Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 02:37
Behavioral task
behavioral1
Sample
c53fe2d6f36bb0c0f2b35027040c7b302fbba18be2ae86d4adbe3860fb1c76f8.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
c53fe2d6f36bb0c0f2b35027040c7b302fbba18be2ae86d4adbe3860fb1c76f8.exe
-
Size
453KB
-
MD5
b5a7f40d9db9ab242b64ec614b4bdd13
-
SHA1
da558f41dbfd332798b75b1c5934bf404c8d5dee
-
SHA256
c53fe2d6f36bb0c0f2b35027040c7b302fbba18be2ae86d4adbe3860fb1c76f8
-
SHA512
31829a128229f4a2fae6a5af287e2dd4b26b9c33badca7e2a215132b5d66bf1c85515b048ab66b00925eeb500b6a4d5a8f987109ed40e0a03ef9afb253bc18fd
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1xrloBNTNm7:x4wFHoS3eFaKHpv/VycgE81lgy
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3160-3-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/372-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/516-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1688-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3444-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4464-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1500-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1564-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2208-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2952-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4800-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3844-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3936-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1220-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2432-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1536-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2724-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1296-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4168-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2884-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1596-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4660-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4328-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1124-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1536-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4164-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1564-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2928-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1396-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1968-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1688-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1736-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1048-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/744-565-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3152-578-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-613-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-617-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3588-705-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-728-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4328-767-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3160-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\fffxrrr.exe UPX