Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 21:19
Behavioral task
behavioral1
Sample
4b1813d3d1cea6d3e67f74a741c7f2aa4b170ca17640930b4cf8103709d50477.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
4b1813d3d1cea6d3e67f74a741c7f2aa4b170ca17640930b4cf8103709d50477.exe
-
Size
80KB
-
MD5
a6ab20bbe6cc77b10ecaf6fe377b5c69
-
SHA1
00881480dea93daf8001a6984ce0475792c97f77
-
SHA256
4b1813d3d1cea6d3e67f74a741c7f2aa4b170ca17640930b4cf8103709d50477
-
SHA512
487ca0430fa554241657efbad1288062ae254656a20197e7d0127afaaaab9641437c39f1dd5e7fa115724f57a730bf9308f78e1f4d6f2b457be8a3da81965736
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6T7v:zhOmTsF93UYfwC6GIoutiTU2HVS63v
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4616-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3080-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3908-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1480-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3424-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1436-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3144-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/868-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3940-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2564-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2760-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2832-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/920-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3128-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2176-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1728-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2976-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3876-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2616-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1824-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/888-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2760-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3100-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2832-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3256-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1016-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2784-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3284-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5056-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2640-406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1496-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3296-517-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-532-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1124-536-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4232-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1472-553-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2704-564-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2164-754-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/4616-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023278-3.dat UPX behavioral2/memory/4616-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00080000000233b9-10.dat UPX behavioral2/memory/3080-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ba-18.dat UPX behavioral2/memory/3908-21-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1480-12-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00080000000233b6-9.dat UPX behavioral2/files/0x00070000000233bb-24.dat UPX behavioral2/memory/3988-26-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233bc-28.dat