Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-05-2024 20:54
Behavioral task
behavioral1
Sample
3d6d6bfc5ea6c02a7bcbba5af7df31e223ce6ce6559156334c3499ef0a7885bf.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
3d6d6bfc5ea6c02a7bcbba5af7df31e223ce6ce6559156334c3499ef0a7885bf.exe
-
Size
121KB
-
MD5
63dac6b8ad9a613588db62ca54f61d5b
-
SHA1
41cca2d53d4453a001e4b3ba3d4ffcf03e071deb
-
SHA256
3d6d6bfc5ea6c02a7bcbba5af7df31e223ce6ce6559156334c3499ef0a7885bf
-
SHA512
336454e3380db377544087051803f7b59a8b6c39abf1c18d1bd91b8044c8fb351ffbe8d564e9d8b8891ece99201b944ee43d089a3d59ee5304e9f7b21b842b83
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcka62c+8+dRN1j:9cm4FmowdHoSZ6lCX3
Malware Config
Signatures
-
Detect Blackmoon payload 53 IoCs
Processes:
resource yara_rule behavioral1/memory/1540-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2144-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/972-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2244-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1812-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-304-0x00000000777E0000-0x00000000778FF000-memory.dmp family_blackmoon behavioral1/memory/2684-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1424-377-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2884-378-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1604-301-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2976-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/956-267-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1964-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/392-239-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1160-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/556-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1240-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-193-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/380-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1584-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1652-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1592-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-440-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1968-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1860-448-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1164-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1784-515-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1184-520-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/3016-601-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2580-621-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2384-653-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-703-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2808-822-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2192-821-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1764-842-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1128-971-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1832-1004-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/704-1126-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2696-1148-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/1540-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jpphn.exe UPX behavioral1/memory/1540-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2600-9-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2600-20-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2144-21-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pfdtpv.exe UPX behavioral1/memory/2144-30-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vvbnfdn.exe UPX \??