Analysis
-
max time kernel
82s -
max time network
83s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 04:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ee57dfea020cb207864180c82500f663d8ac7dc69754c474b8460b93a29feba6.exe
Resource
win7-20240221-en
6 signatures
150 seconds
Errors
Reason
Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-19T04:34:13Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win10v2004-20240412-en/instance_6-dirty.qcow2\"}"
General
-
Target
ee57dfea020cb207864180c82500f663d8ac7dc69754c474b8460b93a29feba6.exe
-
Size
103KB
-
MD5
17e82e53d9eee1d556bf3da76088065b
-
SHA1
15d8c89fd1b7a73cf0070588f63f789a89121aea
-
SHA256
ee57dfea020cb207864180c82500f663d8ac7dc69754c474b8460b93a29feba6
-
SHA512
0915581485ff238881fc0c6b3682ebecb29eb5c2d991315753db5ebba95e8154e2b7ad38e9a7624f888673e11898c2e413ddc0d891718bd881eb1b0e89146459
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoTNKDeS98hPUdHV7RNzfnLnN3oh:ymb3NkkiQ3mdBjFo5KDe88g1fR8r
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral2/memory/2204-2-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/552-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1792-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/812-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-318-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-366-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/848-373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3848-383-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-387-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-394-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 61 IoCs
resource yara_rule behavioral2/memory/2204-1-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2204-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2204-7-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3084-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3084-17-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2948-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4024-30-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4468-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1692-40-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/552-46-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4964-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1548-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4048-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3572-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1504-82-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1792-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4988-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4988-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4688-111-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/812-100-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2328-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3316-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4724-138-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4724-140-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4860-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1168-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1168-155-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4352-164-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2604-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4816-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1948-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1460-197-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2264-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1472-217-