Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
03-05-2024 19:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
275086a38262f498ecafa68672233626bbe08fc9384e9c254c6e21099868759e.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
275086a38262f498ecafa68672233626bbe08fc9384e9c254c6e21099868759e.exe
-
Size
392KB
-
MD5
d40907eed1cdca0c4fb8dc6ff8f061d4
-
SHA1
1edb1176368a9c6fb677fe23218fd8dc6cccf444
-
SHA256
275086a38262f498ecafa68672233626bbe08fc9384e9c254c6e21099868759e
-
SHA512
8759b67b44028b46e480c84e875fcb6442be8eb507d06bf0b636cf6b0904f8573534bd8864c53cb61312202b1047bf50b88bf4b9e7bcf8f18b2800050832bd18
-
SSDEEP
6144:Acm7ImGddX5WrXF5lpKGYV0aTk/BO0XJm4UEPOshN/xdKnvP48bmRa:m7TcJWjdpKGATTk/jYIOWN/KnnPd
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
Processes:
resource yara_rule behavioral1/memory/1772-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-714-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-801-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-1216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-1260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-1177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-1125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-227-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/676-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-26-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/1772-7-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2916-10-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2664-18-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2932-29-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2560-47-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2964-45-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2580-65-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2676-64-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1276-102-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1536-174-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2928-298-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2924-318-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2708-337-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2676-351-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2716-350-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2848-365-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2836-384-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1660-417-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/676-481-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1752-539-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2556-620-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1512-639-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1584-714-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1756-766-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2624-781-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2808-801-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2924-1132-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2764-1170-0x0000000000220000-0x000000000024A000-memory.dmp