Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 22:43
Behavioral task
behavioral1
Sample
64c09dc0ab753704cc3c412228d3b30564cbabc954919cbb720ab6c018ff6608.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
64c09dc0ab753704cc3c412228d3b30564cbabc954919cbb720ab6c018ff6608.exe
-
Size
80KB
-
MD5
66a89472628a243bc5114651788be8fe
-
SHA1
915be5745a881cdab5533eaee2585ddb179f3058
-
SHA256
64c09dc0ab753704cc3c412228d3b30564cbabc954919cbb720ab6c018ff6608
-
SHA512
d76571ddaf1b1353b7d48d4c713518521a77527a47bf5e6fa2951e4afb538def69cb734b3a35fbb6a218abba837b08a392892eb29e5457ad0204379a867e3cbf
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFWxIF5WoZk8:9hOmTsF93UYfwC6GIoutz5yLd5tZv
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4576-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2660-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4768-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1708-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3424-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3412-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2556-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2164-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/816-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4136-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3836-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1532-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1940-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4132-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1136-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1972-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2144-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1472-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2948-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4812-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3424-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1232-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4192-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1112-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3704-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1032-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3116-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3088-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4136-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2184-533-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4880-619-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-652-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2892-664-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3088-704-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-872-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-882-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-1008-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/920-1030-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1340-1052-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4216-1427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4576-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\440482.exe UPX