UPX behavioral2/memory/1488-31-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233bd-33.dat UPX behavioral2/memory/3424-36-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233be-38.dat UPX behavioral2/files/0x00070000000233bf-42.dat UPX behavioral2/memory/1436-45-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233c0-47.dat UPX behavioral2/memory/3144-52-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233c1-51.dat UPX behavioral2/files/0x00070000000233c2-56.dat UPX behavioral2/memory/868-58-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233c3-61.dat UPX behavioral2/memory/1216-63-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5012-64-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233c4-67.dat UPX behavioral2/memory/5012-69-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4792-70-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233c5-73.dat UPX behavioral2/memory/4792-75-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233c6-78.dat UPX behavioral2/memory/3940-79-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233c7-83.dat UPX behavioral2/memory/2564-85-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2796-87-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233c8-89.dat UPX behavioral2/files/0x00070000000233c9-93.dat UPX behavioral2/memory/2760-96-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ca-98.dat UPX behavioral2/files/0x00070000000233cb-103.dat UPX behavioral2/memory/2832-105-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233cc-107.dat UPX behavioral2/memory/920-110-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233cd-113.dat UPX behavioral2/memory/3128-114-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ce-117.dat UPX behavioral2/files/0x00070000000233cf-121.dat UPX behavioral2/memory/1952-123-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233d0-126.dat UPX behavioral2/files/0x00070000000233d1-130.dat UPX behavioral2/files/0x00070000000233d2-135.dat UPX behavioral2/memory/3652-134-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233d3-139.dat UPX behavioral2/memory/4056-144-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233d4-143.dat UPX behavioral2/files/0x00070000000233d5-148.dat UPX behavioral2/memory/2900-150-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00080000000233b7-153.dat UPX behavioral2/memory/2176-161-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1152-170-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1728-173-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2368-176-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2976-179-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3080 hbtnbb.exe 1480 jvvvp.exe 3908 rfxxxxr.exe 4904 7rrlfff.exe 3988 lxrrllf.exe 1488 3ntnnb.exe 3424 jvdvv.exe 3224 xffxrrr.exe 1436 tnbhhh.exe 3144 btthbh.exe 868 ddjpj.exe 1216 rflxffr.exe 5012 hhhhnh.exe 4792 bnnhhh.exe 3940 djpjj.exe 2564 ffxfrrl.exe 2796 ttbhbb.exe 2968 jdvpd.exe 2760 fxfxxff.exe 3116 nnbbbb.exe 2832 jpjpj.exe 920 ddpjj.exe 3128 7lrxrxl.exe 1952 hhtnhh.exe 3536 vppjj.exe 1564 dvjjv.exe 3652 rllrfxr.exe 4836 1xxxxxr.exe 4056 3nthnn.exe 3208 jppjj.exe 2900 7vdvp.exe 4348 lxxrlll.exe 2088 lrfxffx.exe 2176 5bnhbb.exe 3436 dvvpp.exe 3252 dvdpp.exe 3228 rrxrffx.exe 1152 bbbbtn.exe 1728 tnhhnh.exe 2368 1ddjd.exe 2976 7lxxxrr.exe 3556 tnhbtn.exe 2284 pjjdv.exe 4176 dvdjd.exe 2592 fflllfl.exe 212 tbbbtt.exe 4320 vpddj.exe 4324 frfxlrl.exe 4860 3lffxrf.exe 3012 thhbtt.exe 1864 bnnhtt.exe 5052 pdjdd.exe 4200 frxlfxr.exe 3876 ttthbt.exe 4068 tbhbth.exe 3988 jvvpp.exe 2036 9jvpv.exe 3404 9flfxfr.exe 5016 tnnhtt.exe 3224 5hhbbb.exe 4428 vppjd.exe 1436 jppjj.exe 2616 rxffxrr.exe 3144 rxxrllr.exe -
