Analysis
-
max time kernel
143s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 22:22
Behavioral task
behavioral1
Sample
5e563d06c443b81b96905d22fd5a6e254e008a2f5f7e2287360aad79b8586731.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
-
Target
5e563d06c443b81b96905d22fd5a6e254e008a2f5f7e2287360aad79b8586731.exe
-
Size
378KB
-
MD5
088a976bef9d9ff3ea02f4f678c06d69
-
SHA1
9d29c882f8ca630af2fb725a277d6c3e59a7a100
-
SHA256
5e563d06c443b81b96905d22fd5a6e254e008a2f5f7e2287360aad79b8586731
-
SHA512
69d931cea9968ed85bbb774cab37705e00d3114258c955de7a7ff96b01a70c3982f2ccf9cb9540c3a5abffe2e7c2c90fccea26b4c44357a2be9690ddab7176a9
-
SSDEEP
6144:9cm4FmowdHoSABIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf73:/4wFHoSA4KofHfHTXQLzgvnzHPowYbvU
Malware Config
Signatures
-
Detect Blackmoon payload 34 IoCs
Processes:
resource yara_rule behavioral2/memory/3936-32-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1144-38-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/744-41-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2052-76-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/5064-80-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3280-101-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2700-120-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3080-123-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/5116-152-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3588-217-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2884-227-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4868-234-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2612-241-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2612-237-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2788-219-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3692-207-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3692-204-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/636-196-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/456-193-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1640-185-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4380-175-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1720-174-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/684-170-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2572-159-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1196-144-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4360-137-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1460-126-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2440-109-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4704-91-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3148-83-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4140-55-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3748-21-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4760-13-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/5036-10-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule C:\dppdv.exe UPX C:\9rxllfl.exe UPX C:\nnnhnh.exe UPX C:\1hhhhb.exe UPX \??\c:\xrfxlfx.exe UPX behavioral2/memory/3936-32-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/1144-38-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4140-40-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/744-41-0x0000000000400000-0x0000000000460000-memory.dmp UPX \??\c:\thhbtn.exe UPX C:\xrlfxlf.exe UPX behavioral2/memory/4864-51-0x0000000000400000-0x0000000000460000-memory.dmp UPX \??