Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2024, 13:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e08076473ed665039288f72e6cbf235e77c294f51e13532caa7a6106ac327e0.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
1e08076473ed665039288f72e6cbf235e77c294f51e13532caa7a6106ac327e0.exe
-
Size
65KB
-
MD5
4653cf22acfbe2373964547c2320eca1
-
SHA1
96bb491966b58b02d8b16b104af0f09fb074ac74
-
SHA256
1e08076473ed665039288f72e6cbf235e77c294f51e13532caa7a6106ac327e0
-
SHA512
226c4349d50d20882d2d3efbb503fed225631e3857a76d69a66c408ef413ec763d6e1b2654a98d1ad888d7f65f80ae20681d59b8a4dc277a098054690d5696ef
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6Mu/ePS3AyXmhx:ymb3NkkiQ3mdBjFI46TQyXmhx
Malware Config
Signatures
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral2/memory/5032-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1284-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/772-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2628-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1312-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/488-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/724-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/492-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/812-307-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-324-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/348-347-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-355-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-374-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 59 IoCs
resource yara_rule behavioral2/memory/5032-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4384-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5016-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1284-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4500-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4036-47-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4036-45-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/772-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4968-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4968-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4452-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4828-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2968-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3604-93-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4668-97-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4668-99-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2628-106-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1348-114-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3232-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5036-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/500-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5092-147-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5000-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4368-160-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4368-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1312-169-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1776-178-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3468-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2352-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3060-197-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3060-203-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4592-210-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4592-215-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4760-220-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5056-226-