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1472-221-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3088-235-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/624-240-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3980-246-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3980-244-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1148-258-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3412-264-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3836-276-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4888-281-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1736-287-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1020-293-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1136-303-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3080-307-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2368-311-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2368-313-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4988-318-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1640-322-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1640-327-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3640-337-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4572-366-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/848-370-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/848-373-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2764-376-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3848-381-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3848-383-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1884-387-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1676-394-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2948 pdppj.exe 3084 9vpvv.exe 4024 640804.exe 4468 jjdvd.exe 1692 04084.exe 552 462600.exe 4964 tnbtbb.exe 1548 dvvpp.exe 3572 i264204.exe 4048 rrrfxlf.exe 1504 2842604.exe 1792 0008248.exe 812 pjjjd.exe 4988 hbtnbn.exe 4688 nnhbtn.exe 2328 a0668.exe 3316 bhbtnn.exe 2656 rrxlxrx.exe 4724 4864860.exe 4860 840864.exe 1168 8620040.exe 4352 btnbnh.exe 4732 4644226.exe 2604 nnbtnh.exe 4816 8404044.exe 1948 vjdpj.exe 1460 bththh.exe 2264 64860.exe 4448 80480.exe 1472 2280820.exe 8 vpvjd.exe 3224 9ffxllf.exe 3088 4622604.exe 624 08822.exe 3980 22826.exe 3424 08268.exe 3260 620086.exe 1148 08620.exe 3412 nnthnh.exe 4104 7thbbt.exe 1692 084688.exe 3836 hnbtnn.exe 4888 64608.exe 1736 422080.exe 1020 bhtbtn.exe 1688 bthttn.exe 1136 u688804.exe 3080 2004860.exe 2368 rxfrllr.exe 4988 lflffff.exe 1640 rrfxllx.exe 4872 g8004.exe 1964 2020826.exe 3640 04644.exe 3316 jvvpd.exe 4744 nbhthb.exe 2276 280860.exe 3720 0886048.exe 428 lfxfxxl.exe 1932 pppjp.exe 4572 rxrrfxl.exe 848 2808204.exe 2764 2626666.exe 3848 bnttnn.exe -
resource yara_rule behavioral2/memory/2204-1-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1792-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/812-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1948-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1948-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1136-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-307-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-311-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-313-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-318-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-366-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/848-370-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/848-373-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-376-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-381-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-383-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1884-387-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-394-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2948 