\c:\hnthbt.exe UPX behavioral2/memory/2052-62-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/2052-76-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/5064-80-0x0000000000400000-0x0000000000460000-memory.dmp UPX C:\nhbnhh.exe UPX C:\xrllfxr.exe UPX behavioral2/memory/2440-98-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/3280-101-0x0000000000400000-0x0000000000460000-memory.dmp UPX \??\c:\jdjvv.exe UPX behavioral2/memory/2700-120-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/3080-123-0x0000000000400000-0x0000000000460000-memory.dmp UPX C:\ddvjd.exe UPX C:\tbbtnt.exe UPX \??\c:\frfrllf.exe UPX behavioral2/memory/2572-151-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/5116-152-0x0000000000400000-0x0000000000460000-memory.dmp UPX C:\1tthhn.exe UPX \??\c:\lxfrllf.exe UPX \??\c:\pvvvv.exe UPX behavioral2/memory/3588-217-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/2884-227-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4868-234-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/2612-241-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/2612-237-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/2788-219-0x0000000000400000-0x0000000000460000-memory.dmp UPX \??\c:\ttbbtb.exe UPX \??\c:\lxfrllf.exe UPX behavioral2/memory/3692-207-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/3692-204-0x0000000000400000-0x0000000000460000-memory.dmp UPX \??\c:\httbtt.exe UPX \??\c:\tthbnh.exe UPX behavioral2/memory/636-196-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/456-193-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/3384-195-0x0000000000400000-0x0000000000460000-memory.dmp UPX \??\c:\vjdvv.exe UPX \??\c:\dvvvd.exe UPX behavioral2/memory/4380-175-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/1720-174-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/684-170-0x0000000000400000-0x0000000000460000-memory.dmp UPX \??\c:\5bbnbn.exe UPX behavioral2/memory/2572-159-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/684-158-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/1196-144-0x0000000000400000-0x0000000000460000-memory.dmp UPX \??\c:\dvdjp.exe UPX behavioral2/memory/5116-143-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4360-137-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/1196-135-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/1460-126-0x0000000000400000-0x0000000000460000-memory.dmp UPX \??\c:\fffxffr.exe UPX behavioral2/memory/2440-109-0x0000000000400000-0x0000000000460000-memory.dmp UPX C:\llrlrrl.exe UPX \??\c:\rrxlrrl.exe UPX -
Executes dropped EXE 64 IoCs
Processes:
dppdv.exe9rxllfl.exennnhnh.exe1hhhhb.exexrfxlfx.exethhbtn.exexrlfxlf.exehnthbt.exedjpjd.exebbtnhb.exepjvpj.exefrlxlxr.exenhbnhh.exexrllfxr.exerrxlrrl.exellrlrrl.exejdjvv.exefffxffr.exeddvjd.exetbbtnt.exedvdjp.exefrfrllf.exe5bbnbn.exe1tthhn.exelxfrllf.exepvvvv.exedvvvd.exevjdvv.exetthbnh.exehttbtt.exelxfrllf.exettbbtb.exe5vvpj.exe3lrlxrf.exeppjdp.exeflrxlrl.exe3bbtnn.exejdvjv.exejvppj.exethnbnn.exepdjvv.exejjvjv.exedjvvv.exerllxlfr.exedpjvj.exetbbtbt.exe9djdv.exe5vjvj.exefxrfxlf.exe5hhbtn.exepjvpd.exe1xrlxxr.exejpjjj.exefrxlfxx.exenbhbtn.exe9lfrllf.exe5tnbnh.exerlrrrrx.exevpvvv.exexflxxxl.exebtnhbb.exefflrrxl.exehhntnn.exefrlrfrl.exepid process 4760 dppdv.exe 3748 9rxllfl.exe 3936 nnnhnh.exe 744 1hhhhb.exe 1144 