behavioral2/memory/3160-3-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/372-9-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\hhnhbt.exe UPX C:\3rrrlrl.exe UPX behavioral2/memory/5048-15-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pvvpd.exe UPX behavioral2/memory/516-20-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9tbttt.exe UPX behavioral2/memory/1688-29-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\1jjjv.exe UPX behavioral2/memory/3444-40-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1844-39-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\fxrllff.exe UPX behavioral2/memory/4852-26-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\fffllfx.exe UPX behavioral2/memory/4464-46-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rfxrfxl.exe UPX behavioral2/memory/1500-53-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rflxrrl.exe UPX C:\nnhbbt.exe UPX behavioral2/memory/1564-58-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2208-63-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vdvpv.exe UPX behavioral2/memory/3808-69-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rfxrrlf.exe UPX C:\7thbtn.exe UPX behavioral2/memory/4476-78-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\lfllllf.exe UPX \??\c:\pjjpp.exe UPX behavioral2/memory/2952-92-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3lfllxf.exe UPX behavioral2/memory/4308-100-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hhhbnb.exe UPX C:\pvpdp.exe UPX behavioral2/memory/4308-95-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4800-107-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\1thnbb.exe UPX behavioral2/memory/5020-113-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jvjvj.exe UPX C:\httnnh.exe UPX behavioral2/memory/5100-126-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\dpjvj.exe UPX \??\c:\5nnbtn.exe UPX behavioral2/memory/4828-136-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3844-140-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\9bhthb.exe UPX C:\rlrfrrf.exe UPX behavioral2/memory/3712-145-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ppvpd.exe UPX \??\c:\pvvvj.exe UPX behavioral2/memory/3712-152-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2328-150-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1952-160-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\fllfxrf.exe UPX \??\c:\nnbnbt.exe UPX C:\pppdv.exe UPX behavioral2/memory/3936-170-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4336-179-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\1nnhtn.exe UPX behavioral2/memory/1220-185-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2016-196-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2432-201-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
