Analysis
- max time kernel
150s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 01:56
Behavioral task
behavioral1
Sample
aeb42f1babbe7cd1d24ec02cd7ad9098ad4d356790182e5ddf4314b1f566cf7d.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target aeb42f1babbe7cd1d24ec02cd7ad9098ad4d356790182e5ddf4314b1f566cf7d.exe
- Size 313KB
- Sample240518-cc4b9aeh76
- SHA256 aeb42f1babbe7cd1d24ec02cd7ad9098ad4d356790182e5ddf4314b1f566cf7d
- MD5 aca366e4047c72f485aa398b50d1f7ca
- SHA1 ec3c7dfb442e8b3ba3d25ca66192f9312262b90d
- SHA512 294d4a07a267f67b023ab8c62cb2943b30f29fc4bb463f1a048f18264523b4d6a2aca5b55fd94b0b8bfda746aadc958dc8a4e640b864e3f659cfb03a26152f63
- SSDEEP 6144:/cm4FmowdHoSyZuo3F2Y9iE9MAkOCOu0EajNVBZr6y2Wfe:N4wFHoSMu49P9mie
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4544-5-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4552-13-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2428-14-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4036-22-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3740-32-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/892-44-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4844-48-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1744-54-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1876-35-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2352-69-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2480-74-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2524-80-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2780-87-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3892-67-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4504-97-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/824-98-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1268-112-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2952-117-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1984-129-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2652-145-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5068-159-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3620-168-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1904-178-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1808-180-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2284-185-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4628-192-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3444-197-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1988-204-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2728-210-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/960-212-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1556-224-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3460-231-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4864-235-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4404-239-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2924-246-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2780-269-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4064-273-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3624-276-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5064-283-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1844-287-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3116-295-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3992-301-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3160-314-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4928-318-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2392-337-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2132-341-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4908-360-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2428-368-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3480-382-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4472-381-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3340-402-