Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03-05-2024 21:45
Behavioral task
behavioral1
Sample
51da46dde0b6a298f9d8c90c7d75fb0c9a5301ee96ea53050e8a9d4028fa8a4c.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
51da46dde0b6a298f9d8c90c7d75fb0c9a5301ee96ea53050e8a9d4028fa8a4c.exe
-
Size
441KB
-
MD5
3a47f0cbd5a34e45581cc0d12805a0b5
-
SHA1
56fbe900577d89828616ff21d500a9aecd65dbf8
-
SHA256
51da46dde0b6a298f9d8c90c7d75fb0c9a5301ee96ea53050e8a9d4028fa8a4c
-
SHA512
53ec01155f97960815a125dbcdba21105468543c7cc3a2ad29643283fdd45c0a43eead4c928ca292c199a352f04cd4cec6faaab273aab59512c8f2d7966315b8
-
SSDEEP
12288:M4wFHoSpg4wFHonR/nPF2LnFL4wF04wFK4wFK4wluj:UrR/nPM
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/944-13-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3536-15-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4784-59-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4344-65-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4108-83-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1564-137-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1132-155-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1368-205-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4260-254-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3504-269-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1036-266-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2168-262-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1436-272-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3388-257-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4976-250-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/944-246-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3968-241-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4368-238-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4312-233-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3720-230-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3756-225-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2124-222-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1864-217-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1916-214-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5000-209-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2648-201-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2264-197-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1020-191-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2744-185-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/8-179-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1552-173-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4800-167-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3728-161-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3476-149-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3472-143-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4840-132-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3128-125-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1540-119-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2344-114-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4000-107-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1480-101-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5004-95-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3452-89-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/640-77-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3548-71-