2204 ee57dfea020cb207864180c82500f663d8ac7dc69754c474b8460b93a29feba6.exe 84 PID 2204 wrote to memory of 2948 2204 ee57dfea020cb207864180c82500f663d8ac7dc69754c474b8460b93a29feba6.exe 84 PID 2204 wrote to memory of 2948 2204 ee57dfea020cb207864180c82500f663d8ac7dc69754c474b8460b93a29feba6.exe 84 PID 2948 wrote to memory of 3084 2948 pdppj.exe 85 PID 2948 wrote to memory of 3084 2948 pdppj.exe 85 PID 2948 wrote to memory of 3084 2948 pdppj.exe 85 PID 3084 wrote to memory of 4024 3084 9vpvv.exe 86 PID 3084 wrote to memory of 4024 3084 9vpvv.exe 86 PID 3084 wrote to memory of 4024 3084 9vpvv.exe 86 PID 4024 wrote to memory of 4468 4024 640804.exe 87 PID 4024 wrote to memory of 4468 4024 640804.exe 87 PID 4024 wrote to memory of 4468 4024 640804.exe 87 PID 4468 wrote to memory of 1692 4468 jjdvd.exe 88 PID 4468 wrote to memory of 1692 4468 jjdvd.exe 88 PID 4468 wrote to memory of 1692 4468 jjdvd.exe 88 PID 1692 wrote to memory of 552 1692 04084.exe 89 PID 1692 wrote to memory of 552 1692 04084.exe 89 PID 1692 wrote to memory of 552 1692 04084.exe 89 PID 552 wrote to memory of 4964 552 462600.exe 90 PID 552 wrote to memory of 4964 552 462600.exe 90 PID 552 wrote to memory of 4964 552 462600.exe 90 PID 4964 wrote to memory of 1548 4964 tnbtbb.exe 91 PID 4964 wrote to memory of 1548 4964 tnbtbb.exe 91 PID 4964 wrote to memory of 1548 4964 tnbtbb.exe 91 PID 1548 wrote to memory of 3572 1548 dvvpp.exe 92 PID 1548 wrote to memory of 3572 1548 dvvpp.exe 92 PID 1548 wrote to memory of 3572 1548 dvvpp.exe 92 PID 3572 wrote to memory of 4048 3572 i264204.exe 93 PID 3572 wrote to memory of 4048 3572 i264204.exe 93 PID 3572 wrote to memory of 4048 3572 i264204.exe 93 PID 4048 wrote to memory of 1504 4048 rrrfxlf.exe 94 PID 4048 wrote to memory of 1504 4048 rrrfxlf.exe 94 PID 4048 wrote to memory of 1504 4048 rrrfxlf.exe 94 PID 1504 wrote to memory of 1792 1504 2842604.exe 95 PID 1504 wrote to memory of 1792 1504 2842604.exe 95 PID 1504 wrote to memory of 1792 1504 2842604.exe 95 PID 1792 wrote to memory of 812 1792 0008248.exe 96 PID 1792 wrote to memory of 812 1792 0008248.exe 96 PID 1792 wrote to memory of 812 1792 0008248.exe 96 PID 812 wrote to memory of 4988 812 pjjjd.exe 97 PID 812 wrote to memory of 4988 812 pjjjd.exe 97 PID 812 wrote to memory of 4988 812 pjjjd.exe 97 PID 4988 wrote to memory of 4688 4988 hbtnbn.exe 98 PID 4988 wrote to memory of 4688 4988 hbtnbn.exe 98 PID 4988 wrote to memory of 4688 4988 hbtnbn.exe 98 PID 4688 wrote to memory of 2328 4688 nnhbtn.exe 99 PID 4688 wrote to memory of 2328 4688 nnhbtn.exe 99 PID 4688 wrote to memory of 2328 4688 nnhbtn.exe 99 PID 2328 wrote to memory of 3316 2328 a0668.exe 100 PID 2328 wrote to memory of 3316 2328 a0668.exe 100 PID 2328 wrote to memory of 3316 2328 a0668.exe 100 PID 3316 wrote to memory of 2656 3316 bhbtnn.exe 101 PID 3316 wrote to memory of 2656 3316 bhbtnn.exe 101 PID 3316 wrote to memory of 2656 3316 bhbtnn.exe 101 PID 2656 wrote to memory of 4724 2656 rrxlxrx.exe 103 PID 2656 wrote to memory of 4724 2656 rrxlxrx.exe 103 PID 2656 wrote to memory of 4724 2656 rrxlxrx.exe 103 PID 4724 wrote to memory of 4860 4724 4864860.exe 104 PID 4724 wrote to memory of 4860 4724 4864860.exe 104 PID 4724 wrote to memory of 4860 4724 4864860.exe 104 PID 4860 wrote to memory of 1168 4860 840864.exe 105 PID 4860 wrote to memory of 1168 4860 840864.exe 105 PID 4860 wrote to memory of 1168 4860 840864.exe 105 PID 1168 wrote to memory of 4352 1168 8620040.