Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2024 08:00
Behavioral task
behavioral1
Sample
8cf2b67e6147ad64515d038d2bacf84c792c9527fc6e8311794d1143ac2804c6.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
8cf2b67e6147ad64515d038d2bacf84c792c9527fc6e8311794d1143ac2804c6.exe
-
Size
220KB
-
MD5
3c994650a939b97754ef7bf598a2a85a
-
SHA1
75de13b125a1a4119a934caf8b04b8497deba0ca
-
SHA256
8cf2b67e6147ad64515d038d2bacf84c792c9527fc6e8311794d1143ac2804c6
-
SHA512
3dd031b7d5e62530fa5f9d13b89b739a383e3c50bf83dc87c851cc7cf46252c60e513f9c7b31ee5131f5b48aac7e8193e0d9f07a530b62aef366a726803ed42e
-
SSDEEP
6144:0cm4FmowdHoSOI18yP0ddWX+a/zq6atGJ7TA:C4wFHoSF/P0ddWX+yzq6aw7TA
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1988-4-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/836-14-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3560-19-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2224-25-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/548-34-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4588-46-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1904-40-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3524-11-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2232-52-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3532-60-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4924-64-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2948-69-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4940-73-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2976-81-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1912-86-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4148-91-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3212-97-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/724-114-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1112-122-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/512-121-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/8-110-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1492-127-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4400-140-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4384-145-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3260-175-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1260-166-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3248-182-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/904-196-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2792-203-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4056-217-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3768-223-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1856-229-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4060-242-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1440-243-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3280-250-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4656-257-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1484-260-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2700-275-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4412-283-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3940-294-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2292-300-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1864-302-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1636-314-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2780-332-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2572-340-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4952-348-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4072-366-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4892-395-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4588-399-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4776-404-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/812-421-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3744-458-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