\c:\nvpnfx.exe UPX \??\c:\rfnjnbr.exe UPX \??\c:\tnffp.exe UPX behavioral1/memory/1716-85-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lpjnn.exe UPX \??\c:\rhllf.exe UPX behavioral1/memory/972-110-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\ndhjp.exe UPX C:\pddnjn.exe UPX C:\bhjvdx.exe UPX behavioral1/memory/2008-146-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2040-156-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\djvlf.exe UPX \??\c:\tvxvntx.exe UPX behavioral1/memory/2244-155-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\frffp.exe UPX C:\jbnxl.exe UPX behavioral1/memory/1812-212-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\rxntrtl.exe UPX \??\c:\llvjr.exe UPX \??\c:\vjfhthb.exe UPX C:\hbjvldx.exe UPX \??\c:\fvbfbp.exe UPX C:\xxhtt.exe UPX C:\hbjrt.exe UPX \??\c:\lbbjb.exe UPX behavioral1/memory/2908-302-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2908-304-0x00000000777E0000-0x00000000778FF000-memory.dmp UPX behavioral1/memory/2144-325-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2684-337-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2888-370-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1604-292-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2976-385-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1076-250-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1964-248-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1160-231-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/556-398-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1160-223-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\pnlvpx.exe UPX \??\c:\xrxbl.exe UPX behavioral1/memory/1240-204-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\dxttrj.exe UPX behavioral1/memory/380-405-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2276-183-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2812-412-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2276-175-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\fvvpfn.exe UPX behavioral1/memory/1988-172-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\vfjljj.exe UPX \??\c:\bpbnfv.exe UPX behavioral1/memory/2840-129-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2840-120-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1584-119-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\blppn.exe UPX behavioral1/memory/1652-102-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