UPX behavioral1/memory/2116-1197-0x0000000000220000-0x000000000024A000-memory.dmp UPX behavioral1/memory/3036-1216-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1272-1235-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2392-1260-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2724-1303-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2116-1190-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2464-1177-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2332-1145-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2940-1125-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2880-1099-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2008-1074-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1908-964-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2512-927-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2716-890-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2680-876-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2552-837-0x0000000000250000-0x000000000027A000-memory.dmp UPX behavioral1/memory/2968-794-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2204-707-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2652-589-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1520-508-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/548-462-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1300-404-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2440-403-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1708-371-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2916-305-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2972-282-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/3044-266-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1820-257-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1716-254-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1992-246-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1992-238-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/676-211-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1744-201-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2424-192-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1684-159-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1936-132-0x0000000000400000-0x000000000042A000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
vjvdp.exexrlrflx.exehhnbhn.exe9dddp.exexrrxllx.exebnhhth.exepdvvj.exexfxxffl.exeffxrxfr.exehbnbnt.exebhbnth.exedjvpd.exerrlrflf.exehtbtnb.exevvjpv.exeddpjp.exe7hhnnn.exehhbhtt.exe7pdpp.exedpppd.exetbbtbb.exebhtbnb.exepjddj.exellffffr.exettntbb.exetnhnbh.exeffxflxl.exe5frxxxf.exetnhhbh.exepjvdj.exe3lflxfl.exexrrfxxr.exe1btbnb.exe9dvdp.exe3rlllrx.exexrrxffx.exevdvjd.exevvdjv.exerrlrffl.exellflxxf.exe1vppd.exeppjvj.exelfflrrx.exebbttbh.exebbbhhb.exepjjpd.exe3dvdj.exerrrxllx.exennhttn.exenhbthn.exejppjj.exellxfflx.exelfrxfxl.exentbbth.exe5vpvj.exe7jppp.exe1frxxxf.exe5bhnnt.exebtnnhn.exejdvdj.exevpddj.exefxrxlrf.exerlffxrr.exennbbhn.exepid process 2916 vjvdp.exe 2664 xrlrflx.exe 2932 hhnbhn.exe 2964 9dddp.exe 2560 xrrxllx.exe 2676 bnhhth.exe 2580 pdvvj.exe 2464 xfxxffl.exe 2844 ffxrxfr.exe 1276 hbnbnt.exe 2420 bhbnth.exe 2820 djvpd.exe 2952 rrlrflf.exe 1936 htbtnb.exe 308 vvjpv.exe 1968 ddpjp.exe 1684 7hhnnn.exe 1536 hhbhtt.exe 1764 7pdpp.exe 2052 dpppd.exe 2424 tbbtbb.exe 1744 bhtbnb.exe 676 pjddj.exe 580 llffffr.exe 1860 ttntbb.exe 1992 tnhnbh.exe 1716 ffxflxl.exe 1820 5frxxxf.exe 3044 tnhhbh.exe 1752 pjvdj.exe 2972 3lflxfl.exe 2120 xrrfxxr.exe 2928 1btbnb.exe 2916 9dvdp.exe 1612 3rlllrx.exe 2924 xrrxffx.exe 3024 vdvjd.exe 2644 vvdjv.exe 2708 rrlrffl.exe 2716 llflxxf.exe 2676 1vppd.exe 2580 ppjvj.exe 2848 lfflrrx.exe 1708 bbttbh.exe 1276 bbbhhb.exe 2836 pjjpd.exe 2152 3dvdj.exe 2440 rrrxllx.exe 1300 nnhttn.exe 1660 nhbthn.exe 860 jppjj.exe 320 llxfflx.exe 2336 lfrxfxl.exe 632 ntbbth.exe 1408 5vpvj.exe 2184 7jppp.exe 1156 1frxxxf.exe 548 5bhnnt.exe 324 btnnhn.exe 796 jdvdj.exe 676 vpddj.exe 616 fxrxlrf.exe 1788 rlffxrr.exe 1632 nnbbhn.exe -
Processes:
resource yara_rule behavioral1/memory/1772-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-801-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-1132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-1216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-1235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-1260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-1303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-1190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-1177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-1145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-1125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-1099-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-1074-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-964-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-927-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-890-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-93-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
275086a38262f498ecafa68672233626bbe08fc9384e9c254c6e21099868759e.exevjvdp.exexrlrflx.exehhnbhn.exe9dddp.exexrrxllx.exebnhhth.exepdvvj.exexfxxffl.exeffxrxfr.exehbnbnt.exebhbnth.exedjvpd.exerrlrflf.exehtbtnb.exevvjpv.exedescription pid process target process PID 1772 wrote to memory of 2916 1772 275086a38262f498ecafa68672233626bbe08fc9384e9c254c6e21099868759e.exe 9dvdp.exe PID 1772 wrote to memory of 2916 1772 275086a38262f498ecafa68672233626bbe08fc9384e9c254c6e21099868759e.exe 9dvdp.exe PID 1772 wrote to memory of 2916 1772 