resource yara_rule behavioral2/memory/4616-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023278-3.dat upx behavioral2/memory/4616-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233b9-10.dat upx behavioral2/memory/3080-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ba-18.dat upx behavioral2/memory/3908-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1480-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233b6-9.dat upx behavioral2/files/0x00070000000233bb-24.dat upx behavioral2/memory/3988-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233bc-28.dat upx behavioral2/memory/1488-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233bd-33.dat upx behavioral2/memory/3424-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233be-38.dat upx behavioral2/files/0x00070000000233bf-42.dat upx behavioral2/memory/1436-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c0-47.dat upx behavioral2/memory/3144-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c1-51.dat upx behavioral2/files/0x00070000000233c2-56.dat upx behavioral2/memory/868-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c3-61.dat upx behavioral2/memory/1216-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5012-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c4-67.dat upx behavioral2/memory/5012-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4792-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c5-73.dat upx behavioral2/memory/4792-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c6-78.dat upx behavioral2/memory/3940-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c7-83.dat upx behavioral2/memory/2564-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2796-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c8-89.dat upx behavioral2/files/0x00070000000233c9-93.dat upx behavioral2/memory/2760-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ca-98.dat upx behavioral2/files/0x00070000000233cb-103.dat upx behavioral2/memory/2832-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233cc-107.dat upx behavioral2/memory/920-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233cd-113.dat upx behavioral2/memory/3128-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ce-117.dat upx behavioral2/files/0x00070000000233cf-121.dat upx behavioral2/memory/1952-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d0-126.dat upx behavioral2/files/0x00070000000233d1-130.dat upx behavioral2/files/0x00070000000233d2-135.dat upx behavioral2/memory/3652-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d3-139.dat upx behavioral2/memory/4056-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d4-143.dat upx behavioral2/files/0x00070000000233d5-148.dat upx behavioral2/memory/2900-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233b7-153.dat upx behavioral2/memory/2176-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1152-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1728-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2368-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2976-179-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4616 wrote to memory of 3080 4616 4b1813d3d1cea6d3e67f74a741c7f2aa4b170ca17640930b4cf8103709d50477.exe 81 PID 4616 wrote to memory of 3080 4616 4b1813d3d1cea6d3e67f74a741c7f2aa4b170ca17640930b4cf8103709d50477.exe 