behavioral2/memory/4576-4-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2660-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\20600.exe UPX C:\tnbtnt.exe UPX behavioral2/memory/4768-20-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rrfflrr.exe UPX behavioral2/memory/1708-15-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3424-24-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\3nhtnh.exe UPX C:\jpvvj.exe UPX behavioral2/memory/3412-32-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2556-35-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\88408.exe UPX C:\4448664.exe UPX behavioral2/memory/2164-43-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rxxrrlf.exe UPX behavioral2/memory/816-51-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\htnhnh.exe UPX behavioral2/memory/4136-54-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hnntnh.exe UPX behavioral2/memory/3836-59-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1532-66-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\1hnbtn.exe UPX C:\lrlfxrx.exe UPX behavioral2/memory/1940-70-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4972-78-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\1bbnhb.exe UPX \??\c:\pvpdv.exe UPX C:\626200.exe UPX behavioral2/memory/4132-85-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nhhhnb.exe UPX behavioral2/memory/1136-94-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\606664.exe UPX behavioral2/memory/4988-101-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1136-98-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\228860.exe UPX behavioral2/memory/4668-107-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\84008.exe UPX \??\c:\06282.exe UPX behavioral2/memory/3064-117-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\hnnnbt.exe UPX behavioral2/memory/1972-128-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nbbthb.exe UPX \??\c:\nhhbbt.exe UPX \??\c:\htbtnh.exe UPX C:\i826828.exe UPX behavioral2/memory/884-134-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5052-144-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2144-148-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5ddpd.exe UPX \??\c:\i662480.exe UPX behavioral2/memory/1216-154-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ppppj.exe UPX behavioral2/memory/4856-160-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xxflrlx.exe UPX behavioral2/memory/5004-167-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\844204.exe UPX \??\c:\rlxrrrl.exe UPX behavioral2/memory/2764-186-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4852-180-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1588-193-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4580-202-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
