Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
03-05-2024 20:54
Behavioral task
behavioral1
Sample
3d6d6bfc5ea6c02a7bcbba5af7df31e223ce6ce6559156334c3499ef0a7885bf.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
3d6d6bfc5ea6c02a7bcbba5af7df31e223ce6ce6559156334c3499ef0a7885bf.exe
-
Size
121KB
-
MD5
63dac6b8ad9a613588db62ca54f61d5b
-
SHA1
41cca2d53d4453a001e4b3ba3d4ffcf03e071deb
-
SHA256
3d6d6bfc5ea6c02a7bcbba5af7df31e223ce6ce6559156334c3499ef0a7885bf
-
SHA512
336454e3380db377544087051803f7b59a8b6c39abf1c18d1bd91b8044c8fb351ffbe8d564e9d8b8891ece99201b944ee43d089a3d59ee5304e9f7b21b842b83
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcka62c+8+dRN1j:9cm4FmowdHoSZ6lCX3
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/5028-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4192-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4272-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4240-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/804-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3876-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3972-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3764-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4844-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3384-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/924-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/772-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/736-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3936-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3748-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3300-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1860-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3176-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/824-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2912-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3076-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3224-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3740-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/408-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1860-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2052-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1412-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4652-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3876-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/816-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1172-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1544-475-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3812-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3300-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-583-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-578-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1988-603-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-615-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4868-750-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5088-900-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3296-1017-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/980-1037-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-1080-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-1170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2032-1180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-1214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-1290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/5028-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\bhhnht.exe