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3976-53-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4240-47-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4072-41-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3212-35-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2924-28-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3536-22-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4716-9-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4780-277-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/528-278-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1436-279-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/528-283-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3128-288-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4016-289-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1648-294-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4016-293-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1648-298-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/428-303-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4296-308-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1724-314-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule C:\nbnhtn.exe UPX behavioral2/memory/944-13-0x0000000000400000-0x000000000048C000-memory.dmp UPX \??\c:\9pjvp.exe UPX C:\fllxfxr.exe UPX C:\rrlfxxr.exe UPX \??\c:\nnhbbn.exe UPX \??\c:\7vvpp.exe UPX \??\c:\rffrlrl.exe UPX \??\c:\lrllxff.exe UPX behavioral2/memory/4784-59-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/4344-65-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/4108-83-0x0000000000400000-0x000000000048C000-memory.dmp UPX \??\c:\ntnhtb.exe UPX \??\c:\dvdpj.exe UPX \??\c:\rlfrxll.exe UPX \??\c:\fllrfxl.exe UPX \??\c:\3ttnhb.exe UPX \??\c:\vjpdd.exe UPX \??\c:\9fllxlf.exe UPX behavioral2/memory/1564-137-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/1132-155-0x0000000000400000-0x000000000048C000-memory.dmp UPX \??\c:\1lllxrl.exe UPX \??\c:\vvpjv.exe UPX behavioral2/memory/1368-205-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/4260-254-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/3504-269-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/1036-266-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/2168-262-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/1436-272-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/3388-257-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/4976-250-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/944-246-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/3968-241-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/4368-238-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/4312-233-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/3720-230-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/3756-225-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/2124-222-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/1864-217-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/1916-214-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/5000-209-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/2648-201-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/2264-197-0x0000000000400000-0x000000000048C000-memory.dmp UPX \??\c:\frfxrfx.exe UPX behavioral2/memory/1020-191-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/2744-185-0x0000000000400000-0x000000000048C000-memory.dmp UPX \??