Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/04/2024, 23:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9f21e87f6a0295dd673d3dfe8f4b1f836d830d493fd7e5c33ed9ba7c8a12e889.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
9f21e87f6a0295dd673d3dfe8f4b1f836d830d493fd7e5c33ed9ba7c8a12e889.exe
-
Size
183KB
-
MD5
0526c9c5921d3377279beb3acd14dfee
-
SHA1
c44f42c5aa4c65bb96b46f272db9994ae4c1f114
-
SHA256
9f21e87f6a0295dd673d3dfe8f4b1f836d830d493fd7e5c33ed9ba7c8a12e889
-
SHA512
84d726bcf766fcb20fb505d55949907d4885e4648ee930f74d91e584b536f58420af067bd1e4c07779895d08ecfed2a922e93bd09fe03644c3da9d40fd3cca27
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+EMdW:PhOm2sI93UufdC67ciJTWMdW
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2128-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/876-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1304-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/684-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/992-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1832-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-314-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-362-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-368-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1440-383-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-390-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-400-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-413-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-492-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-494-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-501-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-514-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/680-522-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-523-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-545-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-553-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-632-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/556-658-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-679-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-710-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-772-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3040-927-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-1087-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/2128-7-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4584-16-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4696-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1724-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/644-30-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1900-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4776-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4776-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3008-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3608-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3128-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/876-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1304-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2748-81-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4404-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/684-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4700-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4700-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4684-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4964-116-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1676-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2388-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1028-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4844-146-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/232-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1220-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