UPX behavioral2/memory/5028-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1928-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4192-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4272-20-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\xrfxxxl.exe UPX \??\c:\rfrffxf.exe UPX \??\c:\1ntthn.exe UPX \??\c:\3hhbnn.exe UPX C:\jvvjv.exe UPX C:\jvdvv.exe UPX \??\c:\vppdp.exe UPX \??\c:\xxfxrll.exe UPX \??\c:\bhbbtn.exe UPX behavioral2/memory/3724-84-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4240-83-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1168-78-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/804-72-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3876-70-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\5xxrlfr.exe UPX behavioral2/memory/3972-55-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4404-43-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3764-37-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3hbthh.exe UPX \??\c:\jddvp.exe UPX C:\dvpdp.exe UPX behavioral2/memory/4844-100-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3384-96-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/924-32-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\xlrlfxx.exe UPX \??\c:\vvdpp.exe UPX \??\c:\dvpdv.exe UPX C:\lxxrffx.exe UPX behavioral2/memory/4904-107-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bhhbtb.exe UPX behavioral2/memory/772-113-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5ppdp.exe UPX behavioral2/memory/736-119-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3ppdp.exe UPX C:\xflrfxr.exe UPX behavioral2/memory/8-129-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\rrlfrlf.exe UPX behavioral2/memory/4992-136-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tnhbnn.exe UPX behavioral2/memory/1988-141-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vjjjv.exe UPX C:\9fxlxrf.exe UPX \??\c:\nhtnnh.exe UPX behavioral2/memory/3936-160-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tbbbtn.exe UPX C:\7pvjp.exe UPX \??\c:\frlfxxr.exe UPX C:\frfrlfr.exe UPX behavioral2/memory/3748-178-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nhbtbt.exe UPX behavioral2/memory/3300-192-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2392-197-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1860-203-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3176-204-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3176-208-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1204-213-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/220-220-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3448-223-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