1252-470-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1128-492-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1192-514-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1508-552-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4952-644-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4600-664-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4336-743-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1208-867-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4400-886-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4256-890-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2428-1243-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2020-1392-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/1988-0-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/1988-4-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/3524-6-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/files/0x000a0000000231d5-9.dat UPX behavioral2/memory/836-14-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/files/0x0011000000023134-5.dat UPX behavioral2/files/0x00070000000231e5-16.dat UPX behavioral2/memory/3560-19-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/files/0x00070000000231e7-26.dat UPX behavioral2/memory/2224-25-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/548-34-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/files/0x00070000000231e9-36.dat UPX behavioral2/files/0x00070000000231ea-42.dat UPX behavioral2/memory/4588-46-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/1904-40-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/files/0x00070000000231e8-32.dat UPX behavioral2/files/0x00070000000231e6-21.dat UPX behavioral2/memory/3524-11-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/2232-52-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/files/0x000700000001ebc7-55.dat UPX behavioral2/files/0x00070000000231eb-50.dat UPX behavioral2/files/0x00070000000231ec-59.dat UPX behavioral2/memory/3532-60-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/4924-64-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/files/0x00070000000231ed-65.dat UPX behavioral2/files/0x00070000000231ee-70.dat UPX behavioral2/memory/2948-69-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/4940-73-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/files/0x00070000000231ef-76.dat UPX behavioral2/files/0x00070000000231f0-80.dat UPX behavioral2/memory/2976-81-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/files/0x00070000000231f1-85.dat UPX behavioral2/memory/1912-86-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/4148-91-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/files/0x00070000000231f2-93.dat UPX behavioral2/files/0x00090000000231e0-98.dat UPX behavioral2/memory/3212-97-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/files/0x00070000000231f4-108.dat UPX behavioral2/files/0x00070000000231f5-112.dat UPX behavioral2/memory/724-114-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/files/0x00070000000231f6-119.dat UPX behavioral2/memory/1112-122-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/files/0x00070000000231f7-125.dat UPX behavioral2/memory/512-121-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/8-110-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/files/0x00070000000231f3-104.dat UPX behavioral2/files/0x00070000000231f8-132.dat UPX behavioral2/memory/1492-127-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/files/0x00070000000231f9-135.dat UPX behavioral2/memory/4400-140-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/files/0x00070000000231fa-141.dat UPX behavioral2/memory/4384-145-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/files/0x00070000000231fb-148.dat UPX behavioral2/files/0x00070000000231fc-151.dat UPX behavioral2/files/0x00070000000231fd-158.dat UPX behavioral2/files/0x00070000000231fe-162.dat UPX