\c:\hhthbt.exe UPX behavioral2/memory/8-179-0x0000000000400000-0x000000000048C000-memory.dmp UPX \??\c:\rlrlrlf.exe UPX behavioral2/memory/1552-173-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/4800-167-0x0000000000400000-0x000000000048C000-memory.dmp UPX \??\c:\dvdvv.exe UPX behavioral2/memory/3728-161-0x0000000000400000-0x000000000048C000-memory.dmp UPX \??\c:\nbhtnh.exe UPX \??\c:\5xxrfxl.exe UPX behavioral2/memory/3476-149-0x0000000000400000-0x000000000048C000-memory.dmp UPX \??\c:\7rlxrrf.exe UPX behavioral2/memory/3472-143-0x0000000000400000-0x000000000048C000-memory.dmp UPX \??\c:\jvdpd.exe UPX \??\c:\btttbb.exe UPX behavioral2/memory/4840-132-0x0000000000400000-0x000000000048C000-memory.dmp UPX \??\c:\9hbnth.exe UPX behavioral2/memory/3128-125-0x0000000000400000-0x000000000048C000-memory.dmp UPX behavioral2/memory/1540-119-0x0000000000400000-0x000000000048C000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
nbnhtn.exehbbnhb.exe9pjvp.exefllxfxr.exerrlfxxr.exennhbbn.exe7vvpp.exerffrlrl.exelrllxff.exentbthb.exepvjvj.exe5xxlxrr.exettntht.exentnhtb.exedvdpj.exerlfrxll.exefllrfxl.exe3ttnhb.exevjpdd.exe9fllxlf.exe9hbnth.exebtttbb.exejvdpd.exe7rlxrrf.exe5xxrfxl.exenbhtnh.exedvdvv.exe1lllxrl.exerlrlrlf.exehhthbt.exevvpjv.exefrfxrfx.exellxrfxr.exehbbbbt.exeppjdv.exe5jvpj.exexfffxfl.exe3hhthh.exedpjdv.exevvjdp.exexffxlfx.exenbhbhb.exejjpjd.exedpvpd.exelllxrfr.exebhbtnt.exevjpjj.exedjvvj.exelxlfxrl.exe9nnbhb.exejpvpp.exevddvj.exenbbhbb.exe1jppp.exetnhbnh.exerfllrlr.exepjdpj.exelrrlxxf.exethhtnh.exedvddd.exe3pjjv.exedjdjd.exerfxlxrf.exe7xrfxrl.exepid process 944 nbnhtn.exe 3536 hbbnhb.exe 2924 9pjvp.exe 3212 fllxfxr.exe 4072 rrlfxxr.exe 4240 nnhbbn.exe 3976 7vvpp.exe 4784 rffrlrl.exe 4344 lrllxff.exe 3548 ntbthb.exe 640 pvjvj.exe 4108 5xxlxrr.exe 3452 ttntht.exe 5004 ntnhtb.exe 1480 dvdpj.exe 4000 rlfrxll.exe 2344 fllrfxl.exe 1540 3ttnhb.exe 3128 vjpdd.exe 4840 9fllxlf.exe 1564 9hbnth.exe 3472 btttbb.exe 3476 jvdpd.exe 1132 7rlxrrf.exe 3728 5xxrfxl.exe 4800 nbhtnh.exe 1552 dvdvv.exe 8 1lllxrl.exe 2744 rlrlrlf.exe 1020 hhthbt.exe 2264 vvpjv.exe 2648 frfxrfx.exe 1368 llxrfxr.exe 5000 hbbbbt.exe 1916 ppjdv.exe 1864 5jvpj.exe 2124 xfffxfl.exe 3756 3hhthh.exe 3720 dpjdv.exe 4312 vvjdp.exe 4368 xffxlfx.exe 3968 nbhbhb.exe 944 jjpjd.exe 4976 dpvpd.exe 4260 lllxrfr.exe 3388 bhbtnt.exe 2168 vjpjj.exe 1036 djvvj.exe 3504 lxlfxrl.exe 4780 9nnbhb.exe 1436 jpvpp.exe 528 vddvj.exe 3128 nbbhbb.exe 4016 1jppp.exe 1648 tnhbnh.exe 428 rfllrlr.exe 4296 pjdpj.exe 1724 lrrlxxf.exe 464 thhtnh.exe 3924 dvddd.exe 4284 3pjjv.exe 4756 djdjd.exe 2648 rfxlxrf.exe 4144 7xrfxrl.exe -
Processes:
resource yara_rule behavioral2/memory/4716-0-0x0000000000400000-0x000000000048C000-memory.dmp upx C:\nbnhtn.exe upx behavioral2/memory/944-13-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3536-15-0x0000000000400000-0x000000000048C000-memory.dmp upx \??\c:\9pjvp.exe upx C:\fllxfxr.exe upx C:\rrlfxxr.exe upx \??\c:\nnhbbn.exe upx \??\c:\7vvpp.exe upx \??\c:\rffrlrl.exe upx \??\c:\lrllxff.exe upx behavioral2/memory/4784-59-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4344-65-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4108-83-0x0000000000400000-0x000000000048C000-memory.dmp upx \??\c:\ntnhtb.exe upx \??\c:\dvdpj.exe upx \??\c:\rlfrxll.exe upx \??\c:\fllrfxl.exe upx \??\c:\3ttnhb.exe upx \??\c:\vjpdd.exe upx \??\c:\9fllxlf.exe upx behavioral2/memory/1564-137-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1132-155-0x0000000000400000-0x000000000048C000-memory.dmp upx \??