bhhnht.exedvpdv.exevvdpp.exexlrlfxx.exexrfxxxl.exerfrffxf.exe1ntthn.exe3hhbnn.exejvvjv.exejvdvv.exevppdp.exe5xxrlfr.exexxfxrll.exebhbbtn.exe3hbthh.exejddvp.exedvpdp.exelxxrffx.exebhhbtb.exe5ppdp.exe3ppdp.exexflrfxr.exerrlfrlf.exetnhbnn.exevjjjv.exe9fxlxrf.exenhtnnh.exetbbbtn.exe7pvjp.exefrlfxxr.exefrfrlfr.exenhbtbt.exebnnbnb.exejvdpp.exelllllff.exenbtnhh.exehntnbb.exe3pjvj.exepdvpj.exelrrlrlf.exetnbnhb.exe1pddv.exefxrlrrx.exellfrffx.exe9hbnbb.exe9vvjd.exe1ddvj.exexlxrxxr.exefxrrlfx.exe7tnbtb.exe5tnbnn.exepjdvd.exe9dvpd.exelrrlxxx.exettbnnn.exe1jdpd.exe1rlxrlx.exe9fxrllf.exenhhbtn.exe1nnnbt.exejvpdv.exevppjj.exe5lxxxxf.exetbnnnn.exepid process 1928 bhhnht.exe 4192 dvpdv.exe 4272 vvdpp.exe 924 xlrlfxx.exe 3764 xrfxxxl.exe 4404 rfrffxf.exe 2040 1ntthn.exe 3972 3hhbnn.exe 3692 jvvjv.exe 3876 jvdvv.exe 804 vppdp.exe 4240 5xxrlfr.exe 1168 xxfxrll.exe 3724 bhbbtn.exe 404 3hbthh.exe 3384 jddvp.exe 4844 dvpdp.exe 4904 lxxrffx.exe 772 bhhbtb.exe 736 5ppdp.exe 2720 3ppdp.exe 8 xflrfxr.exe 4992 rrlfrlf.exe 1988 tnhbnn.exe 2700 vjjjv.exe 4364 9fxlxrf.exe 3936 nhtnnh.exe 800 tbbbtn.exe 3260 7pvjp.exe 456 frlfxxr.exe 3748 frfrlfr.exe 3932 nhbtbt.exe 3100 bnnbnb.exe 3300 jvdpp.exe 2608 lllllff.exe 2392 nbtnhh.exe 1860 hntnbb.exe 3176 3pjvj.exe 3520 pdvpj.exe 1204 lrrlrlf.exe 3772 tnbnhb.exe 220 1pddv.exe 3448 fxrlrrx.exe 824 llfrffx.exe 3916 9hbnbb.exe 752 9vvjd.exe 2044 1ddvj.exe 1252 xlxrxxr.exe 3820 fxrrlfx.exe 4916 7tnbtb.exe 3524 5tnbnn.exe 4232 pjdvd.exe 2912 9dvpd.exe 4628 lrrlxxx.exe 1824 ttbnnn.exe 3076 1jdpd.exe 2708 1rlxrlx.exe 2536 9fxrllf.exe 3724 nhhbtn.exe 404 1nnnbt.exe 4184 jvpdv.exe 1240 vppjj.exe 436 5lxxxxf.exe 5068 tbnnnn.exe -
Processes:
resource yara_rule behavioral2/memory/5028-0-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bhhnht.exe upx behavioral2/memory/5028-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1928-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4192-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4272-20-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xrfxxxl.exe upx \??\c:\rfrffxf.exe upx \??\c:\1ntthn.exe upx \??\c:\3hhbnn.exe upx C:\jvvjv.exe upx C:\jvdvv.exe upx \??\c:\vppdp.exe upx \??\c:\xxfxrll.exe upx \??\c:\bhbbtn.exe upx behavioral2/memory/3724-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4240-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1168-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/804-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3876-70-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5xxrlfr.exe upx behavioral2/memory/3972-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4404-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3764-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3hbthh.exe upx \??\c:\jddvp.exe upx C:\dvpdp.exe upx behavioral2/memory/4844-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3384-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/924-32-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xlrlfxx.exe upx \??\c:\vvdpp.exe upx \??\c:\dvpdv.exe upx C:\lxxrffx.exe upx behavioral2/memory/4904-107-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhhbtb.exe upx behavioral2/memory/772-113-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5ppdp.exe upx behavioral2/memory/736-119-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3ppdp.exe upx C:\xflrfxr.exe upx behavioral2/memory/8-129-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rrlfrlf.exe upx behavioral2/memory/4992-136-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnhbnn.exe upx behavioral2/memory/1988-141-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjjjv.exe upx C:\9fxlxrf.exe upx \??