Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2024, 22:04
Behavioral task
behavioral1
Sample
59eeaa94dcf1db8714f8104f95555a75c2cf637afeadc672a175d6dc1f109f2d.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
59eeaa94dcf1db8714f8104f95555a75c2cf637afeadc672a175d6dc1f109f2d.exe
-
Size
334KB
-
MD5
7bfd88cb4731f1b3992c4a2eadf45fb0
-
SHA1
a5d35beb2c34b37bc72666d15550927cddb81cf0
-
SHA256
59eeaa94dcf1db8714f8104f95555a75c2cf637afeadc672a175d6dc1f109f2d
-
SHA512
ffc31d7b28dc65740d203008459bd21cddd698061e2c7037e7d36ec34a6ba780a88bdd5909851504f86c56effda6502c47955cbdbf0d80354e4d827851ca156f
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1i/U:x4wFHoS3eFaKHpv/VycgE8oU
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/844-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2984-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3648-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4328-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1740-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3900-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/956-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4188-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/888-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1140-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3480-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2716-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/684-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4312-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2648-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3824-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/952-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/928-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1476-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3224-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4756-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2528-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1160-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1968-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1236-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1808-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3080-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4068-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3772-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4188-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1564-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1808-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1740-540-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1236-607-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-629-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-696-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2448-765-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2712-796-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4796-951-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/844-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000300000001e97c-3.dat UPX behavioral2/memory/844-4-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2984-9-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1928-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0008000000023429-12.dat UPX behavioral2/files/0x0005000000023256-11.dat UPX behavioral2/memory/2984-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3648-20-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342d-23.dat UPX