\c:\1lllxrl.exe upx \??\c:\vvpjv.exe upx behavioral2/memory/1368-205-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4260-254-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3504-269-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1036-266-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2168-262-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1436-272-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4780-271-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3388-257-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4976-250-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/944-246-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3968-241-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4368-238-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4312-233-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3720-230-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3756-225-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2124-222-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1864-217-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1916-214-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5000-209-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2648-201-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2264-197-0x0000000000400000-0x000000000048C000-memory.dmp upx \??\c:\frfxrfx.exe upx behavioral2/memory/1020-191-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2744-185-0x0000000000400000-0x000000000048C000-memory.dmp upx \??\c:\hhthbt.exe upx behavioral2/memory/8-179-0x0000000000400000-0x000000000048C000-memory.dmp upx \??\c:\rlrlrlf.exe upx behavioral2/memory/1552-173-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4800-167-0x0000000000400000-0x000000000048C000-memory.dmp upx \??\c:\dvdvv.exe upx behavioral2/memory/3728-161-0x0000000000400000-0x000000000048C000-memory.dmp upx \??\c:\nbhtnh.exe upx \??\c:\5xxrfxl.exe upx behavioral2/memory/3476-149-0x0000000000400000-0x000000000048C000-memory.dmp upx \??\c:\7rlxrrf.exe upx behavioral2/memory/3472-143-0x0000000000400000-0x000000000048C000-memory.dmp upx \??\c:\jvdpd.exe upx \??\c:\btttbb.exe upx behavioral2/memory/4840-132-0x0000000000400000-0x000000000048C000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
51da46dde0b6a298f9d8c90c7d75fb0c9a5301ee96ea53050e8a9d4028fa8a4c.exenbnhtn.exehbbnhb.exe9pjvp.exefllxfxr.exerrlfxxr.exennhbbn.exe7vvpp.exerffrlrl.exelrllxff.exentbthb.exepvjvj.exe5xxlxrr.exettntht.exentnhtb.exedvdpj.exerlfrxll.exefllrfxl.exe3ttnhb.exevjpdd.exe9fllxlf.exe9hbnth.exedescription pid process target process PID 4716 wrote to memory of 944 4716 51da46dde0b6a298f9d8c90c7d75fb0c9a5301ee96ea53050e8a9d4028fa8a4c.exe jjpjd.exe PID 4716 wrote to memory of 944 4716 51da46dde0b6a298f9d8c90c7d75fb0c9a5301ee96ea53050e8a9d4028fa8a4c.exe jjpjd.exe PID 4716 wrote to memory of 944 4716 51da46dde0b6a298f9d8c90c7d75fb0c9a5301ee96ea53050e8a9d4028fa8a4c.exe jjpjd.exe PID 944 wrote to memory of 3536 944 nbnhtn.exe hbbnhb.exe PID 944 wrote to memory of 3536 944 nbnhtn.exe hbbnhb.exe PID 944 wrote to memory of 3536 944 nbnhtn.exe hbbnhb.exe PID 3536 wrote to memory of 2924 3536 hbbnhb.exe 9pjvp.exe PID 3536 wrote to memory of 2924 3536 hbbnhb.exe 9pjvp.exe PID 3536 wrote to memory of 2924 3536 hbbnhb.exe 9pjvp.exe PID 2924 wrote to memory of 3212 2924 9pjvp.exe fllxfxr.exe PID 2924 wrote to memory of 3212 2924 9pjvp.exe fllxfxr.exe PID 2924 wrote to memory