xrfxlfx.exe 4140 thhbtn.exe 4864 xrlfxlf.exe 4984 hnthbt.exe 2052 djpjd.exe 3148 bbtnhb.exe 5064 pjvpj.exe 4704 frlxlxr.exe 3280 nhbnhh.exe 3528 xrllfxr.exe 2440 rrxlrrl.exe 2700 llrlrrl.exe 3080 jdjvv.exe 1460 fffxffr.exe 4360 ddvjd.exe 1196 tbbtnt.exe 5116 dvdjp.exe 2572 frfrllf.exe 684 5bbnbn.exe 4380 1tthhn.exe 1720 lxfrllf.exe 456 pvvvv.exe 1640 dvvvd.exe 636 vjdvv.exe 3384 tthbnh.exe 3692 httbtt.exe 3588 lxfrllf.exe 2788 ttbbtb.exe 2884 5vvpj.exe 4868 3lrlxrf.exe 3564 ppjdp.exe 4304 flrxlrl.exe 2612 3bbtnn.exe 4012 jdvjv.exe 4200 jvppj.exe 2084 thnbnn.exe 4952 pdjvv.exe 5036 jjvjv.exe 3784 djvvv.exe 4324 rllxlfr.exe 2928 dpjvj.exe 848 tbbtbt.exe 744 9djdv.exe 4744 5vjvj.exe 3652 fxrfxlf.exe 1400 5hhbtn.exe 1632 pjvpd.exe 1752 1xrlxxr.exe 4060 jpjjj.exe 4600 frxlfxx.exe 3404 nbhbtn.exe 412 9lfrllf.exe 4684 5tnbnh.exe 4608 rlrrrrx.exe 4020 vpvvv.exe 464 xflxxxl.exe 4996 btnhbb.exe 1460 fflrrxl.exe 5012 hhntnn.exe 4456 frlrfrl.exe -
Molebox Virtualization software 32 IoCs
Detects file using Molebox Virtualization software.
Processes:
resource yara_rule C:\dppdv.exe molebox C:\9rxllfl.exe molebox C:\nnnhnh.exe molebox C:\1hhhhb.exe molebox \??\c:\xrfxlfx.exe molebox \??\c:\thhbtn.exe molebox C:\xrlfxlf.exe molebox \??\c:\hnthbt.exe molebox C:\nhbnhh.exe molebox C:\xrllfxr.exe molebox \??\c:\jdjvv.exe molebox C:\ddvjd.exe molebox C:\tbbtnt.exe molebox \??\c:\frfrllf.exe molebox C:\1tthhn.exe molebox \??\c:\lxfrllf.exe molebox \??\c:\pvvvv.exe molebox \??\c:\ttbbtb.exe molebox \??\c:\lxfrllf.exe molebox \??\c:\httbtt.exe molebox \??\c:\tthbnh.exe molebox \??\c:\vjdvv.exe molebox \??\c:\dvvvd.exe molebox \??\c:\5bbnbn.exe molebox \??\c:\dvdjp.exe molebox \??\c:\fffxffr.exe molebox C:\llrlrrl.exe molebox \??\c:\rrxlrrl.exe molebox \??\c:\frlxlxr.exe molebox \??\c:\pjvpj.exe molebox \??\c:\bbtnhb.exe molebox \??\c:\djpjd.exe molebox -
Processes:
resource yara_rule behavioral2/memory/5036-0-0x0000000000400000-0x0000000000460000-memory.dmp upx C:\dppdv.exe upx behavioral2/memory/4760-4-0x0000000000400000-0x0000000000460000-memory.dmp upx C:\9rxllfl.exe upx C:\nnnhnh.exe upx C:\1hhhhb.exe upx behavioral2/memory/744-26-0x0000000000400000-0x0000000000460000-memory.dmp upx \??\c:\xrfxlfx.exe upx behavioral2/memory/3936-32-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1144-38-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4140-40-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/744-41-0x0000000000400000-0x0000000000460000-memory.dmp upx \??\c:\thhbtn.exe upx C:\xrlfxlf.exe upx behavioral2/memory/4864-51-0x0000000000400000-0x0000000000460000-memory.dmp upx \??\c:\hnthbt.exe upx behavioral2/memory/2052-62-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2052-76-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/5064-80-0x0000000000400000-0x0000000000460000-memory.dmp upx C:\nhbnhh.exe upx C:\xrllfxr.exe upx behavioral2/memory/2440-98-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3280-101-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2700-106-0x0000000000400000-0x0000000000460000-memory.dmp upx \??\c:\jdjvv.exe upx behavioral2/memory/3080-115-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2700-120-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3080-123-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4984-125-0x0000000000400000-0x0000000000460000-memory.dmp upx C:\ddvjd.exe upx C:\tbbtnt.exe upx \??