Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 21:31
Behavioral task
behavioral1
Sample
4f25f946340232733eb2298291d7c54cf49f03dfb1a7eac0c301a3598e75a8cd.exe
Resource
win7-20240508-en
8 signatures
150 seconds
General
- Target 4f25f946340232733eb2298291d7c54cf49f03dfb1a7eac0c301a3598e75a8cd.exe
- Size 169KB
- Sample240519-1c7axaah43
- SHA256 4f25f946340232733eb2298291d7c54cf49f03dfb1a7eac0c301a3598e75a8cd
- MD5 3ab588166a815ef30a48ca2ee33723a2
- SHA1 a119eb6829d1880685d7607c16432da8e93c1c3e
- SHA512 fb184c941a7c2b2f1e31de44edad5c830499c5e03dd23c4e480018c8763bdd837a0e4ed7b39441fd845b0c6d165b145d00eaa24dddb6fa733925811fdf3ec781
- SSDEEP 1536:HvQBeOGtrYS3srx93UBWfwC6Ggnouy8CUYj7FK4O8A1o4XEc3YtxD8/Ai2S:HhOmTsF93UYfwC6GIoutX8Ki3c3YT8VZ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/392-4-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4968-13-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2308-14-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3956-21-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2192-32-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4660-39-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3228-33-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3988-50-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2120-57-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3116-68-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2196-70-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4572-76-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3764-86-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4608-88-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2240-93-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3284-103-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2284-112-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/5100-111-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4456-126-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4436-195-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4736-199-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1948-183-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/944-187-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4120-201-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4684-165-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4992-153-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1244-149-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3480-143-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1320-207-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1500-211-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3692-215-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2468-217-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2436-223-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4664-234-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4432-236-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3156-242-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3708-244-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3368-248-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2336-267-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2068-280-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4572-290-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1992-296-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3924-299-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4720-329-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4836-338-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1948-358-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1660-371-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3392-391-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1884-442-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3912-494-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1512-528-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1512-531-