behavioral2/memory/4328-25-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342e-28.dat UPX behavioral2/memory/4584-33-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342f-32.dat UPX behavioral2/files/0x0007000000023430-37.dat UPX behavioral2/memory/5064-38-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023431-42.dat UPX behavioral2/files/0x0007000000023432-49.dat UPX behavioral2/memory/3228-47-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023433-53.dat UPX behavioral2/memory/1740-54-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023435-60.dat UPX behavioral2/memory/4848-59-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3900-64-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023436-65.dat UPX behavioral2/files/0x0007000000023437-71.dat UPX behavioral2/memory/4968-75-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023438-76.dat UPX behavioral2/files/0x000800000002342a-80.dat UPX behavioral2/memory/2408-84-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023439-88.dat UPX behavioral2/memory/956-81-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3120-93-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002343a-92.dat UPX behavioral2/memory/4188-113-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002343d-111.dat UPX behavioral2/files/0x000700000002343e-116.dat UPX behavioral2/memory/4364-107-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3988-102-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002343c-105.dat UPX behavioral2/files/0x000700000002343b-99.dat UPX behavioral2/memory/3120-97-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002343f-121.dat UPX behavioral2/memory/888-120-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023441-126.dat UPX behavioral2/files/0x0007000000023442-133.dat UPX behavioral2/files/0x0007000000023443-137.dat UPX behavioral2/memory/3720-138-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1140-140-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023444-144.dat UPX behavioral2/files/0x0007000000023445-147.dat UPX behavioral2/memory/4148-149-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023446-153.dat UPX behavioral2/memory/3584-158-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023447-160.dat UPX behavioral2/files/0x0007000000023448-163.dat UPX behavioral2/memory/3480-164-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023449-168.dat UPX behavioral2/memory/2716-172-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/684-178-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002344a-176.dat UPX behavioral2/memory/4736-181-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4736-184-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4312-187-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2984 vvdpd.exe 1928 tthhbb.exe 3648 pjjjj.exe 4328 tbtnhh.exe 4584 xrxrlll.exe 5064 vjdpd.exe 2280 lfxfxxf.exe 3228 nbbtnn.exe 1740 pddvp.exe 4848 bbtnhh.exe 3900 llfxxrf.exe 1264 hbtnhn.exe 4968 nbhnhb.exe 956 jpvjp.exe 2408 dppdj.exe 1792 xflrlfr.exe 3120 9bnthh.exe 3988 pdddv.exe 4364 bthhth.exe 4188 vpdvp.exe 888 nhhhbb.exe 1660 lfxrrrl.exe 3812 vjppp.exe 1140 frxxrlx.exe 3720 nttttb.exe 4148 jvddv.exe 3240 5nhbtt.exe 3584 jppjj.exe 3480 3fffxfx.exe 4720 vpvvp.exe 2716 xrxllfx.exe 684 htnthn.exe 4736 xxllxxf.exe 4312 jdpjv.exe 4332 lxxxrrr.exe 1624 3tnthh.exe 2036 dvpjd.exe 2648 ffrfrlx.exe 1608 hbbnht.exe 3824 vpdpj.exe 3396 lrffrxx.exe 952 pvjdv.exe 928 xrllxrr.exe 1476 htnhbb.exe 4760 xrrlrlf.exe 752 htbtbt.exe 4284 vpvpp.exe 4828 dvpvd.exe 3224 tbhbnh.exe 2824 jvvpd.exe 2532 ppvpp.exe 1500 lrxrffx.exe 4756 hhnnhh.exe 2528 pppdp.exe 1576 dvpjj.exe 4796 htbttn.exe 2660 lrrfxrr.exe 1160 btnhtb.exe 644 djjvp.exe 4504 pppvd.exe 552 hthhtt.exe 1432 xlxrfxl.exe 4960 5ttbtt.exe 1968 5jjdv.exe -
