Analysis
-
max time kernel
149s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01/05/2024, 19:16
Behavioral task
behavioral1
Sample
1aac9fdd6c25a6f91277681b8bb3a0f93ff6eec3380de07918887a6383bbf4d5.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
1aac9fdd6c25a6f91277681b8bb3a0f93ff6eec3380de07918887a6383bbf4d5.exe
-
Size
57KB
-
MD5
995526e457052e072c2b60995842177b
-
SHA1
8ef54728730cea0a1cb771bda598d69e251bd0a5
-
SHA256
1aac9fdd6c25a6f91277681b8bb3a0f93ff6eec3380de07918887a6383bbf4d5
-
SHA512
d1561dfa104ed2d6ea5358dbaa68484757516f493c40900cc26b5f738581bd79a76b544d7636b382b6b637d19398733b66fa2eebd504614760b3cf8cbc09bd3d
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+IJPhbMie:zhOmTsF93UYfwC6GIoutiTm5hIie
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1516-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1516-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1088-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1868-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3748-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/384-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1864-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1240-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3076-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/896-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4724-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2216-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3704-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3736-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3632-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3632-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4472-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1020-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2640-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1408-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/384-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2920-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/888-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1392-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1428-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2332-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2516-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2456-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3748-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2456-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2676-564-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1240-641-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/1516-1-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000d000000023aee-3.dat UPX behavioral2/memory/5048-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1516-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000b000000023b82-9.dat UPX behavioral2/memory/5048-11-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1088-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b83-12.dat UPX behavioral2/memory/1868-18-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b84-21.dat UPX behavioral2/memory/3276-23-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b85-25.dat UPX behavioral2/files/0x000a000000023b86-30.dat UPX behavioral2/memory/4544-33-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b87-35.dat UPX behavioral2/memory/1696-37-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3748-32-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b88-41.dat