lrlxrlf.exe138⤵
-
\??\c:\nbhtnh.exec:\nbhtnh.exe139⤵
-
\??\c:\vvvdj.exec:\vvvdj.exe140⤵
-
\??\c:\llfxrrl.exec:\llfxrrl.exe141⤵
-
\??\c:\xrfrllf.exec:\xrfrllf.exe142⤵
-
\??\c:\flllfxr.exec:\flllfxr.exe143⤵
-
\??\c:\nbbnbt.exec:\nbbnbt.exe144⤵
-
\??\c:\thnbnn.exec:\thnbnn.exe145⤵
-
\??\c:\dddvp.exec:\dddvp.exe146⤵
-
\??\c:\lfffflf.exec:\lfffflf.exe147⤵
-
\??\c:\7xxrllx.exec:\7xxrllx.exe148⤵
-
\??\c:\tnnhtt.exec:\tnnhtt.exe149⤵
-
\??\c:\vdddp.exec:\vdddp.exe150⤵
-
\??\c:\vjpdd.exec:\vjpdd.exe151⤵
-
\??\c:\lflflfl.exec:\lflflfl.exe152⤵
-
\??\c:\hbhbnt.exec:\hbhbnt.exe153⤵
-
\??\c:\7vddv.exec:\7vddv.exe154⤵
-
\??\c:\ppvpd.exec:\ppvpd.exe155⤵
-
\??\c:\xrrlrll.exec:\xrrlrll.exe156⤵
-
\??\c:\xxxrrxf.exec:\xxxrrxf.exe157⤵
-
\??\c:\nhbnhb.exec:\nhbnhb.exe158⤵
-
\??\c:\djvvp.exec:\djvvp.exe159⤵
-
\??\c:\7pdvd.exec:\7pdvd.exe160⤵
-
\??\c:\3ffrlrx.exec:\3ffrlrx.exe161⤵
-
\??\c:\tnttbb.exec:\tnttbb.exe162⤵
-
\??\c:\bhhbtn.exec:\bhhbtn.exe163⤵
-
\??\c:\pjdpd.exec:\pjdpd.exe164⤵
-
\??\c:\vppdj.exec:\vppdj.exe165⤵
-
\??\c:\5llxlxl.exec:\5llxlxl.exe166⤵
-
\??\c:\7bbthb.exec:\7bbthb.exe167⤵
-
\??\c:\hhntnt.exec:\hhntnt.exe168⤵
-
\??\c:\ppddd.exec:\ppddd.exe169⤵
-
\??\c:\3xxrxxr.exec:\3xxrxxr.exe170⤵
-
\??\c:\3lrxxxr.exec:\3lrxxxr.exe171⤵
-
\??\c:\hhtnbn.exec:\hhtnbn.exe172⤵
-
\??\c:\djdvj.exec:\djdvj.exe173⤵
-
\??\c:\ppvpj.exec:\ppvpj.exe174⤵
-
\??\c:\frxrrrl.exec:\frxrrrl.exe175⤵
-
\??\c:\7xfxlff.exec:\7xfxlff.exe176⤵
-
\??\c:\tthbtn.exec:\tthbtn.exe177⤵
-
\??\c:\bnnnbt.exec:\bnnnbt.exe178⤵
-
\??\c:\5djpj.exec:\5djpj.exe179⤵
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe180⤵
-
\??\c:\lrrrlfx.exec:\lrrrlfx.exe181⤵
-
\??\c:\nhnhhb.exec:\nhnhhb.exe182⤵
-
\??\c:\bnntnh.exec:\bnntnh.exe183⤵
-
\??\c:\ddjdp.exec:\ddjdp.exe184⤵
-
\??\c:\xxxfxfr.exec:\xxxfxfr.exe185⤵
-
\??\c:\rxffrxr.exec:\rxffrxr.exe186⤵
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe187⤵
-
\??\c:\nnhbnn.exec:\nnhbnn.exe188⤵
-
\??\c:\5vpjd.exec:\5vpjd.exe189⤵