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1312-421-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4968-428-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5064-429-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4772-458-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2548-476-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2720-516-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3104-522-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3104-526-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4800-548-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2104-568-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3428-706-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/716-717-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4620-764-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/4544-0-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x00090000000233ea-3.dat UPX behavioral2/memory/4544-5-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000a000000023419-10.dat UPX behavioral2/memory/4552-13-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002341d-12.dat UPX behavioral2/memory/2428-14-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4036-22-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002341f-24.dat UPX behavioral2/files/0x0007000000023420-27.dat UPX behavioral2/memory/3740-32-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023421-34.dat UPX behavioral2/files/0x0007000000023422-40.dat UPX behavioral2/memory/892-44-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023423-47.dat UPX behavioral2/memory/4844-48-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023424-53.dat UPX behavioral2/memory/1744-54-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4448-36-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/1876-35-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023425-59.dat UPX behavioral2/memory/3892-61-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023426-64.dat UPX behavioral2/memory/2352-69-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/2480-74-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023428-77.dat UPX behavioral2/memory/2524-80-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023427-72.dat UPX behavioral2/files/0x0007000000023429-83.dat UPX behavioral2/memory/2780-87-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002342a-89.dat UPX behavioral2/memory/3892-67-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002342c-95.dat UPX behavioral2/memory/4504-97-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002342d-101.dat UPX behavioral2/memory/824-98-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000800000002341a-106.dat UPX behavioral2/files/0x000700000002342e-111.dat UPX behavioral2/memory/1268-112-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002342f-116.dat UPX behavioral2/memory/2952-117-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023430-121.dat UPX behavioral2/files/0x0007000000023431-126.dat UPX behavioral2/memory/1984-129-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023432-132.dat UPX behavioral2/files/0x0007000000023433-138.dat UPX behavioral2/files/0x0007000000023434-143.dat UPX behavioral2/memory/2652-145-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023435-148.dat UPX behavioral2/files/0x0007000000023436-153.dat UPX behavioral2/files/0x0007000000023437-160.dat UPX behavioral2/memory/5068-159-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023438-165.dat UPX behavioral2/memory/3620-168-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023439-172.dat UPX behavioral2/files/0x000700000002343a-175.dat UPX behavioral2/memory/1904-178-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/1808-180-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002343b-182.dat UPX