275086a38262f498ecafa68672233626bbe08fc9384e9c254c6e21099868759e.exe 9dvdp.exe PID 1772 wrote to memory of 2916 1772 275086a38262f498ecafa68672233626bbe08fc9384e9c254c6e21099868759e.exe 9dvdp.exe PID 2916 wrote to memory of 2664 2916 vjvdp.exe xrlrflx.exe PID 2916 wrote to memory of 2664 2916 vjvdp.exe xrlrflx.exe PID 2916 wrote to memory of 2664 2916 vjvdp.exe xrlrflx.exe PID 2916 wrote to memory of 2664 2916 vjvdp.exe xrlrflx.exe PID 2664 wrote to memory of 2932 2664 xrlrflx.exe hhnbhn.exe PID 2664 wrote to memory of 2932 2664 xrlrflx.exe hhnbhn.exe PID 2664 wrote to memory of 2932 2664 xrlrflx.exe hhnbhn.exe PID 2664 wrote to memory of 2932 2664 xrlrflx.exe hhnbhn.exe PID 2932 wrote to memory of 2964 2932 hhnbhn.exe 9dddp.exe PID 2932 wrote to memory of 2964 2932 hhnbhn.exe 9dddp.exe PID 2932 wrote to memory of 2964 2932 hhnbhn.exe 9dddp.exe PID 2932 wrote to memory of 2964 2932 hhnbhn.exe 9dddp.exe PID 2964 wrote to memory of 2560 2964 9dddp.exe xrrxllx.exe PID 2964 wrote to memory of 2560 2964 9dddp.exe xrrxllx.exe PID 2964 wrote to memory of 2560 2964 9dddp.exe xrrxllx.exe PID 2964 wrote to memory of 2560 2964 9dddp.exe xrrxllx.exe PID 2560 wrote to memory of 2676 2560 xrrxllx.exe bnhhth.exe PID 2560 wrote to memory of 2676 2560 xrrxllx.exe bnhhth.exe PID 2560 wrote to memory of 2676 2560 xrrxllx.exe bnhhth.exe PID 2560 wrote to memory of 2676 2560 xrrxllx.exe bnhhth.exe PID 2676 wrote to memory of 2580 2676 bnhhth.exe pdvvj.exe PID 2676 wrote to memory of 2580 2676 bnhhth.exe pdvvj.exe PID 2676 wrote to memory of 2580 2676 bnhhth.exe pdvvj.exe PID 2676 wrote to memory of 2580 2676 bnhhth.exe pdvvj.exe PID 2580 wrote to memory of 2464 2580 pdvvj.exe xfxxffl.exe PID 2580 wrote to memory of 2464 2580 pdvvj.exe xfxxffl.exe PID 2580 wrote to memory of 2464 2580 pdvvj.exe xfxxffl.exe PID 2580 wrote to memory of 2464 2580 pdvvj.exe xfxxffl.exe PID 2464 wrote to memory of 2844 2464 xfxxffl.exe ffxrxfr.exe PID 2464 wrote to memory of 2844 2464 xfxxffl.exe ffxrxfr.exe PID 2464 wrote to memory of 2844 2464 xfxxffl.exe ffxrxfr.exe PID 2464 wrote to memory of 2844 2464 xfxxffl.exe ffxrxfr.exe PID 2844 wrote to memory of 1276 2844 ffxrxfr.exe hbnbnt.exe PID 2844 wrote to memory of 1276 2844 ffxrxfr.exe hbnbnt.exe PID 2844 wrote to memory of 1276 2844 ffxrxfr.exe hbnbnt.exe PID 2844 wrote to memory of 1276 2844 ffxrxfr.exe hbnbnt.exe PID 1276 wrote to memory of 2420 1276 hbnbnt.exe bhbnth.exe PID 1276 wrote to memory of 2420 1276 hbnbnt.exe bhbnth.exe PID 1276 wrote to memory of 2420 1276 hbnbnt.exe bhbnth.exe PID 1276 wrote to memory of 2420 1276 hbnbnt.exe bhbnth.exe PID 2420 wrote to memory of 2820 2420 bhbnth.exe djvpd.exe PID 2420 wrote to memory of 2820 2420 bhbnth.exe djvpd.exe PID 2420 wrote to memory of 2820 2420 bhbnth.exe djvpd.exe PID 2420 wrote to memory of 2820 2420 bhbnth.exe djvpd.exe PID 2820 wrote to memory of 2952 2820 djvpd.exe rrlrflf.exe PID 