Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 18:08
Behavioral task
behavioral1
Sample
01fd4827dd8fb9cc9cdea1848033f371a3e8549f85dd441e4e36b696754c9b7c.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
-
Target
01fd4827dd8fb9cc9cdea1848033f371a3e8549f85dd441e4e36b696754c9b7c.exe
-
Size
380KB
-
MD5
1bc4f9b91f38b4f1fc4df56a642e20bc
-
SHA1
5fcfd44e20aec47e9af2d76aa7581ecf78bc0fd6
-
SHA256
01fd4827dd8fb9cc9cdea1848033f371a3e8549f85dd441e4e36b696754c9b7c
-
SHA512
517dc12fd94a3b1608ee145eeb475c4b3b5f30747ed01acaa1bb18aebc2105732253d1469b43aa941ae1395261dcd51dacc2757c4275599354d0c6d7ccc825d8
-
SSDEEP
6144:Ocm4FmowdHoSsm4FIc1/cm4FmowdHoSsiNlcJcmHYC9/jvvfwL+TLPfSRcm4FVoc:w4wFHoSl4h4wFHoS24yTgL+zfu4/FHok
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2948-7-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2844-29-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2980-41-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3528-59-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1196-71-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4284-209-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2232-217-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4964-225-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3588-233-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/772-241-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1892-283-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1612-288-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2616-298-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3164-300-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4228-294-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2072-280-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4428-275-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2296-271-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/448-267-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4028-263-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3168-256-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/5076-252-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3528-245-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2388-237-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/788-230-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1340-221-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/864-213-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4296-206-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4468-201-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4464-197-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3224-192-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/672-185-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3500-179-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1696-173-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1572-167-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1648-161-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4800-155-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/224-149-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1668-143-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1676-138-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4524-131-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4728-126-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/556-119-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4164-113-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2072-107-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4428-101-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2296-95-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/448-89-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3288-83-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4460-77-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1744-65-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/772-53-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2388-47-