of 3212 2924 9pjvp.exe fllxfxr.exe PID 3212 wrote to memory of 4072 3212 fllxfxr.exe rrlfxxr.exe PID 3212 wrote to memory of 4072 3212 fllxfxr.exe rrlfxxr.exe PID 3212 wrote to memory of 4072 3212 fllxfxr.exe rrlfxxr.exe PID 4072 wrote to memory of 4240 4072 rrlfxxr.exe nnhbbn.exe PID 4072 wrote to memory of 4240 4072 rrlfxxr.exe nnhbbn.exe PID 4072 wrote to memory of 4240 4072 rrlfxxr.exe nnhbbn.exe PID 4240 wrote to memory of 3976 4240 nnhbbn.exe 7vvpp.exe PID 4240 wrote to memory of 3976 4240 nnhbbn.exe 7vvpp.exe PID 4240 wrote to memory of 3976 4240 nnhbbn.exe 7vvpp.exe PID 3976 wrote to memory of 4784 3976 7vvpp.exe rffrlrl.exe PID 3976 wrote to memory of 4784 3976 7vvpp.exe rffrlrl.exe PID 3976 wrote to memory of 4784 3976 7vvpp.exe rffrlrl.exe PID 4784 wrote to memory of 4344 4784 rffrlrl.exe lrllxff.exe PID 4784 wrote to memory of 4344 4784 rffrlrl.exe lrllxff.exe PID 4784 wrote to memory of 4344 4784 rffrlrl.exe lrllxff.exe PID 4344 wrote to memory of 3548 4344 lrllxff.exe ntbthb.exe PID 4344 wrote to memory of 3548 4344 lrllxff.exe ntbthb.exe PID 4344 wrote to memory of 3548 4344 lrllxff.exe ntbthb.exe PID 3548 wrote to memory of 640 3548 ntbthb.exe pvjvj.exe PID 3548 wrote to memory of 640 3548 ntbthb.exe pvjvj.exe PID 3548 wrote to memory of 640 3548 ntbthb.exe pvjvj.exe PID 640 wrote to memory of 4108 640 pvjvj.exe 5xxlxrr.exe PID 640 wrote to memory of 4108 640 pvjvj.exe 5xxlxrr.exe PID 640 wrote to memory of 4108 640 pvjvj.exe 5xxlxrr.exe PID 4108 wrote to memory of 3452 4108 5xxlxrr.exe ttntht.exe PID 4108 wrote to memory of 3452 4108 5xxlxrr.exe ttntht.exe PID 4108 wrote to memory of 3452 4108 5xxlxrr.exe ttntht.exe PID 3452 wrote to memory of 5004 3452 ttntht.exe ntnhtb.exe PID 3452 wrote to memory of 5004 3452 ttntht.exe ntnhtb.exe PID 3452 wrote to memory of 5004 3452 ttntht.exe ntnhtb.exe PID 5004 wrote to memory of 1480 5004 ntnhtb.exe dvdpj.exe PID 5004 wrote to memory of 1480 5004 ntnhtb.exe dvdpj.exe PID 5004 wrote to memory of 1480 5004 ntnhtb.exe dvdpj.exe PID 1480 wrote to memory of 4000 1480 dvdpj.exe rlfrxll.exe PID 1480 wrote to memory of 4000 1480 dvdpj.exe rlfrxll.exe PID 1480 wrote to memory of 4000 1480 dvdpj.exe rlfrxll.exe PID 4000 wrote to memory of 2344 4000 rlfrxll.exe fllrfxl.exe PID 4000 wrote to memory of 2344 4000 rlfrxll.exe fllrfxl.exe PID 4000 wrote to memory of 2344 4000 rlfrxll.exe fllrfxl.exe PID 2344 wrote to memory of 1540 2344 fllrfxl.exe 3ttnhb.exe PID 2344 wrote to memory of 1540 2344 fllrfxl.exe 3ttnhb.exe PID 2344 wrote to memory of 1540 2344 fllrfxl.exe 3ttnhb.exe PID 1540 wrote to memory of 3128 1540 3ttnhb.exe nbbhbb.exe PID 1540 wrote to memory of 3128 1540 3ttnhb.exe nbbhbb.exe PID 1540 wrote to memory of 3128 1540 3ttnhb.exe nbbhbb.exe PID 3128 wrote to memory of 4840 3128 vjpdd.exe 9fllxlf.exe PID 3128 wrote to memory of 4840 3128 vjpdd.exe 9fllxlf.exe PID 3128 wrote to memory of 4840 3128 vjpdd.exe 9fllxlf.exe PID 4840 wrote to memory of 1564 4840 9fllxlf.exe 9hbnth.exe PID 4840 wrote to memory of 1564 4840 9fllxlf.exe 9hbnth.exe PID 4840 wrote to memory of 1564 4840 9fllxlf.exe 9hbnth.exe PID 1564 wrote to memory of 3472 1564 9hbnth.exe btttbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\51da46dde0b6a298f9d8c90c7d75fb0c9a5301ee96ea53050e8a9d4028fa8a4c.exe"C:\Users\Admin\AppData\Local\Temp\51da46dde0b6a298f9d8c90c7d75fb0c9a5301ee96ea53050e8a9d4028fa8a4c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\nbnhtn.exec:\nbnhtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbbnhb.exec:\hbbnhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9pjvp.exec:\9pjvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fllxfxr.exec:\fllxfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnhbbn.exec:\nnhbbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7vvpp.exec:\7vvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rffrlrl.exec:\rffrlrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrllxff.exec:\lrllxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntbthb.exec:\ntbthb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvjvj.exec:\pvjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5xxlxrr.exec:\5xxlxrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttntht.exec:\ttntht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntnhtb.exec:\ntnhtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvdpj.exec:\dvdpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlfrxll.exec:\rlfrxll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fllrfxl.exec:\fllrfxl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3ttnhb.exec:\3ttnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjpdd.exec:\vjpdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9fllxlf.exec:\9fllxlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9hbnth.exec:\9hbnth.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btttbb.exec:\btttbb.exe23⤵
- Executes dropped EXE
-
\??\c:\jvdpd.exec:\jvdpd.exe24⤵
- Executes dropped EXE
-
\??\c:\7rlxrrf.exec:\7rlxrrf.exe25⤵
- Executes dropped EXE
-
\??\c:\5xxrfxl.exec:\5xxrfxl.exe26⤵
- Executes dropped EXE
-
\??\c:\nbhtnh.exec:\nbhtnh.exe27⤵
- Executes dropped EXE
-
\??\c:\dvdvv.exec:\dvdvv.exe28⤵
- Executes dropped EXE
-
\??\c:\1lllxrl.exec:\1lllxrl.exe29⤵
- Executes dropped EXE
-
\??\c:\rlrlrlf.exec:\rlrlrlf.exe30⤵
- Executes dropped EXE
-
\??\c:\hhthbt.exec:\hhthbt.exe31⤵
- Executes dropped EXE
-
\??\c:\vvpjv.exec:\vvpjv.exe32⤵
- Executes dropped EXE
-
\??\c:\frfxrfx.exec:\frfxrfx.exe33⤵
- Executes dropped EXE
-
\??\c:\llxrfxr.exec:\llxrfxr.exe34⤵
- Executes dropped EXE
-
\??\c:\hbbbbt.exec:\hbbbbt.exe35⤵
- Executes dropped EXE
-
\??\c:\ppjdv.exec:\ppjdv.exe36⤵
- Executes dropped EXE
-
\??\c:\5jvpj.exec:\5jvpj.exe37⤵
- Executes dropped EXE
-
\??\c:\xfffxfl.exec:\xfffxfl.exe38⤵
- Executes dropped EXE
-
\??\c:\3hhthh.exec:\3hhthh.exe39⤵
- Executes dropped EXE
-
\??\c:\dpjdv.exec:\dpjdv.exe40⤵
- Executes dropped EXE
-
\??\c:\vvjdp.exec:\vvjdp.exe41⤵
- Executes dropped EXE
-
\??\c:\xffxlfx.exec:\xffxlfx.exe42⤵
- Executes dropped EXE
-
\??\c:\nbhbhb.exec:\nbhbhb.exe43⤵
- Executes dropped EXE
-
\??\c:\jjpjd.exec:\jjpjd.exe44⤵
- Executes dropped EXE
-
\??\c:\dpvpd.exec:\dpvpd.exe45⤵
- Executes dropped EXE
-
\??\c:\lllxrfr.exec:\lllxrfr.exe46⤵
- Executes dropped EXE
-
\??\c:\bhbtnt.exec:\bhbtnt.exe47⤵
- Executes dropped EXE
-
\??\c:\vjpjj.exec:\vjpjj.exe48⤵
- Executes dropped EXE
-
\??\c:\djvvj.exec:\djvvj.exe49⤵
- Executes dropped EXE
-
\??\c:\lxlfxrl.exec:\lxlfxrl.exe50⤵
- Executes dropped EXE
-
\??\c:\9nnbhb.exec:\9nnbhb.exe51⤵
- Executes dropped EXE
-
\??\c:\jpvpp.exec:\jpvpp.exe52⤵
- Executes dropped EXE
-
\??\c:\vddvj.exec:\vddvj.exe53⤵
- Executes dropped EXE
-
\??\c:\nbbhbb.exec:\nbbhbb.exe54⤵
- Executes dropped EXE
-
\??\c:\1jppp.exec:\1jppp.exe55⤵
- Executes dropped EXE
-
\??\c:\tnhbnh.exec:\tnhbnh.exe56⤵
- Executes dropped EXE
-
\??\c:\rfllrlr.exec:\rfllrlr.exe57⤵
- Executes dropped EXE
-
\??\c:\pjdpj.exec:\pjdpj.exe58⤵