3860-173-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3860-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4544-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1784-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1784-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/920-196-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4564-202-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4284-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2228-207-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4360-214-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/992-220-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4720-225-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2384-268-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1832-273-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5100-278-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1052-293-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3284-299-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3036-314-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2080-337-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3700-340-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1940-362-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2612-368-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2348-373-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1440-383-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4792-390-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2316-400-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3524-413-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/448-492-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2388-494-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4604-501-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4992-514-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/680-522-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4556-523-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1784-545-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4424-553-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4560-632-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/556-658-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2060-679-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2128 dpjvj.exe 4584 rrrrllf.exe 4696 nthbtt.exe 1900 jvdvd.exe 644 bhhhbh.exe 4948 vvpdv.exe 4776 9nhbnn.exe 1588 pdpjd.exe 3008 lrffxxr.exe 3608 lrxlfxl.exe 3128 xfffrlf.exe 876 fxrxlfx.exe 1304 9ppvv.exe 2748 3rrlxxr.exe 4404 pdjjd.exe 684 fxffffr.exe 4560 hthbbb.exe 4700 llfxrrl.exe 1676 3hbtnn.exe 4964 pjdpd.exe 4684 3xxrllf.exe 2388 xlxfffl.exe 1028 bhnhbb.exe 556 jddvj.exe 3400 bnnhbh.exe 4844 dpvjd.exe 232 xffxlrl.exe 2452 nbhhbb.exe 3660 9ffrfff.exe 1220 tbhbtt.exe 3860 jvjjd.exe 2892 nhbttt.exe 5088 vjjdv.exe 4544 7lrfxxl.exe 1784 jddvv.exe 216 xlrrllf.exe 920 3tttnn.exe 4564 jdvpd.exe 4284 fxffllr.exe 2228 dvddv.exe 884 jdvdv.exe 4360 3bbthh.exe 992 pjjdp.exe 3664 lflffff.exe 4720 bhbbtt.exe 368 pdjdp.exe 3568 1rxlrrf.exe 2828 1ttnht.exe 644 7bhbtt.exe 3192 5pvjp.exe 4312 3hhbtt.exe 3440 3vjdv.exe 3468 jdvpp.exe 5000 7rxrffx.exe 3052 tnbntn.exe 4732 3btnbb.exe 3480 3pvpj.exe 1216 7lrxrxx.exe 2384 lrfxrll.exe 1504 nbbbtt.exe 1832 bhbtnh.exe 5100 pjjdd.exe 3976 lrrlffr.exe 3688 nhnntn.exe -