UPX behavioral2/memory/384-43-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b8a-45.dat UPX behavioral2/memory/1916-47-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b8b-50.dat UPX behavioral2/files/0x000a000000023b8c-54.dat UPX behavioral2/memory/4480-58-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3032-56-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b8d-60.dat UPX behavioral2/files/0x000a000000023b8e-65.dat UPX behavioral2/memory/3328-69-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b8f-68.dat UPX behavioral2/files/0x000a000000023b90-73.dat UPX behavioral2/memory/4564-75-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b91-78.dat UPX behavioral2/memory/5076-80-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5092-82-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b92-84.dat UPX behavioral2/files/0x000a000000023b93-88.dat UPX behavioral2/memory/5028-90-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b94-93.dat UPX behavioral2/memory/1864-94-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b95-98.dat UPX behavioral2/memory/4692-100-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3140-102-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b96-104.dat UPX behavioral2/files/0x000a000000023b93-108.dat UPX behavioral2/memory/4352-109-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4528-112-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b97-114.dat UPX behavioral2/files/0x000a000000023b98-118.dat UPX behavioral2/memory/4644-119-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b99-123.dat UPX behavioral2/memory/5108-127-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b9a-129.dat UPX behavioral2/files/0x000a000000023b9b-132.dat UPX behavioral2/memory/1240-133-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b9c-137.dat UPX behavioral2/memory/3076-138-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b9d-142.dat UPX behavioral2/memory/3460-145-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b9e-148.dat UPX behavioral2/memory/896-150-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023b9f-152.dat UPX behavioral2/files/0x000a000000023ba0-157.dat UPX behavioral2/memory/4724-156-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2216-165-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 5048 dvddd.exe 1088 vvpjp.exe 1868 xfrrrrr.exe 3276 vpjjd.exe 3748 vpdvp.exe 4544 djvvp.exe 1696 5frrfll.exe 384 rrlllrl.exe 1916 nnbtnt.exe 3032 9jvdv.exe 4480 llfflrr.exe 1092 3rlffll.exe 3328 nnnhhh.exe 4564 bbhbbb.exe 5076 vpvdv.exe 5092 fffrlll.exe 5028 ffffllx.exe 1864 bthhhn.exe 4692 ppppd.exe 3140 jpvjp.exe 4352 ffxxflx.exe 4528 bthhhn.exe 4644 ttnhhb.exe 2700 jvdjj.exe 5108 pvddv.exe 1240 lfrfxll.exe 3076 bhbhnt.exe 2124 hnbtnh.exe 3460 vvpvd.exe 896 fxlrrfx.exe 4724 rrfllrf.exe 3592 btnnnt.exe 3028 vjvdj.exe 2216 rfxxrxr.exe 4272 hnhhnh.exe 3508 htbbnn.exe 2768 1djdv.exe 3704 rlxfrrr.exe 2620 9xllxxf.exe 3432 hntttt.exe 2332 bnhbtt.exe 4460 vjjdv.exe 4660 5rxfrll.exe 3736 7lxxffl.exe 404 tnbnhb.exe 4924 hbhhbb.exe 3060 1vdvp.exe 712 5jjjd.exe 3632 xxfflrr.exe 3284 hhbbbb.exe 3724 pdjjp.exe 1332 3pdvp.exe 2612 xflrxfr.exe 1868 rxlrrll.exe 3276 bbhhht.exe 4472 btbbth.exe 1020 pdpjj.exe 2640 fffxllf.exe 1408 5rxrllf.exe 384 nbttnn.exe 2920 jjjdv.exe 3032 dvjdj.exe 2964 lfxrrrl.exe 3548 xrxrllf.exe -