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3092-35-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2844-27-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3092-26-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3932-21-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2232-15-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1472-302-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3164-309-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4800-312-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2368-318-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1580-316-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1580-321-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/2948-7-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/files/0x0009000000023553-4.dat UPX behavioral2/files/0x000700000002355a-12.dat UPX behavioral2/files/0x000700000002355b-23.dat UPX behavioral2/memory/2844-29-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/files/0x000700000002355c-32.dat UPX behavioral2/files/0x000700000002355d-37.dat UPX behavioral2/memory/2980-41-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/files/0x000700000002355e-44.dat UPX behavioral2/files/0x000700000002355f-50.dat UPX behavioral2/files/0x0007000000023560-56.dat UPX behavioral2/memory/3528-59-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/1196-71-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/files/0x0007000000023564-80.dat UPX behavioral2/files/0x0007000000023565-86.dat UPX behavioral2/files/0x0007000000023566-92.dat UPX behavioral2/files/0x0007000000023567-98.dat UPX behavioral2/files/0x000700000002356d-134.dat UPX behavioral2/files/0x0007000000023570-152.dat UPX behavioral2/files/0x000700000002356c-188.dat UPX behavioral2/memory/4284-209-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/2232-217-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/4964-225-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/3588-233-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/772-241-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/1892-283-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/1612-288-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/2616-298-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/3164-300-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/4228-294-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/2072-280-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/4428-275-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/2296-271-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/448-267-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/4028-263-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/3168-256-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/5076-252-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/3528-245-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/2388-237-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/788-230-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/1340-221-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/864-213-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/4296-206-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/4468-201-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/4464-197-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/files/0x0007000000023575-194.dat UPX behavioral2/memory/3224-192-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/672-185-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/files/0x0007000000023565-182.dat UPX behavioral2/memory/3500-179-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/files/0x0007000000023574-176.dat UPX behavioral2/memory/1696-173-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/files/0x0007000000023573-170.dat UPX behavioral2/memory/1572-167-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/files/0x0007000000023572-164.dat UPX behavioral2/memory/1648-161-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/files/0x0007000000023571-158.dat