\c:\frfrllf.exe upx behavioral2/memory/2572-151-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/5116-152-0x0000000000400000-0x0000000000460000-memory.dmp upx C:\1tthhn.exe upx behavioral2/memory/3528-162-0x0000000000400000-0x0000000000460000-memory.dmp upx \??\c:\lxfrllf.exe upx \??\c:\pvvvv.exe upx behavioral2/memory/636-191-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3588-217-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2884-221-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2884-227-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4868-234-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2612-241-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4304-240-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2612-237-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4868-225-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2788-219-0x0000000000400000-0x0000000000460000-memory.dmp upx \??\c:\ttbbtb.exe upx \??\c:\lxfrllf.exe upx behavioral2/memory/3692-207-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3692-204-0x0000000000400000-0x0000000000460000-memory.dmp upx \??\c:\httbtt.exe upx \??\c:\tthbnh.exe upx behavioral2/memory/636-196-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/456-193-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3384-195-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1640-185-0x0000000000400000-0x0000000000460000-memory.dmp upx \??\c:\vjdvv.exe upx \??\c:\dvvvd.exe upx behavioral2/memory/4380-175-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1720-171-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1720-174-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/684-170-0x0000000000400000-0x0000000000460000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5e563d06c443b81b96905d22fd5a6e254e008a2f5f7e2287360aad79b8586731.exedppdv.exe9rxllfl.exennnhnh.exe1hhhhb.exexrfxlfx.exethhbtn.exexrlfxlf.exehnthbt.exedjpjd.exebbtnhb.exepjvpj.exefrlxlxr.exenhbnhh.exexrllfxr.exerrxlrrl.exellrlrrl.exejdjvv.exefffxffr.exeddvjd.exetbbtnt.exedvdjp.exedescription pid process target process PID 5036 wrote to memory of 4760 5036 5e563d06c443b81b96905d22fd5a6e254e008a2f5f7e2287360aad79b8586731.exe dppdv.exe PID 5036 wrote to memory of 4760 5036 5e563d06c443b81b96905d22fd5a6e254e008a2f5f7e2287360aad79b8586731.exe dppdv.exe PID 5036 wrote to memory of 4760 5036 5e563d06c443b81b96905d22fd5a6e254e008a2f5f7e2287360aad79b8586731.exe dppdv.exe PID 4760 wrote to memory of 3748 4760 dppdv.exe 9rxllfl.exe PID 4760 wrote to memory of 3748 4760 dppdv.exe 9rxllfl.exe PID 4760 wrote to memory of 3748 4760 dppdv.exe 9rxllfl.exe PID 3748 wrote to memory of 3936 3748 9rxllfl.exe nnnhnh.exe PID 3748 wrote to memory of 3936 3748 9rxllfl.exe nnnhnh.exe PID 3748 wrote to memory of 3936 3748 9rxllfl.exe nnnhnh.exe PID 3936 wrote to memory of 744 3936 nnnhnh.exe 1hhhhb.exe PID 3936 wrote to memory of 744 3936 nnnhnh.exe 1hhhhb.exe PID 3936 wrote to memory of 744 3936 nnnhnh.exe 1hhhhb.exe PID 744 wrote to memory of 1144 744 1hhhhb.exe xrfxlfx.exe PID 744 wrote to memory of 1144 744 1hhhhb.exe xrfxlfx.exe PID 744 wrote to memory of 1144 744 1hhhhb.exe xrfxlfx.exe PID 1144 wrote to memory of 4140 1144 xrfxlfx.exe thhbtn.exe PID 1144 wrote to memory of 4140 1144 xrfxlfx.exe thhbtn.exe PID 1144 wrote to memory of 4140 1144 xrfxlfx.exe thhbtn.exe PID 4140 wrote to memory of 4864 