81 PID 4616 wrote to memory of 3080 4616 4b1813d3d1cea6d3e67f74a741c7f2aa4b170ca17640930b4cf8103709d50477.exe 81 PID 3080 wrote to memory of 1480 3080 hbtnbb.exe 82 PID 3080 wrote to memory of 1480 3080 hbtnbb.exe 82 PID 3080 wrote to memory of 1480 3080 hbtnbb.exe 82 PID 1480 wrote to memory of 3908 1480 jvvvp.exe 83 PID 1480 wrote to memory of 3908 1480 jvvvp.exe 83 PID 1480 wrote to memory of 3908 1480 jvvvp.exe 83 PID 3908 wrote to memory of 4904 3908 rfxxxxr.exe 84 PID 3908 wrote to memory of 4904 3908 rfxxxxr.exe 84 PID 3908 wrote to memory of 4904 3908 rfxxxxr.exe 84 PID 4904 wrote to memory of 3988 4904 7rrlfff.exe 86 PID 4904 wrote to memory of 3988 4904 7rrlfff.exe 86 PID 4904 wrote to memory of 3988 4904 7rrlfff.exe 86 PID 3988 wrote to memory of 1488 3988 lxrrllf.exe 87 PID 3988 wrote to memory of 1488 3988 lxrrllf.exe 87 PID 3988 wrote to memory of 1488 3988 lxrrllf.exe 87 PID 1488 wrote to memory of 3424 1488 3ntnnb.exe 88 PID 1488 wrote to memory of 3424 1488 3ntnnb.exe 88 PID 1488 wrote to memory of 3424 1488 3ntnnb.exe 88 PID 3424 wrote to memory of 3224 3424 jvdvv.exe 89 PID 3424 wrote to memory of 3224 3424 jvdvv.exe 89 PID 3424 wrote to memory of 3224 3424 jvdvv.exe 89 PID 3224 wrote to memory of 1436 3224 xffxrrr.exe 90 PID 3224 wrote to memory of 1436 3224 xffxrrr.exe 90 PID 3224 wrote to memory of 1436 3224 xffxrrr.exe 90 PID 1436 wrote to memory of 3144 1436 tnbhhh.exe 91 PID 1436 wrote to memory of 3144 1436 tnbhhh.exe 91 PID 1436 wrote to memory of 3144 1436 tnbhhh.exe 91 PID 3144 wrote to memory of 868 3144 btthbh.exe 93 PID 3144 wrote to memory of 868 3144 btthbh.exe 93 PID 3144 wrote to memory of 868 3144 btthbh.exe 93 PID 868 wrote to memory of 1216 868 ddjpj.exe 94 PID 868 wrote to memory of 1216 868 ddjpj.exe 94 PID 868 wrote to memory of 1216 868 ddjpj.exe 94 PID 1216 wrote to memory of 5012 1216 rflxffr.exe 95 PID 1216 wrote to memory of 5012 1216 rflxffr.exe 95 PID 1216 wrote to memory of 5012 1216 rflxffr.exe 95 PID 5012 wrote to memory of 4792 5012 hhhhnh.exe 96 PID 5012 wrote to memory of 4792 5012 hhhhnh.exe 96 PID 5012 wrote to memory of 4792 5012 hhhhnh.exe 96 PID 4792 wrote to memory of 3940 4792 bnnhhh.exe 97 PID 4792 wrote to memory of 3940 4792 bnnhhh.exe 97 PID 4792 wrote to memory of 3940 4792 bnnhhh.exe 97 PID 3940 wrote to memory of 2564 3940 djpjj.exe 98 PID 3940 wrote to memory of 2564 3940 djpjj.exe 98 PID 3940 wrote to memory of 2564 3940 djpjj.exe 98 PID 2564 wrote to memory of 2796 2564 ffxfrrl.exe 99 PID 2564 wrote to memory of 2796 2564 ffxfrrl.exe 99 PID 2564 wrote to memory of 2796 2564 ffxfrrl.exe 99 PID 2796 wrote to memory of 2968 2796 ttbhbb.exe 100 PID 2796 wrote to memory of 2968 2796 ttbhbb.exe 100 PID 2796 wrote to memory of 2968 2796 ttbhbb.exe 100 PID 2968 wrote to memory of 2760 2968 jdvpd.exe 101 PID 2968 wrote to memory of 2760 2968 jdvpd.exe 101 PID 2968 wrote to memory of 2760 2968 jdvpd.exe 101 PID 2760 wrote to memory of 3116 2760 fxfxxff.exe 102 PID 2760 wrote to memory of 3116 2760 fxfxxff.exe 102 PID 2760 wrote to memory of 3116 2760 fxfxxff.exe 102 PID 3116 wrote to memory of 2832 3116 nnbbbb.exe 103 PID 3116 wrote to memory of 2832 3116 nnbbbb.exe 103 PID 3116 wrote to memory of 2832 3116 nnbbbb.exe 103 PID 2832 wrote to memory of 920 2832 jpjpj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b1813d3d1cea6d3e67f74a741c7f2aa4b170ca17640930b4cf8103709d50477.exe"C:\Users\Admin\AppData\Local\Temp\4b1813d3d1cea6d3e67f74a741c7f2aa4b170ca17640930b4cf8103709d50477.