UPX behavioral2/memory/4800-155-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/224-149-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/files/0x000700000002356f-146.dat UPX behavioral2/memory/1668-143-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/files/0x000700000002356e-140.dat UPX behavioral2/memory/1676-138-0x0000000000400000-0x0000000000472000-memory.dmp UPX behavioral2/memory/4524-131-0x0000000000400000-0x0000000000472000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2232 bhhbtb.exe 3932 nbhbtt.exe 2844 ppvpp.exe 3092 lxllffx.exe 2980 thhtht.exe 2388 5ddvp.exe 772 rfxrfrl.exe 3528 tnbnnh.exe 1744 dvddp.exe 1196 3ffffll.exe 4460 bhbtbb.exe 3288 pjpvp.exe 448 9xlfxrx.exe 2296 httnbb.exe 4428 dpdpp.exe 2072 rfrrlll.exe 4164 nthnhb.exe 556 dvpjj.exe 4728 xfxrlrl.exe 4524 nhnnbb.exe 1676 dpjjd.exe 1668 5rfxrlf.exe 224 7nnnht.exe 4800 5nnhhn.exe 1648 vvvjd.exe 1572 rxxlrff.exe 1696 bttnnt.exe 3500 ddvvp.exe 672 9frrxff.exe 3224 httnbb.exe 4464 dpjjd.exe 4468 rxlrlrl.exe 4296 tttnbh.exe 4284 bnbbbb.exe 864 ddpjv.exe 2232 fflrrrr.exe 1340 ttbhtb.exe 4964 bntnbt.exe 788 pjjvj.exe 3588 flrrllx.exe 2388 hnbhnn.exe 772 jvdjv.exe 3528 xfxfffx.exe 312 tbthtn.exe 5076 thbtnn.exe 3168 vddvp.exe 3956 rxflrxx.exe 4028 bnthtt.exe 448 pvdvd.exe 2296 lffllrr.exe 4428 tbbthh.exe 2072 jppjd.exe 1892 xffllxl.exe 1612 hnhhhn.exe 4700 ddvpd.exe 4228 jpdjd.exe 2616 xlxfllr.exe 1472 ttbhhb.exe 3164 vjvpp.exe 4800 vvppp.exe 2368 jpjpd.exe 1580 rxfrlfx.exe 4156 9nhbth.exe 4928 djjdv.exe -
resource yara_rule behavioral2/memory/2948-0-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2948-7-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2232-6-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0009000000023553-4.dat upx behavioral2/files/0x000700000002355a-12.dat upx behavioral2/files/0x000700000002355b-23.dat upx behavioral2/memory/2844-29-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x000700000002355c-32.dat upx behavioral2/files/0x000700000002355d-37.dat upx behavioral2/memory/2980-41-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x000700000002355e-44.dat upx behavioral2/files/0x000700000002355f-50.dat upx behavioral2/files/0x0007000000023560-56.dat upx behavioral2/memory/3528-59-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1196-71-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023564-80.dat upx behavioral2/files/0x0007000000023565-86.dat upx behavioral2/files/0x0007000000023566-92.dat upx behavioral2/files/0x0007000000023567-98.dat upx behavioral2/files/0x000700000002356d-134.dat upx behavioral2/files/0x0007000000023570-152.dat upx behavioral2/files/0x000700000002356c-188.dat upx behavioral2/memory/4284-209-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2232-217-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4964-225-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3588-233-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/772-241-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1892-283-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1612-288-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2616-298-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3164-300-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4228-294-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2072-280-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4428-275-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2296-271-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/448-267-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4028-263-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3168-256-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/5076-252-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3528-245-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2388-237-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/788-230-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1340-221-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/864-213-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4296-206-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4468-201-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4464-197-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023575-194.dat