fffxrrr.exehhnhbt.exe3rrrlrl.exepvvpd.exefxrllff.exe9tbttt.exe1jjjv.exefffllfx.exerfxrfxl.exerflxrrl.exennhbbt.exevdvpv.exerfxrrlf.exelfllllf.exe7thbtn.exepjjpp.exe3lfllxf.exehhhbnb.exepvpdp.exe1thnbb.exejvjvj.exehttnnh.exedpjvj.exe5nnbtn.exe9bhthb.exerlrfrrf.exeppvpd.exepvvvj.exefllfxrf.exennbnbt.exepppdv.exe1nnhtn.exepdjjj.exexlfxlfr.exebhbnbt.exevjdpd.exexlxfrff.exehhhtbt.exepppdj.exejvjvp.exexxrlfxl.exe7bnhhh.exevpvjd.exerxxxrlf.exebtnhtt.exepjpdv.exepdpdp.exexxffrlx.exebnhhtn.exedpppj.exerlfrxrf.exe7hhttn.exe3jddp.exe1rlxlfr.exe7bhnbt.exe9tbnbt.exeppjdv.exethbnbt.exethnbnh.exejpdvp.exexlfxxlf.exe3ffxfff.exedpjvj.exelxfxlfr.exepid process 372 fffxrrr.exe 5048 hhnhbt.exe 516 3rrrlrl.exe 4852 pvvpd.exe 1688 fxrllff.exe 3444 9tbttt.exe 1844 1jjjv.exe 4464 fffllfx.exe 1500 rfxrfxl.exe 1564 rflxrrl.exe 2208 nnhbbt.exe 3808 vdvpv.exe 4476 rfxrrlf.exe 2856 lfllllf.exe 2032 7thbtn.exe 2952 pjjpp.exe 4308 3lfllxf.exe 4456 hhhbnb.exe 4800 pvpdp.exe 5020 1thnbb.exe 4256 jvjvj.exe 5100 httnnh.exe 5096 dpjvj.exe 4828 5nnbtn.exe 3844 9bhthb.exe 3712 rlrfrrf.exe 2328 ppvpd.exe 1952 pvvvj.exe 1924 fllfxrf.exe 3936 nnbnbt.exe 856 pppdv.exe 4336 1nnhtn.exe 1220 pdjjj.exe 1124 xlfxlfr.exe 4000 bhbnbt.exe 3276 vjdpd.exe 2016 xlxfrff.exe 4708 hhhtbt.exe 2432 pppdj.exe 1536 jvjvp.exe 2724 xxrlfxl.exe 2140 7bnhhh.exe 5040 vpvjd.exe 2160 rxxxrlf.exe 4592 btnhtt.exe 4464 pjpdv.exe 1904 pdpdp.exe 2316 xxffrlx.exe 3660 bnhhtn.exe 1296 dpppj.exe 4168 rlfrxrf.exe 376 7hhttn.exe 2008 3jddp.exe 4476 1rlxlfr.exe 2884 7bhnbt.exe 2928 9tbnbt.exe 3028 ppjdv.exe 3924 thbnbt.exe 4308 thnbnh.exe 4780 jpdvp.exe 2664 xlfxxlf.exe 4972 3ffxfff.exe 5020 dpjvj.exe 4784 lxfxlfr.exe -
Processes:
resource yara_rule behavioral2/memory/3160-0-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fffxrrr.exe upx behavioral2/memory/3160-3-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/372-9-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hhnhbt.exe upx C:\3rrrlrl.exe upx behavioral2/memory/5048-15-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvvpd.exe upx behavioral2/memory/516-20-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9tbttt.exe upx behavioral2/memory/1688-29-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1jjjv.exe upx behavioral2/memory/3444-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1844-39-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxrllff.exe upx behavioral2/memory/4852-26-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fffllfx.exe upx behavioral2/memory/4464-46-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rfxrfxl.exe upx behavioral2/memory/1500-53-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rflxrrl.exe upx C:\nnhbbt.exe upx behavioral2/memory/1564-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2208-63-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vdvpv.exe upx behavioral2/memory/3808-69-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rfxrrlf.exe upx C:\7thbtn.exe upx behavioral2/memory/4476-78-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lfllllf.exe upx \??\c:\pjjpp.exe upx behavioral2/memory/2952-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3lfllxf.exe upx behavioral2/memory/4308-100-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhhbnb.exe upx C:\pvpdp.exe upx behavioral2/memory/4308-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4800-107-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1thnbb.exe upx behavioral2/memory/5020-113-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvjvj.exe upx C:\httnnh.exe upx behavioral2/memory/5100-126-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dpjvj.exe upx \??