behavioral2/files/0x0007000000023200-173.dat UPX behavioral2/memory/3260-175-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/files/0x00070000000231ff-168.dat UPX behavioral2/memory/1260-166-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/3248-182-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/1076-191-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/904-196-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/2792-203-0x0000000000400000-0x0000000000434000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3524 7ttbhh.exe 836 7fffffx.exe 3560 lflrrlr.exe 2224 pvdpd.exe 548 rxlfrlf.exe 1904 jvdvj.exe 5036 7xxlxrx.exe 4588 nhtnnn.exe 2232 vjpdp.exe 3532 5nhtbt.exe 4924 fxrfxrl.exe 2948 nbttnt.exe 4940 jvvpj.exe 2976 flrlfrf.exe 1912 jdvjj.exe 4148 flxrfxr.exe 3212 7xfrrll.exe 4296 djvjj.exe 8 frrlxfx.exe 724 dppjd.exe 512 pdppd.exe 1112 nbhhnb.exe 1492 jpppj.exe 4088 rffrxrl.exe 4400 hhnbbt.exe 4384 xlrxrlf.exe 1444 bhthtt.exe 4512 rllxfxr.exe 4256 1djjd.exe 1260 jdvpd.exe 3332 lffxrrl.exe 3260 hbtnhh.exe 1612 1dvpj.exe 3248 jdddd.exe 2432 lxxrfxr.exe 4076 3tthbn.exe 1076 7pdvj.exe 904 xffxxll.exe 4992 frxlfrl.exe 2792 thnbtn.exe 4612 3vpdj.exe 2944 lfxrfxx.exe 4744 frxrxrf.exe 4056 ntbtnh.exe 3768 pddjj.exe 404 xlrlflr.exe 1856 bhnhbn.exe 2124 5pvjd.exe 1900 tbhbnn.exe 4912 vvddj.exe 4060 3llfxxr.exe 1440 rxffxxx.exe 3280 pjppv.exe 3532 vjpdp.exe 4656 rlxrxlr.exe 1484 btnnhb.exe 4252 1flxrlf.exe 4988 tthnnb.exe 2020 bhhhnt.exe 1140 1vvpv.exe 2700 frrrxlr.exe 3996 nhtbnh.exe 4412 dvvvv.exe 4864 lrfrrrx.exe -
resource yara_rule behavioral2/memory/1988-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1988-4-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3524-6-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000a0000000231d5-9.dat upx behavioral2/memory/836-14-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0011000000023134-5.dat upx behavioral2/files/0x00070000000231e5-16.dat upx behavioral2/memory/3560-19-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000231e7-26.dat upx behavioral2/memory/2224-25-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/548-34-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000231e9-36.dat upx behavioral2/files/0x00070000000231ea-42.dat upx behavioral2/memory/4588-46-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1904-40-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000231e8-32.dat upx behavioral2/files/0x00070000000231e6-21.dat upx behavioral2/memory/3524-11-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2232-52-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000001ebc7-55.dat upx behavioral2/files/0x00070000000231eb-50.dat upx behavioral2/files/0x00070000000231ec-59.dat upx behavioral2/memory/3532-60-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4924-64-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000231ed-65.dat upx behavioral2/files/0x00070000000231ee-70.dat upx behavioral2/memory/2948-69-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4940-73-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000231ef-76.dat upx behavioral2/files/0x00070000000231f0-80.dat upx behavioral2/memory/2976-81-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000231f1-85.dat upx behavioral2/memory/1912-86-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4148-91-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000231f2-93.dat upx behavioral2/files/0x00090000000231e0-98.dat upx behavioral2/memory/3212-97-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000231f4-108.dat upx behavioral2/files/0x00070000000231f5-112.dat upx behavioral2/memory/724-114-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000231f6-119.dat upx behavioral2/memory/1112-122-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000231f7-125.dat upx behavioral2/memory/512-121-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/8-110-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000231f3-104.dat