upx behavioral2/memory/3224-192-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/672-185-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023565-182.dat upx behavioral2/memory/3500-179-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023574-176.dat upx behavioral2/memory/1696-173-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023573-170.dat upx behavioral2/memory/1572-167-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023572-164.dat upx behavioral2/memory/1648-161-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023571-158.dat upx behavioral2/memory/4800-155-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/224-149-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x000700000002356f-146.dat upx behavioral2/memory/1668-143-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x000700000002356e-140.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2948 wrote to memory of 2232 2948 01fd4827dd8fb9cc9cdea1848033f371a3e8549f85dd441e4e36b696754c9b7c.exe 125 PID 2948 wrote to memory of 2232 2948 01fd4827dd8fb9cc9cdea1848033f371a3e8549f85dd441e4e36b696754c9b7c.exe 125 PID 2948 wrote to memory of 2232 2948 01fd4827dd8fb9cc9cdea1848033f371a3e8549f85dd441e4e36b696754c9b7c.exe 125 PID 2232 wrote to memory of 3932 2232 bhhbtb.exe 91 PID 2232 wrote to memory of 3932 2232 bhhbtb.exe 91 PID 2232 wrote to memory of 3932 2232 bhhbtb.exe 91 PID 3932 wrote to memory of 2844 3932 nbhbtt.exe 92 PID 3932 wrote to memory of 2844 3932 nbhbtt.exe 92 PID 3932 wrote to memory of 2844 3932 nbhbtt.exe 92 PID 2844 wrote to memory of 3092 2844 ppvpp.exe 93 PID 2844 wrote to memory of 3092 2844 ppvpp.exe 93 PID 2844 wrote to memory of 3092 2844 ppvpp.exe 93 PID 3092 wrote to memory of 2980 3092 lxllffx.exe 94 PID 3092 wrote to memory of 2980 3092 lxllffx.exe 94 PID 3092 wrote to memory of 2980 3092 lxllffx.exe 94 PID 2980 wrote to memory of 2388 2980 thhtht.exe 95 PID 2980 wrote to memory of 2388 2980 thhtht.exe 95 PID 2980 wrote to memory of 2388 2980 thhtht.exe 95 PID 2388 wrote to memory of 772 2388 5ddvp.exe 96 PID 2388 wrote to memory of 772 2388 5ddvp.exe 96 PID 2388 wrote to memory of 772 2388 5ddvp.exe 96 PID 772 wrote to memory of 3528 772 rfxrfrl.exe 97 PID 772 wrote to memory of 3528 772 rfxrfrl.exe 97 PID 772 wrote to memory of 3528 772 rfxrfrl.exe 97 PID 3528 wrote to memory of 1744 3528 tnbnnh.exe 98 PID 3528 wrote to memory of 1744 3528 tnbnnh.exe 98 PID 3528 wrote to memory of 1744 3528 tnbnnh.exe 98 PID 1744 wrote to memory of 1196 1744 dvddp.exe 99 PID 1744 wrote to memory of 1196 1744 dvddp.exe 99 PID 1744 wrote to memory of 1196 1744 dvddp.exe 99 PID 1196 wrote to memory of 4460 1196 3ffffll.exe 100 PID 1196 wrote to memory of 4460 1196 3ffffll.exe 100 PID 1196 wrote to memory of 4460 1196 3ffffll.exe 100 PID 4460 wrote to memory of 3288 4460 bhbtbb.exe 101 PID 4460 wrote to memory of 3288 4460 bhbtbb.exe 101 PID 4460 wrote to memory of 3288 4460 bhbtbb.exe 101 PID 3288 wrote to memory of 448 3288 pjpvp.exe 102 PID 3288 wrote to memory of 448 3288 pjpvp.exe 102 PID 3288 wrote to memory of 448 3288 pjpvp.exe 102 PID 448 wrote to memory of 2296 448 9xlfxrx.exe 139 PID 448 wrote to memory of 2296 448 9xlfxrx.exe 139 PID 448 wrote to memory of 2296 448 9xlfxrx.exe 139 PID 2296 wrote to memory of 4428 2296 httnbb.exe 104 PID 2296 wrote to memory of 4428 2296 httnbb.exe 104 PID 2296 wrote to memory of 4428 2296 httnbb.exe 104 PID 4428 wrote to memory of 2072 4428 dpdpp.exe 105 PID 4428 wrote to memory of 2072 4428 dpdpp.exe 105 PID 4428 wrote to memory of 2072 4428 dpdpp.exe 105 PID 2072 wrote to memory of 4164 2072 rfrrlll.exe 106 PID 2072 wrote to memory of 4164 2072 rfrrlll.exe 106 PID 2072 wrote to memory