2820 wrote to memory of 2952 2820 djvpd.exe rrlrflf.exe PID 2820 wrote to memory of 2952 2820 djvpd.exe rrlrflf.exe PID 2820 wrote to memory of 2952 2820 djvpd.exe rrlrflf.exe PID 2952 wrote to memory of 1936 2952 rrlrflf.exe htbtnb.exe PID 2952 wrote to memory of 1936 2952 rrlrflf.exe htbtnb.exe PID 2952 wrote to memory of 1936 2952 rrlrflf.exe htbtnb.exe PID 2952 wrote to memory of 1936 2952 rrlrflf.exe htbtnb.exe PID 1936 wrote to memory of 308 1936 htbtnb.exe vvjpv.exe PID 1936 wrote to memory of 308 1936 htbtnb.exe vvjpv.exe PID 1936 wrote to memory of 308 1936 htbtnb.exe vvjpv.exe PID 1936 wrote to memory of 308 1936 htbtnb.exe vvjpv.exe PID 308 wrote to memory of 1968 308 vvjpv.exe ddpjp.exe PID 308 wrote to memory of 1968 308 vvjpv.exe ddpjp.exe PID 308 wrote to memory of 1968 308 vvjpv.exe ddpjp.exe PID 308 wrote to memory of 1968 308 vvjpv.exe ddpjp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\275086a38262f498ecafa68672233626bbe08fc9384e9c254c6e21099868759e.exe"C:\Users\Admin\AppData\Local\Temp\275086a38262f498ecafa68672233626bbe08fc9384e9c254c6e21099868759e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vjvdp.exec:\vjvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrlrflx.exec:\xrlrflx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhnbhn.exec:\hhnbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9dddp.exec:\9dddp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrrxllx.exec:\xrrxllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnhhth.exec:\bnhhth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdvvj.exec:\pdvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xfxxffl.exec:\xfxxffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffxrxfr.exec:\ffxrxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbnbnt.exec:\hbnbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhbnth.exec:\bhbnth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djvpd.exec:\djvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrlrflf.exec:\rrlrflf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htbtnb.exec:\htbtnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvjpv.exec:\vvjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddpjp.exec:\ddpjp.exe17⤵
- Executes dropped EXE
-
\??\c:\7hhnnn.exec:\7hhnnn.exe18⤵
- Executes dropped EXE
-
\??\c:\hhbhtt.exec:\hhbhtt.exe19⤵
- Executes dropped EXE
-
\??\c:\7pdpp.exec:\7pdpp.exe20⤵
- Executes dropped EXE
-
\??\c:\dpppd.exec:\dpppd.exe21⤵
- Executes dropped EXE
-
\??\c:\tbbtbb.exec:\tbbtbb.exe22⤵
- Executes dropped EXE
-
\??\c:\bhtbnb.exec:\bhtbnb.exe23⤵
- Executes dropped EXE
-
\??\c:\pjddj.exec:\pjddj.exe24⤵
- Executes dropped EXE
-
\??\c:\llffffr.exec:\llffffr.exe25⤵
- Executes dropped EXE
-
\??\c:\ttntbb.exec:\ttntbb.exe26⤵
- Executes dropped EXE
-
\??\c:\tnhnbh.exec:\tnhnbh.exe27⤵
- Executes dropped EXE
-
\??\c:\ffxflxl.exec:\ffxflxl.exe28⤵
- Executes dropped EXE
-