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee57dfea020cb207864180c82500f663d8ac7dc69754c474b8460b93a29feba6.exe"C:\Users\Admin\AppData\Local\Temp\ee57dfea020cb207864180c82500f663d8ac7dc69754c474b8460b93a29feba6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\pdppj.exec:\pdppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\9vpvv.exec:\9vpvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\640804.exec:\640804.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\jjdvd.exec:\jjdvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\04084.exec:\04084.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\462600.exec:\462600.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\tnbtbb.exec:\tnbtbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\dvvpp.exec:\dvvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\i264204.exec:\i264204.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\rrrfxlf.exec:\rrrfxlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\2842604.exec:\2842604.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\0008248.exec:\0008248.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\pjjjd.exec:\pjjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\hbtnbn.exec:\hbtnbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\nnhbtn.exec:\nnhbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\a0668.exec:\a0668.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\bhbtnn.exec:\bhbtnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\rrxlxrx.exec:\rrxlxrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\4864860.exec:\4864860.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\840864.exec:\840864.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\8620040.exec:\8620040.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\btnbnh.exec:\btnbnh.exe23⤵
- Executes dropped EXE
PID:4352 -
\??\c:\4644226.exec:\4644226.exe24⤵
- Executes dropped EXE
PID:4732 -
\??\c:\nnbtnh.exec:\nnbtnh.exe25⤵
- Executes dropped EXE
PID:2604 -
\??\c:\8404044.exec:\8404044.exe26⤵
- Executes dropped EXE
PID:4816 -
\??\c:\vjdpj.exec:\vjdpj.exe27⤵
- Executes dropped EXE
PID:1948 -
\??\c:\bththh.exec:\bththh.exe28⤵
- Executes dropped EXE
PID:1460 -
\??\c:\64860.exec:\64860.exe29⤵
- Executes dropped EXE
PID:2264 -
\??\c:\80480.exec:\80480.exe30⤵
- Executes dropped EXE
PID:4448 -
\??\c:\2280820.exec:\2280820.exe31⤵
- Executes dropped EXE
PID:1472 -
\??\c:\vpvjd.exec:\vpvjd.exe32⤵
- Executes dropped EXE
PID:8 -
\??\c:\9ffxllf.exec:\9ffxllf.exe33⤵
- Executes dropped EXE
PID:3224 -
\??\c:\4622604.exec:\4622604.exe34⤵
- Executes dropped EXE
PID:3088 -
\??\c:\08822.exec:\08822.exe35⤵
- Executes dropped EXE
PID:624 -
\??\c:\22826.exec:\22826.exe36⤵
- Executes dropped EXE
PID:3980 -
\??\c:\08268.exec:\08268.exe37⤵
- Executes dropped EXE
PID:3424 -
\??\c:\620086.exec:\620086.exe38⤵
- Executes dropped EXE
PID:3260 -
\??\c:\08620.exec:\08620.exe39⤵
- Executes dropped EXE
PID:1148 -
\??\c:\nnthnh.exec:\nnthnh.exe40⤵
- Executes dropped EXE
PID:3412 -
\??\c:\7thbbt.exec:\7thbbt.exe41⤵
- Executes dropped EXE
PID:4104 -
\??\c:\084688.exec:\084688.exe42⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hnbtnn.exec:\hnbtnn.exe43⤵
- Executes dropped EXE
PID:3836 -
\??\c:\64608.exec:\64608.exe44⤵
- Executes dropped EXE
PID:4888 -
\??\c:\422080.exec:\422080.exe45⤵
- Executes dropped EXE
PID:1736 -
\??\c:\bhtbtn.exec:\bhtbtn.exe46⤵
- Executes dropped EXE
PID:1020 -
\??\c:\bthttn.exec:\bthttn.exe47⤵
- Executes dropped EXE
PID:1688 -
\??\c:\u688804.exec:\u688804.exe48⤵
- Executes dropped EXE
PID:1136 -
\??\c:\2004860.exec:\2004860.exe49⤵
- Executes dropped EXE
PID:3080 -