resource yara_rule behavioral2/memory/1516-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000d000000023aee-3.dat upx behavioral2/memory/5048-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1516-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b82-9.dat upx behavioral2/memory/5048-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1088-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b83-12.dat upx behavioral2/memory/1868-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b84-21.dat upx behavioral2/memory/3276-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b85-25.dat upx behavioral2/files/0x000a000000023b86-30.dat upx behavioral2/memory/4544-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b87-35.dat upx behavioral2/memory/1696-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3748-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b88-41.dat upx behavioral2/memory/384-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8a-45.dat upx behavioral2/memory/1916-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8b-50.dat upx behavioral2/files/0x000a000000023b8c-54.dat upx behavioral2/memory/4480-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3032-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8d-60.dat upx behavioral2/files/0x000a000000023b8e-65.dat upx behavioral2/memory/3328-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8f-68.dat upx behavioral2/files/0x000a000000023b90-73.dat upx behavioral2/memory/4564-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b91-78.dat upx behavioral2/memory/5076-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5092-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b92-84.dat upx behavioral2/files/0x000a000000023b93-88.dat upx behavioral2/memory/5028-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b94-93.dat upx behavioral2/memory/1864-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b95-98.dat upx behavioral2/memory/4692-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3140-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b96-104.dat upx behavioral2/files/0x000a000000023b93-108.dat upx behavioral2/memory/4352-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4528-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b97-114.dat upx behavioral2/files/0x000a000000023b98-118.dat upx behavioral2/memory/4644-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b99-123.dat upx behavioral2/memory/5108-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9a-129.dat upx behavioral2/files/0x000a000000023b9b-132.dat upx behavioral2/memory/1240-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9c-137.dat upx behavioral2/memory/3076-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9d-142.dat upx behavioral2/memory/3460-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9e-148.dat upx behavioral2/memory/896-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9f-152.dat upx behavioral2/files/0x000a000000023ba0-157.dat upx behavioral2/memory/4724-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2216-165-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1516 wrote to memory of 5048 1516 1aac9fdd6c25a6f91277681b8bb3a0f93ff6eec3380de07918887a6383bbf4d5.exe 83 PID 1516 wrote to memory of 5048 1516 1aac9fdd6c25a6f91277681b8bb3a0f93ff6eec3380de07918887a6383bbf4d5.exe 83 PID 1516 wrote to memory of 5048 1516 1aac9fdd6c25a6f91277681b8bb3a0f93ff6eec3380de07918887a6383bbf4d5.exe 83 PID 5048 wrote to memory of 1088 5048 dvddd.exe 84 PID 5048 wrote to memory of 1088 5048 