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/436-561-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2132-570-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4576-603-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3384-647-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2860-788-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4488-836-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1736-846-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2292-869-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1140-895-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2416-1041-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/392-0-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/392-4-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/files/0x0008000000022f51-5.dat UPX behavioral2/memory/4968-7-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/4968-13-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/2308-14-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/files/0x000a0000000233ea-11.dat UPX behavioral2/files/0x00070000000233f3-15.dat UPX behavioral2/memory/3956-21-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/files/0x00070000000233f4-23.dat UPX behavioral2/files/0x00070000000233f5-28.dat UPX behavioral2/memory/2192-32-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/files/0x00070000000233f6-35.dat UPX behavioral2/memory/4660-39-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/3228-33-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/files/0x00070000000233f7-42.dat UPX behavioral2/memory/3988-43-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/files/0x00070000000233f8-47.dat UPX behavioral2/memory/3988-50-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/2120-51-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/files/0x00070000000233f9-54.dat UPX behavioral2/memory/2120-57-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/files/0x00070000000233fa-60.dat UPX behavioral2/files/0x00070000000233fb-67.dat UPX behavioral2/memory/3116-68-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/2196-70-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/files/0x00070000000233fc-73.dat UPX behavioral2/memory/4572-76-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/files/0x00070000000233fd-78.dat UPX behavioral2/files/0x00070000000233fe-83.dat UPX behavioral2/memory/3764-86-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/4608-88-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/files/0x00070000000233ff-90.dat UPX behavioral2/memory/2240-93-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/files/0x0007000000023400-96.dat UPX behavioral2/files/0x0007000000023402-104.dat UPX behavioral2/memory/3284-103-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/5100-106-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/files/0x0007000000023403-108.dat UPX behavioral2/files/0x0007000000023404-115.dat UPX behavioral2/files/0x0007000000023405-120.dat UPX behavioral2/memory/2284-112-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/5100-111-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/4456-126-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/files/0x0007000000023406-132.dat UPX behavioral2/memory/3480-134-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/files/0x0007000000023408-145.dat UPX behavioral2/files/0x000700000002340b-162.dat UPX behavioral2/files/0x000700000002340c-168.dat UPX behavioral2/files/0x000700000002340e-178.dat UPX behavioral2/files/0x000700000002340f-185.dat UPX behavioral2/files/0x0007000000023410-190.dat UPX behavioral2/memory/4436-195-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/4736-199-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/1948-183-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/944-187-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/files/0x000700000002340d-173.dat UPX