resource yara_rule behavioral2/memory/844-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000300000001e97c-3.dat upx behavioral2/memory/844-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2984-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1928-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023429-12.dat upx behavioral2/files/0x0005000000023256-11.dat upx behavioral2/memory/2984-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3648-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-23.dat upx behavioral2/memory/4328-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342e-28.dat upx behavioral2/memory/4584-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342f-32.dat upx behavioral2/files/0x0007000000023430-37.dat upx behavioral2/memory/5064-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023431-42.dat upx behavioral2/files/0x0007000000023432-49.dat upx behavioral2/memory/3228-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023433-53.dat upx behavioral2/memory/1740-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023435-60.dat upx behavioral2/memory/4848-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3900-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023436-65.dat upx behavioral2/files/0x0007000000023437-71.dat upx behavioral2/memory/4968-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023438-76.dat upx behavioral2/files/0x000800000002342a-80.dat upx behavioral2/memory/2408-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023439-88.dat upx behavioral2/memory/956-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3120-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343a-92.dat upx behavioral2/memory/4188-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343d-111.dat upx behavioral2/files/0x000700000002343e-116.dat upx behavioral2/memory/4364-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3988-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343c-105.dat upx behavioral2/files/0x000700000002343b-99.dat upx behavioral2/memory/3120-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343f-121.dat upx behavioral2/memory/888-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023441-126.dat upx behavioral2/files/0x0007000000023442-133.dat upx behavioral2/files/0x0007000000023443-137.dat upx behavioral2/memory/3720-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1140-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023444-144.dat upx behavioral2/files/0x0007000000023445-147.dat upx behavioral2/memory/4148-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023446-153.dat upx behavioral2/memory/3584-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023447-160.dat upx behavioral2/files/0x0007000000023448-163.dat upx behavioral2/memory/3480-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023449-168.dat upx behavioral2/memory/2716-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/684-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344a-176.dat upx behavioral2/memory/4736-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4736-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4312-187-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 844 wrote to memory of 2984 844 59eeaa94dcf1db8714f8104f95555a75c2cf637afeadc672a175d6dc1f109f2d.exe 84 PID 844 wrote to memory of 