\c:\nhtnnh.exe upx behavioral2/memory/3936-160-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbbbtn.exe upx C:\7pvjp.exe upx \??\c:\frlfxxr.exe upx C:\frfrlfr.exe upx behavioral2/memory/3748-178-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhbtbt.exe upx behavioral2/memory/3300-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2392-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1860-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3176-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3176-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1204-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/220-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3448-223-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3d6d6bfc5ea6c02a7bcbba5af7df31e223ce6ce6559156334c3499ef0a7885bf.exebhhnht.exedvpdv.exevvdpp.exexlrlfxx.exexrfxxxl.exerfrffxf.exe1ntthn.exe3hhbnn.exejvvjv.exejvdvv.exevppdp.exe5xxrlfr.exexxfxrll.exebhbbtn.exe3hbthh.exejddvp.exedvpdp.exelxxrffx.exebhhbtb.exe5ppdp.exe3ppdp.exedescription pid process target process PID 5028 wrote to memory of 1928 5028 3d6d6bfc5ea6c02a7bcbba5af7df31e223ce6ce6559156334c3499ef0a7885bf.exe bhhnht.exe PID 5028 wrote to memory of 1928 5028 3d6d6bfc5ea6c02a7bcbba5af7df31e223ce6ce6559156334c3499ef0a7885bf.exe bhhnht.exe PID 5028 wrote to memory of 1928 5028 3d6d6bfc5ea6c02a7bcbba5af7df31e223ce6ce6559156334c3499ef0a7885bf.exe bhhnht.exe PID 1928 wrote to memory of 4192 1928 bhhnht.exe dvpdv.exe PID 1928 wrote to memory of 4192 1928 bhhnht.exe dvpdv.exe PID 1928 wrote to memory of 4192 1928 bhhnht.exe dvpdv.exe PID 4192 wrote to memory of 4272 4192 dvpdv.exe vvdpp.exe PID 4192 wrote to memory of 4272 4192 dvpdv.exe vvdpp.exe PID 4192 wrote to memory of 4272 4192 dvpdv.exe vvdpp.exe PID 4272 wrote to memory of 924 4272 vvdpp.exe xlrlfxx.exe PID 4272 wrote to memory of 924 4272 vvdpp.exe xlrlfxx.exe PID 4272 wrote to memory of 924 4272 vvdpp.exe xlrlfxx.exe PID 924 wrote to memory of 3764 924 xlrlfxx.exe xrfxxxl.exe PID 924 wrote to memory of 3764 924 xlrlfxx.exe xrfxxxl.exe PID 924 wrote to memory of 3764 924 xlrlfxx.exe xrfxxxl.exe PID 3764 wrote to memory of 4404 3764 xrfxxxl.exe rfrffxf.exe PID 3764 wrote to memory of 4404 3764 xrfxxxl.exe rfrffxf.exe PID 3764 wrote to memory of 4404 3764 xrfxxxl.exe rfrffxf.exe PID 4404 wrote to memory of 2040 4404 rfrffxf.exe 1ntthn.exe PID 4404 wrote to memory of 2040 4404 rfrffxf.exe 1ntthn.exe PID 4404 wrote to memory of 2040 4404 rfrffxf.exe 1ntthn.exe PID 2040 wrote to memory of 3972 2040 1ntthn.exe 3hhbnn.exe PID 2040 wrote to memory of 3972 2040 1ntthn.exe 3hhbnn.exe PID 2040 wrote to memory of 3972 2040 1ntthn.exe 3hhbnn.exe PID 3972 wrote to memory of 3692 3972 3hhbnn.exe jvvjv.exe PID 3972 wrote to memory of 3692 3972 3hhbnn.exe jvvjv.exe PID 3972 wrote to memory of 3692 3972 3hhbnn.exe jvvjv.exe PID 3692 wrote to memory of 3876 3692 jvvjv.exe jvdvv.exe PID 3692 wrote to memory of 3876 3692 jvvjv.exe jvdvv.exe