resource yara_rule behavioral2/memory/2128-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/644-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/876-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1304-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/684-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/992-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-314-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-362-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-368-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-373-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1440-383-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-390-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-400-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-413-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-492-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-494-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-501-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-514-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/680-522-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-523-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-545-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-553-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-632-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-658-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2060-679-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1724 wrote to memory of 2128 1724 9f21e87f6a0295dd673d3dfe8f4b1f836d830d493fd7e5c33ed9ba7c8a12e889.exe 87 PID 1724 wrote to memory of 2128 1724 9f21e87f6a0295dd673d3dfe8f4b1f836d830d493fd7e5c33ed9ba7c8a12e889.exe 87 PID 1724 wrote to memory of 2128 1724 9f21e87f6a0295dd673d3dfe8f4b1f836d830d493fd7e5c33ed9ba7c8a12e889.exe 87 PID 2128 wrote to memory of 4584 2128 dpjvj.exe 88 PID 2128 wrote to memory of 4584 2128 dpjvj.exe 88 PID 2128 wrote to memory of 4584 2128 dpjvj.exe 88 PID 4584 wrote to memory of 4696 4584 rrrrllf.exe 89 PID 4584 wrote to memory of 4696 4584 rrrrllf.exe 89 PID 4584 wrote to memory of 4696 4584 rrrrllf.exe 89 PID 4696 wrote to memory of 1900 4696 nthbtt.exe 90 PID 4696 wrote to memory of 1900 4696 nthbtt.exe 90 PID 4696 wrote to memory of 1900 4696 nthbtt.exe 90 PID 1900 wrote to memory of 644 1900 jvdvd.exe 91 PID 1900 wrote to memory of 644 1900 jvdvd.exe 91 PID 1900 wrote to memory of 644 1900 jvdvd.exe 91 PID 644 wrote to memory of 4948 644 bhhhbh.exe 92 PID 644 wrote to memory of 4948 644 bhhhbh.exe 92 PID 644 wrote to memory of 4948 644 bhhhbh.exe 92 PID 4948 wrote to memory of 4776 4948 vvpdv.exe 93 PID 4948 wrote to memory of 4776 4948 vvpdv.exe 93 PID 4948 wrote to memory of 4776 4948 vvpdv.exe 93 PID 4776 wrote to memory of 1588 4776 9nhbnn.exe 94 PID 4776 wrote to memory of 1588 4776 9nhbnn.exe 94 PID 4776 wrote to memory of 1588 4776 9nhbnn.exe 94 PID 1588 wrote to memory of 3008 1588 pdpjd.exe 95 PID 1588 wrote to memory of 3008 1588 pdpjd.exe 95 PID 1588 wrote to memory of 3008 1588 pdpjd.exe 95 PID 3008 wrote to memory of 3608 3008 lrffxxr.exe 96 PID 3008 wrote to memory of 3608 3008 lrffxxr.exe 96 PID 3008 wrote to memory of 3608 3008 lrffxxr.exe 96 PID 3608 wrote to memory of 3128 3608 lrxlfxl.exe 97 PID 3608 wrote to memory of 3128 3608 lrxlfxl.exe 97 PID 3608 wrote to memory of 3128 3608 lrxlfxl.exe 97 PID 3128 wrote to memory of 876 3128 xfffrlf.exe 99 PID 3128 wrote to memory of 876 3128 xfffrlf.exe 99 PID 3128 wrote to memory of 876 3128 xfffrlf.exe 99 PID 876 wrote to memory of 1304 876 fxrxlfx.exe 100 PID 876 wrote to memory of 1304 876 fxrxlfx.exe 100 PID 876 wrote to memory of 1304 876 fxrxlfx.exe 100 PID 1304 wrote to memory of 2748 1304 9ppvv.exe 101 PID 1304 wrote to memory of 2748 1304 9ppvv.exe 101 PID 1304 wrote to memory of 2748 1304 9ppvv.exe 101 PID 2748 wrote to memory of 4404 2748 3rrlxxr.exe 102 PID 2748 wrote to memory of 4404 2748 3rrlxxr.exe 102 PID 2748 wrote to memory of 4404 2748 3rrlxxr.exe 102 PID 4404 wrote to memory of 684 4404 pdjjd.exe 103 PID 4404 wrote to memory of 684 4404 pdjjd.exe 103 PID 4404 wrote to memory of 684 4404 pdjjd.exe 103 PID 684 wrote to memory of 4560 684 fxffffr.exe 104 PID 684 wrote to memory of 4560 684 fxffffr.exe 104 PID 684 wrote to memory of 4560 684 fxffffr.exe 104 PID 4560 wrote to memory of 4700 4560 hthbbb.exe 105 PID 4560 wrote to memory of 4700 4560 hthbbb.exe 105 PID 4560 wrote to memory of 4700 4560 hthbbb.exe 105 PID 4700 wrote to memory of 1676 4700 llfxrrl.exe 106 PID 4700 wrote to memory of 1676 4700 llfxrrl.exe 106 PID 4700 wrote to memory of 1676 4700 llfxrrl.exe 106 PID 1676 wrote to memory of 4964 1676 3hbtnn.exe 107 PID 1676 wrote to memory of 4964 1676 3hbtnn.exe 107 PID 1676 wrote to memory of 4964 1676 3hbtnn.exe 107 PID 4964 wrote to memory of 4684 4964 pjdpd.exe 108 PID 4964 wrote to memory of 4684 4964 pjdpd.exe 108 PID 4964 wrote to memory of 4684 4964 pjdpd.exe 108 PID 4684 wrote to memory of 2388 4684 3xxrllf.