upx behavioral2/files/0x00070000000231f8-132.dat upx behavioral2/memory/1492-127-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000231f9-135.dat upx behavioral2/memory/4400-140-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000231fa-141.dat upx behavioral2/memory/4384-145-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000231fb-148.dat upx behavioral2/files/0x00070000000231fc-151.dat upx behavioral2/files/0x00070000000231fd-158.dat upx behavioral2/files/0x00070000000231fe-162.dat upx behavioral2/files/0x0007000000023200-173.dat upx behavioral2/memory/3260-175-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000231ff-168.dat upx behavioral2/memory/1260-166-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3248-182-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1076-191-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/904-196-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2792-203-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1988 wrote to memory of 3524 1988 8cf2b67e6147ad64515d038d2bacf84c792c9527fc6e8311794d1143ac2804c6.exe 88 PID 1988 wrote to memory of 3524 1988 8cf2b67e6147ad64515d038d2bacf84c792c9527fc6e8311794d1143ac2804c6.exe 88 PID 1988 wrote to memory of 3524 1988 8cf2b67e6147ad64515d038d2bacf84c792c9527fc6e8311794d1143ac2804c6.exe 88 PID 3524 wrote to memory of 836 3524 7ttbhh.exe 89 PID 3524 wrote to memory of 836 3524 7ttbhh.exe 89 PID 3524 wrote to memory of 836 3524 7ttbhh.exe 89 PID 836 wrote to memory of 3560 836 7fffffx.exe 90 PID 836 wrote to memory of 3560 836 7fffffx.exe 90 PID 836 wrote to memory of 3560 836 7fffffx.exe 90 PID 3560 wrote to memory of 2224 3560 lflrrlr.exe 91 PID 3560 wrote to memory of 2224 3560 lflrrlr.exe 91 PID 3560 wrote to memory of 2224 3560 lflrrlr.exe 91 PID 2224 wrote to memory of 548 2224 pvdpd.exe 92 PID 2224 wrote to memory of 548 2224 pvdpd.exe 92 PID 2224 wrote to memory of 548 2224 pvdpd.exe 92 PID 548 wrote to memory of 1904 548 rxlfrlf.exe 93 PID 548 wrote to memory of 1904 548 rxlfrlf.exe 93 PID 548 wrote to memory of 1904 548 rxlfrlf.exe 93 PID 1904 wrote to memory of 5036 1904 jvdvj.exe 94 PID 1904 wrote to memory of 5036 1904 jvdvj.exe 94 PID 1904 wrote to memory of 5036 1904 jvdvj.exe 94 PID 5036 wrote to memory of 4588 5036 7xxlxrx.exe 95 PID 5036 wrote to memory of 4588 5036 7xxlxrx.exe 95 PID 5036 wrote to memory of 4588 5036 7xxlxrx.exe 95 PID 4588 wrote to memory of 2232 4588 nhtnnn.exe 96 PID 4588 wrote to memory of 2232 4588 nhtnnn.exe 96 PID 4588 wrote to memory of 2232 4588 nhtnnn.exe 96 PID 2232 wrote to memory of 3532 2232 vjpdp.exe 97 PID 2232 wrote to memory of 3532 2232 vjpdp.exe 97 PID 2232 wrote to memory of 3532 2232 vjpdp.exe 97 PID 3532 wrote to memory of 4924 3532 5nhtbt.exe 98 PID 3532 wrote to memory of 4924 3532 5nhtbt.exe 98 PID 3532 wrote to memory of 4924 3532 5nhtbt.exe 98 PID 4924 wrote to memory of 2948 4924 fxrfxrl.exe 99 PID 4924 wrote to memory of 2948 4924 fxrfxrl.exe 99 PID 4924 wrote to memory of 2948 4924 fxrfxrl.exe 99 PID 2948 wrote to memory of 4940 2948 nbttnt.exe 100 PID 2948 wrote to memory of 4940 2948 nbttnt.exe 100 PID 2948 wrote to memory of 4940 2948 nbttnt.exe 100 PID 4940 wrote to memory of 2976 4940 jvvpj.exe 101 PID 4940 wrote to memory of 2976 4940 jvvpj.exe 101 PID 4940 wrote to memory of 2976 4940 jvvpj.exe 101 PID 2976 wrote to memory of 1912 2976 flrlfrf.exe 102 PID 2976 wrote to memory of 1912 2976 flrlfrf.exe 102 PID 2976 wrote to memory of 1912 2976 flrlfrf.exe 102 PID 1912 wrote to memory of 4148 1912 jdvjj.exe 103 PID 1912 wrote to memory of 4148 1912 jdvjj.exe 103 PID 1912 wrote to memory of 4148 1912 jdvjj.exe 103 PID 4148 wrote to memory of 3212 4148 flxrfxr.exe 104 PID 4148 wrote to memory of 3212 4148 flxrfxr.exe 104 PID 4148 wrote to memory of 3212 4148 flxrfxr.exe 104 PID 3212 wrote to memory of 4296 3212 7xfrrll.exe 105 PID 3212 wrote to memory of 4296 3212 7xfrrll.exe 105 PID 3212 wrote to memory of 4296 3212 7xfrrll.exe 105 PID 4296 wrote to memory of 8 4296 djvjj.exe 106 PID 4296 wrote to memory of 8 4296 djvjj.exe 106 PID 4296 wrote to memory of 8 4296 djvjj.exe 106 PID 8 wrote to memory of 724 8 frrlxfx.exe 107 PID 8 wrote to memory of 724 8 frrlxfx.exe 107 PID 8 wrote to memory of 724 8 frrlxfx.exe 107 PID 724 wrote to memory of 512 724 dppjd.exe 108 PID 724 wrote to memory of 512 724 dppjd.exe 108 PID 724 wrote to memory of 512 724 dppjd.exe 108 PID 512 wrote to memory of 1112 512 pdppd.