\??\c:\rxfrllr.exec:\rxfrllr.exe50⤵
- Executes dropped EXE
PID:2368 -
\??\c:\lflffff.exec:\lflffff.exe51⤵
- Executes dropped EXE
PID:4988 -
\??\c:\rrfxllx.exec:\rrfxllx.exe52⤵
- Executes dropped EXE
PID:1640 -
\??\c:\g8004.exec:\g8004.exe53⤵
- Executes dropped EXE
PID:4872 -
\??\c:\2020826.exec:\2020826.exe54⤵
- Executes dropped EXE
PID:1964 -
\??\c:\04644.exec:\04644.exe55⤵
- Executes dropped EXE
PID:3640 -
\??\c:\jvvpd.exec:\jvvpd.exe56⤵
- Executes dropped EXE
PID:3316 -
\??\c:\nbhthb.exec:\nbhthb.exe57⤵
- Executes dropped EXE
PID:4744 -
\??\c:\280860.exec:\280860.exe58⤵
- Executes dropped EXE
PID:2276 -
\??\c:\0886048.exec:\0886048.exe59⤵
- Executes dropped EXE
PID:3720 -
\??\c:\lfxfxxl.exec:\lfxfxxl.exe60⤵
- Executes dropped EXE
PID:428 -
\??\c:\pppjp.exec:\pppjp.exe61⤵
- Executes dropped EXE
PID:1932 -
\??\c:\rxrrfxl.exec:\rxrrfxl.exe62⤵
- Executes dropped EXE
PID:4572 -
\??\c:\2808204.exec:\2808204.exe63⤵
- Executes dropped EXE
PID:848 -
\??\c:\2626666.exec:\2626666.exe64⤵
- Executes dropped EXE
PID:2764 -
\??\c:\bnttnn.exec:\bnttnn.exe65⤵
- Executes dropped EXE
PID:3848 -
\??\c:\804864.exec:\804864.exe66⤵PID:1884
-
\??\c:\jpvjp.exec:\jpvjp.exe67⤵PID:1676
-
\??\c:\6008264.exec:\6008264.exe68⤵PID:1856
-
\??\c:\hthbhb.exec:\hthbhb.exe69⤵PID:5048
-
\??\c:\20488.exec:\20488.exe70⤵PID:2748
-
\??\c:\3bhhbt.exec:\3bhhbt.exe71⤵PID:2112
-
\??\c:\vddvj.exec:\vddvj.exe72⤵PID:3696
-
\??\c:\2404204.exec:\2404204.exe73⤵PID:3224
-
\??\c:\hhhthb.exec:\hhhthb.exe74⤵PID:4396
-
\??\c:\g6640.exec:\g6640.exe75⤵PID:2008
-
\??\c:\u804822.exec:\u804822.exe76⤵PID:1740
-
\??\c:\664826.exec:\664826.exe77⤵PID:4820
-
\??\c:\bbbtbb.exec:\bbbtbb.exe78⤵PID:2740
-
\??\c:\4226662.exec:\4226662.exe79⤵PID:4600
-
\??\c:\4004822.exec:\4004822.exe80⤵PID:2556
-
\??\c:\4226048.exec:\4226048.exe81⤵PID:4480
-
\??\c:\pddvp.exec:\pddvp.exe82⤵PID:1664
-
\??\c:\1djjd.exec:\1djjd.exe83⤵PID:4164
-
\??\c:\682042.exec:\682042.exe84⤵PID:4156
-
\??\c:\8662660.exec:\8662660.exe85⤵PID:1452
-
\??\c:\048226.exec:\048226.exe86⤵PID:1016
-
\??\c:\jdddj.exec:\jdddj.exe87⤵PID:1020
-
\??\c:\44088.exec:\44088.exe88⤵PID:4220
-
\??\c:\a0408.exec:\a0408.exe89⤵PID:4568
-
\??\c:\jdvdp.exec:\jdvdp.exe90⤵PID:3128
-
\??\c:\xffxrrx.exec:\xffxrrx.exe91⤵PID:3968
-
\??\c:\vpjdv.exec:\vpjdv.exe92⤵PID:4668
-
\??\c:\o682484.exec:\o682484.exe93⤵PID:2360
-
\??\c:\fxflfff.exec:\fxflfff.exe94⤵PID:1232
-
\??\c:\5ttnnn.exec:\5ttnnn.exe95⤵PID:724
-
\??\c:\dpjdp.exec:\dpjdp.exe96⤵PID:3388
-
\??\c:\26042.exec:\26042.exe97⤵PID:3036
-
\??\c:\5ddjd.exec:\5ddjd.exe98⤵PID:2144
-
\??\c:\462202.exec:\462202.exe99⤵PID:1400
-
\??\c:\vjpdp.exec:\vjpdp.exe100⤵PID:4072
-
\??\c:\3nbtnh.exec:\3nbtnh.exe101⤵PID:2232
-
\??\c:\pdpvp.exec:\pdpvp.exe102⤵PID:1604
-
\??\c:\4066882.exec:\4066882.exe103⤵PID:2484
-
\??\c:\a0020.exec:\a0020.exe104⤵PID:2604
-
\??\c:\488266.exec:\488266.exe105⤵PID:2764
-
\??\c:\64600.exec:\64600.exe106⤵PID:408
-
\??\c:\42266.exec:\42266.exe107⤵PID:1948
-
\??\c:\rffxrlf.exec:\rffxrlf.exe108⤵PID:1868
-
\??\c:\frrxrrl.exec:\frrxrrl.exe109⤵PID:4716
-
\??\c:\660268.exec:\660268.exe110⤵PID:1748
-
\??\c:\420488.exec:\420488.exe111⤵PID:3992
-
\??\c:\0804488.exec:\0804488.exe112⤵PID:4408
-
\??\c:\42604.exec:\42604.exe113⤵PID:4392
-
\??\c:\4842604.exec:\4842604.exe114⤵PID:4192
-
\??\c:\4260606.exec:\4260606.exe115⤵PID:3900
-
\??\c:\28826.exec:\28826.exe116⤵PID:456
-
\??\c:\3bhhnn.exec:\3bhhnn.exe117⤵PID:1740
-
\??\c:\7llfxxx.exec:\7llfxxx.exe118⤵PID:4804
-
\??\c:\7jdpj.exec:\7jdpj.exe119⤵PID:4024
-
\??\c:\6282228.exec:\6282228.exe120⤵PID:1148
-
\??\c:\26626.exec:\26626.exe121⤵PID:3448
-
\??\c:\42648.exec:\42648.exe122⤵PID:5088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-