behavioral2/memory/2284-185-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4628-192-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/3444-197-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/1988-204-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/2728-210-0x0000000000400000-0x0000000000436000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 4552 bnnhht.exe 2428 vjpjd.exe 4036 xrfrfxf.exe 3740 9frrxxf.exe 1876 9vppj.exe 4448 pjjdv.exe 892 5fffxxr.exe 4844 nntnhn.exe 1744 hbnhtt.exe 3892 1ppjv.exe 2352 7ffxllx.exe 2480 btnhbt.exe 2524 bthbtt.exe 2780 vpppj.exe 4504 hhnnhh.exe 824 lxlxrlf.exe 1844 xrrfffr.exe 1268 9pvpj.exe 2952 nntbth.exe 4272 1djjd.exe 1984 ffllfxr.exe 2724 btnnhh.exe 2888 vvvpj.exe 4380 llrrllf.exe 2652 7djvp.exe 1704 lxffxxf.exe 5068 5nhhnn.exe 2268 dpvvp.exe 3620 llxlffx.exe 1904 rllfxxl.exe 1808 rxxrlfr.exe 2284 rflflll.exe 4628 9nbtbb.exe 4776 pvddp.exe 3444 xfrfxlf.exe 4140 tbhbnn.exe 1988 bnhnnn.exe 2728 jvpjd.exe 960 rrrlxxf.exe 4884 7fxrlfx.exe 3480 hnhbbh.exe 1556 tbhbbb.exe 4284 pjdvp.exe 3460 flxfflf.exe 4864 bnnhbb.exe 4404 vddvv.exe 1776 xlrllll.exe 2924 5hhbtt.exe 3212 1dpjp.exe 3892 1dpjd.exe 4904 hnttnh.exe 4412 djjpj.exe 3580 lfxxxxx.exe 4880 jddvp.exe 1156 1flllrx.exe 2780 rffxxrl.exe 4064 nhnntt.exe 3624 ppdpv.exe 3896 1xfxrfx.exe 5064 1tnntt.exe 1844 htbtnh.exe 2696 9dpjj.exe 3116 rxfxxxx.exe 1588 1hhbtt.exe -
resource yara_rule behavioral2/memory/4544-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00090000000233ea-3.dat upx behavioral2/memory/4544-5-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023419-10.dat upx behavioral2/memory/4552-13-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341d-12.dat upx behavioral2/memory/2428-14-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4036-22-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341f-24.dat upx behavioral2/files/0x0007000000023420-27.dat upx behavioral2/memory/3740-32-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023421-34.dat upx behavioral2/files/0x0007000000023422-40.dat upx behavioral2/memory/892-44-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023423-47.dat upx behavioral2/memory/4844-48-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023424-53.dat upx behavioral2/memory/1744-54-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4448-36-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1876-35-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023425-59.dat upx behavioral2/memory/3892-61-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023426-64.dat upx behavioral2/memory/2352-69-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2480-74-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023428-77.dat upx behavioral2/memory/2524-80-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023427-72.dat upx behavioral2/files/0x0007000000023429-83.dat upx behavioral2/memory/2780-87-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342a-89.dat upx behavioral2/memory/3892-67-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342c-95.dat upx behavioral2/memory/4504-97-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342d-101.dat upx behavioral2/memory/824-98-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000800000002341a-106.dat upx behavioral2/files/0x000700000002342e-111.dat upx behavioral2/memory/1268-112-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342f-116.dat upx behavioral2/memory/2952-117-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023430-121.dat upx behavioral2/files/0x0007000000023431-126.dat upx behavioral2/memory/1984-129-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023432-132.dat upx behavioral2/files/0x0007000000023433-138.dat upx behavioral2/files/0x0007000000023434-143.dat upx behavioral2/memory/2652-145-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023435-148.dat upx behavioral2/files/0x0007000000023436-153.dat upx behavioral2/files/0x0007000000023437-160.dat