jpphn.exepfdtpv.exevvbnfdn.exejprjpbv.exenvpnfx.exerfnjnbr.exexbfdrvv.exetnffp.exelpjnn.exerhllf.exeblppn.exendhjp.exepddnjn.exebpbnfv.exebhjvdx.exevfjljj.exetvxvntx.exedjvlf.exefvvpfn.exedxttrj.exefrffp.exexrxbl.exejbnxl.exepnlvpx.exerxntrtl.exellvjr.exevjfhthb.exehbjvldx.exefvbfbp.exexxhtt.exehbjrt.exelbbjb.exetxfdjx.exelrbdpt.exevpvtpr.exebnntf.exelpdhv.exejbrnr.exerbbxhd.exepdrxln.exephflvf.exevdntrph.exedhhrl.exenfnxrb.exejbxjhjb.exeppjtbxt.exernbnr.exednxph.exedrnlx.exepxdtbrr.exenxvbt.exefhvrnb.exepnvrfhr.exefjxptv.exendbfx.exenvfblt.exerxvhth.exenbjprxf.exeplvddb.exebhjbblj.exedpjjbr.exenlnvbf.exedvrnrhp.exehhxrrj.exepid process 2600 jpphn.exe 2144 pfdtpv.exe 2680 vvbnfdn.exe 2540 jprjpbv.exe 2688 nvpnfx.exe 2576 rfnjnbr.exe 2408 xbfdrvv.exe 1716 tnffp.exe 1640 lpjnn.exe 1652 rhllf.exe 972 blppn.exe 1584 ndhjp.exe 2840 pddnjn.exe 1452 bpbnfv.exe 2008 bhjvdx.exe 2244 vfjljj.exe 2040 tvxvntx.exe 1988 djvlf.exe 2276 fvvpfn.exe 2920 dxttrj.exe 1240 frffp.exe 1812 xrxbl.exe 948 jbnxl.exe 1160 pnlvpx.exe 392 rxntrtl.exe 1964 llvjr.exe 1076 vjfhthb.exe 956 hbjvldx.exe 1264 fvbfbp.exe 1588 xxhtt.exe 2372 hbjrt.exe 1604 lbbjb.exe 2908 txfdjx.exe 2548 lrbdpt.exe 2536 vpvtpr.exe 2144 bnntf.exe 2684 lpdhv.exe 2620 jbrnr.exe 2884 rbbxhd.exe 2628 pdrxln.exe 2436 phflvf.exe 2888 vdntrph.exe 1424 dhhrl.exe 2976 nfnxrb.exe 784 jbxjhjb.exe 556 ppjtbxt.exe 380 rnbnr.exe 2812 dnxph.exe 2840 drnlx.exe 1452 pxdtbrr.exe 2008 nxvbt.exe 1592 fhvrnb.exe 1968 pnvrfhr.exe 1860 fjxptv.exe 2004 ndbfx.exe 2344 nvfblt.exe 936 rxvhth.exe 2112 nbjprxf.exe 2772 plvddb.exe 2168 bhjbblj.exe 1812 dpjjbr.exe 1164 nlnvbf.exe 2988 dvrnrhp.exe 1784 hhxrrj.exe -
Processes:
resource yara_rule behavioral1/memory/1540-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpphn.exe upx behavioral1/memory/1540-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2600-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2600-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2144-21-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pfdtpv.exe upx behavioral1/memory/2144-30-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvbnfdn.exe upx \??\c:\nvpnfx.exe upx \??\c:\rfnjnbr.exe upx \??\c:\tnffp.exe upx behavioral1/memory/1716-85-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lpjnn.exe upx \??\c:\rhllf.exe upx behavioral1/memory/972-110-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ndhjp.exe upx C:\pddnjn.exe upx C:\bhjvdx.exe upx behavioral1/memory/2008-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2040-156-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djvlf.exe upx \??\c:\tvxvntx.exe upx behavioral1/memory/2244-155-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frffp.exe upx C:\jbnxl.exe upx behavioral1/memory/1812-212-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rxntrtl.exe upx \??\c:\llvjr.exe upx \??\c:\vjfhthb.exe upx C:\hbjvldx.exe upx \??\c:\fvbfbp.exe upx C:\xxhtt.exe upx C:\hbjrt.exe upx \??\c:\lbbjb.exe upx behavioral1/memory/2908-302-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2908-304-0x00000000777E0000-0x00000000778FF000-memory.dmp upx behavioral1/memory/2144-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-337-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-370-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1604-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2976-385-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1076-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1964-248-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1160-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/556-398-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1160-223-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pnlvpx.exe upx \??