behavioral2/memory/4120-201-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/4684-165-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/files/0x000700000002340a-157.dat UPX behavioral2/memory/4992-153-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/files/0x0007000000023409-151.dat UPX behavioral2/memory/1244-149-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/3480-143-0x0000000000400000-0x0000000000446000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 4968 ffllfxx.exe 2308 nnthbn.exe 3956 hbtntt.exe 2192 htthbt.exe 3228 rlrllfx.exe 4660 flrlffx.exe 3988 ttnhbb.exe 2120 1xxrxrl.exe 892 dvvjp.exe 3116 lflfxrf.exe 2196 bbhttn.exe 4572 jjdvv.exe 3764 jjdvj.exe 4608 hhtnnh.exe 2240 9pvjd.exe 3284 vvjjp.exe 5100 pjddd.exe 2284 rxxxxrr.exe 4456 9xfffff.exe 3884 tbnnhh.exe 3108 vjpdp.exe 3480 jdpjv.exe 1244 ffxfxff.exe 4992 thtbbb.exe 3656 nttbbb.exe 4684 jjpvv.exe 1424 lfxrrrr.exe 3700 1xxfffl.exe 2932 hhbnnb.exe 1948 nnnnnn.exe 944 ppvjp.exe 4436 djvvp.exe 4736 bttttb.exe 4120 bntttb.exe 1320 9pvpp.exe 1500 rrllflx.exe 3692 tnnnnn.exe 2468 jppvd.exe 2436 dpvpp.exe 1700 1flrxlr.exe 1380 nhhhnh.exe 4664 dvjdv.exe 4432 ppjpv.exe 3156 rfxlfrr.exe 3708 7pppv.exe 3368 ppjjv.exe 428 lxlrrxx.exe 3524 hhnhhb.exe 1640 nnbthh.exe 4036 pjpvv.exe 2336 7rflfll.exe 1716 rrlxxff.exe 1884 bhhnnn.exe 4212 nbtbnt.exe 2068 djpjj.exe 4848 lxlrflx.exe 1736 ttbtnh.exe 4572 pjddv.exe 4300 xllrffl.exe 1992 xxffxff.exe 3924 bbnnnt.exe 2424 hhtbnb.exe 3728 vvjpp.exe 1412 jjvvd.exe -
resource yara_rule behavioral2/memory/392-0-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/392-4-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0008000000022f51-5.dat upx behavioral2/memory/4968-7-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4968-13-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2308-14-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x000a0000000233ea-11.dat upx behavioral2/files/0x00070000000233f3-15.dat upx behavioral2/memory/3956-21-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x00070000000233f4-23.dat upx behavioral2/files/0x00070000000233f5-28.dat upx behavioral2/memory/2192-32-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x00070000000233f6-35.dat upx behavioral2/memory/4660-39-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3228-33-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x00070000000233f7-42.dat upx behavioral2/memory/3988-43-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x00070000000233f8-47.dat upx behavioral2/memory/3988-50-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2120-51-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x00070000000233f9-54.dat upx behavioral2/memory/2120-57-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x00070000000233fa-60.dat upx behavioral2/files/0x00070000000233fb-67.dat upx behavioral2/memory/3116-68-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2196-70-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x00070000000233fc-73.dat upx behavioral2/memory/4572-76-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x00070000000233fd-78.dat upx behavioral2/files/0x00070000000233fe-83.dat upx behavioral2/memory/3764-86-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4608-88-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x00070000000233ff-90.dat upx behavioral2/memory/2240-93-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0007000000023400-96.dat upx behavioral2/files/0x0007000000023402-104.dat upx behavioral2/memory/3284-103-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/5100-106-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0007000000023403-108.dat upx behavioral2/files/0x0007000000023404-115.dat upx behavioral2/files/0x0007000000023405-120.dat upx behavioral2/memory/2284-112-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/5100-111-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4456-126-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0007000000023406-132.dat upx