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3988-235-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/488-238-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/488-243-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2396-249-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/724-253-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/724-258-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/492-261-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1544-272-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4860-279-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3432-289-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4408-291-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4252-299-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/812-307-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3136-310-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4216-319-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4216-324-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4768-337-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4768-341-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/348-347-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2836-355-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/640-370-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/640-374-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5108-369-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1492-380-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4384 1nnnhh.exe 5016 lrlfrrf.exe 1284 vpjpd.exe 3152 fxlfxlx.exe 4500 dppvp.exe 4036 lrlfxrr.exe 772 3nhhbh.exe 4968 fflfxlf.exe 4452 3bbthh.exe 4828 lllffxx.exe 2968 bhtthh.exe 3604 5vpjd.exe 4668 bnnhbb.exe 2628 5vddp.exe 1348 bntnnt.exe 3232 jvppv.exe 2740 llxxxfx.exe 5036 nnttbb.exe 500 xxlllrx.exe 5092 btnnbt.exe 5000 rlxrlrr.exe 4368 tnnbnt.exe 1312 jddvp.exe 1776 bthbhn.exe 3468 jjppv.exe 2352 tnntnt.exe 3060 llfxrrl.exe 3148 nbbhhh.exe 4592 7fxrxxx.exe 4760 tbbtnn.exe 5056 jvvdv.exe 3988 bhnnhh.exe 488 1ppdj.exe 4324 llllfll.exe 2396 9hnhhb.exe 724 fxllrrr.exe 492 nnhhhh.exe 4912 vpvjd.exe 4296 ntbtnn.exe 1544 fxxxrrl.exe 4860 btnttb.exe 4204 dvvpj.exe 3432 xllrffr.exe 4408 nnhnhb.exe 4252 xfllfll.exe 3404 bbnhnn.exe 812 vdppp.exe 3136 fxxrrrr.exe 2244 jjjvp.exe 4216 1ffxrxr.exe 2296 5ntnbb.exe 4848 5vvjd.exe 3156 thbtnn.exe 4768 vpjdv.exe 348 pdpjj.exe 3232 xxlxlxr.exe 2836 bnttnt.exe 2636 pdppp.exe 2392 htnbnh.exe 5108 vjjvj.exe 640 7lrlxrl.exe 1976 3vpjd.exe 1492 fxlfxxr.exe 2640 5bttnb.exe -
resource yara_rule behavioral2/memory/5032-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/772-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2628-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/500-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1312-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/488-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/488-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/724-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/724-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/492-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/812-307-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-310-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-319-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-324-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-341-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/348-347-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-355-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-370-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-374-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-380-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5032 