440482.exe20600.exetnbtnt.exerrfflrr.exe3nhtnh.exejpvvj.exe88408.exe4448664.exerxxrrlf.exehtnhnh.exehnntnh.exe1hnbtn.exelrlfxrx.exe1bbnhb.exepvpdv.exe626200.exenhhhnb.exe606664.exe228860.exe84008.exe06282.exehnnnbt.exenbbthb.exenhhbbt.exehtbtnh.exei826828.exe5ddpd.exei662480.exeppppj.exexxflrlx.exe844204.exerlxrrrl.exe084880.exetnnhhb.exe3vpjd.exe5tnbnn.exe04600.exelxxrffl.exe204084.exenhtnbb.exe0662604.exe884488.exehtntnh.exerfrfrlf.exea4426.exejddpv.exebbtnbb.exefrxlffx.exe9btnnb.exehhnbnh.exepjdvj.exenhbnht.exeg6602.exelxlrrlf.exe8682808.exe0022886.exe7fxrlfx.exe3hbthh.exevdpjv.exedppdv.exe860648.exevpddv.exelxrrxxr.exe64020.exepid process 2660 440482.exe 1708 20600.exe 4768 tnbtnt.exe 3424 rrfflrr.exe 3412 3nhtnh.exe 2556 jpvvj.exe 2164 88408.exe 816 4448664.exe 4136 rxxrrlf.exe 3836 htnhnh.exe 1532 hnntnh.exe 1736 1hnbtn.exe 1940 lrlfxrx.exe 4972 1bbnhb.exe 4132 pvpdv.exe 3440 626200.exe 1136 nhhhnb.exe 4988 606664.exe 4668 228860.exe 1232 84008.exe 3064 06282.exe 3388 hnnnbt.exe 1972 nbbthb.exe 884 nhhbbt.exe 5052 htbtnh.exe 2144 i826828.exe 1216 5ddpd.exe 4072 i662480.exe 4856 ppppj.exe 5004 xxflrlx.exe 4876 844204.exe 4852 rlxrrrl.exe 2764 084880.exe 3704 tnnhhb.exe 2256 3vpjd.exe 1588 5tnbnn.exe 1768 04600.exe 1856 lxxrffl.exe 4580 204084.exe 1472 nhtnbb.exe 4776 0662604.exe 2608 884488.exe 3224 htntnh.exe 1660 rfrfrlf.exe 4564 a4426.exe 4576 jddpv.exe 2948 bbtnbb.exe 2588 frxlffx.exe 4812 9btnnb.exe 3424 hhnbnh.exe 4468 pjdvj.exe 3964 nhbnht.exe 1672 g6602.exe 4792 lxlrrlf.exe 816 8682808.exe 4136 0022886.exe 4492 7fxrlfx.exe 2648 3hbthh.exe 4656 vdpjv.exe 3176 dppdv.exe 3292 860648.exe 1000 vpddv.exe 4864 lxrrxxr.exe 4132 64020.exe -
Processes:
resource yara_rule behavioral2/memory/4576-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\440482.exe upx behavioral2/memory/4576-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2660-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\20600.exe upx C:\tnbtnt.exe upx behavioral2/memory/4768-20-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrfflrr.exe upx behavioral2/memory/1708-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3424-24-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3nhtnh.exe upx C:\jpvvj.exe upx behavioral2/memory/3412-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2556-35-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\88408.exe upx C:\4448664.exe upx behavioral2/memory/2164-43-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxxrrlf.exe upx behavioral2/memory/816-51-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htnhnh.exe upx behavioral2/memory/4136-54-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hnntnh.exe upx behavioral2/memory/3836-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1532-66-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1hnbtn.exe upx C:\lrlfxrx.exe upx behavioral2/memory/1940-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4972-78-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1bbnhb.exe upx \??\c:\pvpdv.exe upx C:\626200.exe upx behavioral2/memory/4132-85-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhhhnb.exe upx behavioral2/memory/1136-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\606664.exe upx behavioral2/memory/4988-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1136-98-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\228860.exe upx behavioral2/memory/4668-107-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\84008.exe upx \??\c:\06282.exe upx behavioral2/memory/3064-117-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hnnnbt.exe upx behavioral2/memory/1972-128-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbbthb.exe upx \??