of 4164 2072 rfrrlll.exe 106 PID 4164 wrote to memory of 556 4164 nthnhb.exe 107 PID 4164 wrote to memory of 556 4164 nthnhb.exe 107 PID 4164 wrote to memory of 556 4164 nthnhb.exe 107 PID 556 wrote to memory of 4728 556 dvpjj.exe 176 PID 556 wrote to memory of 4728 556 dvpjj.exe 176 PID 556 wrote to memory of 4728 556 dvpjj.exe 176 PID 4728 wrote to memory of 4524 4728 xfxrlrl.exe 109 PID 4728 wrote to memory of 4524 4728 xfxrlrl.exe 109 PID 4728 wrote to memory of 4524 4728 xfxrlrl.exe 109 PID 4524 wrote to memory of 1676 4524 nhnnbb.exe 110 PID 4524 wrote to memory of 1676 4524 nhnnbb.exe 110 PID 4524 wrote to memory of 1676 4524 nhnnbb.exe 110 PID 1676 wrote to memory of 1668 1676 dpjjd.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\01fd4827dd8fb9cc9cdea1848033f371a3e8549f85dd441e4e36b696754c9b7c.exe"C:\Users\Admin\AppData\Local\Temp\01fd4827dd8fb9cc9cdea1848033f371a3e8549f85dd441e4e36b696754c9b7c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\bhhbtb.exec:\bhhbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\nbhbtt.exec:\nbhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\ppvpp.exec:\ppvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\lxllffx.exec:\lxllffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\thhtht.exec:\thhtht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\5ddvp.exec:\5ddvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\rfxrfrl.exec:\rfxrfrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\tnbnnh.exec:\tnbnnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\dvddp.exec:\dvddp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\3ffffll.exec:\3ffffll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\bhbtbb.exec:\bhbtbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\pjpvp.exec:\pjpvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\9xlfxrx.exec:\9xlfxrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\httnbb.exec:\httnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\dpdpp.exec:\dpdpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\rfrrlll.exec:\rfrrlll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\nthnhb.exec:\nthnhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\dvpjj.exec:\dvpjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\xfxrlrl.exec:\xfxrlrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\nhnnbb.exec:\nhnnbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\dpjjd.exec:\dpjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\5rfxrlf.exec:\5rfxrlf.exe23⤵
- Executes dropped EXE
PID:1668 -
\??\c:\7nnnht.exec:\7nnnht.exe24⤵
- Executes dropped EXE
PID:224 -
\??\c:\5nnhhn.exec:\5nnhhn.exe25⤵
- Executes dropped EXE
PID:4800 -
\??\c:\vvvjd.exec:\vvvjd.exe26⤵
- Executes dropped EXE
PID:1648 -
\??\c:\rxxlrff.exec:\rxxlrff.exe27⤵
- Executes dropped EXE
PID:1572 -
\??\c:\bttnnt.exec:\bttnnt.exe28⤵
- Executes dropped EXE
PID:1696 -
\??\c:\ddvvp.exec:\ddvvp.exe29⤵
- Executes dropped EXE
PID:3500 -
\??\c:\9frrxff.exec:\9frrxff.exe30⤵
- Executes dropped EXE
PID:672 -
\??\c:\httnbb.exec:\httnbb.exe31⤵
- Executes dropped EXE
PID:3224 -
\??\c:\dpjjd.exec:\dpjjd.exe32⤵
- Executes dropped EXE
PID:4464 -
\??\c:\rxlrlrl.exec:\rxlrlrl.exe33⤵
- Executes dropped EXE
PID:4468 -
\??\c:\tttnbh.exec:\tttnbh.exe34⤵
- Executes dropped EXE
PID:4296 -
\??\c:\bnbbbb.exec:\bnbbbb.exe35⤵
- Executes dropped EXE
PID:4284 -
\??\c:\ddpjv.exec:\ddpjv.exe36⤵
- Executes dropped EXE
PID:864 -
\??\c:\fflrrrr.exec:\fflrrrr.exe37⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ttbhtb.exec:\ttbhtb.exe38⤵
- Executes dropped EXE
PID:1340 -
\??\c:\bntnbt.exec:\bntnbt.exe39⤵
- Executes dropped EXE
PID:4964 -
\??\c:\pjjvj.exec:\pjjvj.exe40⤵
- Executes dropped EXE
PID:788 -
\??\c:\flrrllx.exec:\flrrllx.exe41⤵
- Executes dropped EXE
PID:3588 -
\??\c:\hnbhnn.exec:\hnbhnn.exe42⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jvdjv.exec:\jvdjv.exe43⤵
- Executes dropped EXE
PID:772 -
\??\c:\xfxfffx.exec:\xfxfffx.exe44⤵
- Executes dropped EXE
PID:3528 -