PID 3692 wrote to memory of 3876 3692 jvvjv.exe jvdvv.exe PID 3876 wrote to memory of 804 3876 jvdvv.exe vppdp.exe PID 3876 wrote to memory of 804 3876 jvdvv.exe vppdp.exe PID 3876 wrote to memory of 804 3876 jvdvv.exe vppdp.exe PID 804 wrote to memory of 4240 804 vppdp.exe 5xxrlfr.exe PID 804 wrote to memory of 4240 804 vppdp.exe 5xxrlfr.exe PID 804 wrote to memory of 4240 804 vppdp.exe 5xxrlfr.exe PID 4240 wrote to memory of 1168 4240 5xxrlfr.exe xxfxrll.exe PID 4240 wrote to memory of 1168 4240 5xxrlfr.exe xxfxrll.exe PID 4240 wrote to memory of 1168 4240 5xxrlfr.exe xxfxrll.exe PID 1168 wrote to memory of 3724 1168 xxfxrll.exe bhbbtn.exe PID 1168 wrote to memory of 3724 1168 xxfxrll.exe bhbbtn.exe PID 1168 wrote to memory of 3724 1168 xxfxrll.exe bhbbtn.exe PID 3724 wrote to memory of 404 3724 bhbbtn.exe 3hbthh.exe PID 3724 wrote to memory of 404 3724 bhbbtn.exe 3hbthh.exe PID 3724 wrote to memory of 404 3724 bhbbtn.exe 3hbthh.exe PID 404 wrote to memory of 3384 404 3hbthh.exe jddvp.exe PID 404 wrote to memory of 3384 404 3hbthh.exe jddvp.exe PID 404 wrote to memory of 3384 404 3hbthh.exe jddvp.exe PID 3384 wrote to memory of 4844 3384 jddvp.exe dvpdp.exe PID 3384 wrote to memory of 4844 3384 jddvp.exe dvpdp.exe PID 3384 wrote to memory of 4844 3384 jddvp.exe dvpdp.exe PID 4844 wrote to memory of 4904 4844 dvpdp.exe lxxrffx.exe PID 4844 wrote to memory of 4904 4844 dvpdp.exe lxxrffx.exe PID 4844 wrote to memory of 4904 4844 dvpdp.exe lxxrffx.exe PID 4904 wrote to memory of 772 4904 lxxrffx.exe bhhbtb.exe PID 4904 wrote to memory of 772 4904 lxxrffx.exe bhhbtb.exe PID 4904 wrote to memory of 772 4904 lxxrffx.exe bhhbtb.exe PID 772 wrote to memory of 736 772 bhhbtb.exe 5ppdp.exe PID 772 wrote to memory of 736 772 bhhbtb.exe 5ppdp.exe PID 772 wrote to memory of 736 772 bhhbtb.exe 5ppdp.exe PID 736 wrote to memory of 2720 736 5ppdp.exe 3ppdp.exe PID 736 wrote to memory of 2720 736 5ppdp.exe 3ppdp.exe PID 736 wrote to memory of 2720 736 5ppdp.exe 3ppdp.exe PID 2720 wrote to memory of 8 2720 3ppdp.exe xflrfxr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d6d6bfc5ea6c02a7bcbba5af7df31e223ce6ce6559156334c3499ef0a7885bf.exe"C:\Users\Admin\AppData\Local\Temp\3d6d6bfc5ea6c02a7bcbba5af7df31e223ce6ce6559156334c3499ef0a7885bf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\bhhnht.exec:\bhhnht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvpdv.exec:\dvpdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvdpp.exec:\vvdpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrfxxxl.exec:\xrfxxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfrffxf.exec:\rfrffxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1ntthn.exec:\1ntthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3hhbnn.exec:\3hhbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvvjv.exec:\jvvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvdvv.exec:\jvdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vppdp.exec:\vppdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5xxrlfr.exec:\5xxrlfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxfxrll.exec:\xxfxrll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhbbtn.exec:\bhbbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3hbthh.exec