\c:\nhhbbt.exe upx \??\c:\htbtnh.exe upx C:\i826828.exe upx behavioral2/memory/884-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5052-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2144-148-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5ddpd.exe upx \??\c:\i662480.exe upx behavioral2/memory/1216-154-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppppj.exe upx behavioral2/memory/4856-160-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxflrlx.exe upx behavioral2/memory/5004-167-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\844204.exe upx \??\c:\rlxrrrl.exe upx behavioral2/memory/2764-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4852-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1588-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4580-202-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
64c09dc0ab753704cc3c412228d3b30564cbabc954919cbb720ab6c018ff6608.exe440482.exe20600.exetnbtnt.exerrfflrr.exe3nhtnh.exejpvvj.exe88408.exe4448664.exerxxrrlf.exehtnhnh.exehnntnh.exe1hnbtn.exelrlfxrx.exe1bbnhb.exepvpdv.exe626200.exenhhhnb.exe606664.exe228860.exe84008.exe06282.exedescription pid process target process PID 4576 wrote to memory of 2660 4576 64c09dc0ab753704cc3c412228d3b30564cbabc954919cbb720ab6c018ff6608.exe 440482.exe PID 4576 wrote to memory of 2660 4576 64c09dc0ab753704cc3c412228d3b30564cbabc954919cbb720ab6c018ff6608.exe 440482.exe PID 4576 wrote to memory of 2660 4576 64c09dc0ab753704cc3c412228d3b30564cbabc954919cbb720ab6c018ff6608.exe 440482.exe PID 2660 wrote to memory of 1708 2660 440482.exe 20600.exe PID 2660 wrote to memory of 1708 2660 440482.exe 20600.exe PID 2660 wrote to memory of 1708 2660 440482.exe 20600.exe PID 1708 wrote to memory of 4768 1708 20600.exe tnbtnt.exe PID 1708 wrote to memory of 4768 1708 20600.exe tnbtnt.exe PID 1708 wrote to memory of 4768 1708 20600.exe tnbtnt.exe PID 4768 wrote to memory of 3424 4768 tnbtnt.exe rrfflrr.exe PID 4768 wrote to memory of 3424 4768 tnbtnt.exe rrfflrr.exe PID 4768 wrote to memory of 3424 4768 tnbtnt.exe rrfflrr.exe PID 3424 wrote to memory of 3412 3424 rrfflrr.exe 3nhtnh.exe PID 3424 wrote to memory of 3412 3424 rrfflrr.exe 3nhtnh.exe PID 3424 wrote to memory of 3412 3424 rrfflrr.exe 3nhtnh.exe PID 3412 wrote to memory of 2556 3412 3nhtnh.exe jpvvj.exe PID 3412 wrote to memory of 2556 3412 3nhtnh.exe jpvvj.exe PID 3412 wrote to memory of 2556 3412 3nhtnh.exe jpvvj.exe PID 2556 wrote to memory of 2164 2556 jpvvj.exe 88408.exe PID 2556 wrote to memory of 2164 2556 jpvvj.exe 88408.exe PID 2556 wrote to memory of 2164 2556 jpvvj.exe 88408.exe PID 2164 wrote to memory of 816 2164 88408.exe 4448664.exe PID 2164 wrote to memory of 816 2164 88408.exe 4448664.exe PID 2164 wrote to memory of 816 2164 88408.exe 4448664.exe PID 816 wrote to memory of 4136 816 4448664.exe rxxrrlf.exe PID 816 wrote to memory of 4136 816 4448664.exe rxxrrlf.exe PID 816 wrote to memory of 4136 816 4448664.exe rxxrrlf.exe PID 4136 wrote to memory of 3836 4136 rxxrrlf.exe htnhnh.exe PID 4136 wrote to memory of 3836 4136 rxxrrlf.exe htnhnh.exe PID 4136 wrote to memory of 3836 