\c:\5nnbtn.exe upx behavioral2/memory/4828-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3844-140-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9bhthb.exe upx C:\rlrfrrf.exe upx behavioral2/memory/3712-145-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppvpd.exe upx \??\c:\pvvvj.exe upx behavioral2/memory/3712-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2328-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1952-160-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fllfxrf.exe upx \??\c:\nnbnbt.exe upx C:\pppdv.exe upx behavioral2/memory/3936-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4336-179-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1nnhtn.exe upx behavioral2/memory/1220-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2016-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2432-201-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c53fe2d6f36bb0c0f2b35027040c7b302fbba18be2ae86d4adbe3860fb1c76f8.exefffxrrr.exehhnhbt.exe3rrrlrl.exepvvpd.exefxrllff.exe9tbttt.exe1jjjv.exefffllfx.exerfxrfxl.exerflxrrl.exennhbbt.exevdvpv.exerfxrrlf.exelfllllf.exe7thbtn.exepjjpp.exe3lfllxf.exehhhbnb.exepvpdp.exe1thnbb.exejvjvj.exedescription pid process target process PID 3160 wrote to memory of 372 3160 c53fe2d6f36bb0c0f2b35027040c7b302fbba18be2ae86d4adbe3860fb1c76f8.exe fffxrrr.exe PID 3160 wrote to memory of 372 3160 c53fe2d6f36bb0c0f2b35027040c7b302fbba18be2ae86d4adbe3860fb1c76f8.exe fffxrrr.exe PID 3160 wrote to memory of 372 3160 c53fe2d6f36bb0c0f2b35027040c7b302fbba18be2ae86d4adbe3860fb1c76f8.exe fffxrrr.exe PID 372 wrote to memory of 5048 372 fffxrrr.exe hhnhbt.exe PID 372 wrote to memory of 5048 372 fffxrrr.exe hhnhbt.exe PID 372 wrote to memory of 5048 372 fffxrrr.exe hhnhbt.exe PID 5048 wrote to memory of 516 5048 hhnhbt.exe 3rrrlrl.exe PID 5048 wrote to memory of 516 5048 hhnhbt.exe 3rrrlrl.exe PID 5048 wrote to memory of 516 5048 hhnhbt.exe 3rrrlrl.exe PID 516 wrote to memory of 4852 516 3rrrlrl.exe pvvpd.exe PID 516 wrote to memory of 4852 516 3rrrlrl.exe pvvpd.exe PID 516 wrote to memory of 4852 516 3rrrlrl.exe pvvpd.exe PID 4852 wrote to memory of 1688 4852 pvvpd.exe fxrllff.exe PID 4852 wrote to memory of 1688 4852 pvvpd.exe fxrllff.exe PID 4852 wrote to memory of 1688 4852 pvvpd.exe fxrllff.exe PID 1688 wrote to memory of 3444 1688 fxrllff.exe 9tbttt.exe PID 1688 wrote to memory of 3444 1688 fxrllff.exe 9tbttt.exe PID 1688 wrote to memory of 3444 1688 fxrllff.exe 9tbttt.exe PID 3444 wrote to memory of 1844 3444 9tbttt.exe 1jjjv.exe PID 3444 wrote to memory of 1844 3444 9tbttt.exe 1jjjv.exe PID 3444 wrote to memory of 1844 3444 9tbttt.exe 1jjjv.exe PID 1844 wrote to memory of 4464 1844 1jjjv.exe fffllfx.exe PID 1844 wrote to memory of 4464 1844 1jjjv.exe fffllfx.exe PID 1844 wrote to memory of 4464 1844 1jjjv.exe fffllfx.exe PID 4464 wrote to memory of 1500 4464 fffllfx.exe rfxrfxl.exe PID 4464 wrote to memory of 1500 4464 fffllfx.exe rfxrfxl.exe PID 4464 wrote to memory of 1500 4464 fffllfx.exe rfxrfxl.exe PID 1500 wrote to memory of 1564 1500 rfxrfxl.exe rflxrrl.exe PID 1500 wrote to memory of 1564 1500 rfxrfxl.exe rflxrrl.exe PID 1500 wrote to memory of 1564 1500 rfxrfxl.exe