:\3hbthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jddvp.exec:\jddvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvpdp.exec:\dvpdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxxrffx.exec:\lxxrffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhhbtb.exec:\bhhbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5ppdp.exec:\5ppdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3ppdp.exec:\3ppdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xflrfxr.exec:\xflrfxr.exe23⤵
- Executes dropped EXE
-
\??\c:\rrlfrlf.exec:\rrlfrlf.exe24⤵
- Executes dropped EXE
-
\??\c:\tnhbnn.exec:\tnhbnn.exe25⤵
- Executes dropped EXE
-
\??\c:\vjjjv.exec:\vjjjv.exe26⤵
- Executes dropped EXE
-
\??\c:\9fxlxrf.exec:\9fxlxrf.exe27⤵
- Executes dropped EXE
-
\??\c:\nhtnnh.exec:\nhtnnh.exe28⤵
- Executes dropped EXE
-
\??\c:\tbbbtn.exec:\tbbbtn.exe29⤵
- Executes dropped EXE
-
\??\c:\7pvjp.exec:\7pvjp.exe30⤵
- Executes dropped EXE
-
\??\c:\frlfxxr.exec:\frlfxxr.exe31⤵
- Executes dropped EXE
-
\??\c:\frfrlfr.exec:\frfrlfr.exe32⤵
- Executes dropped EXE
-
\??\c:\nhbtbt.exec:\nhbtbt.exe33⤵
- Executes dropped EXE
-
\??\c:\bnnbnb.exec:\bnnbnb.exe34⤵
- Executes dropped EXE
-
\??\c:\jvdpp.exec:\jvdpp.exe35⤵
- Executes dropped EXE
-
\??\c:\lllllff.exec:\lllllff.exe36⤵
- Executes dropped EXE
-
\??\c:\nbtnhh.exec:\nbtnhh.exe37⤵
- Executes dropped EXE
-
\??\c:\hntnbb.exec:\hntnbb.exe38⤵
- Executes dropped EXE
-
\??\c:\3pjvj.exec:\3pjvj.exe39⤵
- Executes dropped EXE
-
\??\c:\pdvpj.exec:\pdvpj.exe40⤵
- Executes dropped EXE
-
\??\c:\lrrlrlf.exec:\lrrlrlf.exe41⤵
- Executes dropped EXE
-
\??\c:\tnbnhb.exec:\tnbnhb.exe42⤵
- Executes dropped EXE
-
\??\c:\1pddv.exec:\1pddv.exe43⤵
- Executes dropped EXE
-
\??\c:\fxrlrrx.exec:\fxrlrrx.exe44⤵
- Executes dropped EXE
-
\??\c:\llfrffx.exec:\llfrffx.exe45⤵
- Executes dropped EXE
-
\??\c:\9hbnbb.exec:\9hbnbb.exe46⤵
- Executes dropped EXE
-
\??\c:\9vvjd.exec:\9vvjd.exe47⤵
- Executes dropped EXE
-
\??\c:\1ddvj.exec:\1ddvj.exe48⤵
- Executes dropped EXE
-
\??\c:\xlxrxxr.exec:\xlxrxxr.exe49⤵
- Executes dropped EXE
-
\??\c:\fxrrlfx.exec:\fxrrlfx.exe50⤵
- Executes dropped EXE
-
\??\c:\7tnbtb.exec:\7tnbtb.exe51⤵
- Executes dropped EXE
-
\??\c:\5tnbnn.exec:\5tnbnn.exe52⤵
- Executes dropped EXE
-
\??\c:\pjdvd.exec:\pjdvd.exe53⤵
- Executes dropped EXE
-
\??\c:\9dvpd.exec:\9dvpd.exe54⤵
- Executes dropped EXE
-
\??\c:\lrrlxxx.exec:\lrrlxxx.exe55⤵
- Executes dropped EXE
-
\??\c:\ttbnnn.exec:\ttbnnn.exe56⤵
- Executes dropped EXE
-
\??\c:\1jdpd.exec:\1jdpd.exe57⤵
- Executes dropped EXE
-
\??\c:\1rlxrlx.exec:\1rlxrlx.exe58⤵
- Executes dropped EXE
-
\??\c:\9fxrllf.exec:\9fxrllf.exe59⤵
- Executes dropped EXE
-
\??\c:\nhhbtn.exec:\nhhbtn.exe60⤵
- Executes dropped EXE
-
\??\c:\1nnnbt.exec:\1nnnbt.exe61⤵
- Executes dropped EXE
-
\??\c:\jvpdv.exec:\jvpdv.exe62⤵
- Executes dropped EXE
-
\??\c:\vppjj.exec:\vppjj.exe63⤵
- Executes dropped EXE
-
\??\c:\5lxxxxf.exec:\5lxxxxf.exe64⤵
- Executes dropped EXE
-
\??\c:\tbnnnn.exec:\tbnnnn.exe65⤵
- Executes dropped EXE
-
\??\c:\vvppd.exec:\vvppd.exe66⤵
-
\??\c:\7jjdd.exec:\7jjdd.exe67⤵
-
\??\c:\xlrlfff.exec:\xlrlfff.exe68⤵
-
\??\c:\rrrxxff.exec:\rrrxxff.exe69⤵
-
\??\c:\1tbtbb.exec:\1tbtbb.exe70⤵
-
\??\c:\bntttt.exec:\bntttt.exe71⤵
-