upx behavioral2/memory/5068-159-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023438-165.dat upx behavioral2/memory/3620-168-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023439-172.dat upx behavioral2/files/0x000700000002343a-175.dat upx behavioral2/memory/1904-178-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1808-180-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002343b-182.dat upx behavioral2/memory/2284-185-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4628-192-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3444-197-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1988-204-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2728-210-0x0000000000400000-0x0000000000436000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4544 wrote to memory of 4552 4544 aeb42f1babbe7cd1d24ec02cd7ad9098ad4d356790182e5ddf4314b1f566cf7d.exe 84 PID 4544 wrote to memory of 4552 4544 aeb42f1babbe7cd1d24ec02cd7ad9098ad4d356790182e5ddf4314b1f566cf7d.exe 84 PID 4544 wrote to memory of 4552 4544 aeb42f1babbe7cd1d24ec02cd7ad9098ad4d356790182e5ddf4314b1f566cf7d.exe 84 PID 4552 wrote to memory of 2428 4552 bnnhht.exe 85 PID 4552 wrote to memory of 2428 4552 bnnhht.exe 85 PID 4552 wrote to memory of 2428 4552 bnnhht.exe 85 PID 2428 wrote to memory of 4036 2428 vjpjd.exe 86 PID 2428 wrote to memory of 4036 2428 vjpjd.exe 86 PID 2428 wrote to memory of 4036 2428 vjpjd.exe 86 PID 4036 wrote to memory of 3740 4036 xrfrfxf.exe 87 PID 4036 wrote to memory of 3740 4036 xrfrfxf.exe 87 PID 4036 wrote to memory of 3740 4036 xrfrfxf.exe 87 PID 3740 wrote to memory of 1876 3740 9frrxxf.exe 88 PID 3740 wrote to memory of 1876 3740 9frrxxf.exe 88 PID 3740 wrote to memory of 1876 3740 9frrxxf.exe 88 PID 1876 wrote to memory of 4448 1876 9vppj.exe 89 PID 1876 wrote to memory of 4448 1876 9vppj.exe 89 PID 1876 wrote to memory of 4448 1876 9vppj.exe 89 PID 4448 wrote to memory of 892 4448 pjjdv.exe 90 PID 4448 wrote to memory of 892 4448 pjjdv.exe 90 PID 4448 wrote to memory of 892 4448 pjjdv.exe 90 PID 892 wrote to memory of 4844 892 5fffxxr.exe 91 PID 892 wrote to memory of 4844 892 5fffxxr.exe 91 PID 892 wrote to memory of 4844 892 5fffxxr.exe 91 PID 4844 wrote to memory of 1744 4844 nntnhn.exe 92 PID 4844 wrote to memory of 1744 4844 nntnhn.exe 92 PID 4844 wrote to memory of 1744 4844 nntnhn.exe 92 PID 1744 wrote to memory of 3892 1744 hbnhtt.exe 94 PID 1744 wrote to memory of 3892 1744 hbnhtt.exe 94 PID 1744 wrote to memory of 3892 1744 hbnhtt.exe 94 PID 3892 wrote to memory of 2352 3892 1ppjv.exe 96 PID 3892 wrote to memory of 2352 3892 1ppjv.exe 96 PID 3892 wrote to memory of 2352 3892 1ppjv.exe 96 PID 2352 wrote to memory of 2480 2352 7ffxllx.exe 97 PID 2352 wrote to memory of 2480 2352 7ffxllx.exe 97 PID 2352 wrote to memory of 2480 2352 7ffxllx.exe 97 PID 2480 wrote to memory of 2524 2480 btnhbt.exe 98 PID 2480 wrote to memory of 2524 2480 btnhbt.exe 98 PID 2480 wrote to memory of 2524 2480 btnhbt.exe 98 PID 2524 wrote to memory of 2780 2524 bthbtt.exe 99 PID 2524 wrote to memory of 2780 2524 bthbtt.exe 99 PID 2524 wrote to memory of 2780 2524 bthbtt.exe 99 PID 2780 wrote to memory of 4504 2780 vpppj.exe 100 PID 2780 wrote to memory of 4504 2780 vpppj.exe 100 PID 2780 wrote to memory of 4504 2780 vpppj.exe 100 PID 4504 wrote to memory of 824 4504 hhnnhh.exe 101 PID 4504 wrote to memory of 824 4504 hhnnhh.exe 101 PID 4504 wrote to memory of 824 4504 hhnnhh.exe 101 PID 824 wrote to memory of 1844 824 lxlxrlf.exe 102 PID 824 wrote to memory of 1844 824 lxlxrlf.exe 102 PID 824 wrote to memory of 1844 824 lxlxrlf.exe 102 PID 1844 wrote to memory of 1268 1844 xrrfffr.exe 103 PID 1844 wrote to memory of 1268 1844 xrrfffr.exe 103 PID 1844 wrote to memory of 1268 1844 xrrfffr.exe 103 PID 1268 wrote to memory of 2952 1268 9pvpj.exe 104 PID 1268 wrote to memory of 2952 1268 9pvpj.exe 104 PID 1268 wrote to memory of 2952 1268 9pvpj.exe 104 PID 2952 wrote to memory of 4272 2952 nntbth.exe 105 PID 2952 wrote to memory of 4272 2952 nntbth.exe 105 PID 2952 wrote to memory of 4272 2952 nntbth.exe 105 PID 4272 wrote to memory of 1984 4272 1djjd.exe 106 PID 4272 wrote to memory of 1984 4272 1djjd.exe 106 PID 4272 wrote to memory of 1984 4272 1djjd.exe 106 PID 1984 wrote to memory of 2724 1984 ffllfxr.