\??\c:\5frxxxf.exec:\5frxxxf.exe29⤵
- Executes dropped EXE
-
\??\c:\tnhhbh.exec:\tnhhbh.exe30⤵
- Executes dropped EXE
-
\??\c:\pjvdj.exec:\pjvdj.exe31⤵
- Executes dropped EXE
-
\??\c:\3lflxfl.exec:\3lflxfl.exe32⤵
- Executes dropped EXE
-
\??\c:\xrrfxxr.exec:\xrrfxxr.exe33⤵
- Executes dropped EXE
-
\??\c:\1btbnb.exec:\1btbnb.exe34⤵
- Executes dropped EXE
-
\??\c:\9dvdp.exec:\9dvdp.exe35⤵
- Executes dropped EXE
-
\??\c:\3rlllrx.exec:\3rlllrx.exe36⤵
- Executes dropped EXE
-
\??\c:\xrrxffx.exec:\xrrxffx.exe37⤵
- Executes dropped EXE
-
\??\c:\vdvjd.exec:\vdvjd.exe38⤵
- Executes dropped EXE
-
\??\c:\vvdjv.exec:\vvdjv.exe39⤵
- Executes dropped EXE
-
\??\c:\rrlrffl.exec:\rrlrffl.exe40⤵
- Executes dropped EXE
-
\??\c:\llflxxf.exec:\llflxxf.exe41⤵
- Executes dropped EXE
-
\??\c:\1vppd.exec:\1vppd.exe42⤵
- Executes dropped EXE
-
\??\c:\ppjvj.exec:\ppjvj.exe43⤵
- Executes dropped EXE
-
\??\c:\lfflrrx.exec:\lfflrrx.exe44⤵
- Executes dropped EXE
-
\??\c:\bbttbh.exec:\bbttbh.exe45⤵
- Executes dropped EXE
-
\??\c:\bbbhhb.exec:\bbbhhb.exe46⤵
- Executes dropped EXE
-
\??\c:\pjjpd.exec:\pjjpd.exe47⤵
- Executes dropped EXE
-
\??\c:\3dvdj.exec:\3dvdj.exe48⤵
- Executes dropped EXE
-
\??\c:\rrrxllx.exec:\rrrxllx.exe49⤵
- Executes dropped EXE
-
\??\c:\nnhttn.exec:\nnhttn.exe50⤵
- Executes dropped EXE
-
\??\c:\nhbthn.exec:\nhbthn.exe51⤵
- Executes dropped EXE
-
\??\c:\jppjj.exec:\jppjj.exe52⤵
- Executes dropped EXE
-
\??\c:\llxfflx.exec:\llxfflx.exe53⤵
- Executes dropped EXE
-
\??\c:\lfrxfxl.exec:\lfrxfxl.exe54⤵
- Executes dropped EXE
-
\??\c:\ntbbth.exec:\ntbbth.exe55⤵
- Executes dropped EXE
-
\??\c:\5vpvj.exec:\5vpvj.exe56⤵
- Executes dropped EXE
-
\??\c:\7jppp.exec:\7jppp.exe57⤵
- Executes dropped EXE
-
\??\c:\1frxxxf.exec:\1frxxxf.exe58⤵
- Executes dropped EXE
-
\??\c:\5bhnnt.exec:\5bhnnt.exe59⤵
- Executes dropped EXE
-
\??\c:\btnnhn.exec:\btnnhn.exe60⤵
- Executes dropped EXE
-
\??\c:\jdvdj.exec:\jdvdj.exe61⤵
- Executes dropped EXE
-
\??\c:\vpddj.exec:\vpddj.exe62⤵
- Executes dropped EXE
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe63⤵
- Executes dropped EXE
-
\??\c:\rlffxrr.exec:\rlffxrr.exe64⤵
- Executes dropped EXE
-
\??\c:\nnbbhn.exec:\nnbbhn.exe65⤵
- Executes dropped EXE
-
\??\c:\dvpvd.exec:\dvpvd.exe66⤵
-
\??\c:\5pjdd.exec:\5pjdd.exe67⤵
-
\??\c:\xrfflrx.exec:\xrfflrx.exe68⤵
-
\??\c:\3lfflrf.exec:\3lfflrf.exe69⤵
-
\??\c:\tnhhbh.exec:\tnhhbh.exe70⤵
-
\??\c:\nntbnn.exec:\nntbnn.exe71⤵
-
\??\c:\vvppj.exec:\vvppj.exe72⤵
-
\??\c:\3frrxxf.exec:\3frrxxf.exe73⤵
-
\??\c:\rlrxllx.exec:\rlrxllx.exe74⤵
-
\??\c:\bhtntb.exec:\bhtntb.exe75⤵
-
\??\c:\5nbbhh.exec:\5nbbhh.exe76⤵
-
\??\c:\ppppv.exec:\ppppv.exe77⤵
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe78⤵
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe79⤵
-
\??\c:\tntbhh.exec:\tntbhh.exe80⤵
-
\??\c:\hbbbnh.exec:\hbbbnh.exe81⤵
-
\??\c:\jppdj.exec:\jppdj.exe82⤵
-
\??\c:\pjddj.exec:\pjddj.exe83⤵
-