wrote to memory of 4384 5032 1e08076473ed665039288f72e6cbf235e77c294f51e13532caa7a6106ac327e0.exe 82 PID 5032 wrote to memory of 4384 5032 1e08076473ed665039288f72e6cbf235e77c294f51e13532caa7a6106ac327e0.exe 82 PID 5032 wrote to memory of 4384 5032 1e08076473ed665039288f72e6cbf235e77c294f51e13532caa7a6106ac327e0.exe 82 PID 4384 wrote to memory of 5016 4384 1nnnhh.exe 83 PID 4384 wrote to memory of 5016 4384 1nnnhh.exe 83 PID 4384 wrote to memory of 5016 4384 1nnnhh.exe 83 PID 5016 wrote to memory of 1284 5016 lrlfrrf.exe 84 PID 5016 wrote to memory of 1284 5016 lrlfrrf.exe 84 PID 5016 wrote to memory of 1284 5016 lrlfrrf.exe 84 PID 1284 wrote to memory of 3152 1284 vpjpd.exe 85 PID 1284 wrote to memory of 3152 1284 vpjpd.exe 85 PID 1284 wrote to memory of 3152 1284 vpjpd.exe 85 PID 3152 wrote to memory of 4500 3152 fxlfxlx.exe 86 PID 3152 wrote to memory of 4500 3152 fxlfxlx.exe 86 PID 3152 wrote to memory of 4500 3152 fxlfxlx.exe 86 PID 4500 wrote to memory of 4036 4500 dppvp.exe 87 PID 4500 wrote to memory of 4036 4500 dppvp.exe 87 PID 4500 wrote to memory of 4036 4500 dppvp.exe 87 PID 4036 wrote to memory of 772 4036 lrlfxrr.exe 88 PID 4036 wrote to memory of 772 4036 lrlfxrr.exe 88 PID 4036 wrote to memory of 772 4036 lrlfxrr.exe 88 PID 772 wrote to memory of 4968 772 3nhhbh.exe 89 PID 772 wrote to memory of 4968 772 3nhhbh.exe 89 PID 772 wrote to memory of 4968 772 3nhhbh.exe 89 PID 4968 wrote to memory of 4452 4968 fflfxlf.exe 90 PID 4968 wrote to memory of 4452 4968 fflfxlf.exe 90 PID 4968 wrote to memory of 4452 4968 fflfxlf.exe 90 PID 4452 wrote to memory of 4828 4452 3bbthh.exe 91 PID 4452 wrote to memory of 4828 4452 3bbthh.exe 91 PID 4452 wrote to memory of 4828 4452 3bbthh.exe 91 PID 4828 wrote to memory of 2968 4828 lllffxx.exe 92 PID 4828 wrote to memory of 2968 4828 lllffxx.exe 92 PID 4828 wrote to memory of 2968 4828 lllffxx.exe 92 PID 2968 wrote to memory of 3604 2968 bhtthh.exe 93 PID 2968 wrote to memory of 3604 2968 bhtthh.exe 93 PID 2968 wrote to memory of 3604 2968 bhtthh.exe 93 PID 3604 wrote to memory of 4668 3604 5vpjd.exe 94 PID 3604 wrote to memory of 4668 3604 5vpjd.exe 94 PID 3604 wrote to memory of 4668 3604 5vpjd.exe 94 PID 4668 wrote to memory of 2628 4668 bnnhbb.exe 96 PID 4668 wrote to memory of 2628 4668 bnnhbb.exe 96 PID 4668 wrote to memory of 2628 4668 bnnhbb.exe 96 PID 2628 wrote to memory of 1348 2628 5vddp.exe 97 PID 2628 wrote to memory of 1348 2628 5vddp.exe 97 PID 2628 wrote to memory of 1348 2628 5vddp.exe 97 PID 1348 wrote to memory of 3232 1348 bntnnt.exe 98 PID 1348 wrote to memory of 3232 1348 bntnnt.exe 98 PID 1348 wrote to memory of 3232 1348 bntnnt.exe 98 PID 3232 wrote to memory of 2740 3232 jvppv.exe 99 PID 3232 wrote to memory of 2740 3232 jvppv.exe 99 PID 3232 wrote to memory of 2740 3232 jvppv.exe 99 PID 2740 wrote to memory of 5036 2740 llxxxfx.exe 100 PID 2740 wrote to memory of 5036 2740 llxxxfx.exe 100 PID 2740 wrote to memory of 5036 2740 llxxxfx.exe 100 PID 5036 wrote to memory of 500 5036 nnttbb.exe 101 PID 5036 wrote to memory of 500 5036 nnttbb.exe 101 PID 5036 wrote to memory of 500 5036 nnttbb.exe 101 PID 500 wrote to memory of 5092 500 xxlllrx.exe 102 PID 500 wrote to memory of 5092 500 xxlllrx.exe 102 PID 500 wrote to memory of 5092 500 xxlllrx.exe 102 PID 5092 wrote to memory of 5000 5092 btnnbt.exe 104 PID 5092 wrote to memory of 5000 5092 btnnbt.exe 104 PID 5092 wrote to memory of 5000 5092 btnnbt.exe 104 PID 5000 wrote to memory of 4368 5000 rlxrlrr.