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\aeb42f1babbe7cd1d24ec02cd7ad9098ad4d356790182e5ddf4314b1f566cf7d.exe"C:\Users\Admin\AppData\Local\Temp\aeb42f1babbe7cd1d24ec02cd7ad9098ad4d356790182e5ddf4314b1f566cf7d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\bnnhht.exec:\bnnhht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\vjpjd.exec:\vjpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\xrfrfxf.exec:\xrfrfxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\9frrxxf.exec:\9frrxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\9vppj.exec:\9vppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\pjjdv.exec:\pjjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\5fffxxr.exec:\5fffxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\nntnhn.exec:\nntnhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\hbnhtt.exec:\hbnhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\1ppjv.exec:\1ppjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\7ffxllx.exec:\7ffxllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\btnhbt.exec:\btnhbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\bthbtt.exec:\bthbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\vpppj.exec:\vpppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\hhnnhh.exec:\hhnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\lxlxrlf.exec:\lxlxrlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\xrrfffr.exec:\xrrfffr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\9pvpj.exec:\9pvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\nntbth.exec:\nntbth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\1djjd.exec:\1djjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\ffllfxr.exec:\ffllfxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\btnnhh.exec:\btnnhh.exe23⤵
- Executes dropped EXE
PID:2724 -
\??\c:\vvvpj.exec:\vvvpj.exe24⤵
- Executes dropped EXE
PID:2888 -
\??\c:\llrrllf.exec:\llrrllf.exe25⤵
- Executes dropped EXE
PID:4380 -
\??\c:\7djvp.exec:\7djvp.exe26⤵
- Executes dropped EXE
PID:2652 -
\??\c:\lxffxxf.exec:\lxffxxf.exe27⤵
- Executes dropped EXE
PID:1704 -
\??\c:\5nhhnn.exec:\5nhhnn.exe28⤵
- Executes dropped EXE
PID:5068 -
\??\c:\dpvvp.exec:\dpvvp.exe29⤵
- Executes dropped EXE
PID:2268 -
\??\c:\llxlffx.exec:\llxlffx.exe30⤵
- Executes dropped EXE
PID:3620 -
\??\c:\rllfxxl.exec:\rllfxxl.exe31⤵
- Executes dropped EXE
PID:1904 -
\??\c:\rxxrlfr.exec:\rxxrlfr.exe32⤵
- Executes dropped EXE
PID:1808 -
\??\c:\rflflll.exec:\rflflll.exe33⤵
- Executes dropped EXE
PID:2284 -
\??\c:\9nbtbb.exec:\9nbtbb.exe34⤵
- Executes dropped EXE
PID:4628 -
\??\c:\pvddp.exec:\pvddp.exe35⤵
- Executes dropped EXE
PID:4776 -
\??\c:\xfrfxlf.exec:\xfrfxlf.exe36⤵
- Executes dropped EXE
PID:3444 -
\??\c:\tbhbnn.exec:\tbhbnn.exe37⤵
- Executes dropped EXE
PID:4140 -
\??\c:\bnhnnn.exec:\bnhnnn.exe38⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jvpjd.exec:\jvpjd.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rrrlxxf.exec:\rrrlxxf.exe40⤵
- Executes dropped EXE
PID:960 -
\??\c:\7fxrlfx.exec:\7fxrlfx.exe41⤵
- Executes dropped EXE
PID:4884 -
\??\c:\hnhbbh.exec:\hnhbbh.exe42⤵
- Executes dropped EXE
PID:3480 -
\??\c:\tbhbbb.exec:\tbhbbb.exe43⤵
- Executes dropped EXE
PID:1556 -
\??\c:\pjdvp.exec:\pjdvp.exe44⤵
- Executes dropped EXE
PID:4284 -
\??\c:\flxfflf.exec:\flxfflf.exe45⤵
- Executes dropped EXE
PID:3460 -
\??\c:\bnnhbb.exec:\bnnhbb.exe46⤵
- Executes dropped EXE
PID:4864 -
\??\c:\vddvv.exec:\vddvv.exe47⤵
- Executes dropped EXE