2984 844 59eeaa94dcf1db8714f8104f95555a75c2cf637afeadc672a175d6dc1f109f2d.exe 84 PID 844 wrote to memory of 2984 844 59eeaa94dcf1db8714f8104f95555a75c2cf637afeadc672a175d6dc1f109f2d.exe 84 PID 2984 wrote to memory of 1928 2984 vvdpd.exe 85 PID 2984 wrote to memory of 1928 2984 vvdpd.exe 85 PID 2984 wrote to memory of 1928 2984 vvdpd.exe 85 PID 1928 wrote to memory of 3648 1928 tthhbb.exe 86 PID 1928 wrote to memory of 3648 1928 tthhbb.exe 86 PID 1928 wrote to memory of 3648 1928 tthhbb.exe 86 PID 3648 wrote to memory of 4328 3648 pjjjj.exe 87 PID 3648 wrote to memory of 4328 3648 pjjjj.exe 87 PID 3648 wrote to memory of 4328 3648 pjjjj.exe 87 PID 4328 wrote to memory of 4584 4328 tbtnhh.exe 88 PID 4328 wrote to memory of 4584 4328 tbtnhh.exe 88 PID 4328 wrote to memory of 4584 4328 tbtnhh.exe 88 PID 4584 wrote to memory of 5064 4584 xrxrlll.exe 89 PID 4584 wrote to memory of 5064 4584 xrxrlll.exe 89 PID 4584 wrote to memory of 5064 4584 xrxrlll.exe 89 PID 5064 wrote to memory of 2280 5064 vjdpd.exe 90 PID 5064 wrote to memory of 2280 5064 vjdpd.exe 90 PID 5064 wrote to memory of 2280 5064 vjdpd.exe 90 PID 2280 wrote to memory of 3228 2280 lfxfxxf.exe 91 PID 2280 wrote to memory of 3228 2280 lfxfxxf.exe 91 PID 2280 wrote to memory of 3228 2280 lfxfxxf.exe 91 PID 3228 wrote to memory of 1740 3228 nbbtnn.exe 92 PID 3228 wrote to memory of 1740 3228 nbbtnn.exe 92 PID 3228 wrote to memory of 1740 3228 nbbtnn.exe 92 PID 1740 wrote to memory of 4848 1740 pddvp.exe 93 PID 1740 wrote to memory of 4848 1740 pddvp.exe 93 PID 1740 wrote to memory of 4848 1740 pddvp.exe 93 PID 4848 wrote to memory of 3900 4848 bbtnhh.exe 94 PID 4848 wrote to memory of 3900 4848 bbtnhh.exe 94 PID 4848 wrote to memory of 3900 4848 bbtnhh.exe 94 PID 3900 wrote to memory of 1264 3900 llfxxrf.exe 95 PID 3900 wrote to memory of 1264 3900 llfxxrf.exe 95 PID 3900 wrote to memory of 1264 3900 llfxxrf.exe 95 PID 1264 wrote to memory of 4968 1264 hbtnhn.exe 96 PID 1264 wrote to memory of 4968 1264 hbtnhn.exe 96 PID 1264 wrote to memory of 4968 1264 hbtnhn.exe 96 PID 4968 wrote to memory of 956 4968 nbhnhb.exe 97 PID 4968 wrote to memory of 956 4968 nbhnhb.exe 97 PID 4968 wrote to memory of 956 4968 nbhnhb.exe 97 PID 956 wrote to memory of 2408 956 jpvjp.exe 99 PID 956 wrote to memory of 2408 956 jpvjp.exe 99 PID 956 wrote to memory of 2408 956 jpvjp.exe 99 PID 2408 wrote to memory of 1792 2408 dppdj.exe 100 PID 2408 wrote to memory of 1792 2408 dppdj.exe 100 PID 2408 wrote to memory of 1792 2408 dppdj.exe 100 PID 1792 wrote to memory of 3120 1792 xflrlfr.exe 101 PID 1792 wrote to memory of 3120 1792 xflrlfr.exe 101 PID 1792 wrote to memory of 3120 1792 xflrlfr.exe 101 PID 3120 wrote to memory of 3988 3120 9bnthh.exe 102 PID 3120 wrote to memory of 3988 3120 9bnthh.exe 102 PID 3120 wrote to memory of 3988 3120 9bnthh.exe 102 PID 3988 wrote to memory of 4364 3988 pdddv.exe 103 PID 3988 wrote to memory of 4364 3988 pdddv.exe 103 PID 3988 wrote to memory of 4364 3988 pdddv.exe 103 PID 4364 wrote to memory of 4188 4364 bthhth.exe 104 PID 4364 wrote to memory of 4188 4364 bthhth.exe 104 PID 4364 wrote to memory of 4188 4364 bthhth.exe 104 PID 4188 wrote to memory of 888 4188 vpdvp.exe 105 PID 4188 wrote to memory of 888 4188 vpdvp.exe 105 PID 4188 wrote to memory of 888 4188 vpdvp.exe 105 PID 888 wrote to memory of 1660 888 nhhhbb.