\c:\xrxbl.exe upx behavioral1/memory/1240-204-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dxttrj.exe upx behavioral1/memory/380-405-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2276-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-412-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2276-175-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fvvpfn.exe upx behavioral1/memory/1988-172-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vfjljj.exe upx \??\c:\bpbnfv.exe upx behavioral1/memory/2840-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2840-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1584-119-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\blppn.exe upx behavioral1/memory/1652-102-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3d6d6bfc5ea6c02a7bcbba5af7df31e223ce6ce6559156334c3499ef0a7885bf.exejpphn.exepfdtpv.exevvbnfdn.exejprjpbv.exenvpnfx.exerfnjnbr.exexbfdrvv.exetnffp.exelpjnn.exerhllf.exeblppn.exendhjp.exepddnjn.exebpbnfv.exebhjvdx.exedescription pid process target process PID 1540 wrote to memory of 2600 1540 3d6d6bfc5ea6c02a7bcbba5af7df31e223ce6ce6559156334c3499ef0a7885bf.exe jpphn.exe PID 1540 wrote to memory of 2600 1540 3d6d6bfc5ea6c02a7bcbba5af7df31e223ce6ce6559156334c3499ef0a7885bf.exe jpphn.exe PID 1540 wrote to memory of 2600 1540 3d6d6bfc5ea6c02a7bcbba5af7df31e223ce6ce6559156334c3499ef0a7885bf.exe jpphn.exe PID 1540 wrote to memory of 2600 1540 3d6d6bfc5ea6c02a7bcbba5af7df31e223ce6ce6559156334c3499ef0a7885bf.exe jpphn.exe PID 2600 wrote to memory of 2144 2600 jpphn.exe bnntf.exe PID 2600 wrote to memory of 2144 2600 jpphn.exe bnntf.exe PID 2600 wrote to memory of 2144 2600 jpphn.exe bnntf.exe PID 2600 wrote to memory of 2144 2600 jpphn.exe bnntf.exe PID 2144 wrote to memory of 2680 2144 pfdtpv.exe vvbnfdn.exe PID 2144 wrote to memory of 2680 2144 pfdtpv.exe vvbnfdn.exe PID 2144 wrote to memory of 2680 2144 pfdtpv.exe vvbnfdn.exe PID 2144 wrote to memory of 2680 2144 pfdtpv.exe vvbnfdn.exe PID 2680 wrote to memory of 2540 2680 vvbnfdn.exe jprjpbv.exe PID 2680 wrote to memory of 2540 2680 vvbnfdn.exe jprjpbv.exe PID 2680 wrote to memory of 2540 2680 vvbnfdn.exe jprjpbv.exe PID 2680 wrote to memory of 2540 2680 vvbnfdn.exe jprjpbv.exe PID 2540 wrote to memory of 2688 2540 jprjpbv.exe nvpnfx.exe PID 2540 wrote to memory of 2688 2540 jprjpbv.exe nvpnfx.exe PID 2540 wrote to memory of 2688 2540 jprjpbv.exe nvpnfx.exe PID 2540 wrote to memory of 2688 2540 jprjpbv.exe nvpnfx.exe PID 2688 wrote to memory of 2576 2688 nvpnfx.exe rfnjnbr.exe PID 2688 wrote to memory of 2576 2688 nvpnfx.exe rfnjnbr.exe PID 2688 wrote to memory of 2576 2688 nvpnfx.exe rfnjnbr.exe PID 2688 wrote to memory of 2576 2688 nvpnfx.exe rfnjnbr.exe PID 2576 wrote to memory of 2408 2576 rfnjnbr.exe xbfdrvv.exe PID 2576 wrote to memory of 2408 2576 rfnjnbr.exe xbfdrvv.exe PID 2576 wrote to memory of 2408 2576 rfnjnbr.exe xbfdrvv.exe PID 2576 wrote to memory of 2408 2576 rfnjnbr.exe xbfdrvv.exe PID 