4136 rxxrrlf.exe htnhnh.exe PID 3836 wrote to memory of 1532 3836 htnhnh.exe hnntnh.exe PID 3836 wrote to memory of 1532 3836 htnhnh.exe hnntnh.exe PID 3836 wrote to memory of 1532 3836 htnhnh.exe hnntnh.exe PID 1532 wrote to memory of 1736 1532 hnntnh.exe 1hnbtn.exe PID 1532 wrote to memory of 1736 1532 hnntnh.exe 1hnbtn.exe PID 1532 wrote to memory of 1736 1532 hnntnh.exe 1hnbtn.exe PID 1736 wrote to memory of 1940 1736 1hnbtn.exe lrlfxrx.exe PID 1736 wrote to memory of 1940 1736 1hnbtn.exe lrlfxrx.exe PID 1736 wrote to memory of 1940 1736 1hnbtn.exe lrlfxrx.exe PID 1940 wrote to memory of 4972 1940 lrlfxrx.exe 1bbnhb.exe PID 1940 wrote to memory of 4972 1940 lrlfxrx.exe 1bbnhb.exe PID 1940 wrote to memory of 4972 1940 lrlfxrx.exe 1bbnhb.exe PID 4972 wrote to memory of 4132 4972 1bbnhb.exe pvpdv.exe PID 4972 wrote to memory of 4132 4972 1bbnhb.exe pvpdv.exe PID 4972 wrote to memory of 4132 4972 1bbnhb.exe pvpdv.exe PID 4132 wrote to memory of 3440 4132 pvpdv.exe 626200.exe PID 4132 wrote to memory of 3440 4132 pvpdv.exe 626200.exe PID 4132 wrote to memory of 3440 4132 pvpdv.exe 626200.exe PID 3440 wrote to memory of 1136 3440 626200.exe nhhhnb.exe PID 3440 wrote to memory of 1136 3440 626200.exe nhhhnb.exe PID 3440 wrote to memory of 1136 3440 626200.exe nhhhnb.exe PID 1136 wrote to memory of 4988 1136 nhhhnb.exe 606664.exe PID 1136 wrote to memory of 4988 1136 nhhhnb.exe 606664.exe PID 1136 wrote to memory of 4988 1136 nhhhnb.exe 606664.exe PID 4988 wrote to memory of 4668 4988 606664.exe 060860.exe PID 4988 wrote to memory of 4668 4988 606664.exe 060860.exe PID 4988 wrote to memory of 4668 4988 606664.exe 060860.exe PID 4668 wrote to memory of 1232 4668 228860.exe 84008.exe PID 4668 wrote to memory of 1232 4668 228860.exe 84008.exe PID 4668 wrote to memory of 1232 4668 228860.exe 84008.exe PID 1232 wrote to memory of 3064 1232 84008.exe 06282.exe PID 1232 wrote to memory of 3064 1232 84008.exe 06282.exe PID 1232 wrote to memory of 3064 1232 84008.exe 06282.exe PID 3064 wrote to memory of 3388 3064 06282.exe hnnnbt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\64c09dc0ab753704cc3c412228d3b30564cbabc954919cbb720ab6c018ff6608.exe"C:\Users\Admin\AppData\Local\Temp\64c09dc0ab753704cc3c412228d3b30564cbabc954919cbb720ab6c018ff6608.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\440482.exec:\440482.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\20600.exec:\20600.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbtnt.exec:\tnbtnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrfflrr.exec:\rrfflrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3nhtnh.exec:\3nhtnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpvvj.exec:\jpvvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\88408.exec:\88408.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\4448664.exec:\4448664.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxxrrlf.exec:\rxxrrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htnhnh.exec:\htnhnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnntnh.exec:\hnntnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1hnbtn.exec:\1hnbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrlfxrx.exec:\lrlfxrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1bbnhb.exec:\1bbnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvpdv.exec:\pvpdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\626200.exec:\626200.