- Executes dropped EXE
-
\??\c:\lrrlxxf.exec:\lrrlxxf.exe59⤵
- Executes dropped EXE
-
\??\c:\thhtnh.exec:\thhtnh.exe60⤵
- Executes dropped EXE
-
\??\c:\dvddd.exec:\dvddd.exe61⤵
- Executes dropped EXE
-
\??\c:\3pjjv.exec:\3pjjv.exe62⤵
- Executes dropped EXE
-
\??\c:\djdjd.exec:\djdjd.exe63⤵
- Executes dropped EXE
-
\??\c:\rfxlxrf.exec:\rfxlxrf.exe64⤵
- Executes dropped EXE
-
\??\c:\7xrfxrl.exec:\7xrfxrl.exe65⤵
- Executes dropped EXE
-
\??\c:\nbthbt.exec:\nbthbt.exe66⤵
-
\??\c:\httnbt.exec:\httnbt.exe67⤵
-
\??\c:\vdpdj.exec:\vdpdj.exe68⤵
-
\??\c:\9ddvp.exec:\9ddvp.exe69⤵
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe70⤵
-
\??\c:\1nhbtn.exec:\1nhbtn.exe71⤵
-
\??\c:\jdjvp.exec:\jdjvp.exe72⤵
-
\??\c:\tnhbtn.exec:\tnhbtn.exe73⤵
-
\??\c:\hbhbbt.exec:\hbhbbt.exe74⤵
-
\??\c:\1jpjj.exec:\1jpjj.exe75⤵
-
\??\c:\9frfrrf.exec:\9frfrrf.exe76⤵
-
\??\c:\llrlflf.exec:\llrlflf.exe77⤵
-
\??\c:\1htnhb.exec:\1htnhb.exe78⤵
-
\??\c:\jjdvj.exec:\jjdvj.exe79⤵
-
\??\c:\lfrfrlx.exec:\lfrfrlx.exe80⤵
-
\??\c:\xffrfxr.exec:\xffrfxr.exe81⤵
-
\??\c:\7htnhb.exec:\7htnhb.exe82⤵
-
\??\c:\dvddd.exec:\dvddd.exe83⤵
-
\??\c:\pdppj.exec:\pdppj.exe84⤵
-
\??\c:\ffllfff.exec:\ffllfff.exe85⤵
-
\??\c:\ntntbn.exec:\ntntbn.exe86⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe87⤵
-
\??\c:\1bthtn.exec:\1bthtn.exe88⤵
-
\??\c:\9vjvj.exec:\9vjvj.exe89⤵
-
\??\c:\5xrlllx.exec:\5xrlllx.exe90⤵
-
\??\c:\tnnnbb.exec:\tnnnbb.exe91⤵
-
\??\c:\dpvdp.exec:\dpvdp.exe92⤵
-
\??\c:\rffrfrl.exec:\rffrfrl.exe93⤵
-
\??\c:\rffrllf.exec:\rffrllf.exe94⤵
-
\??\c:\hnthbt.exec:\hnthbt.exe95⤵
-
\??\c:\tbbtnn.exec:\tbbtnn.exe96⤵
-
\??\c:\jvvjv.exec:\jvvjv.exe97⤵
-
\??\c:\flrrllf.exec:\flrrllf.exe98⤵
-
\??\c:\rrrfrlx.exec:\rrrfrlx.exe99⤵
-
\??\c:\1nbthb.exec:\1nbthb.exe100⤵
-
\??\c:\djvjv.exec:\djvjv.exe101⤵
-
\??\c:\9pppj.exec:\9pppj.exe102⤵
-
\??\c:\fffrfxl.exec:\fffrfxl.exe103⤵
-
\??\c:\nbhbbt.exec:\nbhbbt.exe104⤵
-
\??\c:\tnbttn.exec:\tnbttn.exe105⤵
-
\??\c:\1djdd.exec:\1djdd.exe106⤵
-
\??\c:\xllxfxr.exec:\xllxfxr.exe107⤵
-
\??\c:\lxlfrlf.exec:\lxlfrlf.exe108⤵
-
\??\c:\btnbnb.exec:\btnbnb.exe109⤵
-
\??\c:\pjvpd.exec:\pjvpd.exe110⤵
-
\??\c:\vdvdv.exec:\vdvdv.exe111⤵
-
\??\c:\xlxlfrl.exec:\xlxlfrl.exe112⤵
-
\??\c:\ntbthb.exec:\ntbthb.exe113⤵
-
\??\c:\hbbnbh.exec:\hbbnbh.exe114⤵
-
\??\c:\dvpdj.exec:\dvpdj.exe115⤵
-
\??\c:\vdvpd.exec:\vdvpd.exe116⤵
-
\??\c:\rxxrlfx.exec:\rxxrlfx.exe117⤵
-
\??\c:\5ttntt.exec:\5ttntt.exe118⤵
-
\??\c:\nhhbbt.exec:\nhhbbt.exe119⤵
-
\??\c:\jjjdp.exec:\jjjdp.exe120⤵
-
\??\c:\xffrllx.exec:\xffrllx.exe121⤵
-
\??\c:\frrfxrr.exec:\frrfxrr.exe122⤵
-
\??\c:\hhnhtb.exec:\hhnhtb.exe123⤵
-
\??\c:\jdvjd.exec:\jdvjd.exe124⤵
-
\??\c:\vddpj.exec:\vddpj.exe125⤵
-
\??\c:\7xrfrrl.exec:\7xrfrrl.exe126⤵
-
\??\c:\lrrfrff.exec:\lrrfrff.exe127⤵
-
\??\c:\hnnbhb.exec:\hnnbhb.exe128⤵
-
\??\c:\9jjdp.exec:\9jjdp.exe129⤵
-
\??\c:\ppjvj.exec:\ppjvj.exe130⤵
-
\??\c:\xxfxlfx.exec:\xxfxlfx.exe131⤵
-
\??\c:\ffxrrrx.exec:\ffxrrrx.exe132⤵
-
\??\c:\ntnbtn.exec:\ntnbtn.exe133⤵
-
\??\c:\vvvvj.exec:\vvvvj.exe134⤵
-
\??\c:\frlxflx.exec:\frlxflx.exe135⤵
-
\??\c:\5rfflfr.exec:\5rfflfr.exe136⤵
-
\??\c:\bttnbh.exec:\bttnbh.exe137⤵
-
\??\c:\1jvpj.exec:\1jvpj.exe138⤵
-
\??\c:\xlfrfxl.exec:\xlfrfxl.exe139⤵
-
\??\c:\3nnbbh.exec:\3nnbbh.exe140⤵
-
\??\c:\pvppd.exec:\pvppd.exe141⤵
-
\??\c:\lrrfrlx.exec:\lrrfrlx.exe142⤵
-
\??\c:\lllfxxf.exec:\lllfxxf.exe143⤵
-
\??\c:\hbhbtt.exec:\hbhbtt.exe144⤵
-
\??\c:\3jjvp.exec:\3jjvp.exe145⤵
-
\??\c:\lflflll.exec:\lflflll.exe146⤵
-
\??\c:\7rxrlfr.exec:\7rxrlfr.exe147⤵