behavioral2/memory/3480-134-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0007000000023408-145.dat upx behavioral2/files/0x000700000002340b-162.dat upx behavioral2/files/0x000700000002340c-168.dat upx behavioral2/files/0x000700000002340e-178.dat upx behavioral2/files/0x000700000002340f-185.dat upx behavioral2/files/0x0007000000023410-190.dat upx behavioral2/memory/4436-195-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4736-199-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/1948-183-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/944-187-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x000700000002340d-173.dat upx behavioral2/memory/4120-201-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4684-165-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x000700000002340a-157.dat upx behavioral2/memory/4992-153-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/files/0x0007000000023409-151.dat upx behavioral2/memory/1244-149-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3480-143-0x0000000000400000-0x0000000000446000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 392 wrote to memory of 4968 392 4f25f946340232733eb2298291d7c54cf49f03dfb1a7eac0c301a3598e75a8cd.exe 83 PID 392 wrote to memory of 4968 392 4f25f946340232733eb2298291d7c54cf49f03dfb1a7eac0c301a3598e75a8cd.exe 83 PID 392 wrote to memory of 4968 392 4f25f946340232733eb2298291d7c54cf49f03dfb1a7eac0c301a3598e75a8cd.exe 83 PID 4968 wrote to memory of 2308 4968 ffllfxx.exe 84 PID 4968 wrote to memory of 2308 4968 ffllfxx.exe 84 PID 4968 wrote to memory of 2308 4968 ffllfxx.exe 84 PID 2308 wrote to memory of 3956 2308 nnthbn.exe 85 PID 2308 wrote to memory of 3956 2308 nnthbn.exe 85 PID 2308 wrote to memory of 3956 2308 nnthbn.exe 85 PID 3956 wrote to memory of 2192 3956 hbtntt.exe 86 PID 3956 wrote to memory of 2192 3956 hbtntt.exe 86 PID 3956 wrote to memory of 2192 3956 hbtntt.exe 86 PID 2192 wrote to memory of 3228 2192 htthbt.exe 87 PID 2192 wrote to memory of 3228 2192 htthbt.exe 87 PID 2192 wrote to memory of 3228 2192 htthbt.exe 87 PID 3228 wrote to memory of 4660 3228 rlrllfx.exe 88 PID 3228 wrote to memory of 4660 3228 rlrllfx.exe 88 PID 3228 wrote to memory of 4660 3228 rlrllfx.exe 88 PID 4660 wrote to memory of 3988 4660 flrlffx.exe 89 PID 4660 wrote to memory of 3988 4660 flrlffx.exe 89 PID 4660 wrote to memory of 3988 4660 flrlffx.exe 89 PID 3988 wrote to memory of 2120 3988 ttnhbb.exe 90 PID 3988 wrote to memory of 2120 3988 ttnhbb.exe 90 PID 3988 wrote to memory of 2120 3988 ttnhbb.exe 90 PID 2120 wrote to memory of 892 2120 1xxrxrl.exe 91 PID 2120 wrote to memory of 892 2120 1xxrxrl.exe 91 PID 2120 wrote to memory of 892 2120 1xxrxrl.exe 91 PID 892 wrote to memory of 3116 892 dvvjp.exe 92 PID 892 wrote to memory of 3116 892 dvvjp.exe 92 PID 892 wrote to memory of 3116 892 dvvjp.exe 92 PID 3116 wrote to memory of 2196 3116 lflfxrf.exe 93 PID 3116 wrote to memory of 2196 3116 lflfxrf.exe 93 PID 3116 wrote to memory of 2196 3116 lflfxrf.exe 93 PID 2196 wrote to memory of 4572 2196 bbhttn.exe 94 PID 2196 wrote to memory of 4572 2196 bbhttn.exe 94 PID 2196 wrote to memory of 4572 2196 bbhttn.exe 94 PID 4572 wrote to memory of 3764 4572 jjdvv.exe 95 PID 4572 wrote to memory of 3764 4572 jjdvv.exe 95 PID 4572 wrote to memory of 3764 4572 jjdvv.exe 95 PID 3764 wrote to memory of 4608 3764 jjdvj.exe 96 PID 3764 wrote to memory of 4608 3764 jjdvj.exe 96 PID 3764 wrote to memory of 4608 3764 jjdvj.exe 96 PID 4608 wrote to memory of 2240 4608 hhtnnh.exe 97 PID 4608 wrote to memory of 2240 4608 hhtnnh.exe 97 PID 4608 wrote to memory of 2240 4608 hhtnnh.exe 97 PID 2240 wrote to memory of 3284 2240 9pvjd.exe 98 PID 2240 wrote to memory of 3284 2240 9pvjd.exe 98 PID 2240 wrote to memory of 3284 2240 9pvjd.exe 98 PID 3284 wrote to memory of 5100 3284 vvjjp.exe 99 PID 3284 wrote to memory of 5100 3284 vvjjp.exe 99 PID 3284 wrote to memory of 5100 3284 vvjjp.exe 99 PID 5100 wrote to memory of 2284 5100 