2408 wrote to memory of 1716 2408 xbfdrvv.exe tnffp.exe PID 2408 wrote to memory of 1716 2408 xbfdrvv.exe tnffp.exe PID 2408 wrote to memory of 1716 2408 xbfdrvv.exe tnffp.exe PID 2408 wrote to memory of 1716 2408 xbfdrvv.exe tnffp.exe PID 1716 wrote to memory of 1640 1716 tnffp.exe lpjnn.exe PID 1716 wrote to memory of 1640 1716 tnffp.exe lpjnn.exe PID 1716 wrote to memory of 1640 1716 tnffp.exe lpjnn.exe PID 1716 wrote to memory of 1640 1716 tnffp.exe lpjnn.exe PID 1640 wrote to memory of 1652 1640 lpjnn.exe rhllf.exe PID 1640 wrote to memory of 1652 1640 lpjnn.exe rhllf.exe PID 1640 wrote to memory of 1652 1640 lpjnn.exe rhllf.exe PID 1640 wrote to memory of 1652 1640 lpjnn.exe rhllf.exe PID 1652 wrote to memory of 972 1652 rhllf.exe blppn.exe PID 1652 wrote to memory of 972 1652 rhllf.exe blppn.exe PID 1652 wrote to memory of 972 1652 rhllf.exe blppn.exe PID 1652 wrote to memory of 972 1652 rhllf.exe blppn.exe PID 972 wrote to memory of 1584 972 blppn.exe ndhjp.exe PID 972 wrote to memory of 1584 972 blppn.exe ndhjp.exe PID 972 wrote to memory of 1584 972 blppn.exe ndhjp.exe PID 972 wrote to memory of 1584 972 blppn.exe ndhjp.exe PID 1584 wrote to memory of 2840 1584 ndhjp.exe pddnjn.exe PID 1584 wrote to memory of 2840 1584 ndhjp.exe pddnjn.exe PID 1584 wrote to memory of 2840 1584 ndhjp.exe pddnjn.exe PID 1584 wrote to memory of 2840 1584 ndhjp.exe pddnjn.exe PID 2840 wrote to memory of 1452 2840 pddnjn.exe bpbnfv.exe PID 2840 wrote to memory of 1452 2840 pddnjn.exe bpbnfv.exe PID 2840 wrote to memory of 1452 2840 pddnjn.exe bpbnfv.exe PID 2840 wrote to memory of 1452 2840 pddnjn.exe bpbnfv.exe PID 1452 wrote to memory of 2008 1452 bpbnfv.exe nxvbt.exe PID 1452 wrote to memory of 2008 1452 bpbnfv.exe nxvbt.exe PID 1452 wrote to memory of 2008 1452 bpbnfv.exe nxvbt.exe PID 1452 wrote to memory of 2008 1452 bpbnfv.exe nxvbt.exe PID 2008 wrote to memory of 2244 2008 bhjvdx.exe vfjljj.exe PID 2008 wrote to memory of 2244 2008 bhjvdx.exe vfjljj.exe PID 2008 wrote to memory of 2244 2008 bhjvdx.exe vfjljj.exe PID 2008 wrote to memory of 2244 2008 bhjvdx.exe vfjljj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d6d6bfc5ea6c02a7bcbba5af7df31e223ce6ce6559156334c3499ef0a7885bf.exe"C:\Users\Admin\AppData\Local\Temp\3d6d6bfc5ea6c02a7bcbba5af7df31e223ce6ce6559156334c3499ef0a7885bf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\jpphn.exec:\jpphn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pfdtpv.exec:\pfdtpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvbnfdn.exec:\vvbnfdn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jprjpbv.exec:\jprjpbv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nvpnfx.exec:\nvpnfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfnjnbr.exec:\rfnjnbr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xbfdrvv.exec:\xbfdrvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnffp.exec:\tnffp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lpjnn.exec:\lpjnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rhllf.exec:\rhllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\blppn.exec:\blppn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ndhjp.exec:\ndhjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pddnjn.exec:\pddnjn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bpbnfv.exec:\bpbnfv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhjvdx.exec:\bhjvdx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vfjljj.exec:\vfjljj.exe17⤵