dvddd.exe 84 PID 5048 wrote to memory of 1088 5048 dvddd.exe 84 PID 1088 wrote to memory of 1868 1088 vvpjp.exe 85 PID 1088 wrote to memory of 1868 1088 vvpjp.exe 85 PID 1088 wrote to memory of 1868 1088 vvpjp.exe 85 PID 1868 wrote to memory of 3276 1868 xfrrrrr.exe 86 PID 1868 wrote to memory of 3276 1868 xfrrrrr.exe 86 PID 1868 wrote to memory of 3276 1868 xfrrrrr.exe 86 PID 3276 wrote to memory of 3748 3276 vpjjd.exe 87 PID 3276 wrote to memory of 3748 3276 vpjjd.exe 87 PID 3276 wrote to memory of 3748 3276 vpjjd.exe 87 PID 3748 wrote to memory of 4544 3748 vpdvp.exe 88 PID 3748 wrote to memory of 4544 3748 vpdvp.exe 88 PID 3748 wrote to memory of 4544 3748 vpdvp.exe 88 PID 4544 wrote to memory of 1696 4544 djvvp.exe 89 PID 4544 wrote to memory of 1696 4544 djvvp.exe 89 PID 4544 wrote to memory of 1696 4544 djvvp.exe 89 PID 1696 wrote to memory of 384 1696 5frrfll.exe 90 PID 1696 wrote to memory of 384 1696 5frrfll.exe 90 PID 1696 wrote to memory of 384 1696 5frrfll.exe 90 PID 384 wrote to memory of 1916 384 rrlllrl.exe 91 PID 384 wrote to memory of 1916 384 rrlllrl.exe 91 PID 384 wrote to memory of 1916 384 rrlllrl.exe 91 PID 1916 wrote to memory of 3032 1916 nnbtnt.exe 92 PID 1916 wrote to memory of 3032 1916 nnbtnt.exe 92 PID 1916 wrote to memory of 3032 1916 nnbtnt.exe 92 PID 3032 wrote to memory of 4480 3032 9jvdv.exe 93 PID 3032 wrote to memory of 4480 3032 9jvdv.exe 93 PID 3032 wrote to memory of 4480 3032 9jvdv.exe 93 PID 4480 wrote to memory of 1092 4480 llfflrr.exe 94 PID 4480 wrote to memory of 1092 4480 llfflrr.exe 94 PID 4480 wrote to memory of 1092 4480 llfflrr.exe 94 PID 1092 wrote to memory of 3328 1092 3rlffll.exe 95 PID 1092 wrote to memory of 3328 1092 3rlffll.exe 95 PID 1092 wrote to memory of 3328 1092 3rlffll.exe 95 PID 3328 wrote to memory of 4564 3328 nnnhhh.exe 96 PID 3328 wrote to memory of 4564 3328 nnnhhh.exe 96 PID 3328 wrote to memory of 4564 3328 nnnhhh.exe 96 PID 4564 wrote to memory of 5076 4564 bbhbbb.exe 97 PID 4564 wrote to memory of 5076 4564 bbhbbb.exe 97 PID 4564 wrote to memory of 5076 4564 bbhbbb.exe 97 PID 5076 wrote to memory of 5092 5076 vpvdv.exe 98 PID 5076 wrote to memory of 5092 5076 vpvdv.exe 98 PID 5076 wrote to memory of 5092 5076 vpvdv.exe 98 PID 5092 wrote to memory of 5028 5092 fffrlll.exe 99 PID 5092 wrote to memory of 5028 5092 fffrlll.exe 99 PID 5092 wrote to memory of 5028 5092 fffrlll.exe 99 PID 5028 wrote to memory of 1864 5028 ffffllx.exe 100 PID 5028 wrote to memory of 1864 5028 ffffllx.exe 100 PID 5028 wrote to memory of 1864 5028 ffffllx.exe 100 PID 1864 wrote to memory of 4692 1864 bthhhn.exe 101 PID 1864 wrote to memory of 4692 1864 bthhhn.exe 101 PID 1864 wrote to memory of 4692 1864 bthhhn.exe 101 PID 4692 wrote to memory of 3140 4692 ppppd.exe 102 PID 4692 wrote to memory of 3140 4692 ppppd.exe 102 PID 4692 wrote to memory of 3140 4692 ppppd.exe 102 PID 3140 wrote to memory of 4352 3140 jpvjp.exe 103 PID 3140 wrote to memory of 4352 3140 jpvjp.exe 103 PID 3140 wrote to memory of 4352 3140 jpvjp.exe 103 PID 4352 wrote to memory of 4528 4352 