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f21e87f6a0295dd673d3dfe8f4b1f836d830d493fd7e5c33ed9ba7c8a12e889.exe"C:\Users\Admin\AppData\Local\Temp\9f21e87f6a0295dd673d3dfe8f4b1f836d830d493fd7e5c33ed9ba7c8a12e889.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\dpjvj.exec:\dpjvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\rrrrllf.exec:\rrrrllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\nthbtt.exec:\nthbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\jvdvd.exec:\jvdvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\bhhhbh.exec:\bhhhbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\vvpdv.exec:\vvpdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\9nhbnn.exec:\9nhbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\pdpjd.exec:\pdpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\lrffxxr.exec:\lrffxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\lrxlfxl.exec:\lrxlfxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\xfffrlf.exec:\xfffrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\fxrxlfx.exec:\fxrxlfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\9ppvv.exec:\9ppvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\3rrlxxr.exec:\3rrlxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\pdjjd.exec:\pdjjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\fxffffr.exec:\fxffffr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\hthbbb.exec:\hthbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\llfxrrl.exec:\llfxrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\3hbtnn.exec:\3hbtnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\pjdpd.exec:\pjdpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\3xxrllf.exec:\3xxrllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\xlxfffl.exec:\xlxfffl.exe23⤵
- Executes dropped EXE
PID:2388 -
\??\c:\bhnhbb.exec:\bhnhbb.exe24⤵
- Executes dropped EXE
PID:1028 -
\??\c:\jddvj.exec:\jddvj.exe25⤵
- Executes dropped EXE
PID:556 -
\??\c:\bnnhbh.exec:\bnnhbh.exe26⤵
- Executes dropped EXE
PID:3400 -
\??\c:\dpvjd.exec:\dpvjd.exe27⤵
- Executes dropped EXE
PID:4844 -
\??\c:\xffxlrl.exec:\xffxlrl.exe28⤵
- Executes dropped EXE
PID:232 -
\??\c:\nbhhbb.exec:\nbhhbb.exe29⤵
- Executes dropped EXE
PID:2452 -
\??\c:\9ffrfff.exec:\9ffrfff.exe30⤵
- Executes dropped EXE
PID:3660 -
\??\c:\tbhbtt.exec:\tbhbtt.exe31⤵
- Executes dropped EXE
PID:1220 -
\??\c:\jvjjd.exec:\jvjjd.exe32⤵
- Executes dropped EXE
PID:3860 -
\??\c:\nhbttt.exec:\nhbttt.exe33⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vjjdv.exec:\vjjdv.exe34⤵
- Executes dropped EXE
PID:5088 -
\??\c:\7lrfxxl.exec:\7lrfxxl.exe35⤵
- Executes dropped EXE
PID:4544 -
\??\c:\jddvv.exec:\jddvv.exe36⤵
- Executes dropped EXE
PID:1784 -
\??\c:\xlrrllf.exec:\xlrrllf.exe37⤵
- Executes dropped EXE
PID:216 -
\??\c:\3tttnn.exec:\3tttnn.exe38⤵
- Executes dropped EXE
PID:920 -
\??\c:\jdvpd.exec:\jdvpd.exe39⤵
- Executes dropped EXE
PID:4564 -
\??\c:\fxffllr.exec:\fxffllr.exe40⤵
- Executes dropped EXE
PID:4284 -
\??\c:\dvddv.exec:\dvddv.exe41⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jdvdv.exec:\jdvdv.exe42⤵
- Executes dropped EXE
PID:884 -
\??\c:\3bbthh.exec:\3bbthh.exe43⤵
- Executes dropped EXE
PID:4360 -
\??\c:\pjjdp.exec:\pjjdp.exe44⤵
- Executes dropped EXE
PID:992 -
\??\c:\lflffff.exec:\lflffff.exe45⤵
- Executes dropped EXE
PID:3664 -
\??\c:\bhbbtt.exec:\bhbbtt.exe46⤵