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cf2b67e6147ad64515d038d2bacf84c792c9527fc6e8311794d1143ac2804c6.exe"C:\Users\Admin\AppData\Local\Temp\8cf2b67e6147ad64515d038d2bacf84c792c9527fc6e8311794d1143ac2804c6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\7ttbhh.exec:\7ttbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\7fffffx.exec:\7fffffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\lflrrlr.exec:\lflrrlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\pvdpd.exec:\pvdpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\rxlfrlf.exec:\rxlfrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\jvdvj.exec:\jvdvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\7xxlxrx.exec:\7xxlxrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\nhtnnn.exec:\nhtnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\vjpdp.exec:\vjpdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\5nhtbt.exec:\5nhtbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\fxrfxrl.exec:\fxrfxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\nbttnt.exec:\nbttnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\jvvpj.exec:\jvvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\flrlfrf.exec:\flrlfrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\jdvjj.exec:\jdvjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\flxrfxr.exec:\flxrfxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\7xfrrll.exec:\7xfrrll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\djvjj.exec:\djvjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\frrlxfx.exec:\frrlxfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\dppjd.exec:\dppjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
\??\c:\pdppd.exec:\pdppd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\nbhhnb.exec:\nbhhnb.exe23⤵
- Executes dropped EXE
PID:1112 -
\??\c:\jpppj.exec:\jpppj.exe24⤵
- Executes dropped EXE
PID:1492 -
\??\c:\rffrxrl.exec:\rffrxrl.exe25⤵
- Executes dropped EXE
PID:4088 -
\??\c:\hhnbbt.exec:\hhnbbt.exe26⤵
- Executes dropped EXE
PID:4400 -
\??\c:\xlrxrlf.exec:\xlrxrlf.exe27⤵
- Executes dropped EXE
PID:4384 -
\??\c:\bhthtt.exec:\bhthtt.exe28⤵
- Executes dropped EXE
PID:1444 -
\??\c:\rllxfxr.exec:\rllxfxr.exe29⤵
- Executes dropped EXE
PID:4512 -
\??\c:\1djjd.exec:\1djjd.exe30⤵
- Executes dropped EXE
PID:4256 -
\??\c:\jdvpd.exec:\jdvpd.exe31⤵
- Executes dropped EXE
PID:1260 -
\??\c:\lffxrrl.exec:\lffxrrl.exe32⤵
- Executes dropped EXE
PID:3332 -
\??\c:\hbtnhh.exec:\hbtnhh.exe33⤵
- Executes dropped EXE
PID:3260 -
\??\c:\1dvpj.exec:\1dvpj.exe34⤵
- Executes dropped EXE
PID:1612 -
\??\c:\jdddd.exec:\jdddd.exe35⤵
- Executes dropped EXE
PID:3248 -
\??\c:\lxxrfxr.exec:\lxxrfxr.exe36⤵
- Executes dropped EXE
PID:2432 -
\??\c:\3tthbn.exec:\3tthbn.exe37⤵
- Executes dropped EXE
PID:4076 -
\??\c:\7pdvj.exec:\7pdvj.exe38⤵
- Executes dropped EXE
PID:1076 -
\??\c:\xffxxll.exec:\xffxxll.exe39⤵
- Executes dropped EXE
PID:904 -
\??\c:\frxlfrl.exec:\frxlfrl.exe40⤵
- Executes dropped EXE
PID:4992 -
\??\c:\thnbtn.exec:\thnbtn.exe41⤵
- Executes dropped EXE
PID:2792 -
\??\c:\3vpdj.exec:\3vpdj.exe42⤵
- Executes dropped EXE
PID:4612 -
\??\c:\lfxrfxx.exec:\lfxrfxx.exe43⤵
- Executes dropped EXE
PID:2944 -
\??\c:\frxrxrf.exec:\frxrxrf.exe44⤵
- Executes dropped EXE
PID:4744 -
\??\c:\ntbtnh.exec:\ntbtnh.exe45⤵
- Executes dropped EXE
PID:4056 -
\??\c:\pddjj.exec:\pddjj.exe46⤵