4140 thhbtn.exe xrlfxlf.exe PID 4140 wrote to memory of 4864 4140 thhbtn.exe xrlfxlf.exe PID 4140 wrote to memory of 4864 4140 thhbtn.exe xrlfxlf.exe PID 4864 wrote to memory of 4984 4864 xrlfxlf.exe hnthbt.exe PID 4864 wrote to memory of 4984 4864 xrlfxlf.exe hnthbt.exe PID 4864 wrote to memory of 4984 4864 xrlfxlf.exe hnthbt.exe PID 4984 wrote to memory of 2052 4984 hnthbt.exe djpjd.exe PID 4984 wrote to memory of 2052 4984 hnthbt.exe djpjd.exe PID 4984 wrote to memory of 2052 4984 hnthbt.exe djpjd.exe PID 2052 wrote to memory of 3148 2052 djpjd.exe bbtnhb.exe PID 2052 wrote to memory of 3148 2052 djpjd.exe bbtnhb.exe PID 2052 wrote to memory of 3148 2052 djpjd.exe bbtnhb.exe PID 3148 wrote to memory of 5064 3148 bbtnhb.exe pjvpj.exe PID 3148 wrote to memory of 5064 3148 bbtnhb.exe pjvpj.exe PID 3148 wrote to memory of 5064 3148 bbtnhb.exe pjvpj.exe PID 5064 wrote to memory of 4704 5064 pjvpj.exe frlxlxr.exe PID 5064 wrote to memory of 4704 5064 pjvpj.exe frlxlxr.exe PID 5064 wrote to memory of 4704 5064 pjvpj.exe frlxlxr.exe PID 4704 wrote to memory of 3280 4704 frlxlxr.exe nhbnhh.exe PID 4704 wrote to memory of 3280 4704 frlxlxr.exe nhbnhh.exe PID 4704 wrote to memory of 3280 4704 frlxlxr.exe nhbnhh.exe PID 3280 wrote to memory of 3528 3280 nhbnhh.exe xrllfxr.exe PID 3280 wrote to memory of 3528 3280 nhbnhh.exe xrllfxr.exe PID 3280 wrote to memory of 3528 3280 nhbnhh.exe xrllfxr.exe PID 3528 wrote to memory of 2440 3528 xrllfxr.exe rrxlrrl.exe PID 3528 wrote to memory of 2440 3528 xrllfxr.exe rrxlrrl.exe PID 3528 wrote to memory of 2440 3528 xrllfxr.exe rrxlrrl.exe PID 2440 wrote to memory of 2700 2440 rrxlrrl.exe llrlrrl.exe PID 2440 wrote to memory of 2700 2440 rrxlrrl.exe llrlrrl.exe PID 2440 wrote to memory of 2700 2440 rrxlrrl.exe llrlrrl.exe PID 2700 wrote to memory of 3080 2700 llrlrrl.exe jdjvv.exe PID 2700 wrote to memory of 3080 2700 llrlrrl.exe jdjvv.exe PID 2700 wrote to memory of 3080 2700 llrlrrl.exe jdjvv.exe PID 3080 wrote to memory of 1460 3080 jdjvv.exe fflrrxl.exe PID 3080 wrote to memory of 1460 3080 jdjvv.exe fflrrxl.exe PID 3080 wrote to memory of 1460 3080 jdjvv.exe fflrrxl.exe PID 1460 wrote to memory of 4360 1460 fffxffr.exe ddvjd.exe PID 1460 wrote to memory of 4360 1460 fffxffr.exe ddvjd.exe PID 1460 wrote to memory of 4360 1460 fffxffr.exe ddvjd.exe PID 4360 wrote to memory of 1196 4360 ddvjd.exe tbbtnt.exe PID 4360 wrote to memory of 1196 4360 ddvjd.exe tbbtnt.exe PID 4360 wrote to memory of 1196 4360 ddvjd.exe tbbtnt.exe PID 1196 wrote to memory of 5116 1196 tbbtnt.exe dvdjp.exe PID 1196 wrote to memory of 5116 1196 tbbtnt.exe dvdjp.exe PID 1196 wrote to memory of 5116 1196 tbbtnt.exe dvdjp.exe PID 5116 wrote to memory of 2572 5116 dvdjp.exe frfrllf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e563d06c443b81b96905d22fd5a6e254e008a2f5f7e2287360aad79b8586731.exe"C:\Users\Admin\AppData\Local\Temp\5e563d06c443b81b96905d22fd5a6e254e008a2f5f7e2287360aad79b8586731.