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e08076473ed665039288f72e6cbf235e77c294f51e13532caa7a6106ac327e0.exe"C:\Users\Admin\AppData\Local\Temp\1e08076473ed665039288f72e6cbf235e77c294f51e13532caa7a6106ac327e0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\1nnnhh.exec:\1nnnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\lrlfrrf.exec:\lrlfrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\vpjpd.exec:\vpjpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\fxlfxlx.exec:\fxlfxlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\dppvp.exec:\dppvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\lrlfxrr.exec:\lrlfxrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\3nhhbh.exec:\3nhhbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\fflfxlf.exec:\fflfxlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\3bbthh.exec:\3bbthh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\lllffxx.exec:\lllffxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\bhtthh.exec:\bhtthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\5vpjd.exec:\5vpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\bnnhbb.exec:\bnnhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\5vddp.exec:\5vddp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\bntnnt.exec:\bntnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\jvppv.exec:\jvppv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\llxxxfx.exec:\llxxxfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\nnttbb.exec:\nnttbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\xxlllrx.exec:\xxlllrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:500 -
\??\c:\btnnbt.exec:\btnnbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\rlxrlrr.exec:\rlxrlrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\tnnbnt.exec:\tnnbnt.exe23⤵
- Executes dropped EXE
PID:4368 -
\??\c:\jddvp.exec:\jddvp.exe24⤵
- Executes dropped EXE
PID:1312 -
\??\c:\bthbhn.exec:\bthbhn.exe25⤵
- Executes dropped EXE
PID:1776 -
\??\c:\jjppv.exec:\jjppv.exe26⤵
- Executes dropped EXE
PID:3468 -
\??\c:\tnntnt.exec:\tnntnt.exe27⤵
- Executes dropped EXE
PID:2352 -
\??\c:\llfxrrl.exec:\llfxrrl.exe28⤵
- Executes dropped EXE
PID:3060 -
\??\c:\nbbhhh.exec:\nbbhhh.exe29⤵
- Executes dropped EXE
PID:3148 -
\??\c:\7fxrxxx.exec:\7fxrxxx.exe30⤵
- Executes dropped EXE
PID:4592 -
\??\c:\tbbtnn.exec:\tbbtnn.exe31⤵
- Executes dropped EXE
PID:4760 -
\??\c:\jvvdv.exec:\jvvdv.exe32⤵
- Executes dropped EXE
PID:5056 -
\??\c:\bhnnhh.exec:\bhnnhh.exe33⤵
- Executes dropped EXE
PID:3988 -
\??\c:\1ppdj.exec:\1ppdj.exe34⤵
- Executes dropped EXE
PID:488 -
\??\c:\llllfll.exec:\llllfll.exe35⤵
- Executes dropped EXE
PID:4324 -
\??\c:\9hnhhb.exec:\9hnhhb.exe36⤵
- Executes dropped EXE
PID:2396 -
\??\c:\fxllrrr.exec:\fxllrrr.exe37⤵
- Executes dropped EXE
PID:724 -
\??\c:\nnhhhh.exec:\nnhhhh.exe38⤵
- Executes dropped EXE
PID:492 -
\??\c:\vpvjd.exec:\vpvjd.exe39⤵
- Executes dropped EXE
PID:4912 -
\??\c:\ntbtnn.exec:\ntbtnn.exe40⤵
- Executes dropped EXE
PID:4296 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe41⤵
- Executes dropped EXE
PID:1544 -
\??\c:\btnttb.exec:\btnttb.exe42⤵
- Executes dropped EXE
PID:4860 -
\??\c:\dvvpj.exec:\dvvpj.exe43⤵
- Executes dropped EXE
PID:4204 -
\??\c:\xllrffr.exec:\xllrffr.exe44⤵
- Executes dropped EXE
PID:3432 -
\??\c:\nnhnhb.exec:\nnhnhb.exe45⤵
- Executes dropped EXE
PID:4408 -
\??\c:\xfllfll.exec:\xfllfll.exe46⤵
- Executes dropped EXE
PID:4252 -
\??\c:\bbnhnn.exec:\bbnhnn.exe47⤵
- Executes dropped EXE
PID:3404 -
\??\c:\vdppp.exec:\vdppp.exe48⤵
- Executes dropped EXE
PID:812 -
\??\c:\fxxrrrr.exec:\fxxrrrr.exe49⤵
- Executes dropped EXE
PID:3136 -
\??\c:\jjjvp.exec:\jjjvp.exe50⤵