- Executes dropped EXE
PID:3768 -
\??\c:\xlrlflr.exec:\xlrlflr.exe47⤵
- Executes dropped EXE
PID:404 -
\??\c:\bhnhbn.exec:\bhnhbn.exe48⤵
- Executes dropped EXE
PID:1856 -
\??\c:\5pvjd.exec:\5pvjd.exe49⤵
- Executes dropped EXE
PID:2124 -
\??\c:\tbhbnn.exec:\tbhbnn.exe50⤵
- Executes dropped EXE
PID:1900 -
\??\c:\vvddj.exec:\vvddj.exe51⤵
- Executes dropped EXE
PID:4912 -
\??\c:\3llfxxr.exec:\3llfxxr.exe52⤵
- Executes dropped EXE
PID:4060 -
\??\c:\rxffxxx.exec:\rxffxxx.exe53⤵
- Executes dropped EXE
PID:1440 -
\??\c:\pjppv.exec:\pjppv.exe54⤵
- Executes dropped EXE
PID:3280 -
\??\c:\vjpdp.exec:\vjpdp.exe55⤵
- Executes dropped EXE
PID:3532 -
\??\c:\rlxrxlr.exec:\rlxrxlr.exe56⤵
- Executes dropped EXE
PID:4656 -
\??\c:\btnnhb.exec:\btnnhb.exe57⤵
- Executes dropped EXE
PID:1484 -
\??\c:\1flxrlf.exec:\1flxrlf.exe58⤵
- Executes dropped EXE
PID:4252 -
\??\c:\tthnnb.exec:\tthnnb.exe59⤵
- Executes dropped EXE
PID:4988 -
\??\c:\bhhhnt.exec:\bhhhnt.exe60⤵
- Executes dropped EXE
PID:2020 -
\??\c:\1vvpv.exec:\1vvpv.exe61⤵
- Executes dropped EXE
PID:1140 -
\??\c:\frrrxlr.exec:\frrrxlr.exe62⤵
- Executes dropped EXE
PID:2700 -
\??\c:\nhtbnh.exec:\nhtbnh.exe63⤵
- Executes dropped EXE
PID:3996 -
\??\c:\dvvvv.exec:\dvvvv.exe64⤵
- Executes dropped EXE
PID:4412 -
\??\c:\lrfrrrx.exec:\lrfrrrx.exe65⤵
- Executes dropped EXE
PID:4864 -
\??\c:\1rlfxlf.exec:\1rlfxlf.exe66⤵PID:2264
-
\??\c:\htbbtt.exec:\htbbtt.exe67⤵PID:4284
-
\??\c:\vpjdv.exec:\vpjdv.exe68⤵PID:3940
-
\??\c:\pvdjv.exec:\pvdjv.exe69⤵PID:2292
-
\??\c:\frflrxr.exec:\frflrxr.exe70⤵PID:1864
-
\??\c:\3vvvv.exec:\3vvvv.exe71⤵PID:3460
-
\??\c:\fxxrlxr.exec:\fxxrlxr.exe72⤵PID:2964
-
\??\c:\5bbbbh.exec:\5bbbbh.exe73⤵PID:1636
-
\??\c:\hbbhtn.exec:\hbbhtn.exe74⤵PID:1252
-
\??\c:\5xlflfx.exec:\5xlflfx.exe75⤵PID:1324
-
\??\c:\pvvvj.exec:\pvvvj.exe76⤵PID:3512
-
\??\c:\jjppd.exec:\jjppd.exe77⤵PID:1512
-
\??\c:\xlxfxxf.exec:\xlxfxxf.exe78⤵PID:4100
-
\??\c:\flxrlrr.exec:\flxrlrr.exe79⤵PID:2780
-
\??\c:\frfflxf.exec:\frfflxf.exe80⤵PID:2572
-
\??\c:\tnnbbh.exec:\tnnbbh.exe81⤵PID:3928
-
\??\c:\9ddvp.exec:\9ddvp.exe82⤵PID:3576
-
\??\c:\rxrrlrr.exec:\rxrrlrr.exe83⤵PID:4592
-
\??\c:\3hnhbt.exec:\3hnhbt.exe84⤵PID:4952
-
\??\c:\pddpj.exec:\pddpj.exe85⤵PID:3248
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe86⤵PID:1648
-
\??\c:\vjdvv.exec:\vjdvv.exe87⤵PID:1184
-
\??\c:\vjpvv.exec:\vjpvv.exe88⤵PID:5064
-
\??\c:\thhtnn.exec:\thhtnn.exe89⤵PID:4072
-
\??\c:\pvdpd.exec:\pvdpd.exe90⤵PID:4424
-
\??\c:\hhttbh.exec:\hhttbh.exe91⤵PID:4040
-
\??\c:\pjpjj.exec:\pjpjj.exe92⤵PID:3524
-
\??\c:\jjppp.exec:\jjppp.exe93⤵PID:2908
-
\??\c:\rxlrxfx.exec:\rxlrxfx.exe94⤵PID:4968
-
\??\c:\jvvvp.exec:\jvvvp.exe95⤵PID:4408
-
\??\c:\fxrfxrl.exec:\fxrfxrl.exe96⤵PID:452
-
\??\c:\7nbtbb.exec:\7nbtbb.exe97⤵PID:2640
-
\??\c:\tbbhbt.exec:\tbbhbt.exe98⤵PID:4892
-
\??\c:\7lflxlf.exec:\7lflxlf.exe99⤵PID:4588
-
\??\c:\nhbtnn.exec:\nhbtnn.exe100⤵PID:3648
-
\??\c:\fxlfxlr.exec:\fxlfxlr.exe101⤵PID:4776
-
\??\c:\rlfxxlx.exec:\rlfxxlx.exe102⤵PID:2468
-
\??\c:\bhbnbh.exec:\bhbnbh.exe103⤵PID:3240
-
\??\c:\tbhbtn.exec:\tbhbtn.exe104⤵PID:4948
-
\??\c:\1ppjv.exec:\1ppjv.exe105⤵PID:812
-
\??\c:\rllrfrf.exec:\rllrfrf.exe106⤵PID:4252
-
\??\c:\xfxxflr.exec:\xfxxflr.exe107⤵PID:1312
-
\??\c:\bnhbnh.exec:\bnhbnh.exe108⤵PID:1384
-
\??\c:\7vvpd.exec:\7vvpd.exe109⤵PID:408
-
\??\c:\djjdv.exec:\djjdv.exe110⤵PID:4640
-
\??\c:\9lffrlx.exec:\9lffrlx.exe111⤵PID:3564
-
\??\c:\5rlfxxx.exec:\5rlfxxx.exe112⤵PID:1480
-
\??\c:\ntnbtn.exec:\ntnbtn.exe113⤵PID:1800
-
\??\c:\jddpj.exec:\jddpj.exe114⤵PID:612
-
\??\c:\3rrlffx.exec:\3rrlffx.exe115⤵PID:1524
-
\??\c:\lffxxxr.exec:\lffxxxr.exe116⤵PID:3940
-
\??\c:\7vpjv.exec:\7vpjv.exe117⤵PID:4624
-
\??\c:\xlxrrlf.exec:\xlxrrlf.exe118⤵PID:3744
-
\??\c:\fxxrxxr.exec:\fxxrxxr.exe119⤵PID:3268
-
\??\c:\jvvpj.exec:\jvvpj.exe120⤵PID:2324
-
\??\c:\rrrlffx.exec:\rrrlffx.exe121⤵PID:932
-
\??\c:\1frlrll.exec:\1frlrll.exe122⤵PID:1252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-