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\dppdv.exec:\dppdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9rxllfl.exec:\9rxllfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnnhnh.exec:\nnnhnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1hhhhb.exec:\1hhhhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrfxlfx.exec:\xrfxlfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thhbtn.exec:\thhbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrlfxlf.exec:\xrlfxlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnthbt.exec:\hnthbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djpjd.exec:\djpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbtnhb.exec:\bbtnhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvpj.exec:\pjvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frlxlxr.exec:\frlxlxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbnhh.exec:\nhbnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrllfxr.exec:\xrllfxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrxlrrl.exec:\rrxlrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llrlrrl.exec:\llrlrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdjvv.exec:\jdjvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fffxffr.exec:\fffxffr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddvjd.exec:\ddvjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbbtnt.exec:\tbbtnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvdjp.exec:\dvdjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frfrllf.exec:\frfrllf.exe23⤵
- Executes dropped EXE
-
\??\c:\5bbnbn.exec:\5bbnbn.exe24⤵
- Executes dropped EXE
-
\??\c:\1tthhn.exec:\1tthhn.exe25⤵
- Executes dropped EXE
-
\??\c:\lxfrllf.exec:\lxfrllf.exe26⤵
- Executes dropped EXE
-
\??\c:\pvvvv.exec:\pvvvv.exe27⤵
- Executes dropped EXE
-
\??\c:\dvvvd.exec:\dvvvd.exe28⤵
- Executes dropped EXE
-
\??\c:\vjdvv.exec:\vjdvv.exe29⤵
- Executes dropped EXE
-
\??\c:\tthbnh.exec:\tthbnh.exe30⤵
- Executes dropped EXE
-
\??\c:\httbtt.exec:\httbtt.exe31⤵
- Executes dropped EXE
-
\??\c:\lxfrllf.exec:\lxfrllf.exe32⤵
- Executes dropped EXE
-
\??\c:\ttbbtb.exec:\ttbbtb.exe33⤵
- Executes dropped EXE
-
\??\c:\5vvpj.exec:\5vvpj.exe34⤵
- Executes dropped EXE
-
\??\c:\3lrlxrf.exec:\3lrlxrf.exe35⤵
- Executes dropped EXE
-
\??\c:\ppjdp.exec:\ppjdp.exe36⤵
- Executes dropped EXE
-
\??\c:\flrxlrl.exec:\flrxlrl.exe37⤵
- Executes dropped EXE
-
\??\c:\3bbtnn.exec:\3bbtnn.exe38⤵
- Executes dropped EXE
-
\??\c:\jdvjv.exec:\jdvjv.exe39⤵
- Executes dropped EXE
-
\??\c:\jvppj.exec:\jvppj.exe40⤵
- Executes dropped EXE
-
\??\c:\thnbnn.exec:\thnbnn.exe41⤵
- Executes dropped EXE
-
\??\c:\pdjvv.exec:\pdjvv.exe42⤵
- Executes dropped EXE
-
\??\c:\jjvjv.exec:\jjvjv.exe43⤵
- Executes dropped EXE
-
\??\c:\djvvv.exec:\djvvv.exe44⤵
- Executes dropped EXE
-
\??\c:\rllxlfr.exec:\rllxlfr.exe45⤵
- Executes dropped EXE
-
\??\c:\dpjvj.exec:\dpjvj.exe46⤵
- Executes dropped EXE
-
\??\c:\tbbtbt.exec:\tbbtbt.exe47⤵
- Executes dropped EXE
-
\??\c:\9djdv.exec:\9djdv.exe48⤵
- Executes dropped EXE
-
\??\c:\5vjvj.exec:\5vjvj.exe49⤵
- Executes dropped EXE
-
\??\c:\fxrfxlf.exec:\fxrfxlf.exe50⤵
- Executes dropped EXE
-
\??\c:\5hhbtn.exec:\5hhbtn.exe51⤵
- Executes dropped EXE
-
\??\c:\pjvpd.exec:\pjvpd.exe52⤵
- Executes dropped EXE
-
\??\c:\1xrlxxr.exec:\1xrlxxr.exe53⤵
- Executes dropped EXE
-
\??\c:\jpjjj.exec:\jpjjj.exe54⤵
- Executes dropped EXE
-
\??\c:\frxlfxx.exec:\frxlfxx.exe55⤵
- Executes dropped EXE
-
\??\c:\nbhbtn.exec:\nbhbtn.exe56⤵
- Executes dropped EXE
-
\??\c:\9lfrllf.exec:\9lfrllf.exe57⤵
- Executes dropped EXE
-
\??\c:\5tnbnh.exec:\5tnbnh.exe58⤵
- Executes dropped EXE
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe59⤵
- Executes dropped EXE
-
\??\c:\vpvvv.exec:\vpvvv.exe60⤵
- Executes dropped EXE
-
\??\c:\xflxxxl.exec:\xflxxxl.exe61⤵
- Executes dropped EXE
-