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\hbtnbb.exec:\hbtnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\jvvvp.exec:\jvvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\rfxxxxr.exec:\rfxxxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\7rrlfff.exec:\7rrlfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\lxrrllf.exec:\lxrrllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\3ntnnb.exec:\3ntnnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\jvdvv.exec:\jvdvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\xffxrrr.exec:\xffxrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\tnbhhh.exec:\tnbhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\btthbh.exec:\btthbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\ddjpj.exec:\ddjpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\rflxffr.exec:\rflxffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\hhhhnh.exec:\hhhhnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\bnnhhh.exec:\bnnhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\djpjj.exec:\djpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\ffxfrrl.exec:\ffxfrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\ttbhbb.exec:\ttbhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\jdvpd.exec:\jdvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\fxfxxff.exec:\fxfxxff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\nnbbbb.exec:\nnbbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\jpjpj.exec:\jpjpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\ddpjj.exec:\ddpjj.exe23⤵
- Executes dropped EXE
PID:920 -
\??\c:\7lrxrxl.exec:\7lrxrxl.exe24⤵
- Executes dropped EXE
PID:3128 -
\??\c:\hhtnhh.exec:\hhtnhh.exe25⤵
- Executes dropped EXE
PID:1952 -
\??\c:\vppjj.exec:\vppjj.exe26⤵
- Executes dropped EXE
PID:3536 -
\??\c:\dvjjv.exec:\dvjjv.exe27⤵
- Executes dropped EXE
PID:1564 -
\??\c:\rllrfxr.exec:\rllrfxr.exe28⤵
- Executes dropped EXE
PID:3652 -
\??\c:\1xxxxxr.exec:\1xxxxxr.exe29⤵
- Executes dropped EXE
PID:4836 -
\??\c:\3nthnn.exec:\3nthnn.exe30⤵
- Executes dropped EXE
PID:4056 -
\??\c:\jppjj.exec:\jppjj.exe31⤵
- Executes dropped EXE
PID:3208 -
\??\c:\7vdvp.exec:\7vdvp.exe32⤵
- Executes dropped EXE
PID:2900 -
\??\c:\lxxrlll.exec:\lxxrlll.exe33⤵
- Executes dropped EXE
PID:4348 -
\??\c:\lrfxffx.exec:\lrfxffx.exe34⤵
- Executes dropped EXE
PID:2088 -
\??\c:\5bnhbb.exec:\5bnhbb.exe35⤵
- Executes dropped EXE
PID:2176 -
\??\c:\dvvpp.exec:\dvvpp.exe36⤵
- Executes dropped EXE
PID:3436 -
\??\c:\dvdpp.exec:\dvdpp.exe37⤵
- Executes dropped EXE
PID:3252 -
\??\c:\rrxrffx.exec:\rrxrffx.exe38⤵
- Executes dropped EXE
PID:3228 -
\??\c:\bbbbtn.exec:\bbbbtn.exe39⤵
- Executes dropped EXE
PID:1152 -
\??\c:\tnhhnh.exec:\tnhhnh.exe40⤵
- Executes dropped EXE
PID:1728 -
\??\c:\1ddjd.exec:\1ddjd.exe41⤵
- Executes dropped EXE
PID:2368 -
\??\c:\7lxxxrr.exec:\7lxxxrr.exe42⤵
- Executes dropped EXE
PID:2976 -
\??\c:\tnhbtn.exec:\tnhbtn.exe43⤵
- Executes dropped EXE
PID:3556 -
\??\c:\pjjdv.exec:\pjjdv.exe44⤵
- Executes dropped EXE
PID:2284 -
\??\c:\dvdjd.exec:\dvdjd.exe45⤵
- Executes dropped EXE
PID:4176 -
\??\c:\fflllfl.exec:\fflllfl.exe46⤵
- Executes dropped EXE
PID:2592 -
\??\c:\tbbbtt.exec:\tbbbtt.exe47⤵
- Executes dropped EXE
PID:212 -
\??\c:\vpddj.exec:\vpddj.exe48⤵
- Executes dropped EXE
PID:4320 -
\??\c:\frfxlrl.exec:\frfxlrl.exe49⤵
- Executes dropped EXE
PID:4324 -
\??\c:\3lffxrf.exec:\3lffxrf.exe50⤵
- Executes dropped EXE
PID:4860 -
\??\c:\thhbtt.exec:\thhbtt.exe51⤵
- Executes dropped EXE