- Executes dropped EXE
-
\??\c:\tvxvntx.exec:\tvxvntx.exe18⤵
- Executes dropped EXE
-
\??\c:\djvlf.exec:\djvlf.exe19⤵
- Executes dropped EXE
-
\??\c:\fvvpfn.exec:\fvvpfn.exe20⤵
- Executes dropped EXE
-
\??\c:\dxttrj.exec:\dxttrj.exe21⤵
- Executes dropped EXE
-
\??\c:\frffp.exec:\frffp.exe22⤵
- Executes dropped EXE
-
\??\c:\xrxbl.exec:\xrxbl.exe23⤵
- Executes dropped EXE
-
\??\c:\jbnxl.exec:\jbnxl.exe24⤵
- Executes dropped EXE
-
\??\c:\pnlvpx.exec:\pnlvpx.exe25⤵
- Executes dropped EXE
-
\??\c:\rxntrtl.exec:\rxntrtl.exe26⤵
- Executes dropped EXE
-
\??\c:\llvjr.exec:\llvjr.exe27⤵
- Executes dropped EXE
-
\??\c:\vjfhthb.exec:\vjfhthb.exe28⤵
- Executes dropped EXE
-
\??\c:\hbjvldx.exec:\hbjvldx.exe29⤵
- Executes dropped EXE
-
\??\c:\fvbfbp.exec:\fvbfbp.exe30⤵
- Executes dropped EXE
-
\??\c:\xxhtt.exec:\xxhtt.exe31⤵
- Executes dropped EXE
-
\??\c:\hbjrt.exec:\hbjrt.exe32⤵
- Executes dropped EXE
-
\??\c:\lbbjb.exec:\lbbjb.exe33⤵
- Executes dropped EXE
-
\??\c:\txfdjx.exec:\txfdjx.exe34⤵
- Executes dropped EXE
-
\??\c:\fjtrnp.exec:\fjtrnp.exe35⤵
-
\??\c:\lrbdpt.exec:\lrbdpt.exe36⤵
- Executes dropped EXE
-
\??\c:\vpvtpr.exec:\vpvtpr.exe37⤵
- Executes dropped EXE
-
\??\c:\bnntf.exec:\bnntf.exe38⤵
- Executes dropped EXE
-
\??\c:\lpdhv.exec:\lpdhv.exe39⤵
- Executes dropped EXE
-
\??\c:\jbrnr.exec:\jbrnr.exe40⤵
- Executes dropped EXE
-
\??\c:\rbbxhd.exec:\rbbxhd.exe41⤵
- Executes dropped EXE
-
\??\c:\pdrxln.exec:\pdrxln.exe42⤵
- Executes dropped EXE
-
\??\c:\phflvf.exec:\phflvf.exe43⤵
- Executes dropped EXE
-
\??\c:\vdntrph.exec:\vdntrph.exe44⤵
- Executes dropped EXE
-
\??\c:\dhhrl.exec:\dhhrl.exe45⤵
- Executes dropped EXE
-
\??\c:\nfnxrb.exec:\nfnxrb.exe46⤵
- Executes dropped EXE
-
\??\c:\jbxjhjb.exec:\jbxjhjb.exe47⤵
- Executes dropped EXE
-
\??\c:\ppjtbxt.exec:\ppjtbxt.exe48⤵
- Executes dropped EXE
-
\??\c:\rnbnr.exec:\rnbnr.exe49⤵
- Executes dropped EXE
-
\??\c:\dnxph.exec:\dnxph.exe50⤵
- Executes dropped EXE
-
\??\c:\drnlx.exec:\drnlx.exe51⤵
- Executes dropped EXE
-
\??\c:\pxdtbrr.exec:\pxdtbrr.exe52⤵
- Executes dropped EXE
-
\??\c:\nxvbt.exec:\nxvbt.exe53⤵
- Executes dropped EXE
-
\??\c:\fhvrnb.exec:\fhvrnb.exe54⤵
- Executes dropped EXE
-
\??\c:\pnvrfhr.exec:\pnvrfhr.exe55⤵
- Executes dropped EXE
-
\??\c:\fjxptv.exec:\fjxptv.exe56⤵
- Executes dropped EXE
-
\??\c:\ndbfx.exec:\ndbfx.exe57⤵
- Executes dropped EXE
-
\??\c:\nvfblt.exec:\nvfblt.exe58⤵
- Executes dropped EXE
-
\??\c:\rxvhth.exec:\rxvhth.exe59⤵
- Executes dropped EXE
-
\??\c:\nbjprxf.exec:\nbjprxf.exe60⤵
- Executes dropped EXE
-
\??\c:\plvddb.exec:\plvddb.exe61⤵
- Executes dropped EXE
-
\??\c:\bhjbblj.exec:\bhjbblj.exe62⤵
- Executes dropped EXE
-
\??\c:\dpjjbr.exec:\dpjjbr.exe63⤵
- Executes dropped EXE
-
\??\c:\nlnvbf.exec:\nlnvbf.exe64⤵
- Executes dropped EXE
-
\??\c:\dvrnrhp.exec:\dvrnrhp.exe65⤵
- Executes dropped EXE
-
\??\c:\hhxrrj.exec:\hhxrrj.exe66⤵
- Executes dropped EXE
-
\??\c:\bdjhpxl.exec:\bdjhpxl.exe67⤵
-
\??\c:\ffnddbb.exec:\ffnddbb.exe68⤵