- Executes dropped EXE
PID:4720 -
\??\c:\pdjdp.exec:\pdjdp.exe47⤵
- Executes dropped EXE
PID:368 -
\??\c:\1rxlrrf.exec:\1rxlrrf.exe48⤵
- Executes dropped EXE
PID:3568 -
\??\c:\1ttnht.exec:\1ttnht.exe49⤵
- Executes dropped EXE
PID:2828 -
\??\c:\7bhbtt.exec:\7bhbtt.exe50⤵
- Executes dropped EXE
PID:644 -
\??\c:\5pvjp.exec:\5pvjp.exe51⤵
- Executes dropped EXE
PID:3192 -
\??\c:\3hhbtt.exec:\3hhbtt.exe52⤵
- Executes dropped EXE
PID:4312 -
\??\c:\3vjdv.exec:\3vjdv.exe53⤵
- Executes dropped EXE
PID:3440 -
\??\c:\jdvpp.exec:\jdvpp.exe54⤵
- Executes dropped EXE
PID:3468 -
\??\c:\7rxrffx.exec:\7rxrffx.exe55⤵
- Executes dropped EXE
PID:5000 -
\??\c:\tnbntn.exec:\tnbntn.exe56⤵
- Executes dropped EXE
PID:3052 -
\??\c:\3btnbb.exec:\3btnbb.exe57⤵
- Executes dropped EXE
PID:4732 -
\??\c:\3pvpj.exec:\3pvpj.exe58⤵
- Executes dropped EXE
PID:3480 -
\??\c:\7lrxrxx.exec:\7lrxrxx.exe59⤵
- Executes dropped EXE
PID:1216 -
\??\c:\lrfxrll.exec:\lrfxrll.exe60⤵
- Executes dropped EXE
PID:2384 -
\??\c:\nbbbtt.exec:\nbbbtt.exe61⤵
- Executes dropped EXE
PID:1504 -
\??\c:\bhbtnh.exec:\bhbtnh.exe62⤵
- Executes dropped EXE
PID:1832 -
\??\c:\pjjdd.exec:\pjjdd.exe63⤵
- Executes dropped EXE
PID:5100 -
\??\c:\lrrlffr.exec:\lrrlffr.exe64⤵
- Executes dropped EXE
PID:3976 -
\??\c:\nhnntn.exec:\nhnntn.exe65⤵
- Executes dropped EXE
PID:3688 -
\??\c:\nnbtnn.exec:\nnbtnn.exe66⤵PID:4980
-
\??\c:\vpppd.exec:\vpppd.exe67⤵PID:3264
-
\??\c:\ffxrxxf.exec:\ffxrxxf.exe68⤵PID:1052
-
\??\c:\lxrlrrx.exec:\lxrlrrx.exe69⤵PID:4560
-
\??\c:\3bnbnh.exec:\3bnbnh.exe70⤵PID:3284
-
\??\c:\jdpjv.exec:\jdpjv.exe71⤵PID:2028
-
\??\c:\xrrlrrx.exec:\xrrlrrx.exe72⤵PID:5036
-
\??\c:\3hhbbn.exec:\3hhbbn.exe73⤵PID:3732
-
\??\c:\vpvjd.exec:\vpvjd.exe74⤵PID:3036
-
\??\c:\vjvpp.exec:\vjvpp.exe75⤵PID:1444
-
\??\c:\9bhbtn.exec:\9bhbtn.exe76⤵PID:2368
-
\??\c:\9jdpd.exec:\9jdpd.exe77⤵PID:2156
-
\??\c:\1rrfrlf.exec:\1rrfrlf.exe78⤵PID:3904
-
\??\c:\xfrrrxx.exec:\xfrrrxx.exe79⤵PID:1028
-
\??\c:\bnnbnh.exec:\bnnbnh.exe80⤵PID:1624
-
\??\c:\tntnht.exec:\tntnht.exe81⤵PID:4992
-
\??\c:\dpjvp.exec:\dpjvp.exe82⤵PID:2080
-
\??\c:\9ppjd.exec:\9ppjd.exe83⤵PID:3700
-
\??\c:\thbbnb.exec:\thbbnb.exe84⤵PID:2648
-
\??\c:\7hhbtt.exec:\7hhbtt.exe85⤵PID:2452
-
\??\c:\3pjjd.exec:\3pjjd.exe86⤵PID:2752
-
\??\c:\vppdv.exec:\vppdv.exe87⤵PID:1488
-
\??\c:\xxxrlrl.exec:\xxxrlrl.exe88⤵PID:388
-
\??\c:\tthbtt.exec:\tthbtt.exe89⤵PID:1940
-
\??\c:\jppjv.exec:\jppjv.exe90⤵PID:4376
-
\??\c:\vvpdv.exec:\vvpdv.exe91⤵PID:2612
-
\??\c:\lfffrrx.exec:\lfffrrx.exe92⤵PID:2348
-
\??\c:\fflxlrf.exec:\fflxlrf.exe93⤵PID:2996
-
\??\c:\1jvpp.exec:\1jvpp.exe94⤵PID:1908
-
\??\c:\lffxrrl.exec:\lffxrrl.exe95⤵PID:1440
-
\??\c:\fxrlllf.exec:\fxrlllf.exe96⤵PID:2652
-
\??\c:\1djdv.exec:\1djdv.exe97⤵PID:4792
-
\??\c:\3jjpp.exec:\3jjpp.exe98⤵PID:4768
-
\??\c:\1bnnnn.exec:\1bnnnn.exe99⤵PID:4372
-
\??\c:\dddvp.exec:\dddvp.exe100⤵PID:2316
-
\??\c:\9rrflxl.exec:\9rrflxl.exe101⤵PID:4344
-
\??\c:\1tbbtn.exec:\1tbbtn.exe102⤵PID:3436
-
\??\c:\jdjvp.exec:\jdjvp.exe103⤵PID:4164
-
\??\c:\dvjjj.exec:\dvjjj.exe104⤵PID:3728
-
\??\c:\flffrrr.exec:\flffrrr.exe105⤵PID:3524
-
\??\c:\xxfxlfr.exec:\xxfxlfr.exe106⤵PID:3084
-
\??\c:\tnhhtn.exec:\tnhhtn.exe107⤵PID:1096
-
\??\c:\tntnhh.exec:\tntnhh.exe108⤵PID:2440
-
\??\c:\3pppp.exec:\3pppp.exe109⤵PID:2964
-
\??\c:\frxxlrl.exec:\frxxlrl.exe110⤵PID:972
-
\??\c:\rlrrllf.exec:\rlrrllf.exe111⤵PID:3176
-
\??\c:\nhnntt.exec:\nhnntt.exe112⤵PID:3468
-
\??\c:\3hhhbb.exec:\3hhhbb.exe113⤵PID:1936
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe114⤵PID:3852
-
\??\c:\fxrrlxx.exec:\fxrrlxx.exe115⤵PID:3128
-
\??\c:\hbbhbn.exec:\hbbhbn.exe116⤵PID:412
-
\??\c:\vdpvj.exec:\vdpvj.exe117⤵PID:2384
-
\??\c:\1flfxxx.exec:\1flfxxx.exe118⤵PID:2840
-
\??\c:\btbtbt.exec:\btbtbt.exe119⤵PID:2664
-
\??\c:\nhhtnn.exec:\nhhtnn.exe120⤵PID:2924
-
\??\c:\jddjd.exec:\jddjd.exe121⤵PID:4920
-
\??\c:\vjvpd.exec:\vjvpd.exe122⤵PID:1388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-