-
\??\c:\pjvpd.exec:\pjvpd.exe148⤵
-
\??\c:\frlxrlx.exec:\frlxrlx.exe149⤵
-
\??\c:\nhhhnh.exec:\nhhhnh.exe150⤵
-
\??\c:\jdvpj.exec:\jdvpj.exe151⤵
-
\??\c:\xrfxlfx.exec:\xrfxlfx.exe152⤵
-
\??\c:\1bbnbt.exec:\1bbnbt.exe153⤵
-
\??\c:\dpvjp.exec:\dpvjp.exe154⤵
-
\??\c:\xlrflfl.exec:\xlrflfl.exe155⤵
-
\??\c:\3rrffff.exec:\3rrffff.exe156⤵
-
\??\c:\nnnnhb.exec:\nnnnhb.exe157⤵
-
\??\c:\ththnh.exec:\ththnh.exe158⤵
-
\??\c:\jdvjp.exec:\jdvjp.exe159⤵
-
\??\c:\frlfxrl.exec:\frlfxrl.exe160⤵
-
\??\c:\rfrlrlf.exec:\rfrlrlf.exe161⤵
-
\??\c:\tntnnb.exec:\tntnnb.exe162⤵
-
\??\c:\pjvjd.exec:\pjvjd.exe163⤵
-
\??\c:\5rlxlfr.exec:\5rlxlfr.exe164⤵
-
\??\c:\1xlxrlx.exec:\1xlxrlx.exe165⤵
-
\??\c:\thbnbt.exec:\thbnbt.exe166⤵
-
\??\c:\pjpdp.exec:\pjpdp.exe167⤵
-
\??\c:\rlfrllf.exec:\rlfrllf.exe168⤵
-
\??\c:\xxfrlfr.exec:\xxfrlfr.exe169⤵
-
\??\c:\nbnbbt.exec:\nbnbbt.exe170⤵
-
\??\c:\dvvvj.exec:\dvvvj.exe171⤵
-
\??\c:\3dvpj.exec:\3dvpj.exe172⤵
-
\??\c:\1rrlxrl.exec:\1rrlxrl.exe173⤵
-
\??\c:\3tnhtn.exec:\3tnhtn.exe174⤵
-
\??\c:\bhhbtt.exec:\bhhbtt.exe175⤵
-
\??\c:\djjdj.exec:\djjdj.exe176⤵
-
\??\c:\vjjdv.exec:\vjjdv.exe177⤵
-
\??\c:\lfffrrl.exec:\lfffrrl.exe178⤵
-
\??\c:\tnnhbb.exec:\tnnhbb.exe179⤵
-
\??\c:\9nnnbh.exec:\9nnnbh.exe180⤵
-
\??\c:\1pvpd.exec:\1pvpd.exe181⤵
-
\??\c:\rxrfrxl.exec:\rxrfrxl.exe182⤵
-
\??\c:\bhtbhb.exec:\bhtbhb.exe183⤵
-
\??\c:\djpjd.exec:\djpjd.exe184⤵
-
\??\c:\9vdvd.exec:\9vdvd.exe185⤵
-
\??\c:\1frfrlf.exec:\1frfrlf.exe186⤵
-
\??\c:\nhtnhb.exec:\nhtnhb.exe187⤵
-
\??\c:\hbhttt.exec:\hbhttt.exe188⤵
-
\??\c:\djdjp.exec:\djdjp.exe189⤵
-
\??\c:\xxxlffx.exec:\xxxlffx.exe190⤵
-
\??\c:\tbhbbt.exec:\tbhbbt.exe191⤵
-
\??\c:\thtnbb.exec:\thtnbb.exe192⤵
-
\??\c:\vvjdd.exec:\vvjdd.exe193⤵
-
\??\c:\lrrfxrr.exec:\lrrfxrr.exe194⤵
-
\??\c:\5nhtnb.exec:\5nhtnb.exe195⤵
-
\??\c:\pvdpd.exec:\pvdpd.exe196⤵
-
\??\c:\dpppd.exec:\dpppd.exe197⤵
-
\??\c:\7xrrlfr.exec:\7xrrlfr.exe198⤵
-
\??\c:\bhhhtt.exec:\bhhhtt.exe199⤵
-
\??\c:\vvvpd.exec:\vvvpd.exe200⤵
-
\??\c:\jjjjj.exec:\jjjjj.exe201⤵
-
\??\c:\xrxrxrf.exec:\xrxrxrf.exe202⤵
-
\??\c:\bnhtnh.exec:\bnhtnh.exe203⤵
-
\??\c:\bbbthb.exec:\bbbthb.exe204⤵
-
\??\c:\1vpdv.exec:\1vpdv.exe205⤵
-
\??\c:\1vpdj.exec:\1vpdj.exe206⤵
-
\??\c:\xllxrlr.exec:\xllxrlr.exe207⤵
-
\??\c:\bnhtnb.exec:\bnhtnb.exe208⤵
-
\??\c:\nnhtnh.exec:\nnhtnh.exe209⤵
-
\??\c:\9pdvd.exec:\9pdvd.exe210⤵
-
\??\c:\7vjvj.exec:\7vjvj.exe211⤵
-
\??\c:\llxxlfx.exec:\llxxlfx.exe212⤵
-
\??\c:\1bbtnh.exec:\1bbtnh.exe213⤵
-
\??\c:\bnbnnn.exec:\bnbnnn.exe214⤵
-
\??\c:\3jddv.exec:\3jddv.exe215⤵
-
\??\c:\lrrlxlx.exec:\lrrlxlx.exe216⤵
-
\??\c:\nnbbbt.exec:\nnbbbt.exe217⤵
-
\??\c:\tnbthh.exec:\tnbthh.exe218⤵
-
\??\c:\dvdpd.exec:\dvdpd.exe219⤵
-
\??\c:\lxllxxl.exec:\lxllxxl.exe220⤵
-
\??\c:\lflxrlx.exec:\lflxrlx.exe221⤵
-
\??\c:\hbhbbt.exec:\hbhbbt.exe222⤵
-
\??\c:\pvjdp.exec:\pvjdp.exe223⤵
-
\??\c:\vvjvj.exec:\vvjvj.exe224⤵
-
\??\c:\9ttnbn.exec:\9ttnbn.exe225⤵
-
\??\c:\3bbtbb.exec:\3bbtbb.exe226⤵
-
\??\c:\pjpjj.exec:\pjpjj.exe227⤵
-
\??\c:\jdvjp.exec:\jdvjp.exe228⤵
-
\??\c:\9xrflfx.exec:\9xrflfx.exe229⤵
-
\??\c:\1htthh.exec:\1htthh.exe230⤵
-
\??\c:\pjddp.exec:\pjddp.exe231⤵
-
\??\c:\xxxllll.exec:\xxxllll.exe232⤵
-
\??\c:\bhthtn.exec:\bhthtn.exe233⤵
-
\??\c:\nhbnbn.exec:\nhbnbn.exe234⤵
-
\??\c:\9pdpd.exec:\9pdpd.exe235⤵
-
\??\c:\llrfrlf.exec:\llrfrlf.exe236⤵
-
\??\c:\hbbtth.exec:\hbbtth.exe237⤵
-
\??\c:\5tnbnh.exec:\5tnbnh.exe238⤵
-
\??\c:\7jvjv.exec:\7jvjv.exe239⤵
-
\??\c:\frfxxrr.exec:\frfxxrr.exe240⤵
-
\??\c:\xfffxrf.exec:\xfffxrf.exe241⤵