-
\??\c:\frfxl.exec:\frfxl.exe69⤵
-
\??\c:\fvlrtt.exec:\fvlrtt.exe70⤵
-
\??\c:\vpxpjd.exec:\vpxpjd.exe71⤵
-
\??\c:\tvjlx.exec:\tvjlx.exe72⤵
-
\??\c:\tvrdff.exec:\tvrdff.exe73⤵
-
\??\c:\pvndnn.exec:\pvndnn.exe74⤵
-
\??\c:\lxrrrnt.exec:\lxrrrnt.exe75⤵
-
\??\c:\xrjvpnd.exec:\xrjvpnd.exe76⤵
-
\??\c:\ddjlfxt.exec:\ddjlfxt.exe77⤵
-
\??\c:\rpvvxpx.exec:\rpvvxpx.exe78⤵
-
\??\c:\jjlhn.exec:\jjlhn.exe79⤵
-
\??\c:\pnxhrvp.exec:\pnxhrvp.exe80⤵
-
\??\c:\pldvp.exec:\pldvp.exe81⤵
-
\??\c:\jdrlnt.exec:\jdrlnt.exe82⤵
-
\??\c:\lbbpfdv.exec:\lbbpfdv.exe83⤵
-
\??\c:\xpjjrf.exec:\xpjjrf.exe84⤵
-
\??\c:\jhfjvxl.exec:\jhfjvxl.exe85⤵
-
\??\c:\vrftft.exec:\vrftft.exe86⤵
-
\??\c:\dvnddpf.exec:\dvnddpf.exe87⤵
-
\??\c:\dvxldhp.exec:\dvxldhp.exe88⤵
-
\??\c:\jrtnpjb.exec:\jrtnpjb.exe89⤵
-
\??\c:\ptvrdhn.exec:\ptvrdhn.exe90⤵
-
\??\c:\tttjfp.exec:\tttjfp.exe91⤵
-
\??\c:\tfjhhd.exec:\tfjhhd.exe92⤵
-
\??\c:\hxbjlr.exec:\hxbjlr.exe93⤵
-
\??\c:\lpbtl.exec:\lpbtl.exe94⤵
-
\??\c:\jxtnfv.exec:\jxtnfv.exe95⤵
-
\??\c:\vtbjlh.exec:\vtbjlh.exe96⤵
-
\??\c:\frvdj.exec:\frvdj.exe97⤵
-
\??\c:\vrlphh.exec:\vrlphh.exe98⤵
-
\??\c:\jffnv.exec:\jffnv.exe99⤵
-
\??\c:\rxvjtr.exec:\rxvjtr.exe100⤵
-
\??\c:\xvtthjf.exec:\xvtthjf.exe101⤵
-
\??\c:\vjdnj.exec:\vjdnj.exe102⤵
-
\??\c:\bhbxlv.exec:\bhbxlv.exe103⤵
-
\??\c:\vlvhfrb.exec:\vlvhfrb.exe104⤵
-
\??\c:\tlxtvrd.exec:\tlxtvrd.exe105⤵
-
\??\c:\vvfdhd.exec:\vvfdhd.exe106⤵
-
\??\c:\lhvjhh.exec:\lhvjhh.exe107⤵
-
\??\c:\xrvbr.exec:\xrvbr.exe108⤵
-
\??\c:\trdxhjh.exec:\trdxhjh.exe109⤵
-
\??\c:\nlxhhxp.exec:\nlxhhxp.exe110⤵
-
\??\c:\njjhpv.exec:\njjhpv.exe111⤵
-
\??\c:\bhvhhpn.exec:\bhvhhpn.exe112⤵
-
\??\c:\jtbflb.exec:\jtbflb.exe113⤵
-
\??\c:\bxrdt.exec:\bxrdt.exe114⤵
-
\??\c:\dbljfrj.exec:\dbljfrj.exe115⤵
-
\??\c:\prblxl.exec:\prblxl.exe116⤵
-
\??\c:\lflxbrf.exec:\lflxbrf.exe117⤵
-
\??\c:\jrfbnn.exec:\jrfbnn.exe118⤵
-
\??\c:\vvhlbh.exec:\vvhlbh.exe119⤵
-
\??\c:\rtnnl.exec:\rtnnl.exe120⤵
-
\??\c:\tvrxv.exec:\tvrxv.exe121⤵
-
\??\c:\vrjrr.exec:\vrjrr.exe122⤵
-
\??\c:\htxvh.exec:\htxvh.exe123⤵
-
\??\c:\drbvr.exec:\drbvr.exe124⤵
-
\??\c:\phfdrn.exec:\phfdrn.exe125⤵
-
\??\c:\lplllb.exec:\lplllb.exe126⤵
-
\??\c:\bfbnj.exec:\bfbnj.exe127⤵
-
\??\c:\bbvdtr.exec:\bbvdtr.exe128⤵
-
\??\c:\vbdnnd.exec:\vbdnnd.exe129⤵
-
\??\c:\vxxfnlb.exec:\vxxfnlb.exe130⤵
-
\??\c:\nndpxtr.exec:\nndpxtr.exe131⤵
-
\??\c:\xhjnjj.exec:\xhjnjj.exe132⤵
-
\??\c:\vppvjrl.exec:\vppvjrl.exe133⤵
-
\??\c:\jbftvf.exec:\jbftvf.exe134⤵
-
\??\c:\hvnht.exec:\hvnht.exe135⤵
-
\??\c:\vfbfnv.exec:\vfbfnv.exe136⤵
-
\??\c:\dvfrh.exec:\dvfrh.exe137⤵
-
\??\c:\dtrhtjn.exec:\dtrhtjn.exe138⤵
-
\??\c:\jhdplfl.exec:\jhdplfl.exe139⤵
-
\??\c:\pfhfnj.exec:\pfhfnj.exe140⤵
-
\??\c:\fnxvr.exec:\fnxvr.exe141⤵
-
\??\c:\vlhtrr.exec:\vlhtrr.exe142⤵
-
\??\c:\vdtlhh.exec:\vdtlhh.exe143⤵
-
\??\c:\jnlnlp.exec:\jnlnlp.exe144⤵
-
\??\c:\rrrtt.exec:\rrrtt.exe145⤵
-
\??\c:\dhfpnhp.exec:\dhfpnhp.exe146⤵
-
\??\c:\vvjjbbn.exec:\vvjjbbn.exe147⤵
-
\??\c:\hfxftr.exec:\hfxftr.exe148⤵
-
\??\c:\nvtfnbp.exec:\nvtfnbp.exe149⤵
-
\??\c:\fftjr.exec:\fftjr.exe150⤵
-
\??\c:\bffbpl.exec:\bffbpl.exe151⤵
-
\??\c:\xtvbtb.exec:\xtvbtb.exe152⤵
-
\??\c:\pfnndr.exec:\pfnndr.exe153⤵
-
\??\c:\nfltrld.exec:\nfltrld.exe154⤵
-
\??\c:\fhdjdt.exec:\fhdjdt.exe155⤵