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\59eeaa94dcf1db8714f8104f95555a75c2cf637afeadc672a175d6dc1f109f2d.exe"C:\Users\Admin\AppData\Local\Temp\59eeaa94dcf1db8714f8104f95555a75c2cf637afeadc672a175d6dc1f109f2d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\vvdpd.exec:\vvdpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\tthhbb.exec:\tthhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\pjjjj.exec:\pjjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\tbtnhh.exec:\tbtnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\xrxrlll.exec:\xrxrlll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\vjdpd.exec:\vjdpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\lfxfxxf.exec:\lfxfxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\nbbtnn.exec:\nbbtnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\pddvp.exec:\pddvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\bbtnhh.exec:\bbtnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\llfxxrf.exec:\llfxxrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\hbtnhn.exec:\hbtnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\nbhnhb.exec:\nbhnhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\jpvjp.exec:\jpvjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\dppdj.exec:\dppdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\xflrlfr.exec:\xflrlfr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\9bnthh.exec:\9bnthh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\pdddv.exec:\pdddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\bthhth.exec:\bthhth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\vpdvp.exec:\vpdvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\nhhhbb.exec:\nhhhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\lfxrrrl.exec:\lfxrrrl.exe23⤵
- Executes dropped EXE
PID:1660 -
\??\c:\vjppp.exec:\vjppp.exe24⤵
- Executes dropped EXE
PID:3812 -
\??\c:\frxxrlx.exec:\frxxrlx.exe25⤵
- Executes dropped EXE
PID:1140 -
\??\c:\nttttb.exec:\nttttb.exe26⤵
- Executes dropped EXE
PID:3720 -
\??\c:\jvddv.exec:\jvddv.exe27⤵
- Executes dropped EXE
PID:4148 -
\??\c:\5nhbtt.exec:\5nhbtt.exe28⤵
- Executes dropped EXE
PID:3240 -
\??\c:\jppjj.exec:\jppjj.exe29⤵
- Executes dropped EXE
PID:3584 -
\??\c:\3fffxfx.exec:\3fffxfx.exe30⤵
- Executes dropped EXE
PID:3480 -
\??\c:\vpvvp.exec:\vpvvp.exe31⤵
- Executes dropped EXE
PID:4720 -
\??\c:\xrxllfx.exec:\xrxllfx.exe32⤵
- Executes dropped EXE
PID:2716 -
\??\c:\htnthn.exec:\htnthn.exe33⤵
- Executes dropped EXE
PID:684 -
\??\c:\xxllxxf.exec:\xxllxxf.exe34⤵
- Executes dropped EXE
PID:4736 -
\??\c:\jdpjv.exec:\jdpjv.exe35⤵
- Executes dropped EXE
PID:4312 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe36⤵
- Executes dropped EXE
PID:4332 -
\??\c:\3tnthh.exec:\3tnthh.exe37⤵
- Executes dropped EXE
PID:1624 -
\??\c:\dvpjd.exec:\dvpjd.exe38⤵
- Executes dropped EXE
PID:2036 -
\??\c:\ffrfrlx.exec:\ffrfrlx.exe39⤵
- Executes dropped EXE
PID:2648 -
\??\c:\hbbnht.exec:\hbbnht.exe40⤵
- Executes dropped EXE
PID:1608 -
\??\c:\vpdpj.exec:\vpdpj.exe41⤵
- Executes dropped EXE
PID:3824 -
\??\c:\lrffrxx.exec:\lrffrxx.exe42⤵
- Executes dropped EXE
PID:3396 -
\??\c:\pvjdv.exec:\pvjdv.exe43⤵
- Executes dropped EXE
PID:952 -
\??\c:\xrllxrr.exec:\xrllxrr.exe44⤵
- Executes dropped EXE
PID:928 -
\??\c:\htnhbb.exec:\htnhbb.exe45⤵
- Executes dropped EXE
PID:1476 -
\??\c:\xrrlrlf.exec:\xrrlrlf.exe46⤵
- Executes dropped EXE
PID:4760 -
\??\c:\htbtbt.exec:\htbtbt.exe47⤵
- Executes dropped EXE
PID:752 -
\??\c:\vpvpp.exec:\vpvpp.exe48⤵
- Executes dropped EXE
PID:4284 -
\??\c:\dvpvd.exec:\dvpvd.exe49⤵
- Executes dropped EXE
PID:4828 -
\??\c:\tbhbnh.exec:\tbhbnh.exe50⤵
- Executes dropped EXE
PID:3224 -
\??\c:\jvvpd.exec:\jvvpd.exe51⤵
- Executes dropped EXE
PID:2824 -