PID:4404 -
\??\c:\xlrllll.exec:\xlrllll.exe48⤵
- Executes dropped EXE
PID:1776 -
\??\c:\5hhbtt.exec:\5hhbtt.exe49⤵
- Executes dropped EXE
PID:2924 -
\??\c:\1dpjp.exec:\1dpjp.exe50⤵
- Executes dropped EXE
PID:3212 -
\??\c:\1dpjd.exec:\1dpjd.exe51⤵
- Executes dropped EXE
PID:3892 -
\??\c:\hnttnh.exec:\hnttnh.exe52⤵
- Executes dropped EXE
PID:4904 -
\??\c:\djjpj.exec:\djjpj.exe53⤵
- Executes dropped EXE
PID:4412 -
\??\c:\lfxxxxx.exec:\lfxxxxx.exe54⤵
- Executes dropped EXE
PID:3580 -
\??\c:\jddvp.exec:\jddvp.exe55⤵
- Executes dropped EXE
PID:4880 -
\??\c:\1flllrx.exec:\1flllrx.exe56⤵
- Executes dropped EXE
PID:1156 -
\??\c:\rffxxrl.exec:\rffxxrl.exe57⤵
- Executes dropped EXE
PID:2780 -
\??\c:\nhnntt.exec:\nhnntt.exe58⤵
- Executes dropped EXE
PID:4064 -
\??\c:\ppdpv.exec:\ppdpv.exe59⤵
- Executes dropped EXE
PID:3624 -
\??\c:\1xfxrfx.exec:\1xfxrfx.exe60⤵
- Executes dropped EXE
PID:3896 -
\??\c:\1tnntt.exec:\1tnntt.exe61⤵
- Executes dropped EXE
PID:5064 -
\??\c:\htbtnh.exec:\htbtnh.exe62⤵
- Executes dropped EXE
PID:1844 -
\??\c:\9dpjj.exec:\9dpjj.exe63⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rxfxxxx.exec:\rxfxxxx.exe64⤵
- Executes dropped EXE
PID:3116 -
\??\c:\1hhbtt.exec:\1hhbtt.exe65⤵
- Executes dropped EXE
PID:1588 -
\??\c:\jdjjp.exec:\jdjjp.exe66⤵PID:3992
-
\??\c:\7pvpj.exec:\7pvpj.exe67⤵PID:1524
-
\??\c:\lxllrll.exec:\lxllrll.exe68⤵PID:1040
-
\??\c:\5nnhnh.exec:\5nnhnh.exe69⤵PID:3160
-
\??\c:\dvppj.exec:\dvppj.exe70⤵PID:4928
-
\??\c:\xxlxfff.exec:\xxlxfff.exe71⤵PID:2652
-
\??\c:\nhnhtt.exec:\nhnhtt.exe72⤵PID:1704
-
\??\c:\nbnnhh.exec:\nbnnhh.exe73⤵PID:4920
-
\??\c:\jdjjj.exec:\jdjjj.exe74⤵PID:4792
-
\??\c:\xfxxlll.exec:\xfxxlll.exe75⤵PID:412
-
\??\c:\tntnnn.exec:\tntnnn.exe76⤵PID:2392
-
\??\c:\vvdvp.exec:\vvdvp.exe77⤵PID:4692
-
\??\c:\xflfrrr.exec:\xflfrrr.exe78⤵PID:2132
-
\??\c:\tnnhbn.exec:\tnnhbn.exe79⤵PID:4180
-
\??\c:\tbbhbh.exec:\tbbhbh.exe80⤵PID:2180
-
\??\c:\pjpdd.exec:\pjpdd.exe81⤵PID:3744
-
\??\c:\5ffxrxr.exec:\5ffxrxr.exe82⤵PID:4444
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe83⤵PID:4908
-
\??\c:\htthhb.exec:\htthhb.exe84⤵PID:3444
-
\??\c:\5jdvp.exec:\5jdvp.exe85⤵PID:2428
-
\??\c:\llrfxxl.exec:\llrfxxl.exe86⤵PID:3616
-
\??\c:\xlrlffl.exec:\xlrlffl.exe87⤵PID:4652
-
\??\c:\bhnhbb.exec:\bhnhbb.exe88⤵PID:960
-
\??\c:\vvddj.exec:\vvddj.exe89⤵PID:4472
-
\??\c:\pvvvv.exec:\pvvvv.exe90⤵PID:3480
-
\??\c:\lflfffx.exec:\lflfffx.exe91⤵PID:4316
-
\??\c:\ttbtnn.exec:\ttbtnn.exe92⤵PID:5092
-
\??\c:\3vppj.exec:\3vppj.exe93⤵PID:3460
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe94⤵PID:2028
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe95⤵PID:1544
-
\??\c:\hntnhb.exec:\hntnhb.exe96⤵PID:3340
-
\??\c:\jpvdd.exec:\jpvdd.exe97⤵PID:2372
-
\??\c:\jjddv.exec:\jjddv.exe98⤵PID:4800
-
\??\c:\lxllfll.exec:\lxllfll.exe99⤵PID:3196
-
\??\c:\tnhbtn.exec:\tnhbtn.exe100⤵PID:2524
-
\??\c:\7ntnhh.exec:\7ntnhh.exe101⤵PID:1312
-
\??\c:\pdvvp.exec:\pdvvp.exe102⤵PID:2752
-
\??\c:\xffxrlf.exec:\xffxrlf.exe103⤵PID:4968
-
\??\c:\lrfxrrl.exec:\lrfxrrl.exe104⤵PID:5064
-
\??\c:\5hbbtt.exec:\5hbbtt.exe105⤵PID:2696
-
\??\c:\dvvpp.exec:\dvvpp.exe106⤵PID:3116
-
\??\c:\lrxxxxr.exec:\lrxxxxr.exe107⤵PID:3664
-
\??\c:\btbttn.exec:\btbttn.exe108⤵PID:1736
-
\??\c:\dvvpj.exec:\dvvpj.exe109⤵PID:4916
-
\??\c:\5xxlllr.exec:\5xxlllr.exe110⤵PID:3928
-
\??\c:\hthbbb.exec:\hthbbb.exe111⤵PID:1124
-
\??\c:\hnnhbt.exec:\hnnhbt.exe112⤵PID:4660
-
\??\c:\djvpj.exec:\djvpj.exe113⤵PID:4772
-
\??\c:\fxxxrlx.exec:\fxxxrlx.exe114⤵PID:3908
-
\??\c:\nhnnhh.exec:\nhnnhh.exe115⤵PID:3816
-
\??\c:\1tnnhn.exec:\1tnnhn.exe116⤵PID:4396
-
\??\c:\dpddd.exec:\dpddd.exe117⤵PID:2940
-
\??\c:\7flflll.exec:\7flflll.exe118⤵PID:2548
-
\??\c:\frffrfx.exec:\frffrfx.exe119⤵PID:4836
-
\??\c:\hhhhbb.exec:\hhhhbb.exe120⤵PID:4692
-
\??\c:\jdpjj.exec:\jdpjj.exe121⤵PID:2132
-
\??\c:\lxxrffx.exec:\lxxrffx.exe122⤵PID:1668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-