-
\??\c:\dhhfd.exec:\dhhfd.exe156⤵
-
\??\c:\lpjtbt.exec:\lpjtbt.exe157⤵
-
\??\c:\jxrtbr.exec:\jxrtbr.exe158⤵
-
\??\c:\nrhnvb.exec:\nrhnvb.exe159⤵
-
\??\c:\pfdfpd.exec:\pfdfpd.exe160⤵
-
\??\c:\bffhjr.exec:\bffhjr.exe161⤵
-
\??\c:\rbxfjl.exec:\rbxfjl.exe162⤵
-
\??\c:\vvbbtvn.exec:\vvbbtvn.exe163⤵
-
\??\c:\jjptxn.exec:\jjptxn.exe164⤵
-
\??\c:\xbdjfxh.exec:\xbdjfxh.exe165⤵
-
\??\c:\ttjvt.exec:\ttjvt.exe166⤵
-
\??\c:\llrff.exec:\llrff.exe167⤵
-
\??\c:\trjfvl.exec:\trjfvl.exe168⤵
-
\??\c:\rvpddph.exec:\rvpddph.exe169⤵
-
\??\c:\hjndf.exec:\hjndf.exe170⤵
-
\??\c:\bxdvrh.exec:\bxdvrh.exe171⤵
-
\??\c:\fjhdnrv.exec:\fjhdnrv.exe172⤵
-
\??\c:\lbvnh.exec:\lbvnh.exe173⤵
-
\??\c:\xxtrjlj.exec:\xxtrjlj.exe174⤵
-
\??\c:\fplxddr.exec:\fplxddr.exe175⤵
-
\??\c:\ddvrhrj.exec:\ddvrhrj.exe176⤵
-
\??\c:\tjtvr.exec:\tjtvr.exe177⤵
-
\??\c:\djltn.exec:\djltn.exe178⤵
-
\??\c:\nnxpdnr.exec:\nnxpdnr.exe179⤵
-
\??\c:\drjfnb.exec:\drjfnb.exe180⤵
-
\??\c:\nddxjf.exec:\nddxjf.exe181⤵
-
\??\c:\tpvth.exec:\tpvth.exe182⤵
-
\??\c:\vfpjlph.exec:\vfpjlph.exe183⤵
-
\??\c:\xtpxtn.exec:\xtpxtn.exe184⤵
-
\??\c:\rhjvdfv.exec:\rhjvdfv.exe185⤵
-
\??\c:\dbdxnn.exec:\dbdxnn.exe186⤵
-
\??\c:\tllrjht.exec:\tllrjht.exe187⤵
-
\??\c:\vvnpfn.exec:\vvnpfn.exe188⤵
-
\??\c:\hbnfn.exec:\hbnfn.exe189⤵
-
\??\c:\httbv.exec:\httbv.exe190⤵
-
\??\c:\tjrbp.exec:\tjrbp.exe191⤵
-
\??\c:\prtrbl.exec:\prtrbl.exe192⤵
-
\??\c:\bjdhf.exec:\bjdhf.exe193⤵
-
\??\c:\fjvffvl.exec:\fjvffvl.exe194⤵
-
\??\c:\vjpvb.exec:\vjpvb.exe195⤵
-
\??\c:\hxbtjp.exec:\hxbtjp.exe196⤵
-
\??\c:\jfndfxl.exec:\jfndfxl.exe197⤵
-
\??\c:\pvrhb.exec:\pvrhb.exe198⤵
-
\??\c:\pfptvb.exec:\pfptvb.exe199⤵
-
\??\c:\nlfvhhr.exec:\nlfvhhr.exe200⤵
-
\??\c:\xntrxx.exec:\xntrxx.exe201⤵
-
\??\c:\rlhvjh.exec:\rlhvjh.exe202⤵
-
\??\c:\xlbvh.exec:\xlbvh.exe203⤵
-
\??\c:\fxhrddj.exec:\fxhrddj.exe204⤵
-
\??\c:\lhxdxl.exec:\lhxdxl.exe205⤵
-
\??\c:\hxlvr.exec:\hxlvr.exe206⤵
-
\??\c:\lrtph.exec:\lrtph.exe207⤵
-
\??\c:\frfpld.exec:\frfpld.exe208⤵
-
\??\c:\vrjbdnr.exec:\vrjbdnr.exe209⤵
-
\??\c:\dnnnv.exec:\dnnnv.exe210⤵
-
\??\c:\jpldrl.exec:\jpldrl.exe211⤵
-
\??\c:\pnndnnr.exec:\pnndnnr.exe212⤵
-
\??\c:\pvjbv.exec:\pvjbv.exe213⤵
-
\??\c:\dxrlfrt.exec:\dxrlfrt.exe214⤵
-
\??\c:\vhfdhrn.exec:\vhfdhrn.exe215⤵
-
\??\c:\dbdtb.exec:\dbdtb.exe216⤵
-
\??\c:\rrnjxr.exec:\rrnjxr.exe217⤵
-
\??\c:\jbrlbld.exec:\jbrlbld.exe218⤵
-
\??\c:\hjbfv.exec:\hjbfv.exe219⤵
-
\??\c:\vnfllnn.exec:\vnfllnn.exe220⤵
-
\??\c:\jbbbdjb.exec:\jbbbdjb.exe221⤵
-
\??\c:\rjrhpp.exec:\rjrhpp.exe222⤵
-
\??\c:\rrnrdvb.exec:\rrnrdvb.exe223⤵
-
\??\c:\tlfjvn.exec:\tlfjvn.exe224⤵
-
\??\c:\trjxjdj.exec:\trjxjdj.exe225⤵
-
\??\c:\ptxtln.exec:\ptxtln.exe226⤵
-
\??\c:\fdbrdn.exec:\fdbrdn.exe227⤵
-
\??\c:\fdrxfhr.exec:\fdrxfhr.exe228⤵
-
\??\c:\fhldlx.exec:\fhldlx.exe229⤵
-
\??\c:\nhnlb.exec:\nhnlb.exe230⤵
-
\??\c:\fxlhntf.exec:\fxlhntf.exe231⤵
-
\??\c:\rlrhnrn.exec:\rlrhnrn.exe232⤵
-
\??\c:\plnphr.exec:\plnphr.exe233⤵
-
\??\c:\xjjrnf.exec:\xjjrnf.exe234⤵
-
\??\c:\jjxff.exec:\jjxff.exe235⤵
-
\??\c:\pffrb.exec:\pffrb.exe236⤵
-
\??\c:\brtlllv.exec:\brtlllv.exe237⤵
-
\??\c:\bnhjnf.exec:\bnhjnf.exe238⤵
-
\??\c:\nrvrhh.exec:\nrvrhh.exe239⤵
-
\??\c:\vnvjpvr.exec:\vnvjpvr.exe240⤵
-
\??\c:\txvfrf.exec:\txvfrf.exe241⤵