\??\c:\ppvpp.exec:\ppvpp.exe52⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lrxrffx.exec:\lrxrffx.exe53⤵
- Executes dropped EXE
PID:1500 -
\??\c:\hhnnhh.exec:\hhnnhh.exe54⤵
- Executes dropped EXE
PID:4756 -
\??\c:\pppdp.exec:\pppdp.exe55⤵
- Executes dropped EXE
PID:2528 -
\??\c:\dvpjj.exec:\dvpjj.exe56⤵
- Executes dropped EXE
PID:1576 -
\??\c:\htbttn.exec:\htbttn.exe57⤵
- Executes dropped EXE
PID:4796 -
\??\c:\lrrfxrr.exec:\lrrfxrr.exe58⤵
- Executes dropped EXE
PID:2660 -
\??\c:\btnhtb.exec:\btnhtb.exe59⤵
- Executes dropped EXE
PID:1160 -
\??\c:\djjvp.exec:\djjvp.exe60⤵
- Executes dropped EXE
PID:644 -
\??\c:\pppvd.exec:\pppvd.exe61⤵
- Executes dropped EXE
PID:4504 -
\??\c:\hthhtt.exec:\hthhtt.exe62⤵
- Executes dropped EXE
PID:552 -
\??\c:\xlxrfxl.exec:\xlxrfxl.exe63⤵
- Executes dropped EXE
PID:1432 -
\??\c:\5ttbtt.exec:\5ttbtt.exe64⤵
- Executes dropped EXE
PID:4960 -
\??\c:\5jjdv.exec:\5jjdv.exe65⤵
- Executes dropped EXE
PID:1968 -
\??\c:\djjvj.exec:\djjvj.exe66⤵PID:3192
-
\??\c:\tntntn.exec:\tntntn.exe67⤵PID:3452
-
\??\c:\pjdjj.exec:\pjdjj.exe68⤵PID:1516
-
\??\c:\lxxrfxx.exec:\lxxrfxx.exe69⤵PID:1660
-
\??\c:\thtntt.exec:\thtntt.exe70⤵PID:4892
-
\??\c:\pvpjv.exec:\pvpjv.exe71⤵PID:2332
-
\??\c:\lxxfrfr.exec:\lxxfrfr.exe72⤵PID:3300
-
\??\c:\jdjdj.exec:\jdjdj.exe73⤵PID:1236
-
\??\c:\pjdvv.exec:\pjdvv.exe74⤵PID:1808
-
\??\c:\rxllrxf.exec:\rxllrxf.exe75⤵PID:4952
-
\??\c:\tntnhb.exec:\tntnhb.exe76⤵PID:3240
-
\??\c:\jddpp.exec:\jddpp.exe77⤵PID:4752
-
\??\c:\flflrlx.exec:\flflrlx.exe78⤵PID:4412
-
\??\c:\nbhtnn.exec:\nbhtnn.exe79⤵PID:4720
-
\??\c:\dvjjd.exec:\dvjjd.exe80⤵PID:3484
-
\??\c:\xrlxrlx.exec:\xrlxrlx.exe81⤵PID:4388
-
\??\c:\nhnhbt.exec:\nhnhbt.exe82⤵PID:3200
-
\??\c:\jjvvj.exec:\jjvvj.exe83⤵PID:4396
-
\??\c:\7vpjd.exec:\7vpjd.exe84⤵PID:4332
-
\??\c:\xrrrffl.exec:\xrrrffl.exe85⤵PID:2120
-
\??\c:\nhhbbb.exec:\nhhbbb.exe86⤵PID:1928
-
\??\c:\9ntnnn.exec:\9ntnnn.exe87⤵PID:3372
-
\??\c:\vdjvp.exec:\vdjvp.exe88⤵PID:3284
-
\??\c:\flxflxf.exec:\flxflxf.exe89⤵PID:1608
-
\??\c:\nhbtnn.exec:\nhbtnn.exe90⤵PID:3080
-
\??\c:\vddvp.exec:\vddvp.exe91⤵PID:4980
-
\??\c:\bnbttn.exec:\bnbttn.exe92⤵PID:4764
-
\??\c:\vdvpj.exec:\vdvpj.exe93⤵PID:1476
-
\??\c:\rlfxxrr.exec:\rlfxxrr.exe94⤵PID:3604
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe95⤵PID:3208
-
\??\c:\bthhtt.exec:\bthhtt.exe96⤵PID:1740
-
\??\c:\rxxrfxl.exec:\rxxrfxl.exe97⤵PID:4976
-
\??\c:\xxxfllf.exec:\xxxfllf.exe98⤵PID:3900
-
\??\c:\bnbbhb.exec:\bnbbhb.exe99⤵PID:4068
-
\??\c:\vjddv.exec:\vjddv.exe100⤵PID:4964
-
\??\c:\rlrlffx.exec:\rlrlffx.exe101⤵PID:2728
-
\??\c:\hthbbt.exec:\hthbbt.exe102⤵PID:3392
-
\??\c:\jddvp.exec:\jddvp.exe103⤵PID:4212
-
\??\c:\jjjdp.exec:\jjjdp.exe104⤵PID:2292
-
\??\c:\5rrrllf.exec:\5rrrllf.exe105⤵PID:4512
-
\??\c:\rfxrfxr.exec:\rfxrfxr.exe106⤵PID:1792
-
\??\c:\bthhhh.exec:\bthhhh.exe107⤵PID:4852
-
\??\c:\3jdvp.exec:\3jdvp.exe108⤵PID:1160
-
\??\c:\lrrfrlf.exec:\lrrfrlf.exe109⤵PID:3772
-
\??\c:\9rrrlfx.exec:\9rrrlfx.exe110⤵PID:4908
-
\??\c:\nhhbth.exec:\nhhbth.exe111⤵PID:4188
-
\??\c:\jvvpj.exec:\jvvpj.exe112⤵PID:2744
-
\??\c:\nhbnhb.exec:\nhbnhb.exe113⤵PID:1268
-
\??\c:\ntthnh.exec:\ntthnh.exe114⤵PID:1564
-
\??\c:\jdpdj.exec:\jdpdj.exe115⤵PID:1912
-
\??\c:\nnnbtn.exec:\nnnbtn.exe116⤵PID:3812
-
\??\c:\tbttnt.exec:\tbttnt.exe117⤵PID:5032
-
\??\c:\pppdv.exec:\pppdv.exe118⤵PID:812
-
\??\c:\fffrfxr.exec:\fffrfxr.exe119⤵PID:3300
-
\??\c:\btnnhh.exec:\btnnhh.exe120⤵PID:4148
-
\??\c:\nttntn.exec:\nttntn.exe121⤵PID:1808
-
\??\c:\djdvj.exec:\djdvj.exe122⤵PID:3952
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-