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhhnb.exec:\nhhhnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\606664.exec:\606664.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\228860.exec:\228860.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\84008.exec:\84008.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\06282.exec:\06282.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnnnbt.exec:\hnnnbt.exe23⤵
- Executes dropped EXE
-
\??\c:\nbbthb.exec:\nbbthb.exe24⤵
- Executes dropped EXE
-
\??\c:\nhhbbt.exec:\nhhbbt.exe25⤵
- Executes dropped EXE
-
\??\c:\htbtnh.exec:\htbtnh.exe26⤵
- Executes dropped EXE
-
\??\c:\i826828.exec:\i826828.exe27⤵
- Executes dropped EXE
-
\??\c:\5ddpd.exec:\5ddpd.exe28⤵
- Executes dropped EXE
-
\??\c:\i662480.exec:\i662480.exe29⤵
- Executes dropped EXE
-
\??\c:\ppppj.exec:\ppppj.exe30⤵
- Executes dropped EXE
-
\??\c:\xxflrlx.exec:\xxflrlx.exe31⤵
- Executes dropped EXE
-
\??\c:\844204.exec:\844204.exe32⤵
- Executes dropped EXE
-
\??\c:\rlxrrrl.exec:\rlxrrrl.exe33⤵
- Executes dropped EXE
-
\??\c:\084880.exec:\084880.exe34⤵
- Executes dropped EXE
-
\??\c:\tnnhhb.exec:\tnnhhb.exe35⤵
- Executes dropped EXE
-
\??\c:\3vpjd.exec:\3vpjd.exe36⤵
- Executes dropped EXE
-
\??\c:\5tnbnn.exec:\5tnbnn.exe37⤵
- Executes dropped EXE
-
\??\c:\04600.exec:\04600.exe38⤵
- Executes dropped EXE
-
\??\c:\lxxrffl.exec:\lxxrffl.exe39⤵
- Executes dropped EXE
-
\??\c:\204084.exec:\204084.exe40⤵
- Executes dropped EXE
-
\??\c:\nhtnbb.exec:\nhtnbb.exe41⤵
- Executes dropped EXE
-
\??\c:\0662604.exec:\0662604.exe42⤵
- Executes dropped EXE
-
\??\c:\884488.exec:\884488.exe43⤵
- Executes dropped EXE
-
\??\c:\htntnh.exec:\htntnh.exe44⤵
- Executes dropped EXE
-
\??\c:\rfrfrlf.exec:\rfrfrlf.exe45⤵
- Executes dropped EXE
-
\??\c:\a4426.exec:\a4426.exe46⤵
- Executes dropped EXE
-
\??\c:\jddpv.exec:\jddpv.exe47⤵
- Executes dropped EXE
-
\??\c:\bbtnbb.exec:\bbtnbb.exe48⤵
- Executes dropped EXE
-
\??\c:\frxlffx.exec:\frxlffx.exe49⤵
- Executes dropped EXE
-
\??\c:\9btnnb.exec:\9btnnb.exe50⤵
- Executes dropped EXE
-
\??\c:\hhnbnh.exec:\hhnbnh.exe51⤵
- Executes dropped EXE
-
\??\c:\pjdvj.exec:\pjdvj.exe52⤵
- Executes dropped EXE
-
\??\c:\nhbnht.exec:\nhbnht.exe53⤵
- Executes dropped EXE
-
\??\c:\g6602.exec:\g6602.exe54⤵
- Executes dropped EXE
-
\??\c:\lxlrrlf.exec:\lxlrrlf.exe55⤵
- Executes dropped EXE
-
\??\c:\8682808.exec:\8682808.exe56⤵
- Executes dropped EXE
-
\??\c:\0022886.exec:\0022886.exe57⤵
- Executes dropped EXE
-
\??\c:\7fxrlfx.exec:\7fxrlfx.exe58⤵
- Executes dropped EXE
-
\??\c:\3hbthh.exec:\3hbthh.exe59⤵
- Executes dropped EXE
-
\??\c:\vdpjv.exec:\vdpjv.exe60⤵
- Executes dropped EXE
-
\??\c:\dppdv.exec:\dppdv.exe61⤵
- Executes dropped EXE
-
\??\c:\860648.exec:\860648.exe62⤵
- Executes dropped EXE
-
\??\c:\vpddv.exec:\vpddv.exe63⤵
- Executes dropped EXE
-
\??\c:\lxrrxxr.exec:\lxrrxxr.exe64⤵
- Executes dropped EXE
-
\??\c:\64020.exec:\64020.exe65⤵
- Executes dropped EXE
-
\??\c:\o060820.exec:\o060820.exe66⤵
-