\??\c:\lfxlxxl.exec:\lfxlxxl.exe84⤵
-
\??\c:\rllxlrx.exec:\rllxlrx.exe85⤵
-
\??\c:\7bhnhn.exec:\7bhnhn.exe86⤵
-
\??\c:\9nnbnt.exec:\9nnbnt.exe87⤵
-
\??\c:\dvjvv.exec:\dvjvv.exe88⤵
-
\??\c:\jdvvv.exec:\jdvvv.exe89⤵
-
\??\c:\lrflxxr.exec:\lrflxxr.exe90⤵
-
\??\c:\lfxxxff.exec:\lfxxxff.exe91⤵
-
\??\c:\nnbhnt.exec:\nnbhnt.exe92⤵
-
\??\c:\bnbbhb.exec:\bnbbhb.exe93⤵
-
\??\c:\jdvpv.exec:\jdvpv.exe94⤵
-
\??\c:\lfxxlrf.exec:\lfxxlrf.exe95⤵
-
\??\c:\xrllllx.exec:\xrllllx.exe96⤵
-
\??\c:\5nnnnn.exec:\5nnnnn.exe97⤵
-
\??\c:\9bhbbn.exec:\9bhbbn.exe98⤵
-
\??\c:\vpdvv.exec:\vpdvv.exe99⤵
-
\??\c:\7vpdp.exec:\7vpdp.exe100⤵
-
\??\c:\1rfxxfl.exec:\1rfxxfl.exe101⤵
-
\??\c:\9thhhh.exec:\9thhhh.exe102⤵
-
\??\c:\1bbbhh.exec:\1bbbhh.exe103⤵
-
\??\c:\vpdvp.exec:\vpdvp.exe104⤵
-
\??\c:\pjdjp.exec:\pjdjp.exe105⤵
-
\??\c:\rffrrlx.exec:\rffrrlx.exe106⤵
-
\??\c:\lxlflfl.exec:\lxlflfl.exe107⤵
-
\??\c:\9htthh.exec:\9htthh.exe108⤵
-
\??\c:\hhtbnb.exec:\hhtbnb.exe109⤵
-
\??\c:\vpdvd.exec:\vpdvd.exe110⤵
-
\??\c:\3pdjj.exec:\3pdjj.exe111⤵
-
\??\c:\1ffrlfx.exec:\1ffrlfx.exe112⤵
-
\??\c:\rxrxrxl.exec:\rxrxrxl.exe113⤵
-
\??\c:\hbnthn.exec:\hbnthn.exe114⤵
-
\??\c:\9vvdd.exec:\9vvdd.exe115⤵
-
\??\c:\pdvvd.exec:\pdvvd.exe116⤵
-
\??\c:\3lffffr.exec:\3lffffr.exe117⤵
-
\??\c:\lfrffff.exec:\lfrffff.exe118⤵
-
\??\c:\nnbbnn.exec:\nnbbnn.exe119⤵
-
\??\c:\jdpjv.exec:\jdpjv.exe120⤵
-
\??\c:\pjvdj.exec:\pjvdj.exe121⤵
-
\??\c:\rrflxff.exec:\rrflxff.exe122⤵
-
\??\c:\rrlrxfx.exec:\rrlrxfx.exe123⤵
-
\??\c:\9bhhhb.exec:\9bhhhb.exe124⤵
-
\??\c:\nbnhtt.exec:\nbnhtt.exe125⤵
-
\??\c:\ddpvv.exec:\ddpvv.exe126⤵
-
\??\c:\ppddd.exec:\ppddd.exe127⤵
-
\??\c:\xlfxxxl.exec:\xlfxxxl.exe128⤵
-
\??\c:\7xrlrxx.exec:\7xrlrxx.exe129⤵
-
\??\c:\hhbbbb.exec:\hhbbbb.exe130⤵
-
\??\c:\bhhtbh.exec:\bhhtbh.exe131⤵
-
\??\c:\jdpvv.exec:\jdpvv.exe132⤵
-
\??\c:\ddvdp.exec:\ddvdp.exe133⤵
-
\??\c:\lflfllr.exec:\lflfllr.exe134⤵
-
\??\c:\lrlxrlx.exec:\lrlxrlx.exe135⤵
-
\??\c:\tbnthh.exec:\tbnthh.exe136⤵
-
\??\c:\hbnntt.exec:\hbnntt.exe137⤵
-
\??\c:\ddpdj.exec:\ddpdj.exe138⤵
-
\??\c:\jjpdd.exec:\jjpdd.exe139⤵
-
\??\c:\lfllxxf.exec:\lfllxxf.exe140⤵
-
\??\c:\xlxxlrf.exec:\xlxxlrf.exe141⤵
-
\??\c:\bthbnh.exec:\bthbnh.exe142⤵
-
\??\c:\ntntnn.exec:\ntntnn.exe143⤵
-
\??\c:\jdddd.exec:\jdddd.exe144⤵
-
\??\c:\1jpdd.exec:\1jpdd.exe145⤵
-
\??\c:\lxrrxxl.exec:\lxrrxxl.exe146⤵
-
\??\c:\xrrfrrf.exec:\xrrfrrf.exe147⤵
-
\??\c:\tnhntb.exec:\tnhntb.exe148⤵
-
\??\c:\nhhhbh.exec:\nhhhbh.exe149⤵
-
\??\c:\jpdvv.exec:\jpdvv.exe150⤵
-
\??\c:\fxlfffl.exec:\fxlfffl.exe151⤵
-
\??\c:\rffflff.exec:\rffflff.exe152⤵
-
\??\c:\5bnbbb.exec:\5bnbbb.exe153⤵
-
\??\c:\htbtbt.exec:\htbtbt.exe154⤵
-
\??\c:\dvppv.exec:\dvppv.exe155⤵
-
\??\c:\jdpjj.exec:\jdpjj.exe156⤵
-
\??\c:\lxlfrrf.exec:\lxlfrrf.exe157⤵
-
\??\c:\llxlllr.exec:\llxlllr.exe158⤵
-
\??\c:\tnbbtt.exec:\tnbbtt.exe159⤵
-
\??\c:\7bnttb.exec:\7bnttb.exe160⤵
-
\??\c:\vdvvd.exec:\vdvvd.exe161⤵
-
\??\c:\vvjjd.exec:\vvjjd.exe162⤵
-