rflxrrl.exe PID 1564 wrote to memory of 2208 1564 rflxrrl.exe nnhbbt.exe PID 1564 wrote to memory of 2208 1564 rflxrrl.exe nnhbbt.exe PID 1564 wrote to memory of 2208 1564 rflxrrl.exe nnhbbt.exe PID 2208 wrote to memory of 3808 2208 nnhbbt.exe vdvpv.exe PID 2208 wrote to memory of 3808 2208 nnhbbt.exe vdvpv.exe PID 2208 wrote to memory of 3808 2208 nnhbbt.exe vdvpv.exe PID 3808 wrote to memory of 4476 3808 vdvpv.exe rfxrrlf.exe PID 3808 wrote to memory of 4476 3808 vdvpv.exe rfxrrlf.exe PID 3808 wrote to memory of 4476 3808 vdvpv.exe rfxrrlf.exe PID 4476 wrote to memory of 2856 4476 rfxrrlf.exe lfllllf.exe PID 4476 wrote to memory of 2856 4476 rfxrrlf.exe lfllllf.exe PID 4476 wrote to memory of 2856 4476 rfxrrlf.exe lfllllf.exe PID 2856 wrote to memory of 2032 2856 lfllllf.exe 7thbtn.exe PID 2856 wrote to memory of 2032 2856 lfllllf.exe 7thbtn.exe PID 2856 wrote to memory of 2032 2856 lfllllf.exe 7thbtn.exe PID 2032 wrote to memory of 2952 2032 7thbtn.exe pjjpp.exe PID 2032 wrote to memory of 2952 2032 7thbtn.exe pjjpp.exe PID 2032 wrote to memory of 2952 2032 7thbtn.exe pjjpp.exe PID 2952 wrote to memory of 4308 2952 pjjpp.exe 3lfllxf.exe PID 2952 wrote to memory of 4308 2952 pjjpp.exe 3lfllxf.exe PID 2952 wrote to memory of 4308 2952 pjjpp.exe 3lfllxf.exe PID 4308 wrote to memory of 4456 4308 3lfllxf.exe hhhbnb.exe PID 4308 wrote to memory of 4456 4308 3lfllxf.exe hhhbnb.exe PID 4308 wrote to memory of 4456 4308 3lfllxf.exe hhhbnb.exe PID 4456 wrote to memory of 4800 4456 hhhbnb.exe pvpdp.exe PID 4456 wrote to memory of 4800 4456 hhhbnb.exe pvpdp.exe PID 4456 wrote to memory of 4800 4456 hhhbnb.exe pvpdp.exe PID 4800 wrote to memory of 5020 4800 pvpdp.exe 1thnbb.exe PID 4800 wrote to memory of 5020 4800 pvpdp.exe 1thnbb.exe PID 4800 wrote to memory of 5020 4800 pvpdp.exe 1thnbb.exe PID 5020 wrote to memory of 4256 5020 1thnbb.exe jvjvj.exe PID 5020 wrote to memory of 4256 5020 1thnbb.exe jvjvj.exe PID 5020 wrote to memory of 4256 5020 1thnbb.exe jvjvj.exe PID 4256 wrote to memory of 5100 4256 jvjvj.exe httnnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c53fe2d6f36bb0c0f2b35027040c7b302fbba18be2ae86d4adbe3860fb1c76f8.exe"C:\Users\Admin\AppData\Local\Temp\c53fe2d6f36bb0c0f2b35027040c7b302fbba18be2ae86d4adbe3860fb1c76f8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\fffxrrr.exec:\fffxrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhnhbt.exec:\hhnhbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3rrrlrl.exec:\3rrrlrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvvpd.exec:\pvvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxrllff.exec:\fxrllff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9tbttt.exec:\9tbttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1jjjv.exec:\1jjjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fffllfx.exec:\fffllfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfxrfxl.exec:\rfxrfxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rflxrrl.exec:\rflxrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnhbbt.exec:\nnhbbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdvpv.exec:\vdvpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfxrrlf.exec:\rfxrrlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfllllf.exec:\lfllllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7thbtn.exec:\7thbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjjpp.exec:\pjjpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3lfllxf.exec:\3lfllxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhbnb.exec:\hhhbnb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvpdp.exec:\pvpdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1thnbb.exec:\1thnbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvjvj.exec:\jvjvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\httnnh.exec:\httnnh.exe23⤵
- Executes dropped EXE
-
\??\c:\dpjvj.exec:\dpjvj.exe24⤵
- Executes dropped EXE
-
\??\c:\5nnbtn.exec:\5nnbtn.exe25⤵
- Executes dropped EXE
-
\??\c:\9bhthb.exec:\9bhthb.exe26⤵
- Executes dropped EXE
-
\??\c:\rlrfrrf.exec:\rlrfrrf.exe27⤵
- Executes dropped EXE
-
\??\c:\ppvpd.exec:\ppvpd.exe28⤵
- Executes dropped EXE
-
\??\c:\pvvvj.exec:\pvvvj.exe29⤵
- Executes dropped EXE
-
\??\c:\fllfxrf.exec:\fllfxrf.exe30⤵
- Executes dropped EXE
-
\??\c:\nnbnbt.exec:\nnbnbt.exe31⤵
- Executes dropped EXE
-
\??\c:\pppdv.exec:\pppdv.exe32⤵
- Executes dropped EXE
-
\??\c:\1nnhtn.exec:\1nnhtn.exe33⤵
- Executes dropped EXE
-
\??\c:\pdjjj.exec:\pdjjj.exe34⤵
- Executes dropped EXE
-
\??\c:\xlfxlfr.exec:\xlfxlfr.exe35⤵
- Executes dropped EXE
-
\??\c:\bhbnbt.exec:\bhbnbt.exe36⤵
- Executes dropped EXE
-
\??\c:\vjdpd.exec:\vjdpd.exe37⤵
- Executes dropped EXE
-
\??\c:\xlxfrff.exec:\xlxfrff.exe38⤵
- Executes dropped EXE
-
\??\c:\hhhtbt.exec:\hhhtbt.exe39⤵
- Executes dropped EXE
-
\??\c:\pppdj.exec:\pppdj.exe40⤵
- Executes dropped EXE
-
\??\c:\jvjvp.exec:\jvjvp.exe41⤵
- Executes dropped EXE
-
\??\c:\xxrlfxl.exec:\xxrlfxl.exe42⤵
- Executes dropped EXE
-
\??\c:\7bnhhh.exec:\7bnhhh.exe43⤵
- Executes dropped EXE
-
\??\c:\vpvjd.exec:\vpvjd.exe44⤵
- Executes dropped EXE
-
\??\c:\rxxxrlf.exec:\rxxxrlf.exe45⤵
- Executes dropped EXE
-
\??\c:\btnhtt.exec:\btnhtt.exe46⤵
- Executes dropped EXE
-
\??\c:\pjpdv.exec:\pjpdv.exe47⤵
- Executes dropped EXE
-
\??\c:\pdpdp.exec:\pdpdp.exe48⤵
- Executes dropped EXE
-
\??\c:\xxffrlx.exec:\xxffrlx.exe49⤵
- Executes dropped EXE
-
\??\c:\bnhhtn.exec:\bnhhtn.exe50⤵
- Executes dropped EXE
-
\??\c:\dpppj.exec:\dpppj.exe51⤵
- Executes dropped EXE
-
\??\c:\rlfrxrf.exec:\rlfrxrf.exe52⤵
- Executes dropped EXE
-
\??\c:\7hhttn.exec:\7hhttn.exe53⤵
- Executes dropped EXE
-
\??\c:\3jddp.exec:\3jddp.exe54⤵
- Executes dropped EXE
-
\??\c:\1rlxlfr.exec:\1rlxlfr.exe55⤵
- Executes dropped EXE
-
\??\c:\7bhnbt.exec:\7bhnbt.exe56⤵
- Executes dropped EXE
-
\??\c:\9tbnbt.exec:\9tbnbt.exe57⤵
- Executes dropped EXE
-
\??\c:\ppjdv.exec:\ppjdv.exe58⤵
- Executes dropped EXE
-
\??\c:\thbnbt.exec:\thbnbt.exe59⤵
- Executes dropped EXE
-
\??\c:\thnbnh.exec:\thnbnh.exe60⤵
- Executes dropped EXE
-
\??\c:\jpdvp.exec:\jpdvp.exe61⤵
- Executes dropped EXE
-
\??\c:\xlfxxlf.exec:\xlfxxlf.exe62⤵
- Executes dropped EXE
-
\??\c:\3ffxfff.exec:\3ffxfff.exe63⤵
- Executes dropped EXE
-
\??\c:\dpjvj.exec:\dpjvj.exe64⤵
- Executes dropped EXE
-
\??\c:\lxfxlfr.exec:\lxfxlfr.exe65⤵
- Executes dropped EXE
-
\??\c:\3bbnbt.exec:\3bbnbt.exe66⤵
-
\??\c:\flrlxlx.exec:\flrlxlx.exe67⤵
-
\??\c:\nnnhbt.exec:\nnnhbt.exe68⤵