pjddd.exe 100 PID 5100 wrote to memory of 2284 5100 pjddd.exe 100 PID 5100 wrote to memory of 2284 5100 pjddd.exe 100 PID 2284 wrote to memory of 4456 2284 rxxxxrr.exe 101 PID 2284 wrote to memory of 4456 2284 rxxxxrr.exe 101 PID 2284 wrote to memory of 4456 2284 rxxxxrr.exe 101 PID 4456 wrote to memory of 3884 4456 9xfffff.exe 102 PID 4456 wrote to memory of 3884 4456 9xfffff.exe 102 PID 4456 wrote to memory of 3884 4456 9xfffff.exe 102 PID 3884 wrote to memory of 3108 3884 tbnnhh.exe 103 PID 3884 wrote to memory of 3108 3884 tbnnhh.exe 103 PID 3884 wrote to memory of 3108 3884 tbnnhh.exe 103 PID 3108 wrote to memory of 3480 3108 vjpdp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f25f946340232733eb2298291d7c54cf49f03dfb1a7eac0c301a3598e75a8cd.exe"C:\Users\Admin\AppData\Local\Temp\4f25f946340232733eb2298291d7c54cf49f03dfb1a7eac0c301a3598e75a8cd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\ffllfxx.exec:\ffllfxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\nnthbn.exec:\nnthbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\hbtntt.exec:\hbtntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\htthbt.exec:\htthbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\rlrllfx.exec:\rlrllfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\flrlffx.exec:\flrlffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\ttnhbb.exec:\ttnhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\1xxrxrl.exec:\1xxrxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\dvvjp.exec:\dvvjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\lflfxrf.exec:\lflfxrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\bbhttn.exec:\bbhttn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\jjdvv.exec:\jjdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\jjdvj.exec:\jjdvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\hhtnnh.exec:\hhtnnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\9pvjd.exec:\9pvjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\vvjjp.exec:\vvjjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\pjddd.exec:\pjddd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\rxxxxrr.exec:\rxxxxrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\9xfffff.exec:\9xfffff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\tbnnhh.exec:\tbnnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\vjpdp.exec:\vjpdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\jdpjv.exec:\jdpjv.exe23⤵
- Executes dropped EXE
PID:3480 -
\??\c:\ffxfxff.exec:\ffxfxff.exe24⤵
- Executes dropped EXE
PID:1244 -
\??\c:\thtbbb.exec:\thtbbb.exe25⤵
- Executes dropped EXE
PID:4992 -
\??\c:\nttbbb.exec:\nttbbb.exe26⤵
- Executes dropped EXE
PID:3656 -
\??\c:\jjpvv.exec:\jjpvv.exe27⤵
- Executes dropped EXE
PID:4684 -
\??\c:\lfxrrrr.exec:\lfxrrrr.exe28⤵
- Executes dropped EXE
PID:1424 -
\??\c:\1xxfffl.exec:\1xxfffl.exe29⤵
- Executes dropped EXE
PID:3700 -
\??\c:\hhbnnb.exec:\hhbnnb.exe30⤵
- Executes dropped EXE
PID:2932 -
\??\c:\nnnnnn.exec:\nnnnnn.exe31⤵
- Executes dropped EXE
PID:1948 -
\??\c:\ppvjp.exec:\ppvjp.exe32⤵
- Executes dropped EXE
PID:944 -
\??\c:\djvvp.exec:\djvvp.exe33⤵
- Executes dropped EXE
PID:4436 -
\??\c:\bttttb.exec:\bttttb.exe34⤵
- Executes dropped EXE
PID:4736 -
\??\c:\bntttb.exec:\bntttb.exe35⤵
- Executes dropped EXE
PID:4120 -
\??\c:\9pvpp.exec:\9pvpp.exe36⤵
- Executes dropped EXE
PID:1320 -
\??\c:\rrllflx.exec:\rrllflx.exe37⤵
- Executes dropped EXE
PID:1500 -
\??\c:\tnnnnn.exec:\tnnnnn.exe38⤵
- Executes dropped EXE
PID:3692 -
\??\c:\jppvd.exec:\jppvd.exe39⤵
- Executes dropped EXE
PID:2468 -
\??\c:\dpvpp.exec:\dpvpp.exe40⤵
- Executes dropped EXE
PID:2436 -
\??\c:\1flrxlr.exec:\1flrxlr.exe41⤵
- Executes dropped EXE
PID:1700 -
\??\c:\nhhhnh.exec:\nhhhnh.exe42⤵
- Executes dropped EXE
PID:1380 -
\??\c:\dvjdv.exec:\dvjdv.exe43⤵
- Executes dropped EXE
PID:4664 -
\??\c:\ppjpv.exec:\ppjpv.exe44⤵
- Executes dropped EXE
PID:4432 -
\??\c:\rfxlfrr.exec:\rfxlfrr.exe45⤵
- Executes dropped EXE