ffxxflx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\1aac9fdd6c25a6f91277681b8bb3a0f93ff6eec3380de07918887a6383bbf4d5.exe"C:\Users\Admin\AppData\Local\Temp\1aac9fdd6c25a6f91277681b8bb3a0f93ff6eec3380de07918887a6383bbf4d5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\dvddd.exec:\dvddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\vvpjp.exec:\vvpjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\xfrrrrr.exec:\xfrrrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\vpjjd.exec:\vpjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\vpdvp.exec:\vpdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\djvvp.exec:\djvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\5frrfll.exec:\5frrfll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\rrlllrl.exec:\rrlllrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\nnbtnt.exec:\nnbtnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\9jvdv.exec:\9jvdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\llfflrr.exec:\llfflrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\3rlffll.exec:\3rlffll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\nnnhhh.exec:\nnnhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\bbhbbb.exec:\bbhbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\vpvdv.exec:\vpvdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\fffrlll.exec:\fffrlll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\ffffllx.exec:\ffffllx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\bthhhn.exec:\bthhhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\ppppd.exec:\ppppd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\jpvjp.exec:\jpvjp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\ffxxflx.exec:\ffxxflx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\bthhhn.exec:\bthhhn.exe23⤵
- Executes dropped EXE
PID:4528 -
\??\c:\ttnhhb.exec:\ttnhhb.exe24⤵
- Executes dropped EXE
PID:4644 -
\??\c:\jvdjj.exec:\jvdjj.exe25⤵
- Executes dropped EXE
PID:2700 -
\??\c:\pvddv.exec:\pvddv.exe26⤵
- Executes dropped EXE
PID:5108 -
\??\c:\lfrfxll.exec:\lfrfxll.exe27⤵
- Executes dropped EXE
PID:1240 -
\??\c:\bhbhnt.exec:\bhbhnt.exe28⤵
- Executes dropped EXE
PID:3076 -
\??\c:\hnbtnh.exec:\hnbtnh.exe29⤵
- Executes dropped EXE
PID:2124 -
\??\c:\vvpvd.exec:\vvpvd.exe30⤵
- Executes dropped EXE
PID:3460 -
\??\c:\fxlrrfx.exec:\fxlrrfx.exe31⤵
- Executes dropped EXE
PID:896 -
\??\c:\rrfllrf.exec:\rrfllrf.exe32⤵
- Executes dropped EXE
PID:4724 -
\??\c:\btnnnt.exec:\btnnnt.exe33⤵
- Executes dropped EXE
PID:3592 -
\??\c:\vjvdj.exec:\vjvdj.exe34⤵
- Executes dropped EXE
PID:3028 -
\??\c:\rfxxrxr.exec:\rfxxrxr.exe35⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hnhhnh.exec:\hnhhnh.exe36⤵
- Executes dropped EXE
PID:4272 -
\??\c:\htbbnn.exec:\htbbnn.exe37⤵
- Executes dropped EXE
PID:3508 -
\??\c:\1djdv.exec:\1djdv.exe38⤵
- Executes dropped EXE
PID:2768 -
\??\c:\rlxfrrr.exec:\rlxfrrr.exe39⤵
- Executes dropped EXE
PID:3704 -
\??\c:\9xllxxf.exec:\9xllxxf.exe40⤵
- Executes dropped EXE
PID:2620 -
\??\c:\hntttt.exec:\hntttt.exe41⤵
- Executes dropped EXE
PID:3432 -
\??\c:\bnhbtt.exec:\bnhbtt.exe42⤵
- Executes dropped EXE
PID:2332 -
\??\c:\vjjdv.exec:\vjjdv.exe43⤵
- Executes dropped EXE
PID:4460 -
\??\c:\5rxfrll.exec:\5rxfrll.exe44⤵
- Executes dropped EXE
PID:4660 -
\??\c:\7lxxffl.exec:\7lxxffl.exe45⤵
- Executes dropped EXE
PID:3736 -
\??\c:\tnbnhb.exec:\tnbnhb.exe46⤵
- Executes dropped EXE
PID:404 -
\??\c:\hbhhbb.exec:\hbhhbb.exe47⤵
- Executes dropped EXE
PID:4924 -
\??\c:\1vdvp.exec:\1vdvp.exe48⤵
- Executes dropped EXE
PID:3060 -
\??\c:\5jjjd.exec:\5jjjd.exe49⤵
- Executes dropped EXE
PID:712 -
\??\c:\fllfxxx.exec:\fllfxxx.exe50⤵PID:4356
-
\??\c:\xxfflrr.exec:\xxfflrr.exe51⤵
- Executes dropped EXE
PID:3632 -
\??\c:\hhbbbb.exec:\hhbbbb.exe52⤵
- Executes dropped EXE
PID:3284 -
\??\c:\pdjjp.exec:\pdjjp.exe53⤵
- Executes dropped EXE
PID:3724 -