-
\??\c:\7vdvj.exec:\7vdvj.exe190⤵
-
\??\c:\1djdp.exec:\1djdp.exe191⤵
-
\??\c:\rxxlrrx.exec:\rxxlrrx.exe192⤵
-
\??\c:\nbtnht.exec:\nbtnht.exe193⤵
-
\??\c:\hnnbtn.exec:\hnnbtn.exe194⤵
-
\??\c:\dvvjj.exec:\dvvjj.exe195⤵
-
\??\c:\pvpjj.exec:\pvpjj.exe196⤵
-
\??\c:\7rfxxlf.exec:\7rfxxlf.exe197⤵
-
\??\c:\nbnhhb.exec:\nbnhhb.exe198⤵
-
\??\c:\bthnhh.exec:\bthnhh.exe199⤵
-
\??\c:\pvvvd.exec:\pvvvd.exe200⤵
-
\??\c:\5lrfxrf.exec:\5lrfxrf.exe201⤵
-
\??\c:\xxfxxrl.exec:\xxfxxrl.exe202⤵
-
\??\c:\nhhbnh.exec:\nhhbnh.exe203⤵
-
\??\c:\bnthhn.exec:\bnthhn.exe204⤵
-
\??\c:\3vdvp.exec:\3vdvp.exe205⤵
-
\??\c:\jdjvp.exec:\jdjvp.exe206⤵
-
\??\c:\lffrffr.exec:\lffrffr.exe207⤵
-
\??\c:\tntnnh.exec:\tntnnh.exe208⤵
-
\??\c:\ttbthh.exec:\ttbthh.exe209⤵
-
\??\c:\vvpjd.exec:\vvpjd.exe210⤵
-
\??\c:\xxxlxxr.exec:\xxxlxxr.exe211⤵
-
\??\c:\rflfrlf.exec:\rflfrlf.exe212⤵
-
\??\c:\1tbtnn.exec:\1tbtnn.exe213⤵
-
\??\c:\nhbthh.exec:\nhbthh.exe214⤵
-
\??\c:\vvdvj.exec:\vvdvj.exe215⤵
-
\??\c:\5ppdp.exec:\5ppdp.exe216⤵
-
\??\c:\lrxlllf.exec:\lrxlllf.exe217⤵
-
\??\c:\xxxrlfr.exec:\xxxrlfr.exe218⤵
-
\??\c:\3nbbnn.exec:\3nbbnn.exe219⤵
-
\??\c:\dvvpp.exec:\dvvpp.exe220⤵
-
\??\c:\vpjjv.exec:\vpjjv.exe221⤵
-
\??\c:\lfxrrrl.exec:\lfxrrrl.exe222⤵
-
\??\c:\rrrxrfx.exec:\rrrxrfx.exe223⤵
-
\??\c:\ttbtnt.exec:\ttbtnt.exe224⤵
-
\??\c:\9jjvj.exec:\9jjvj.exe225⤵
-
\??\c:\vpjvp.exec:\vpjvp.exe226⤵
-
\??\c:\xxrflfl.exec:\xxrflfl.exe227⤵
-
\??\c:\9frffxx.exec:\9frffxx.exe228⤵
-
\??\c:\bttnnh.exec:\bttnnh.exe229⤵
-
\??\c:\hhhtnn.exec:\hhhtnn.exe230⤵
-
\??\c:\jdvjv.exec:\jdvjv.exe231⤵
-
\??\c:\lxrlfff.exec:\lxrlfff.exe232⤵
-
\??\c:\lrrlxxl.exec:\lrrlxxl.exe233⤵
-
\??\c:\btbhbt.exec:\btbhbt.exe234⤵
-
\??\c:\bntnbt.exec:\bntnbt.exe235⤵
-
\??\c:\pjdvd.exec:\pjdvd.exe236⤵
-
\??\c:\jjvdp.exec:\jjvdp.exe237⤵
-
\??\c:\xlllxxr.exec:\xlllxxr.exe238⤵
-
\??\c:\5hhhhn.exec:\5hhhhn.exe239⤵
-
\??\c:\tthhbt.exec:\tthhbt.exe240⤵
-
\??\c:\thhtnh.exec:\thhtnh.exe241⤵