\??\c:\jdvjd.exec:\jdvjd.exe67⤵
-
\??\c:\frlrflf.exec:\frlrflf.exe68⤵
-
\??\c:\rrfxrlf.exec:\rrfxrlf.exe69⤵
-
\??\c:\060860.exec:\060860.exe70⤵
-
\??\c:\28848.exec:\28848.exe71⤵
-
\??\c:\22608.exec:\22608.exe72⤵
-
\??\c:\1jddp.exec:\1jddp.exe73⤵
-
\??\c:\60048.exec:\60048.exe74⤵
-
\??\c:\6824888.exec:\6824888.exe75⤵
-
\??\c:\082086.exec:\082086.exe76⤵
-
\??\c:\420408.exec:\420408.exe77⤵
-
\??\c:\pjpjd.exec:\pjpjd.exe78⤵
-
\??\c:\tnnhtn.exec:\tnnhtn.exe79⤵
-
\??\c:\064680.exec:\064680.exe80⤵
-
\??\c:\m0482.exec:\m0482.exe81⤵
-
\??\c:\20042.exec:\20042.exe82⤵
-
\??\c:\rlfxllf.exec:\rlfxllf.exe83⤵
-
\??\c:\vvpjv.exec:\vvpjv.exe84⤵
-
\??\c:\5xxrlrf.exec:\5xxrlrf.exe85⤵
-
\??\c:\dvvjv.exec:\dvvjv.exe86⤵
-
\??\c:\02202.exec:\02202.exe87⤵
-
\??\c:\nbnnhb.exec:\nbnnhb.exe88⤵
-
\??\c:\60486.exec:\60486.exe89⤵
-
\??\c:\djdpj.exec:\djdpj.exe90⤵
-
\??\c:\tbbtnh.exec:\tbbtnh.exe91⤵
-
\??\c:\428260.exec:\428260.exe92⤵
-
\??\c:\244800.exec:\244800.exe93⤵
-
\??\c:\1vpvj.exec:\1vpvj.exe94⤵
-
\??\c:\bnhbtn.exec:\bnhbtn.exe95⤵
-
\??\c:\pppdp.exec:\pppdp.exe96⤵
-
\??\c:\4202604.exec:\4202604.exe97⤵
-
\??\c:\88004.exec:\88004.exe98⤵
-
\??\c:\nthnht.exec:\nthnht.exe99⤵
-
\??\c:\bnhthb.exec:\bnhthb.exe100⤵
-
\??\c:\rffxlfx.exec:\rffxlfx.exe101⤵
-
\??\c:\288264.exec:\288264.exe102⤵
-
\??\c:\nhbnbt.exec:\nhbnbt.exe103⤵
-
\??\c:\lflfxrl.exec:\lflfxrl.exe104⤵
-
\??\c:\84042.exec:\84042.exe105⤵
-
\??\c:\3vdpd.exec:\3vdpd.exe106⤵
-
\??\c:\ffxlxll.exec:\ffxlxll.exe107⤵
-
\??\c:\88448.exec:\88448.exe108⤵
-
\??\c:\jddvp.exec:\jddvp.exe109⤵
-
\??\c:\1pppj.exec:\1pppj.exe110⤵
-
\??\c:\pdjdv.exec:\pdjdv.exe111⤵
-
\??\c:\xflxlxr.exec:\xflxlxr.exe112⤵
-
\??\c:\646600.exec:\646600.exe113⤵
-
\??\c:\bbbtnh.exec:\bbbtnh.exe114⤵
-
\??\c:\064686.exec:\064686.exe115⤵
-
\??\c:\868260.exec:\868260.exe116⤵
-
\??\c:\rxllfxr.exec:\rxllfxr.exe117⤵
-
\??\c:\xllffrf.exec:\xllffrf.exe118⤵
-
\??\c:\vdvpd.exec:\vdvpd.exe119⤵
-
\??\c:\xxrfxxx.exec:\xxrfxxx.exe120⤵
-
\??\c:\tthhbb.exec:\tthhbb.exe121⤵
-
\??\c:\800202.exec:\800202.exe122⤵
-
\??\c:\jvdvj.exec:\jvdvj.exe123⤵
-
\??\c:\84628.exec:\84628.exe124⤵
-
\??\c:\xflffll.exec:\xflffll.exe125⤵
-
\??\c:\fflrllf.exec:\fflrllf.exe126⤵
-
\??\c:\vpvvj.exec:\vpvvj.exe127⤵
-
\??\c:\080000.exec:\080000.exe128⤵
-
\??\c:\httnhb.exec:\httnhb.exe129⤵
-
\??\c:\i688004.exec:\i688004.exe130⤵
-
\??\c:\5jddp.exec:\5jddp.exe131⤵
-
\??\c:\c000400.exec:\c000400.exe132⤵
-
\??\c:\hntbhh.exec:\hntbhh.exe133⤵
-
\??\c:\lxrlfxx.exec:\lxrlfxx.exe134⤵
-
\??\c:\42824.exec:\42824.exe135⤵
-
\??\c:\k40822.exec:\k40822.exe136⤵
-
\??\c:\220482.exec:\220482.exe137⤵
-
\??\c:\862000.exec:\862000.exe138⤵
-
\??\c:\i826460.exec:\i826460.exe139⤵
-
\??\c:\6448264.exec:\6448264.exe140⤵
-
\??\c:\vvjvj.exec:\vvjvj.exe141⤵
-
\??\c:\pvdvv.exec:\pvdvv.exe142⤵
-
\??\c:\jdppp.exec:\jdppp.exe143⤵
-
\??\c:\rlrllff.exec:\rlrllff.exe144⤵
-
\??\c:\vpvjd.exec:\vpvjd.exe145⤵
-
\??\c:\226082.exec:\226082.exe146⤵
-
\??\c:\xxxrfxl.exec:\xxxrfxl.exe147⤵
-
\??\c:\0626486.exec:\0626486.exe148⤵
-
\??\c:\688648.exec:\688648.exe149⤵
-
\??\c:\5fxxlfx.exec:\5fxxlfx.exe150⤵
-
\??\c:\00002.exec:\00002.exe151⤵
-
\??\c:\606482.exec:\606482.exe152⤵
-
\??\c:\hhhtnn.exec:\hhhtnn.exe153⤵
-
\??\c:\3pjjv.exec:\3pjjv.exe154⤵