-
\??\c:\pjjvd.exec:\pjjvd.exe69⤵
-
\??\c:\lffrffx.exec:\lffrffx.exe70⤵
-
\??\c:\nntnbb.exec:\nntnbb.exe71⤵
-
\??\c:\nnhthb.exec:\nnhthb.exe72⤵
-
\??\c:\7rxllff.exec:\7rxllff.exe73⤵
-
\??\c:\jpdpd.exec:\jpdpd.exe74⤵
-
\??\c:\vvpdp.exec:\vvpdp.exe75⤵
-
\??\c:\rrfxrrf.exec:\rrfxrrf.exe76⤵
-
\??\c:\jddpj.exec:\jddpj.exe77⤵
-
\??\c:\pddpd.exec:\pddpd.exe78⤵
-
\??\c:\thtbnb.exec:\thtbnb.exe79⤵
-
\??\c:\1ppdv.exec:\1ppdv.exe80⤵
-
\??\c:\3llfllr.exec:\3llfllr.exe81⤵
-
\??\c:\bnntht.exec:\bnntht.exe82⤵
-
\??\c:\jvvjv.exec:\jvvjv.exe83⤵
-
\??\c:\xxrfxrl.exec:\xxrfxrl.exe84⤵
-
\??\c:\ntnbnh.exec:\ntnbnh.exe85⤵
-
\??\c:\hththh.exec:\hththh.exe86⤵
-
\??\c:\ppjjp.exec:\ppjjp.exe87⤵
-
\??\c:\llxlxff.exec:\llxlxff.exe88⤵
-
\??\c:\nhnbbn.exec:\nhnbbn.exe89⤵
-
\??\c:\pdjjd.exec:\pdjjd.exe90⤵
-
\??\c:\tnbttn.exec:\tnbttn.exe91⤵
-
\??\c:\jjvpj.exec:\jjvpj.exe92⤵
-
\??\c:\1xxrfxl.exec:\1xxrfxl.exe93⤵
-
\??\c:\3dvpd.exec:\3dvpd.exe94⤵
-
\??\c:\jppdp.exec:\jppdp.exe95⤵
-
\??\c:\rxxfrlf.exec:\rxxfrlf.exe96⤵
-
\??\c:\ntthhb.exec:\ntthhb.exe97⤵
-
\??\c:\pddpj.exec:\pddpj.exe98⤵
-
\??\c:\bhnnbh.exec:\bhnnbh.exe99⤵
-
\??\c:\vpvpv.exec:\vpvpv.exe100⤵
-
\??\c:\5rlxrlf.exec:\5rlxrlf.exe101⤵
-
\??\c:\5lfrlfr.exec:\5lfrlfr.exe102⤵
-
\??\c:\5nhthb.exec:\5nhthb.exe103⤵
-
\??\c:\dpjvj.exec:\dpjvj.exe104⤵
-
\??\c:\lfrllrf.exec:\lfrllrf.exe105⤵
-
\??\c:\bhhbnn.exec:\bhhbnn.exe106⤵
-
\??\c:\bbhthn.exec:\bbhthn.exe107⤵
-
\??\c:\jvppd.exec:\jvppd.exe108⤵
-
\??\c:\bbhhhb.exec:\bbhhhb.exe109⤵
-
\??\c:\jjjdv.exec:\jjjdv.exe110⤵
-
\??\c:\dddpv.exec:\dddpv.exe111⤵
-
\??\c:\rfxxfxr.exec:\rfxxfxr.exe112⤵
-
\??\c:\xfrlxxr.exec:\xfrlxxr.exe113⤵
-
\??\c:\thhbtn.exec:\thhbtn.exe114⤵
-
\??\c:\9dpjv.exec:\9dpjv.exe115⤵
-
\??\c:\hhnbbt.exec:\hhnbbt.exe116⤵
-
\??\c:\dvvjd.exec:\dvvjd.exe117⤵
-
\??\c:\vpvjj.exec:\vpvjj.exe118⤵
-
\??\c:\9lxlfxl.exec:\9lxlfxl.exe119⤵
-
\??\c:\7tnnhb.exec:\7tnnhb.exe120⤵
-
\??\c:\nttnbt.exec:\nttnbt.exe121⤵
-
\??\c:\vjjdp.exec:\vjjdp.exe122⤵
-
\??\c:\vvvpj.exec:\vvvpj.exe123⤵
-
\??\c:\rrlxrfx.exec:\rrlxrfx.exe124⤵
-
\??\c:\tnnbnh.exec:\tnnbnh.exe125⤵
-
\??\c:\3tthtn.exec:\3tthtn.exe126⤵
-
\??\c:\jddvj.exec:\jddvj.exe127⤵
-
\??\c:\1ddvd.exec:\1ddvd.exe128⤵
-
\??\c:\lffrfxr.exec:\lffrfxr.exe129⤵
-
\??\c:\9nhtnh.exec:\9nhtnh.exe130⤵
-
\??\c:\jddvp.exec:\jddvp.exe131⤵
-
\??\c:\xrlfrlf.exec:\xrlfrlf.exe132⤵
-
\??\c:\7hnbnh.exec:\7hnbnh.exe133⤵
-
\??\c:\5vdpj.exec:\5vdpj.exe134⤵
-
\??\c:\5vdvj.exec:\5vdvj.exe135⤵
-
\??\c:\rflflfx.exec:\rflflfx.exe136⤵
-
\??\c:\5btnbt.exec:\5btnbt.exe137⤵
-
\??\c:\xxrfrfx.exec:\xxrfrfx.exe138⤵
-
\??\c:\9llxrrl.exec:\9llxrrl.exe139⤵
-
\??\c:\nbthbn.exec:\nbthbn.exe140⤵
-
\??\c:\tbbbnn.exec:\tbbbnn.exe141⤵
-
\??\c:\vddpd.exec:\vddpd.exe142⤵
-
\??\c:\lllfxrf.exec:\lllfxrf.exe143⤵
-
\??\c:\nbbnnb.exec:\nbbnnb.exe144⤵
-
\??\c:\bnhhbt.exec:\bnhhbt.exe145⤵
-
\??\c:\djvvv.exec:\djvvv.exe146⤵
-
\??\c:\llxfxxx.exec:\llxfxxx.exe147⤵
-
\??\c:\1hnthn.exec:\1hnthn.exe148⤵
-
\??\c:\1tnbtt.exec:\1tnbtt.exe149⤵
-
\??\c:\vdvdv.exec:\vdvdv.exe150⤵
-
\??\c:\flrfrfr.exec:\flrfrfr.exe151⤵
-
\??\c:\lrrfxlf.exec:\lrrfxlf.exe152⤵
-
\??\c:\nbbthb.exec:\nbbthb.exe153⤵
-
\??\c:\nnttth.exec:\nnttth.exe154⤵
-
\??\c:\rrrlffx.exec:\rrrlffx.exe155⤵
-