\??\c:\btntnn.exec:\btntnn.exe72⤵
-
\??\c:\djvvv.exec:\djvvv.exe73⤵
-
\??\c:\vdjjv.exec:\vdjjv.exe74⤵
-
\??\c:\lrxrfff.exec:\lrxrfff.exe75⤵
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe76⤵
-
\??\c:\hbbbtt.exec:\hbbbtt.exe77⤵
-
\??\c:\hhbbbb.exec:\hhbbbb.exe78⤵
-
\??\c:\vjddv.exec:\vjddv.exe79⤵
-
\??\c:\fxxlffx.exec:\fxxlffx.exe80⤵
-
\??\c:\lrlxxlf.exec:\lrlxxlf.exe81⤵
-
\??\c:\3bhhbb.exec:\3bhhbb.exe82⤵
-
\??\c:\9vvvv.exec:\9vvvv.exe83⤵
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe84⤵
-
\??\c:\frxxrxr.exec:\frxxrxr.exe85⤵
-
\??\c:\5hbbtb.exec:\5hbbtb.exe86⤵
-
\??\c:\pjpjp.exec:\pjpjp.exe87⤵
-
\??\c:\djvpj.exec:\djvpj.exe88⤵
-
\??\c:\5xllfff.exec:\5xllfff.exe89⤵
-
\??\c:\ntttnn.exec:\ntttnn.exe90⤵
-
\??\c:\3nhhtb.exec:\3nhhtb.exe91⤵
-
\??\c:\7pvvj.exec:\7pvvj.exe92⤵
-
\??\c:\1xfxrrr.exec:\1xfxrrr.exe93⤵
-
\??\c:\xflfxxx.exec:\xflfxxx.exe94⤵
-
\??\c:\tbbbbb.exec:\tbbbbb.exe95⤵
-
\??\c:\bntbtn.exec:\bntbtn.exe96⤵
-
\??\c:\pvvdj.exec:\pvvdj.exe97⤵
-
\??\c:\pppjj.exec:\pppjj.exe98⤵
-
\??\c:\flrrfff.exec:\flrrfff.exe99⤵
-
\??\c:\fllrxxr.exec:\fllrxxr.exe100⤵
-
\??\c:\httbtb.exec:\httbtb.exe101⤵
-
\??\c:\1ntthn.exec:\1ntthn.exe102⤵
-
\??\c:\jdppp.exec:\jdppp.exe103⤵
-
\??\c:\dvvvp.exec:\dvvvp.exe104⤵
-
\??\c:\fxxrxxl.exec:\fxxrxxl.exe105⤵
-
\??\c:\lffxrrl.exec:\lffxrrl.exe106⤵
-
\??\c:\xflxxxr.exec:\xflxxxr.exe107⤵
-
\??\c:\5ntnnn.exec:\5ntnnn.exe108⤵
-
\??\c:\pvvdv.exec:\pvvdv.exe109⤵
-
\??\c:\jjppj.exec:\jjppj.exe110⤵
-
\??\c:\djjjd.exec:\djjjd.exe111⤵
-
\??\c:\fllllll.exec:\fllllll.exe112⤵
-
\??\c:\rxfllrr.exec:\rxfllrr.exe113⤵
-
\??\c:\1htnhh.exec:\1htnhh.exe114⤵
-
\??\c:\nbhnhh.exec:\nbhnhh.exe115⤵
-
\??\c:\vpvpv.exec:\vpvpv.exe116⤵
-
\??\c:\1jdvj.exec:\1jdvj.exe117⤵
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe118⤵
-
\??\c:\lrxfffx.exec:\lrxfffx.exe119⤵
-
\??\c:\9btnnn.exec:\9btnnn.exe120⤵
-
\??\c:\tntnnn.exec:\tntnnn.exe121⤵
-
\??\c:\dvdvd.exec:\dvdvd.exe122⤵
-
\??\c:\fxrllrr.exec:\fxrllrr.exe123⤵
-
\??\c:\rlllrrf.exec:\rlllrrf.exe124⤵
-
\??\c:\9hhhbh.exec:\9hhhbh.exe125⤵
-
\??\c:\tntttt.exec:\tntttt.exe126⤵
-
\??\c:\vvddv.exec:\vvddv.exe127⤵
-
\??\c:\9vddp.exec:\9vddp.exe128⤵
-
\??\c:\xrxllrl.exec:\xrxllrl.exe129⤵
-
\??\c:\5xxxrrr.exec:\5xxxrrr.exe130⤵
-
\??\c:\rlffxff.exec:\rlffxff.exe131⤵
-
\??\c:\9hbtnn.exec:\9hbtnn.exe132⤵
-
\??\c:\5nbbbh.exec:\5nbbbh.exe133⤵
-
\??\c:\5pjvj.exec:\5pjvj.exe134⤵
-
\??\c:\jpvvp.exec:\jpvvp.exe135⤵
-
\??\c:\lffxxxx.exec:\lffxxxx.exe136⤵
-
\??\c:\rlrllrr.exec:\rlrllrr.exe137⤵
-
\??\c:\hbbntt.exec:\hbbntt.exe138⤵
-
\??\c:\nntbth.exec:\nntbth.exe139⤵
-
\??\c:\7bhhhh.exec:\7bhhhh.exe140⤵
-
\??\c:\3vddd.exec:\3vddd.exe141⤵
-
\??\c:\7pvpd.exec:\7pvpd.exe142⤵
-
\??\c:\rlrlxxx.exec:\rlrlxxx.exe143⤵
-
\??\c:\9xxfxfx.exec:\9xxfxfx.exe144⤵
-
\??\c:\tnnntt.exec:\tnnntt.exe145⤵
-
\??\c:\1vpjd.exec:\1vpjd.exe146⤵
-
\??\c:\jpvvp.exec:\jpvvp.exe147⤵
-
\??\c:\pddjd.exec:\pddjd.exe148⤵
-
\??\c:\lffrflr.exec:\lffrflr.exe149⤵
-
\??\c:\dvvpv.exec:\dvvpv.exe150⤵
-
\??\c:\5jjdv.exec:\5jjdv.exe151⤵
-
\??\c:\lfllfff.exec:\lfllfff.exe152⤵
-
\??\c:\1frrrrr.exec:\1frrrrr.exe153⤵
-
\??\c:\nbbbtt.exec:\nbbbtt.exe154⤵
-
\??\c:\5btnnn.exec:\5btnnn.exe155⤵
-
\??\c:\bthnhh.exec:\bthnhh.exe156⤵
-
\??\c:\jjpvj.exec:\jjpvj.exe157⤵
-
\??\c:\rxffxxx.exec:\rxffxxx.exe158⤵