\??\c:\tbthtn.exec:\tbthtn.exe45⤵
- Executes dropped EXE
PID:312 -
\??\c:\thbtnn.exec:\thbtnn.exe46⤵
- Executes dropped EXE
PID:5076 -
\??\c:\vddvp.exec:\vddvp.exe47⤵
- Executes dropped EXE
PID:3168 -
\??\c:\rxflrxx.exec:\rxflrxx.exe48⤵
- Executes dropped EXE
PID:3956 -
\??\c:\bnthtt.exec:\bnthtt.exe49⤵
- Executes dropped EXE
PID:4028 -
\??\c:\pvdvd.exec:\pvdvd.exe50⤵
- Executes dropped EXE
PID:448 -
\??\c:\lffllrr.exec:\lffllrr.exe51⤵
- Executes dropped EXE
PID:2296 -
\??\c:\tbbthh.exec:\tbbthh.exe52⤵
- Executes dropped EXE
PID:4428 -
\??\c:\jppjd.exec:\jppjd.exe53⤵
- Executes dropped EXE
PID:2072 -
\??\c:\xffllxl.exec:\xffllxl.exe54⤵
- Executes dropped EXE
PID:1892 -
\??\c:\hnhhhn.exec:\hnhhhn.exe55⤵
- Executes dropped EXE
PID:1612 -
\??\c:\ddvpd.exec:\ddvpd.exe56⤵
- Executes dropped EXE
PID:4700 -
\??\c:\jpdjd.exec:\jpdjd.exe57⤵
- Executes dropped EXE
PID:4228 -
\??\c:\xlxfllr.exec:\xlxfllr.exe58⤵
- Executes dropped EXE
PID:2616 -
\??\c:\ttbhhb.exec:\ttbhhb.exe59⤵
- Executes dropped EXE
PID:1472 -
\??\c:\vjvpp.exec:\vjvpp.exe60⤵
- Executes dropped EXE
PID:3164 -
\??\c:\vvppp.exec:\vvppp.exe61⤵
- Executes dropped EXE
PID:4800 -
\??\c:\jpjpd.exec:\jpjpd.exe62⤵
- Executes dropped EXE
PID:2368 -
\??\c:\rxfrlfx.exec:\rxfrlfx.exe63⤵
- Executes dropped EXE
PID:1580 -
\??\c:\9nhbth.exec:\9nhbth.exe64⤵
- Executes dropped EXE
PID:4156 -
\??\c:\djjdv.exec:\djjdv.exe65⤵
- Executes dropped EXE
PID:4928 -
\??\c:\xxxrxxx.exec:\xxxrxxx.exe66⤵PID:3224
-
\??\c:\bnhhhh.exec:\bnhhhh.exe67⤵PID:1976
-
\??\c:\thnhbb.exec:\thnhbb.exe68⤵PID:4284
-
\??\c:\nhtnbh.exec:\nhtnbh.exe69⤵PID:3932
-
\??\c:\vdpvj.exec:\vdpvj.exe70⤵PID:2196
-
\??\c:\vjvdp.exec:\vjvdp.exe71⤵PID:1832
-
\??\c:\xrlxfrl.exec:\xrlxfrl.exe72⤵PID:4448
-
\??\c:\tbbbnn.exec:\tbbbnn.exe73⤵PID:4416
-
\??\c:\rfrrrrr.exec:\rfrrrrr.exe74⤵PID:1448
-
\??\c:\hntnht.exec:\hntnht.exe75⤵PID:880
-
\??\c:\vpvdp.exec:\vpvdp.exe76⤵PID:3548
-
\??\c:\xrlfffl.exec:\xrlfffl.exe77⤵PID:4556
-
\??\c:\5ppdd.exec:\5ppdd.exe78⤵PID:4220
-
\??\c:\llrllfx.exec:\llrllfx.exe79⤵PID:1320
-
\??\c:\bhtbht.exec:\bhtbht.exe80⤵PID:4900
-
\??\c:\llrllrf.exec:\llrllrf.exe81⤵PID:4036
-
\??\c:\bnhnnn.exec:\bnhnnn.exe82⤵PID:3184
-
\??\c:\pjvjv.exec:\pjvjv.exe83⤵PID:4952
-
\??\c:\1lxrllx.exec:\1lxrllx.exe84⤵PID:4532
-
\??\c:\bbtnnh.exec:\bbtnnh.exe85⤵PID:2160
-
\??\c:\jjjpp.exec:\jjjpp.exe86⤵PID:4728
-
\??\c:\rrflfxr.exec:\rrflfxr.exe87⤵PID:1000
-
\??\c:\fllrlfr.exec:\fllrlfr.exe88⤵PID:3872
-
\??\c:\bhtttb.exec:\bhtttb.exe89⤵PID:3668
-
\??\c:\dpvvv.exec:\dpvvv.exe90⤵PID:1472
-
\??\c:\djvvj.exec:\djvvj.exe91⤵PID:1240
-
\??\c:\lllrrxx.exec:\lllrrxx.exe92⤵PID:1088
-
\??\c:\nnhbbt.exec:\nnhbbt.exe93⤵PID:1572
-
\??\c:\tnnntn.exec:\tnnntn.exe94⤵PID:1580
-
\??\c:\pvdvv.exec:\pvdvv.exe95⤵PID:2592
-
\??\c:\frlrrrr.exec:\frlrrrr.exe96⤵PID:3452
-
\??\c:\hbhbhh.exec:\hbhbhh.exe97⤵PID:4300
-
\??\c:\vddpv.exec:\vddpv.exe98⤵PID:4424
-
\??\c:\bhthhn.exec:\bhthhn.exe99⤵PID:4312
-
\??\c:\9vvpp.exec:\9vvpp.exe100⤵PID:3932
-
\??\c:\5jpjd.exec:\5jpjd.exe101⤵PID:1152
-
\??\c:\llxrrxl.exec:\llxrrxl.exe102⤵PID:3712
-
\??\c:\nttthb.exec:\nttthb.exe103⤵PID:2128
-
\??\c:\xxffxxx.exec:\xxffxxx.exe104⤵PID:3896
-
\??\c:\hhthtn.exec:\hhthtn.exe105⤵PID:1744
-
\??\c:\jdpjd.exec:\jdpjd.exe106⤵PID:3472
-
\??\c:\rfxrlll.exec:\rfxrlll.exe107⤵PID:3708
-
\??\c:\hbntbh.exec:\hbntbh.exe108⤵PID:2960
-
\??\c:\jjpvv.exec:\jjpvv.exe109⤵PID:4236
-
\??\c:\hbtbht.exec:\hbtbht.exe110⤵PID:3616
-
\??\c:\ddvjd.exec:\ddvjd.exe111⤵PID:4036
-
\??\c:\llxrrxr.exec:\llxrrxr.exe112⤵PID:4420
-
\??\c:\nbbtbn.exec:\nbbtbn.exe113⤵PID:2236
-
\??\c:\dvjpp.exec:\dvjpp.exe114⤵PID:4532
-
\??\c:\lxflfrx.exec:\lxflfrx.exe115⤵PID:3508
-
\??\c:\hbtbtt.exec:\hbtbtt.exe116⤵PID:4728
-
\??\c:\vpvjj.exec:\vpvjj.exe117⤵PID:5088
-
\??\c:\rrfxxxx.exec:\rrfxxxx.exe118⤵PID:3668
-
\??\c:\hbtbtn.exec:\hbtbtn.exe119⤵PID:4736
-
\??\c:\bhhbht.exec:\bhhbht.exe120⤵PID:1252
-
\??\c:\jjpjp.exec:\jjpjp.exe121⤵PID:1080
-
\??\c:\1lrxxrr.exec:\1lrxxrr.exe122⤵PID:4156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-