\??\c:\bhbthb.exec:\bhbthb.exe156⤵
-
\??\c:\nbthbt.exec:\nbthbt.exe157⤵
-
\??\c:\dvjdp.exec:\dvjdp.exe158⤵
-
\??\c:\djvdj.exec:\djvdj.exe159⤵
-
\??\c:\3vjvj.exec:\3vjvj.exe160⤵
-
\??\c:\xlxrfrf.exec:\xlxrfrf.exe161⤵
-
\??\c:\hhthnb.exec:\hhthnb.exe162⤵
-
\??\c:\1btbnh.exec:\1btbnh.exe163⤵
-
\??\c:\5pjdv.exec:\5pjdv.exe164⤵
-
\??\c:\jdpdv.exec:\jdpdv.exe165⤵
-
\??\c:\lfxlrrf.exec:\lfxlrrf.exe166⤵
-
\??\c:\nhhtnb.exec:\nhhtnb.exe167⤵
-
\??\c:\5pdvp.exec:\5pdvp.exe168⤵
-
\??\c:\fxxxrll.exec:\fxxxrll.exe169⤵
-
\??\c:\hbbnhb.exec:\hbbnhb.exe170⤵
-
\??\c:\1ppjp.exec:\1ppjp.exe171⤵
-
\??\c:\rxfxrll.exec:\rxfxrll.exe172⤵
-
\??\c:\bbbtnh.exec:\bbbtnh.exe173⤵
-
\??\c:\7jvpd.exec:\7jvpd.exe174⤵
-
\??\c:\xllfxxx.exec:\xllfxxx.exe175⤵
-
\??\c:\3thbth.exec:\3thbth.exe176⤵
-
\??\c:\btbttn.exec:\btbttn.exe177⤵
-
\??\c:\vpvjj.exec:\vpvjj.exe178⤵
-
\??\c:\fxxlxxl.exec:\fxxlxxl.exe179⤵
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe180⤵
-
\??\c:\9tnbnn.exec:\9tnbnn.exe181⤵
-
\??\c:\5jvjp.exec:\5jvjp.exe182⤵
-
\??\c:\djjvj.exec:\djjvj.exe183⤵
-
\??\c:\5lxllfx.exec:\5lxllfx.exe184⤵
-
\??\c:\hbhbbb.exec:\hbhbbb.exe185⤵
-
\??\c:\tbhbhb.exec:\tbhbhb.exe186⤵
-
\??\c:\pdpjv.exec:\pdpjv.exe187⤵
-
\??\c:\fxrlfff.exec:\fxrlfff.exe188⤵
-
\??\c:\7nnnhh.exec:\7nnnhh.exe189⤵
-
\??\c:\jdddv.exec:\jdddv.exe190⤵
-
\??\c:\xlrrffx.exec:\xlrrffx.exe191⤵
-
\??\c:\tthbnt.exec:\tthbnt.exe192⤵
-
\??\c:\thnbtn.exec:\thnbtn.exe193⤵
-
\??\c:\jddvp.exec:\jddvp.exe194⤵
-
\??\c:\xxxrlll.exec:\xxxrlll.exe195⤵
-
\??\c:\tntntt.exec:\tntntt.exe196⤵
-
\??\c:\1pvpj.exec:\1pvpj.exe197⤵
-
\??\c:\jdjpp.exec:\jdjpp.exe198⤵
-
\??\c:\5rlfxrf.exec:\5rlfxrf.exe199⤵
-
\??\c:\vpjdp.exec:\vpjdp.exe200⤵
-
\??\c:\dpdvp.exec:\dpdvp.exe201⤵
-
\??\c:\1frlxxr.exec:\1frlxxr.exe202⤵
-
\??\c:\thnhbb.exec:\thnhbb.exe203⤵
-
\??\c:\dpvvp.exec:\dpvvp.exe204⤵
-
\??\c:\frfrfrl.exec:\frfrfrl.exe205⤵
-
\??\c:\fxfxrxr.exec:\fxfxrxr.exe206⤵
-
\??\c:\ttbtnn.exec:\ttbtnn.exe207⤵
-
\??\c:\9dvpd.exec:\9dvpd.exe208⤵
-
\??\c:\9nthhb.exec:\9nthhb.exe209⤵
-
\??\c:\tbtntn.exec:\tbtntn.exe210⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe211⤵
-
\??\c:\ffrlfxx.exec:\ffrlfxx.exe212⤵
-
\??\c:\thnhtn.exec:\thnhtn.exe213⤵
-
\??\c:\3dpdp.exec:\3dpdp.exe214⤵
-
\??\c:\vpvpv.exec:\vpvpv.exe215⤵
-
\??\c:\1lrfrrl.exec:\1lrfrrl.exe216⤵
-
\??\c:\tnhhhh.exec:\tnhhhh.exe217⤵
-
\??\c:\jjvdp.exec:\jjvdp.exe218⤵
-
\??\c:\jdpdv.exec:\jdpdv.exe219⤵
-
\??\c:\1rxlxrl.exec:\1rxlxrl.exe220⤵
-
\??\c:\thhthb.exec:\thhthb.exe221⤵
-
\??\c:\vpdvj.exec:\vpdvj.exe222⤵
-
\??\c:\vpjvj.exec:\vpjvj.exe223⤵
-
\??\c:\fxlfrrr.exec:\fxlfrrr.exe224⤵
-
\??\c:\nbnhhn.exec:\nbnhhn.exe225⤵
-
\??\c:\hbhtnb.exec:\hbhtnb.exe226⤵
-
\??\c:\3ffrfxr.exec:\3ffrfxr.exe227⤵
-
\??\c:\rrxrrxr.exec:\rrxrrxr.exe228⤵
-
\??\c:\3bhbtt.exec:\3bhbtt.exe229⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe230⤵
-
\??\c:\5vvpj.exec:\5vvpj.exe231⤵
-
\??\c:\thnhhb.exec:\thnhhb.exe232⤵
-
\??\c:\jjvvv.exec:\jjvvv.exe233⤵
-
\??\c:\ppvjd.exec:\ppvjd.exe234⤵
-
\??\c:\7lfxxxr.exec:\7lfxxxr.exe235⤵
-
\??\c:\nhbnbt.exec:\nhbnbt.exe236⤵
-
\??\c:\vpjvp.exec:\vpjvp.exe237⤵
-
\??\c:\rlrlxfx.exec:\rlrlxfx.exe238⤵
-
\??\c:\5bnnnn.exec:\5bnnnn.exe239⤵
-
\??\c:\ddpvj.exec:\ddpvj.exe240⤵
-
\??\c:\7pdvv.exec:\7pdvv.exe241⤵