- Executes dropped EXE
PID:2244 -
\??\c:\1ffxrxr.exec:\1ffxrxr.exe51⤵
- Executes dropped EXE
PID:4216 -
\??\c:\5ntnbb.exec:\5ntnbb.exe52⤵
- Executes dropped EXE
PID:2296 -
\??\c:\5vvjd.exec:\5vvjd.exe53⤵
- Executes dropped EXE
PID:4848 -
\??\c:\thbtnn.exec:\thbtnn.exe54⤵
- Executes dropped EXE
PID:3156 -
\??\c:\vpjdv.exec:\vpjdv.exe55⤵
- Executes dropped EXE
PID:4768 -
\??\c:\pdpjj.exec:\pdpjj.exe56⤵
- Executes dropped EXE
PID:348 -
\??\c:\xxlxlxr.exec:\xxlxlxr.exe57⤵
- Executes dropped EXE
PID:3232 -
\??\c:\bnttnt.exec:\bnttnt.exe58⤵
- Executes dropped EXE
PID:2836 -
\??\c:\pdppp.exec:\pdppp.exe59⤵
- Executes dropped EXE
PID:2636 -
\??\c:\htnbnh.exec:\htnbnh.exe60⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vjjvj.exec:\vjjvj.exe61⤵
- Executes dropped EXE
PID:5108 -
\??\c:\7lrlxrl.exec:\7lrlxrl.exe62⤵
- Executes dropped EXE
PID:640 -
\??\c:\3vpjd.exec:\3vpjd.exe63⤵
- Executes dropped EXE
PID:1976 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe64⤵
- Executes dropped EXE
PID:1492 -
\??\c:\5bttnb.exec:\5bttnb.exe65⤵
- Executes dropped EXE
PID:2640 -
\??\c:\5ppdp.exec:\5ppdp.exe66⤵PID:3716
-
\??\c:\5ntnhn.exec:\5ntnhn.exe67⤵PID:1048
-
\??\c:\xrlfrlf.exec:\xrlfrlf.exe68⤵PID:1472
-
\??\c:\nhbtbb.exec:\nhbtbb.exe69⤵PID:3964
-
\??\c:\7xxlffr.exec:\7xxlffr.exe70⤵PID:3172
-
\??\c:\bnnhtn.exec:\bnnhtn.exe71⤵PID:4528
-
\??\c:\7xlfxlf.exec:\7xlfxlf.exe72⤵PID:4592
-
\??\c:\fllrllf.exec:\fllrllf.exe73⤵PID:2372
-
\??\c:\vjddj.exec:\vjddj.exe74⤵PID:5056
-
\??\c:\9xxlxrl.exec:\9xxlxrl.exe75⤵PID:3240
-
\??\c:\pdjvd.exec:\pdjvd.exe76⤵PID:1276
-
\??\c:\frrlxxr.exec:\frrlxxr.exe77⤵PID:3436
-
\??\c:\vjpjv.exec:\vjpjv.exe78⤵PID:784
-
\??\c:\7rfxllf.exec:\7rfxllf.exe79⤵PID:1648
-
\??\c:\btntnb.exec:\btntnb.exe80⤵PID:4912
-
\??\c:\7btnhb.exec:\7btnhb.exe81⤵PID:4040
-
\??\c:\lxlxrlr.exec:\lxlxrlr.exe82⤵PID:1912
-
\??\c:\9hnbbt.exec:\9hnbbt.exe83⤵PID:2752
-
\??\c:\pvvpd.exec:\pvvpd.exe84⤵PID:3820
-
\??\c:\nbthht.exec:\nbthht.exe85⤵PID:4864
-
\??\c:\vjpdd.exec:\vjpdd.exe86⤵PID:1992
-
\??\c:\7xxrllf.exec:\7xxrllf.exe87⤵PID:4888
-
\??\c:\9pjjd.exec:\9pjjd.exe88⤵PID:3000
-
\??\c:\ttbhnt.exec:\ttbhnt.exe89⤵PID:1516
-
\??\c:\jvvpp.exec:\jvvpp.exe90⤵PID:5052
-
\??\c:\ttbtbb.exec:\ttbtbb.exe91⤵PID:4448
-
\??\c:\5vvjv.exec:\5vvjv.exe92⤵PID:4920
-
\??\c:\rxrlxrr.exec:\rxrlxrr.exe93⤵PID:2744
-
\??\c:\5vpjv.exec:\5vpjv.exe94⤵PID:2276
-
\??\c:\lxfrfff.exec:\lxfrfff.exe95⤵PID:4056
-
\??\c:\vjddv.exec:\vjddv.exe96⤵PID:3388
-
\??\c:\9lfrxrr.exec:\9lfrxrr.exe97⤵PID:1996
-
\??\c:\btbtnh.exec:\btbtnh.exe98⤵PID:4672
-
\??\c:\jpvvv.exec:\jpvvv.exe99⤵PID:3952
-
\??\c:\3llxfxl.exec:\3llxfxl.exe100⤵PID:4444
-
\??\c:\dpjjv.exec:\dpjjv.exe101⤵PID:4440
-
\??\c:\xfrrlxx.exec:\xfrrlxx.exe102⤵PID:2468
-
\??\c:\tntttt.exec:\tntttt.exe103⤵PID:1872
-
\??\c:\dvpjd.exec:\dvpjd.exe104⤵PID:1936
-
\??\c:\nbhttt.exec:\nbhttt.exe105⤵PID:4352
-
\??\c:\9jvjp.exec:\9jvjp.exe106⤵PID:4812
-
\??\c:\ffxrflx.exec:\ffxrflx.exe107⤵PID:3368
-
\??\c:\7jddv.exec:\7jddv.exe108⤵PID:3596
-
\??\c:\pddvj.exec:\pddvj.exe109⤵PID:2888
-
\??\c:\tnhthb.exec:\tnhthb.exe110⤵PID:2808
-
\??\c:\jdpjj.exec:\jdpjj.exe111⤵PID:4744
-
\??\c:\5rrlxfx.exec:\5rrlxfx.exe112⤵PID:2876
-
\??\c:\7tthbb.exec:\7tthbb.exe113⤵PID:5032
-
\??\c:\7vvpd.exec:\7vvpd.exe114⤵PID:1104
-
\??\c:\3ffrxrr.exec:\3ffrxrr.exe115⤵PID:1388
-
\??\c:\pdpjv.exec:\pdpjv.exe116⤵PID:784
-
\??\c:\rllxrlr.exec:\rllxrlr.exe117⤵PID:4944
-
\??\c:\tnhttn.exec:\tnhttn.exe118⤵PID:3352
-
\??\c:\dppjv.exec:\dppjv.exe119⤵PID:4040
-
\??\c:\rflrlxx.exec:\rflrlxx.exe120⤵PID:4536
-
\??\c:\ntnhtn.exec:\ntnhtn.exe121⤵PID:4172
-
\??\c:\ddjdp.exec:\ddjdp.exe122⤵PID:1748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-