-
\??\c:\xxlxxff.exec:\xxlxxff.exe159⤵
-
\??\c:\5nbbtb.exec:\5nbbtb.exe160⤵
-
\??\c:\ntbbtt.exec:\ntbbtt.exe161⤵
-
\??\c:\ddpjp.exec:\ddpjp.exe162⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe163⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe164⤵
-
\??\c:\rxffrrl.exec:\rxffrrl.exe165⤵
-
\??\c:\xlxfxxx.exec:\xlxfxxx.exe166⤵
-
\??\c:\tbnnnb.exec:\tbnnnb.exe167⤵
-
\??\c:\nbhhhh.exec:\nbhhhh.exe168⤵
-
\??\c:\vvppj.exec:\vvppj.exe169⤵
-
\??\c:\7vppd.exec:\7vppd.exe170⤵
-
\??\c:\llxrxxl.exec:\llxrxxl.exe171⤵
-
\??\c:\rrlffrr.exec:\rrlffrr.exe172⤵
-
\??\c:\tbbttt.exec:\tbbttt.exe173⤵
-
\??\c:\bbbtnn.exec:\bbbtnn.exe174⤵
-
\??\c:\djvvp.exec:\djvvp.exe175⤵
-
\??\c:\jvjjd.exec:\jvjjd.exe176⤵
-
\??\c:\lrxxrxx.exec:\lrxxrxx.exe177⤵
-
\??\c:\rxfffff.exec:\rxfffff.exe178⤵
-
\??\c:\5fxrffr.exec:\5fxrffr.exe179⤵
-
\??\c:\bhhhbh.exec:\bhhhbh.exe180⤵
-
\??\c:\hnnhbn.exec:\hnnhbn.exe181⤵
-
\??\c:\pjjjd.exec:\pjjjd.exe182⤵
-
\??\c:\jvjjd.exec:\jvjjd.exe183⤵
-
\??\c:\xlxrrrf.exec:\xlxrrrf.exe184⤵
-
\??\c:\xxffxxr.exec:\xxffxxr.exe185⤵
-
\??\c:\3bnnnh.exec:\3bnnnh.exe186⤵
-
\??\c:\nbhbbb.exec:\nbhbbb.exe187⤵
-
\??\c:\tbhhbb.exec:\tbhhbb.exe188⤵
-
\??\c:\vvvvp.exec:\vvvvp.exe189⤵
-
\??\c:\pjpjj.exec:\pjpjj.exe190⤵
-
\??\c:\flllxxx.exec:\flllxxx.exe191⤵
-
\??\c:\rllxrrl.exec:\rllxrrl.exe192⤵
-
\??\c:\hbtnnn.exec:\hbtnnn.exe193⤵
-
\??\c:\ntbbnt.exec:\ntbbnt.exe194⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe195⤵
-
\??\c:\rfrrrrl.exec:\rfrrrrl.exe196⤵
-
\??\c:\rlrlxrx.exec:\rlrlxrx.exe197⤵
-
\??\c:\tbnhbt.exec:\tbnhbt.exe198⤵
-
\??\c:\dvvdd.exec:\dvvdd.exe199⤵
-
\??\c:\5dppp.exec:\5dppp.exe200⤵
-
\??\c:\rlxrflx.exec:\rlxrflx.exe201⤵
-
\??\c:\nnnnnn.exec:\nnnnnn.exe202⤵
-
\??\c:\3hnnbb.exec:\3hnnbb.exe203⤵
-
\??\c:\dvpjj.exec:\dvpjj.exe204⤵
-
\??\c:\lffxxxx.exec:\lffxxxx.exe205⤵
-
\??\c:\btbbhh.exec:\btbbhh.exe206⤵
-
\??\c:\hbtnht.exec:\hbtnht.exe207⤵
-
\??\c:\dpdvv.exec:\dpdvv.exe208⤵
-
\??\c:\xfffxrr.exec:\xfffxrr.exe209⤵
-
\??\c:\frfrlxr.exec:\frfrlxr.exe210⤵
-
\??\c:\bhnhbb.exec:\bhnhbb.exe211⤵
-
\??\c:\lfrlrrf.exec:\lfrlrrf.exe212⤵
-
\??\c:\tbhhbh.exec:\tbhhbh.exe213⤵
-
\??\c:\hhbbtt.exec:\hhbbtt.exe214⤵
-
\??\c:\hnbbtt.exec:\hnbbtt.exe215⤵
-
\??\c:\vvpjd.exec:\vvpjd.exe216⤵
-
\??\c:\3ddjj.exec:\3ddjj.exe217⤵
-
\??\c:\rllfxxx.exec:\rllfxxx.exe218⤵
-
\??\c:\1frrxrx.exec:\1frrxrx.exe219⤵
-
\??\c:\ttbhbb.exec:\ttbhbb.exe220⤵
-
\??\c:\hbtbtb.exec:\hbtbtb.exe221⤵
-
\??\c:\djjjp.exec:\djjjp.exe222⤵
-
\??\c:\dvddv.exec:\dvddv.exe223⤵
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe224⤵
-
\??\c:\flxffff.exec:\flxffff.exe225⤵
-
\??\c:\7xxxxrr.exec:\7xxxxrr.exe226⤵
-
\??\c:\bbbbtt.exec:\bbbbtt.exe227⤵
-
\??\c:\btbtnt.exec:\btbtnt.exe228⤵
-
\??\c:\5pvvd.exec:\5pvvd.exe229⤵
-
\??\c:\jddvp.exec:\jddvp.exe230⤵
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe231⤵
-
\??\c:\lxffllf.exec:\lxffllf.exe232⤵
-
\??\c:\btttnn.exec:\btttnn.exe233⤵
-
\??\c:\ntbhtb.exec:\ntbhtb.exe234⤵
-
\??\c:\3pvvv.exec:\3pvvv.exe235⤵
-
\??\c:\vpvjd.exec:\vpvjd.exe236⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe237⤵
-
\??\c:\lrrlffx.exec:\lrrlffx.exe238⤵
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe239⤵
-
\??\c:\htbbtt.exec:\htbbtt.exe240⤵
-
\??\c:\3vddd.exec:\3vddd.exe241⤵