\??\c:\btnhbb.exec:\btnhbb.exe62⤵
- Executes dropped EXE
-
\??\c:\fflrrxl.exec:\fflrrxl.exe63⤵
- Executes dropped EXE
-
\??\c:\hhntnn.exec:\hhntnn.exe64⤵
- Executes dropped EXE
-
\??\c:\frlrfrl.exec:\frlrfrl.exe65⤵
- Executes dropped EXE
-
\??\c:\nnbnhb.exec:\nnbnhb.exe66⤵
-
\??\c:\thnbtn.exec:\thnbtn.exe67⤵
-
\??\c:\rrrfrlx.exec:\rrrfrlx.exe68⤵
-
\??\c:\nhhbbh.exec:\nhhbbh.exe69⤵
-
\??\c:\dpvvp.exec:\dpvvp.exe70⤵
-
\??\c:\5rfflfr.exec:\5rfflfr.exe71⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe72⤵
-
\??\c:\jjpdp.exec:\jjpdp.exe73⤵
-
\??\c:\hbthnb.exec:\hbthnb.exe74⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe75⤵
-
\??\c:\7xxrffl.exec:\7xxrffl.exe76⤵
-
\??\c:\5ttnbb.exec:\5ttnbb.exe77⤵
-
\??\c:\5djvv.exec:\5djvv.exe78⤵
-
\??\c:\bbtnbb.exec:\bbtnbb.exe79⤵
-
\??\c:\pjdpj.exec:\pjdpj.exe80⤵
-
\??\c:\fffrllr.exec:\fffrllr.exe81⤵
-
\??\c:\djvjd.exec:\djvjd.exe82⤵
-
\??\c:\rxfrfrl.exec:\rxfrfrl.exe83⤵
-
\??\c:\7ttnhh.exec:\7ttnhh.exe84⤵
-
\??\c:\ppvpp.exec:\ppvpp.exe85⤵
-
\??\c:\dppjv.exec:\dppjv.exe86⤵
-
\??\c:\ntbbnn.exec:\ntbbnn.exe87⤵
-
\??\c:\5nnbbt.exec:\5nnbbt.exe88⤵
-
\??\c:\dvjdp.exec:\dvjdp.exe89⤵
-
\??\c:\rffrlrf.exec:\rffrlrf.exe90⤵
-
\??\c:\hhnhth.exec:\hhnhth.exe91⤵
-
\??\c:\9vpdp.exec:\9vpdp.exe92⤵
-
\??\c:\lflfxrx.exec:\lflfxrx.exe93⤵
-
\??\c:\7thbtn.exec:\7thbtn.exe94⤵
-
\??\c:\1hbtnh.exec:\1hbtnh.exe95⤵
-
\??\c:\thbbnt.exec:\thbbnt.exe96⤵
-
\??\c:\5pjvd.exec:\5pjvd.exe97⤵
-
\??\c:\xxffxrl.exec:\xxffxrl.exe98⤵
-
\??\c:\5dvdj.exec:\5dvdj.exe99⤵
-
\??\c:\rffrlfr.exec:\rffrlfr.exe100⤵
-
\??\c:\bbbttt.exec:\bbbttt.exe101⤵
-
\??\c:\xrrrlff.exec:\xrrrlff.exe102⤵
-
\??\c:\vjpjp.exec:\vjpjp.exe103⤵
-
\??\c:\xffxlfx.exec:\xffxlfx.exe104⤵
-
\??\c:\bnnnhb.exec:\bnnnhb.exe105⤵
-
\??\c:\vpvpv.exec:\vpvpv.exe106⤵
-
\??\c:\xxrfxxr.exec:\xxrfxxr.exe107⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe108⤵
-
\??\c:\1lffxxr.exec:\1lffxxr.exe109⤵
-
\??\c:\lfrrlll.exec:\lfrrlll.exe110⤵
-
\??\c:\ttnnbt.exec:\ttnnbt.exe111⤵
-
\??\c:\tbhbtb.exec:\tbhbtb.exe112⤵
-
\??\c:\1rlxrlf.exec:\1rlxrlf.exe113⤵
-
\??\c:\bnnhbt.exec:\bnnhbt.exe114⤵
-
\??\c:\9jjvj.exec:\9jjvj.exe115⤵
-
\??\c:\dvvpd.exec:\dvvpd.exe116⤵
-
\??\c:\nhtntn.exec:\nhtntn.exe117⤵
-
\??\c:\dppdv.exec:\dppdv.exe118⤵
-
\??\c:\9xfxxrl.exec:\9xfxxrl.exe119⤵
-
\??\c:\djdvj.exec:\djdvj.exe120⤵
-
\??\c:\7xlfxxf.exec:\7xlfxxf.exe121⤵
-
\??\c:\nbbtnn.exec:\nbbtnn.exe122⤵
-
\??\c:\jdvjd.exec:\jdvjd.exe123⤵
-
\??\c:\lxfxrll.exec:\lxfxrll.exe124⤵
-
\??\c:\dpjvp.exec:\dpjvp.exe125⤵
-
\??\c:\rrxrrrf.exec:\rrxrrrf.exe126⤵
-
\??\c:\ppddp.exec:\ppddp.exe127⤵
-
\??\c:\7ffxxxl.exec:\7ffxxxl.exe128⤵
-
\??\c:\pvvjv.exec:\pvvjv.exe129⤵
-
\??\c:\flrllxr.exec:\flrllxr.exe130⤵
-
\??\c:\xxrrrxx.exec:\xxrrrxx.exe131⤵
-
\??\c:\nbhbtt.exec:\nbhbtt.exe132⤵
-
\??\c:\tbbnbt.exec:\tbbnbt.exe133⤵
-
\??\c:\frrfrrf.exec:\frrfrrf.exe134⤵
-
\??\c:\1jdvj.exec:\1jdvj.exe135⤵
-
\??\c:\xxxlfxr.exec:\xxxlfxr.exe136⤵
-
\??\c:\thnhtt.exec:\thnhtt.exe137⤵
-
\??\c:\pjjdj.exec:\pjjdj.exe138⤵
-
\??\c:\nhnnnh.exec:\nhnnnh.exe139⤵
-
\??\c:\9pjvp.exec:\9pjvp.exe140⤵
-
\??\c:\hnthtn.exec:\hnthtn.exe141⤵
-
\??\c:\dvvpp.exec:\dvvpp.exe142⤵
-
\??\c:\bttnhb.exec:\bttnhb.exe143⤵
-
\??\c:\lrxlfrl.exec:\lrxlfrl.exe144⤵
-
\??\c:\bnnhbt.exec:\bnnhbt.exe145⤵
-
\??\c:\jdpjd.exec:\jdpjd.exe146⤵
-
\??\c:\vjjjj.exec:\vjjjj.exe147⤵
-
\??\c:\xlrfrlf.exec:\xlrfrlf.exe148⤵
-
\??\c:\bhhtnh.exec:\bhhtnh.exe149⤵
-
\??\c:\rrlxlfr.exec:\rrlxlfr.exe150⤵