\??\c:\3pdvp.exec:\3pdvp.exe54⤵
- Executes dropped EXE
PID:1332 -
\??\c:\xflrxfr.exec:\xflrxfr.exe55⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rxlrrll.exec:\rxlrrll.exe56⤵
- Executes dropped EXE
PID:1868 -
\??\c:\bbhhht.exec:\bbhhht.exe57⤵
- Executes dropped EXE
PID:3276 -
\??\c:\btbbth.exec:\btbbth.exe58⤵
- Executes dropped EXE
PID:4472 -
\??\c:\pdpjj.exec:\pdpjj.exe59⤵
- Executes dropped EXE
PID:1020 -
\??\c:\fffxllf.exec:\fffxllf.exe60⤵
- Executes dropped EXE
PID:2640 -
\??\c:\5rxrllf.exec:\5rxrllf.exe61⤵
- Executes dropped EXE
PID:1408 -
\??\c:\nbttnn.exec:\nbttnn.exe62⤵
- Executes dropped EXE
PID:384 -
\??\c:\jjjdv.exec:\jjjdv.exe63⤵
- Executes dropped EXE
PID:2920 -
\??\c:\dvjdj.exec:\dvjdj.exe64⤵
- Executes dropped EXE
PID:3032 -
\??\c:\lfxrrrl.exec:\lfxrrrl.exe65⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xrxrllf.exec:\xrxrllf.exe66⤵
- Executes dropped EXE
PID:3548 -
\??\c:\bbnhbn.exec:\bbnhbn.exe67⤵PID:888
-
\??\c:\tnnhhh.exec:\tnnhhh.exe68⤵PID:4596
-
\??\c:\jpvpj.exec:\jpvpj.exe69⤵PID:2044
-
\??\c:\fxrrrrx.exec:\fxrrrrx.exe70⤵PID:864
-
\??\c:\flffxrx.exec:\flffxrx.exe71⤵PID:5092
-
\??\c:\rrxxxrr.exec:\rrxxxrr.exe72⤵PID:1392
-
\??\c:\htbbtt.exec:\htbbtt.exe73⤵PID:3604
-
\??\c:\hbttbb.exec:\hbttbb.exe74⤵PID:3312
-
\??\c:\ppdvv.exec:\ppdvv.exe75⤵PID:4968
-
\??\c:\lfxrrxr.exec:\lfxrrxr.exe76⤵PID:1428
-
\??\c:\xlllfff.exec:\xlllfff.exe77⤵PID:336
-
\??\c:\hbhbtt.exec:\hbhbtt.exe78⤵PID:1776
-
\??\c:\nbbbbb.exec:\nbbbbb.exe79⤵PID:2680
-
\??\c:\ppvdp.exec:\ppvdp.exe80⤵PID:3420
-
\??\c:\jjvpp.exec:\jjvpp.exe81⤵PID:3500
-
\??\c:\lllfflf.exec:\lllfflf.exe82⤵PID:1700
-
\??\c:\bbnttt.exec:\bbnttt.exe83⤵PID:4704
-
\??\c:\tnthnn.exec:\tnthnn.exe84⤵PID:4416
-
\??\c:\dvpjp.exec:\dvpjp.exe85⤵PID:1628
-
\??\c:\pppjv.exec:\pppjv.exe86⤵PID:2932
-
\??\c:\9xxrrxr.exec:\9xxrrxr.exe87⤵PID:1384
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe88⤵PID:2348
-
\??\c:\tntttb.exec:\tntttb.exe89⤵PID:1832
-
\??\c:\lrfflfl.exec:\lrfflfl.exe90⤵PID:3912
-
\??\c:\ttnnbh.exec:\ttnnbh.exe91⤵PID:1740
-
\??\c:\jjjpv.exec:\jjjpv.exe92⤵PID:2172
-
\??\c:\xxfxxfx.exec:\xxfxxfx.exe93⤵PID:4432
-
\??\c:\7lrrrff.exec:\7lrrrff.exe94⤵PID:696
-
\??\c:\7ttttt.exec:\7ttttt.exe95⤵PID:2528
-
\??\c:\7pddd.exec:\7pddd.exe96⤵PID:3636
-
\??\c:\pvpvj.exec:\pvpvj.exe97⤵PID:5084
-
\??\c:\lrlxrlf.exec:\lrlxrlf.exe98⤵PID:716
-
\??\c:\nhbbnn.exec:\nhbbnn.exe99⤵PID:4412
-
\??\c:\hnhhbt.exec:\hnhhbt.exe100⤵PID:1996
-
\??\c:\ppddd.exec:\ppddd.exe101⤵PID:3704
-
\??\c:\ddvvp.exec:\ddvvp.exe102⤵PID:2620
-
\??\c:\7ffflrl.exec:\7ffflrl.exe103⤵PID:1712
-
\??\c:\5lrxxff.exec:\5lrxxff.exe104⤵PID:2332
-
\??\c:\tntnhh.exec:\tntnhh.exe105⤵PID:4460
-
\??\c:\bntbtb.exec:\bntbtb.exe106⤵PID:452
-
\??\c:\vjjdd.exec:\vjjdd.exe107⤵PID:324
-
\??\c:\dvjdv.exec:\dvjdv.exe108⤵PID:1952
-
\??\c:\xxrlxrl.exec:\xxrlxrl.exe109⤵PID:2376
-
\??\c:\nbhnnn.exec:\nbhnnn.exe110⤵PID:1936
-
\??\c:\nbhtnn.exec:\nbhtnn.exe111⤵PID:712
-
\??\c:\1jvvd.exec:\1jvvd.exe112⤵PID:1308
-
\??\c:\1rllfff.exec:\1rllfff.exe113⤵PID:4080
-
\??\c:\7rxxxrl.exec:\7rxxxrl.exe114⤵PID:2516
-
\??\c:\hhbhbb.exec:\hhbhbb.exe115⤵PID:1088
-
\??\c:\nnnbtb.exec:\nnnbtb.exe116⤵PID:1256
-
\??\c:\frrrfxx.exec:\frrrfxx.exe117⤵PID:4984
-
\??\c:\lflrffr.exec:\lflrffr.exe118⤵PID:4296
-
\??\c:\bttnhh.exec:\bttnhh.exe119⤵PID:3276
-
\??\c:\bthbhh.exec:\bthbhh.exe120⤵PID:3016
-
\??\c:\btttbh.exec:\btttbh.exe121⤵PID:2520
-
\??\c:\dvvpd.exec:\dvvpd.exe122⤵PID:4048
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-