PID:3156 -
\??\c:\7pppv.exec:\7pppv.exe46⤵
- Executes dropped EXE
PID:3708 -
\??\c:\ppjjv.exec:\ppjjv.exe47⤵
- Executes dropped EXE
PID:3368 -
\??\c:\lxlrrxx.exec:\lxlrrxx.exe48⤵
- Executes dropped EXE
PID:428 -
\??\c:\hhnhhb.exec:\hhnhhb.exe49⤵
- Executes dropped EXE
PID:3524 -
\??\c:\nnbthh.exec:\nnbthh.exe50⤵
- Executes dropped EXE
PID:1640 -
\??\c:\pjpvv.exec:\pjpvv.exe51⤵
- Executes dropped EXE
PID:4036 -
\??\c:\7rflfll.exec:\7rflfll.exe52⤵
- Executes dropped EXE
PID:2336 -
\??\c:\rrlxxff.exec:\rrlxxff.exe53⤵
- Executes dropped EXE
PID:1716 -
\??\c:\bhhnnn.exec:\bhhnnn.exe54⤵
- Executes dropped EXE
PID:1884 -
\??\c:\nbtbnt.exec:\nbtbnt.exe55⤵
- Executes dropped EXE
PID:4212 -
\??\c:\djpjj.exec:\djpjj.exe56⤵
- Executes dropped EXE
PID:2068 -
\??\c:\lxlrflx.exec:\lxlrflx.exe57⤵
- Executes dropped EXE
PID:4848 -
\??\c:\ttbtnh.exec:\ttbtnh.exe58⤵
- Executes dropped EXE
PID:1736 -
\??\c:\pjddv.exec:\pjddv.exe59⤵
- Executes dropped EXE
PID:4572 -
\??\c:\xllrffl.exec:\xllrffl.exe60⤵
- Executes dropped EXE
PID:4300 -
\??\c:\xxffxff.exec:\xxffxff.exe61⤵
- Executes dropped EXE
PID:1992 -
\??\c:\bbnnnt.exec:\bbnnnt.exe62⤵
- Executes dropped EXE
PID:3924 -
\??\c:\hhtbnb.exec:\hhtbnb.exe63⤵
- Executes dropped EXE
PID:2424 -
\??\c:\vvjpp.exec:\vvjpp.exe64⤵
- Executes dropped EXE
PID:3728 -
\??\c:\jjvvd.exec:\jjvvd.exe65⤵
- Executes dropped EXE
PID:1412 -
\??\c:\lrfxrxx.exec:\lrfxrxx.exe66⤵PID:1808
-
\??\c:\bhhtbt.exec:\bhhtbt.exe67⤵PID:4348
-
\??\c:\hhnnbb.exec:\hhnnbb.exe68⤵PID:2148
-
\??\c:\vdddv.exec:\vdddv.exe69⤵PID:4916
-
\??\c:\vdpvp.exec:\vdpvp.exe70⤵PID:4936
-
\??\c:\fxfxlxf.exec:\fxfxlxf.exe71⤵PID:3344
-
\??\c:\hnbbtb.exec:\hnbbtb.exe72⤵PID:4720
-
\??\c:\jppjj.exec:\jppjj.exe73⤵PID:3180
-
\??\c:\fxrrrxx.exec:\fxrrrxx.exe74⤵PID:4836
-
\??\c:\rlffrrf.exec:\rlffrrf.exe75⤵PID:3656
-
\??\c:\bthhhn.exec:\bthhhn.exe76⤵PID:1732
-
\??\c:\tntttb.exec:\tntttb.exe77⤵PID:4676
-
\??\c:\ppdjj.exec:\ppdjj.exe78⤵PID:3644
-
\??\c:\1rrrlrx.exec:\1rrrlrx.exe79⤵PID:1196
-
\??\c:\ffxxllx.exec:\ffxxllx.exe80⤵PID:1948
-
\??\c:\nnbntt.exec:\nnbntt.exe81⤵PID:1072
-
\??\c:\5pddv.exec:\5pddv.exe82⤵PID:3532
-
\??\c:\vvddd.exec:\vvddd.exe83⤵PID:4016
-
\??\c:\rlffllr.exec:\rlffllr.exe84⤵PID:1660
-
\??\c:\pddjj.exec:\pddjj.exe85⤵PID:2860
-
\??\c:\pdjpp.exec:\pdjpp.exe86⤵PID:3588
-
\??\c:\llxxrrx.exec:\llxxrrx.exe87⤵PID:4496
-
\??\c:\hbhhhh.exec:\hbhhhh.exe88⤵PID:3328
-
\??\c:\httbbb.exec:\httbbb.exe89⤵PID:4372
-
\??\c:\jpppp.exec:\jpppp.exe90⤵PID:1156
-
\??\c:\rlrxxlr.exec:\rlrxxlr.exe91⤵PID:3392
-
\??\c:\lrffflf.exec:\lrffflf.exe92⤵PID:4020
-
\??\c:\nhhhhh.exec:\nhhhhh.exe93⤵PID:2960
-
\??\c:\pjppd.exec:\pjppd.exe94⤵PID:4424
-
\??\c:\flrlrrr.exec:\flrlrrr.exe95⤵PID:3600
-
\??\c:\hhnnhn.exec:\hhnnhn.exe96⤵PID:1204
-
\??\c:\9nnnbn.exec:\9nnnbn.exe97⤵PID:1112
-
\??\c:\ddvvj.exec:\ddvvj.exe98⤵PID:3368
-
\??\c:\lfrrlrr.exec:\lfrrlrr.exe99⤵PID:428
-
\??\c:\flrxxff.exec:\flrxxff.exe100⤵PID:3524
-
\??\c:\hbhhhn.exec:\hbhhhn.exe101⤵PID:3016
-
\??\c:\dpppj.exec:\dpppj.exe102⤵PID:2344
-
\??\c:\5pvvv.exec:\5pvvv.exe103⤵PID:2368
-
\??\c:\lfffxfx.exec:\lfffxfx.exe104⤵PID:2460
-
\??\c:\fflffll.exec:\fflffll.exe105⤵PID:4560
-
\??\c:\xrrllxx.exec:\xrrllxx.exe106⤵PID:1716
-
\??\c:\bhthtb.exec:\bhthtb.exe107⤵PID:1884
-
\??\c:\1pppp.exec:\1pppp.exe108⤵PID:2228
-
\??\c:\dvjjj.exec:\dvjjj.exe109⤵PID:2072
-
\??\c:\ffllrlx.exec:\ffllrlx.exe110⤵PID:2792
-
\??\c:\rfxlrxf.exec:\rfxlrxf.exe111⤵PID:4572
-
\??\c:\7hbhhn.exec:\7hbhhn.exe112⤵PID:3920
-
\??\c:\vpvdd.exec:\vpvdd.exe113⤵PID:2240
-
\??\c:\jpvdv.exec:\jpvdv.exe114⤵PID:3192
-
\??\c:\rrrrlrl.exec:\rrrrlrl.exe115⤵PID:3728
-
\??\c:\rlxxxff.exec:\rlxxxff.exe116⤵PID:1412
-
\??\c:\vjvvd.exec:\vjvvd.exe117⤵PID:560
-
\??\c:\rfxflll.exec:\rfxflll.exe118⤵PID:4412
-
\??\c:\lxlllll.exec:\lxlllll.exe119⤵PID:3884
-
\??\c:\hhnnnn.exec:\hhnnnn.exe120⤵PID:4936
-
\??\c:\1ttthn.exec:\1ttthn.exe121⤵PID:2692
-
\??\c:\jjpvd.exec:\jjpvd.exe122⤵PID:4224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-