-
\??\c:\nhnhnh.exec:\nhnhnh.exe151⤵
-
\??\c:\dvpjv.exec:\dvpjv.exe152⤵
-
\??\c:\rrrfxfx.exec:\rrrfxfx.exe153⤵
-
\??\c:\htbnbb.exec:\htbnbb.exe154⤵
-
\??\c:\3vjdd.exec:\3vjdd.exe155⤵
-
\??\c:\nnttbt.exec:\nnttbt.exe156⤵
-
\??\c:\djjdv.exec:\djjdv.exe157⤵
-
\??\c:\fxfxxlr.exec:\fxfxxlr.exe158⤵
-
\??\c:\7bbttb.exec:\7bbttb.exe159⤵
-
\??\c:\ddjdv.exec:\ddjdv.exe160⤵
-
\??\c:\xrxrllf.exec:\xrxrllf.exe161⤵
-
\??\c:\dvpvv.exec:\dvpvv.exe162⤵
-
\??\c:\bhthbt.exec:\bhthbt.exe163⤵
-
\??\c:\tbhbtt.exec:\tbhbtt.exe164⤵
-
\??\c:\fxrrflf.exec:\fxrrflf.exe165⤵
-
\??\c:\lfffrfr.exec:\lfffrfr.exe166⤵
-
\??\c:\nnbbnn.exec:\nnbbnn.exe167⤵
-
\??\c:\rxxlxrl.exec:\rxxlxrl.exe168⤵
-
\??\c:\1rrrrxf.exec:\1rrrrxf.exe169⤵
-
\??\c:\nttnbb.exec:\nttnbb.exe170⤵
-
\??\c:\rllxrlx.exec:\rllxrlx.exe171⤵
-
\??\c:\llrrllf.exec:\llrrllf.exe172⤵
-
\??\c:\nnnnth.exec:\nnnnth.exe173⤵
-
\??\c:\3pvpp.exec:\3pvpp.exe174⤵
-
\??\c:\rrlfxxf.exec:\rrlfxxf.exe175⤵
-
\??\c:\hbbhtb.exec:\hbbhtb.exe176⤵
-
\??\c:\1pdpj.exec:\1pdpj.exe177⤵
-
\??\c:\ffflffx.exec:\ffflffx.exe178⤵
-
\??\c:\7nhbtt.exec:\7nhbtt.exe179⤵
-
\??\c:\rfrrlll.exec:\rfrrlll.exe180⤵
-
\??\c:\dvpjd.exec:\dvpjd.exe181⤵
-
\??\c:\5fxrllf.exec:\5fxrllf.exe182⤵
-
\??\c:\xrrlrrx.exec:\xrrlrrx.exe183⤵
-
\??\c:\jvdpj.exec:\jvdpj.exe184⤵
-
\??\c:\xxfxrxx.exec:\xxfxrxx.exe185⤵
-
\??\c:\llrrffl.exec:\llrrffl.exe186⤵
-
\??\c:\bbtnth.exec:\bbtnth.exe187⤵
-
\??\c:\jpdvv.exec:\jpdvv.exe188⤵
-
\??\c:\7rxxxxx.exec:\7rxxxxx.exe189⤵
-
\??\c:\tbbhnn.exec:\tbbhnn.exe190⤵
-
\??\c:\vvpjj.exec:\vvpjj.exe191⤵
-
\??\c:\xrrllll.exec:\xrrllll.exe192⤵
-
\??\c:\rxllfxr.exec:\rxllfxr.exe193⤵
-
\??\c:\1bbbtt.exec:\1bbbtt.exe194⤵
-
\??\c:\bbnhbb.exec:\bbnhbb.exe195⤵
-
\??\c:\vvppp.exec:\vvppp.exe196⤵
-
\??\c:\xrxxfff.exec:\xrxxfff.exe197⤵
-
\??\c:\9thhnn.exec:\9thhnn.exe198⤵
-
\??\c:\dvddp.exec:\dvddp.exe199⤵
-
\??\c:\1djdp.exec:\1djdp.exe200⤵
-
\??\c:\tthbnt.exec:\tthbnt.exe201⤵
-
\??\c:\xxlrrrf.exec:\xxlrrrf.exe202⤵
-
\??\c:\bthhhh.exec:\bthhhh.exe203⤵
-
\??\c:\xllxlfx.exec:\xllxlfx.exe204⤵
-
\??\c:\7tthbt.exec:\7tthbt.exe205⤵
-
\??\c:\dppvv.exec:\dppvv.exe206⤵
-
\??\c:\ffflflf.exec:\ffflflf.exe207⤵
-
\??\c:\9jvvd.exec:\9jvvd.exe208⤵
-
\??\c:\nbbtnn.exec:\nbbtnn.exe209⤵
-
\??\c:\thbttt.exec:\thbttt.exe210⤵
-
\??\c:\bnnhbt.exec:\bnnhbt.exe211⤵
-
\??\c:\ppvpp.exec:\ppvpp.exe212⤵
-
\??\c:\xxllrrx.exec:\xxllrrx.exe213⤵
-
\??\c:\3hnhhh.exec:\3hnhhh.exe214⤵
-
\??\c:\fffxrrr.exec:\fffxrrr.exe215⤵
-
\??\c:\rrfxlfx.exec:\rrfxlfx.exe216⤵
-
\??\c:\jdddv.exec:\jdddv.exe217⤵
-
\??\c:\lfrlfff.exec:\lfrlfff.exe218⤵
-
\??\c:\rffxllx.exec:\rffxllx.exe219⤵
-
\??\c:\dvpjd.exec:\dvpjd.exe220⤵
-
\??\c:\ttbbtb.exec:\ttbbtb.exe221⤵
-
\??\c:\3dvpd.exec:\3dvpd.exe222⤵
-
\??\c:\1flfxxr.exec:\1flfxxr.exe223⤵
-
\??\c:\dppjv.exec:\dppjv.exe224⤵
-
\??\c:\llxrlfx.exec:\llxrlfx.exe225⤵
-
\??\c:\rxrrlxr.exec:\rxrrlxr.exe226⤵
-
\??\c:\9jvpj.exec:\9jvpj.exe227⤵
-
\??\c:\9xfxrll.exec:\9xfxrll.exe228⤵
-
\??\c:\vjjjp.exec:\vjjjp.exe229⤵
-
\??\c:\7fllfxf.exec:\7fllfxf.exe230⤵
-
\??\c:\jddvj.exec:\jddvj.exe231⤵
-
\??\c:\rfrfxrl.exec:\rfrfxrl.exe232⤵
-
\??\c:\vjpjv.exec:\vjpjv.exe233⤵
-
\??\c:\xffxrfr.exec:\xffxrfr.exe234⤵
-
\??\c:\jjvpj.exec:\jjvpj.exe235⤵
-
\??\c:\xlrlffx.exec:\xlrlffx.exe236⤵
-
\??\c:\htnhbb.exec:\htnhbb.exe237⤵
-
\??\c:\7djjj.exec:\7djjj.exe238⤵
-
\??\c:\rrrxlxf.exec:\rrrxlxf.exe239⤵
-
\??\c:\rlfxxxr.exec:\rlfxxxr.exe240⤵
-
\??\c:\lxxrrxx.exec:\lxxrrxx.exe241⤵