PID:3012 -
\??\c:\bnnhtt.exec:\bnnhtt.exe52⤵
- Executes dropped EXE
PID:1864 -
\??\c:\pdjdd.exec:\pdjdd.exe53⤵
- Executes dropped EXE
PID:5052 -
\??\c:\frxlfxr.exec:\frxlfxr.exe54⤵
- Executes dropped EXE
PID:4200 -
\??\c:\ttthbt.exec:\ttthbt.exe55⤵
- Executes dropped EXE
PID:3876 -
\??\c:\tbhbth.exec:\tbhbth.exe56⤵
- Executes dropped EXE
PID:4068 -
\??\c:\jvvpp.exec:\jvvpp.exe57⤵
- Executes dropped EXE
PID:3988 -
\??\c:\9jvpv.exec:\9jvpv.exe58⤵
- Executes dropped EXE
PID:2036 -
\??\c:\9flfxfr.exec:\9flfxfr.exe59⤵
- Executes dropped EXE
PID:3404 -
\??\c:\tnnhtt.exec:\tnnhtt.exe60⤵
- Executes dropped EXE
PID:5016 -
\??\c:\5hhbbb.exec:\5hhbbb.exe61⤵
- Executes dropped EXE
PID:3224 -
\??\c:\vppjd.exec:\vppjd.exe62⤵
- Executes dropped EXE
PID:4428 -
\??\c:\jppjj.exec:\jppjj.exe63⤵
- Executes dropped EXE
PID:1436 -
\??\c:\rxffxrr.exec:\rxffxrr.exe64⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rxxrllr.exec:\rxxrllr.exe65⤵
- Executes dropped EXE
PID:3144 -
\??\c:\bbhbnb.exec:\bbhbnb.exe66⤵PID:404
-
\??\c:\7pppj.exec:\7pppj.exe67⤵PID:3840
-
\??\c:\jppjp.exec:\jppjp.exe68⤵PID:1824
-
\??\c:\lrrlxrl.exec:\lrrlxrl.exe69⤵PID:2480
-
\??\c:\9bhbbh.exec:\9bhbbh.exe70⤵PID:5040
-
\??\c:\tnnntn.exec:\tnnntn.exe71⤵PID:4484
-
\??\c:\jvvjd.exec:\jvvjd.exe72⤵PID:1768
-
\??\c:\7vpjv.exec:\7vpjv.exe73⤵PID:888
-
\??\c:\fllxlrl.exec:\fllxlrl.exe74⤵PID:4252
-
\??\c:\5bhhtt.exec:\5bhhtt.exe75⤵PID:4700
-
\??\c:\nhtnhh.exec:\nhtnhh.exe76⤵PID:3660
-
\??\c:\1jvvv.exec:\1jvvv.exe77⤵PID:2968
-
\??\c:\fxrrlll.exec:\fxrrlll.exe78⤵PID:2760
-
\??\c:\pvvpp.exec:\pvvpp.exe79⤵PID:3100
-
\??\c:\vpdvj.exec:\vpdvj.exe80⤵PID:2832
-
\??\c:\lfxrfxx.exec:\lfxrfxx.exe81⤵PID:920
-
\??\c:\3htntt.exec:\3htntt.exe82⤵PID:1080
-
\??\c:\jppjj.exec:\jppjj.exe83⤵PID:636
-
\??\c:\rfrlxrr.exec:\rfrlxrr.exe84⤵PID:2820
-
\??\c:\rxxrlfx.exec:\rxxrlfx.exe85⤵PID:4212
-
\??\c:\hnbbtn.exec:\hnbbtn.exe86⤵PID:3256
-
\??\c:\httnnn.exec:\httnnn.exe87⤵PID:884
-
\??\c:\frrlfrl.exec:\frrlfrl.exe88⤵PID:1016
-
\??\c:\xrxxfxf.exec:\xrxxfxf.exe89⤵PID:4232
-
\??\c:\5hhhbb.exec:\5hhhbb.exe90⤵PID:2080
-
\??\c:\dvvvv.exec:\dvvvv.exe91⤵PID:1440
-
\??\c:\xxxrllf.exec:\xxxrllf.exe92⤵PID:2028
-
\??\c:\flllffx.exec:\flllffx.exe93⤵PID:2204
-
\??\c:\nhthtn.exec:\nhthtn.exe94⤵PID:2576
-
\??\c:\rxrxlll.exec:\rxrxlll.exe95⤵PID:1156
-
\??\c:\ttbbnn.exec:\ttbbnn.exe96⤵PID:2132
-
\??\c:\vvvjv.exec:\vvvjv.exe97⤵PID:2784
-
\??\c:\jdvdj.exec:\jdvdj.exe98⤵PID:3708
-
\??\c:\flrxrrr.exec:\flrxrrr.exe99⤵PID:4912
-
\??\c:\nnbnbb.exec:\nnbnbb.exe100⤵PID:464
-
\??\c:\9vvvj.exec:\9vvvj.exe101⤵PID:4540
-
\??\c:\bnbthh.exec:\bnbthh.exe102⤵PID:3284
-
\??\c:\vjppv.exec:\vjppv.exe103⤵PID:3672
-
\??\c:\jvvvd.exec:\jvvvd.exe104⤵PID:3556
-
\??\c:\xxrrrrl.exec:\xxrrrrl.exe105⤵PID:2284
-
\??\c:\nnhttn.exec:\nnhttn.exe106⤵PID:3088
-
\??\c:\7pvjd.exec:\7pvjd.exe107⤵PID:2612
-
\??\c:\1fxxlfr.exec:\1fxxlfr.exe108⤵PID:212
-
\??\c:\lrfxxff.exec:\lrfxxff.exe109⤵PID:2984
-
\??\c:\nhbttt.exec:\nhbttt.exe110⤵PID:4324
-
\??\c:\pjpdj.exec:\pjpdj.exe111⤵PID:4860
-
\??\c:\lfxxxfx.exec:\lfxxxfx.exe112⤵PID:3012
-
\??\c:\vdjpp.exec:\vdjpp.exe113⤵PID:1864
-
\??\c:\frlxfff.exec:\frlxfff.exe114⤵PID:3908
-
\??\c:\llfflfx.exec:\llfflfx.exe115⤵PID:4236
-
\??\c:\htttnt.exec:\htttnt.exe116⤵PID:4848
-
\??\c:\dvvjd.exec:\dvvjd.exe117⤵PID:220
-
\??\c:\jdddp.exec:\jdddp.exe118⤵PID:2376
-
\??\c:\lfrllll.exec:\lfrllll.exe119⤵PID:1148
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe120⤵PID:5016
-
\??\c:\nhbtbb.exec:\nhbtbb.exe121⤵PID:3596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-