\??\c:\xlfxxxf.exec:\xlfxxxf.exe163⤵
-
\??\c:\5frlrlx.exec:\5frlrlx.exe164⤵
-
\??\c:\ttntbt.exec:\ttntbt.exe165⤵
-
\??\c:\7bbtnh.exec:\7bbtnh.exe166⤵
-
\??\c:\vjddp.exec:\vjddp.exe167⤵
-
\??\c:\ddvdv.exec:\ddvdv.exe168⤵
-
\??\c:\7xxrrrf.exec:\7xxrrrf.exe169⤵
-
\??\c:\3lfllrr.exec:\3lfllrr.exe170⤵
-
\??\c:\nhnttn.exec:\nhnttn.exe171⤵
-
\??\c:\tnbntn.exec:\tnbntn.exe172⤵
-
\??\c:\vpjjv.exec:\vpjjv.exe173⤵
-
\??\c:\5dvdj.exec:\5dvdj.exe174⤵
-
\??\c:\7xllrll.exec:\7xllrll.exe175⤵
-
\??\c:\5frrxxl.exec:\5frrxxl.exe176⤵
-
\??\c:\7hhhbt.exec:\7hhhbt.exe177⤵
-
\??\c:\5hnhnn.exec:\5hnhnn.exe178⤵
-
\??\c:\3dvvv.exec:\3dvvv.exe179⤵
-
\??\c:\xrfrxlr.exec:\xrfrxlr.exe180⤵
-
\??\c:\3tnbhn.exec:\3tnbhn.exe181⤵
-
\??\c:\5dpvd.exec:\5dpvd.exe182⤵
-
\??\c:\ppjpv.exec:\ppjpv.exe183⤵
-
\??\c:\fxxxlrl.exec:\fxxxlrl.exe184⤵
-
\??\c:\9xxxffr.exec:\9xxxffr.exe185⤵
-
\??\c:\tnhnbh.exec:\tnhnbh.exe186⤵
-
\??\c:\nnhbhn.exec:\nnhbhn.exe187⤵
-
\??\c:\djjpv.exec:\djjpv.exe188⤵
-
\??\c:\jdppp.exec:\jdppp.exe189⤵
-
\??\c:\rlfflxl.exec:\rlfflxl.exe190⤵
-
\??\c:\xxrrffr.exec:\xxrrffr.exe191⤵
-
\??\c:\1ttntt.exec:\1ttntt.exe192⤵
-
\??\c:\btnnhn.exec:\btnnhn.exe193⤵
-
\??\c:\djjpd.exec:\djjpd.exe194⤵
-
\??\c:\dpvpd.exec:\dpvpd.exe195⤵
-
\??\c:\9frrxxf.exec:\9frrxxf.exe196⤵
-
\??\c:\bbnthn.exec:\bbnthn.exe197⤵
-
\??\c:\7vppd.exec:\7vppd.exe198⤵
-
\??\c:\1xrxxxl.exec:\1xrxxxl.exe199⤵
-
\??\c:\1bbbbh.exec:\1bbbbh.exe200⤵
-
\??\c:\jjppv.exec:\jjppv.exe201⤵
-
\??\c:\llrllfr.exec:\llrllfr.exe202⤵
-
\??\c:\httnnn.exec:\httnnn.exe203⤵
-
\??\c:\7jddj.exec:\7jddj.exe204⤵
-
\??\c:\bhtbht.exec:\bhtbht.exe205⤵
-
\??\c:\1jdvj.exec:\1jdvj.exe206⤵
-
\??\c:\dvddv.exec:\dvddv.exe207⤵
-
\??\c:\rxrlxfx.exec:\rxrlxfx.exe208⤵
-
\??\c:\btntht.exec:\btntht.exe209⤵
-
\??\c:\ffxflrf.exec:\ffxflrf.exe210⤵
-
\??\c:\jjvdj.exec:\jjvdj.exe211⤵
-
\??\c:\lrfxlff.exec:\lrfxlff.exe212⤵
-
\??\c:\ppjjv.exec:\ppjjv.exe213⤵
-
\??\c:\7fxxxxl.exec:\7fxxxxl.exe214⤵
-
\??\c:\bbtbhn.exec:\bbtbhn.exe215⤵
-
\??\c:\vpjpd.exec:\vpjpd.exe216⤵
-
\??\c:\ddddp.exec:\ddddp.exe217⤵
-
\??\c:\tttbhh.exec:\tttbhh.exe218⤵
-
\??\c:\vppdj.exec:\vppdj.exe219⤵
-
\??\c:\hhhnbh.exec:\hhhnbh.exe220⤵
-
\??\c:\jjdpp.exec:\jjdpp.exe221⤵
-
\??\c:\fxfllrx.exec:\fxfllrx.exe222⤵
-
\??\c:\3ppvd.exec:\3ppvd.exe223⤵
-
\??\c:\xxlrfll.exec:\xxlrfll.exe224⤵
-
\??\c:\3tntbb.exec:\3tntbb.exe225⤵
-
\??\c:\btnttb.exec:\btnttb.exe226⤵
-
\??\c:\3dvvv.exec:\3dvvv.exe227⤵
-
\??\c:\xxxflrf.exec:\xxxflrf.exe228⤵
-
\??\c:\nnhnhh.exec:\nnhnhh.exe229⤵
-
\??\c:\9dppp.exec:\9dppp.exe230⤵
-
\??\c:\xxffllr.exec:\xxffllr.exe231⤵
-
\??\c:\hbtthn.exec:\hbtthn.exe232⤵
-
\??\c:\djvjv.exec:\djvjv.exe233⤵
-
\??\c:\5hhhnt.exec:\5hhhnt.exe234⤵
-
\??\c:\7xflllr.exec:\7xflllr.exe235⤵
-
\??\c:\hbthnt.exec:\hbthnt.exe236⤵
-
\??\c:\pjddj.exec:\pjddj.exe237⤵
-
\??\c:\7flllll.exec:\7flllll.exe238⤵
-
\??\c:\nnhnht.exec:\nnhnht.exe239⤵
-
\??\c:\3pppv.exec:\3pppv.exe240⤵
-
\??\c:\fxrxxff.exec:\fxrxxff.exe241⤵