-
\??\c:\xrlxlfr.exec:\xrlxlfr.exe155⤵
-
\??\c:\8420842.exec:\8420842.exe156⤵
-
\??\c:\bhhbnb.exec:\bhhbnb.exe157⤵
-
\??\c:\lxxrxxr.exec:\lxxrxxr.exe158⤵
-
\??\c:\7btnbh.exec:\7btnbh.exe159⤵
-
\??\c:\fffxllf.exec:\fffxllf.exe160⤵
-
\??\c:\22882.exec:\22882.exe161⤵
-
\??\c:\022404.exec:\022404.exe162⤵
-
\??\c:\ttbbnh.exec:\ttbbnh.exe163⤵
-
\??\c:\1jvpd.exec:\1jvpd.exe164⤵
-
\??\c:\428828.exec:\428828.exe165⤵
-
\??\c:\82244.exec:\82244.exe166⤵
-
\??\c:\k80604.exec:\k80604.exe167⤵
-
\??\c:\44042.exec:\44042.exe168⤵
-
\??\c:\hthbhb.exec:\hthbhb.exe169⤵
-
\??\c:\e06648.exec:\e06648.exe170⤵
-
\??\c:\4482260.exec:\4482260.exe171⤵
-
\??\c:\jddpd.exec:\jddpd.exe172⤵
-
\??\c:\dvjjd.exec:\dvjjd.exe173⤵
-
\??\c:\42802.exec:\42802.exe174⤵
-
\??\c:\rrxrxxr.exec:\rrxrxxr.exe175⤵
-
\??\c:\44048.exec:\44048.exe176⤵
-
\??\c:\06204.exec:\06204.exe177⤵
-
\??\c:\nnnbtt.exec:\nnnbtt.exe178⤵
-
\??\c:\82820.exec:\82820.exe179⤵
-
\??\c:\rrxfxrr.exec:\rrxfxrr.exe180⤵
-
\??\c:\vpjdv.exec:\vpjdv.exe181⤵
-
\??\c:\s2264.exec:\s2264.exe182⤵
-
\??\c:\bhnnbb.exec:\bhnnbb.exe183⤵
-
\??\c:\262660.exec:\262660.exe184⤵
-
\??\c:\668800.exec:\668800.exe185⤵
-
\??\c:\3ffxllf.exec:\3ffxllf.exe186⤵
-
\??\c:\thhbnh.exec:\thhbnh.exe187⤵
-
\??\c:\5xlfxxx.exec:\5xlfxxx.exe188⤵
-
\??\c:\3hnbbt.exec:\3hnbbt.exe189⤵
-
\??\c:\266426.exec:\266426.exe190⤵
-
\??\c:\6460448.exec:\6460448.exe191⤵
-
\??\c:\088260.exec:\088260.exe192⤵
-
\??\c:\xlrrllf.exec:\xlrrllf.exe193⤵
-
\??\c:\2082628.exec:\2082628.exe194⤵
-
\??\c:\bhhbbt.exec:\bhhbbt.exe195⤵
-
\??\c:\6226460.exec:\6226460.exe196⤵
-
\??\c:\bhnnbb.exec:\bhnnbb.exe197⤵
-
\??\c:\1lllxlf.exec:\1lllxlf.exe198⤵
-
\??\c:\hbhthb.exec:\hbhthb.exe199⤵
-
\??\c:\64424.exec:\64424.exe200⤵
-
\??\c:\a6262.exec:\a6262.exe201⤵
-
\??\c:\1jjvp.exec:\1jjvp.exe202⤵
-
\??\c:\vdjvj.exec:\vdjvj.exe203⤵
-
\??\c:\s2264.exec:\s2264.exe204⤵
-
\??\c:\7tthtt.exec:\7tthtt.exe205⤵
-
\??\c:\g0484.exec:\g0484.exe206⤵
-
\??\c:\g6820.exec:\g6820.exe207⤵
-
\??\c:\6088608.exec:\6088608.exe208⤵
-
\??\c:\48604.exec:\48604.exe209⤵
-
\??\c:\888080.exec:\888080.exe210⤵
-
\??\c:\08602.exec:\08602.exe211⤵
-
\??\c:\64008.exec:\64008.exe212⤵
-
\??\c:\a4042.exec:\a4042.exe213⤵
-
\??\c:\3vdjv.exec:\3vdjv.exe214⤵
-
\??\c:\8888604.exec:\8888604.exe215⤵
-
\??\c:\42260.exec:\42260.exe216⤵
-
\??\c:\00008.exec:\00008.exe217⤵
-
\??\c:\608204.exec:\608204.exe218⤵
-
\??\c:\o848222.exec:\o848222.exe219⤵
-
\??\c:\hbnhbb.exec:\hbnhbb.exe220⤵
-
\??\c:\ttbthb.exec:\ttbthb.exe221⤵
-
\??\c:\w42848.exec:\w42848.exe222⤵
-
\??\c:\htnhtn.exec:\htnhtn.exe223⤵
-
\??\c:\c848226.exec:\c848226.exe224⤵
-
\??\c:\2088604.exec:\2088604.exe225⤵
-
\??\c:\dddvv.exec:\dddvv.exe226⤵
-
\??\c:\g4848.exec:\g4848.exe227⤵
-
\??\c:\lfxffxf.exec:\lfxffxf.exe228⤵
-
\??\c:\20402.exec:\20402.exe229⤵
-
\??\c:\06220.exec:\06220.exe230⤵
-
\??\c:\3pjdp.exec:\3pjdp.exe231⤵
-
\??\c:\88242.exec:\88242.exe232⤵
-
\??\c:\a0002.exec:\a0002.exe233⤵
-
\??\c:\228208.exec:\228208.exe234⤵
-
\??\c:\3nnhbb.exec:\3nnhbb.exe235⤵
-
\??\c:\5rxrlff.exec:\5rxrlff.exe236⤵
-
\??\c:\bbtnhb.exec:\bbtnhb.exe237⤵
-
\??\c:\6404262.exec:\6404262.exe238⤵
-
\??\c:\8660486.exec:\8660486.exe239⤵
-
\??\c:\ttnhtn.exec:\ttnhtn.exe240⤵
-
\??\c:\bnbntn.exec:\bnbntn.exe241⤵