Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 22:52
Behavioral task
behavioral1
Sample
6a74c9abd6b4b7f9a7e5b80238d407bf0295c91276c81e84618ae87e45aad9db.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
- Target 6a74c9abd6b4b7f9a7e5b80238d407bf0295c91276c81e84618ae87e45aad9db.exe
- Size 367KB
- Sample240519-2tcnasfd35
- SHA256 6a74c9abd6b4b7f9a7e5b80238d407bf0295c91276c81e84618ae87e45aad9db
- MD5 c8f4593e498d80a1c336797511278cc1
- SHA1 a83ccec6b1a60d31280e2104ac8e9380c542cf8b
- SHA512 a932c704735e9006a7c07c41477dc36c9d7b122c426f2849f80c8f4cd9932e59374df614071b6aee0125031ad6a83b4fe747e134f42addbc30705d2c34fd91c1
- SSDEEP 6144:kcm4FmowdHoSphraHcpOFltH4tiAlSpgFZAzwdjcIlSpgFZZr3GSM/xY:y4wFHoS3eFplAlSpgFZAKjcIlSpgFZZ5
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/348-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2388-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2224-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3904-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1364-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/468-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1592-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/560-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2944-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2032-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2704-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3028-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1028-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4012-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4488-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2096-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/836-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3840-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1224-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1680-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2320-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2084-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3844-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4312-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4188-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2944-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4448-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4452-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3300-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/748-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3676-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3736-455-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-464-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-501-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1712-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-527-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5088-539-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-546-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-559-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-574-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2944-581-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/348-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/348-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0008000000022f51-5.dat UPX behavioral2/memory/2388-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a0000000233f2-10.dat UPX behavioral2/memory/2224-15-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233fb-16.dat UPX behavioral2/memory/4376-25-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1528-31-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233fd-29.dat UPX behavioral2/files/0x00070000000233fc-23.dat UPX behavioral2/memory/3904-20-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ff-34.dat UPX behavioral2/memory/1528-36-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2792-38-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023400-43.dat UPX behavioral2/files/0x0007000000023401-46.dat UPX behavioral2/files/0x0007000000023402-51.dat UPX behavioral2/memory/3628-52-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023403-56.dat UPX behavioral2/memory/3892-58-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023404-62.dat UPX behavioral2/files/0x0007000000023405-71.dat UPX behavioral2/memory/1364-72-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3552-70-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4564-67-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023406-75.dat UPX behavioral2/memory/1364-78-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023407-81.dat UPX behavioral2/memory/2400-83-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a0000000233f3-87.dat UPX behavioral2/memory/4832-89-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/468-95-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023408-93.dat UPX behavioral2/files/0x0007000000023409-99.dat UPX behavioral2/files/0x000700000002340a-104.dat UPX behavioral2/memory/1592-110-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002340c-112.dat UPX behavioral2/memory/3652-109-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/560-117-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002340d-118.dat UPX behavioral2/files/0x000700000002340e-123.dat UPX behavioral2/memory/5064-125-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002340f-130.dat UPX behavioral2/memory/2944-128-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023410-134.dat UPX behavioral2/files/0x0007000000023411-140.dat UPX behavioral2/memory/4872-139-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2032-143-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023412-146.dat UPX behavioral2/memory/872-151-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023413-153.dat UPX behavioral2/memory/2032-150-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023414-158.dat UPX behavioral2/memory/4180-160-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2704-163-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023415-165.dat UPX behavioral2/files/0x0007000000023416-172.dat UPX behavioral2/memory/3028-171-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1028-174-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023417-178.dat UPX behavioral2/files/0x0007000000023418-182.dat UPX behavioral2/files/0x0007000000023419-187.dat UPX behavioral2/memory/4012-196-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 2388 7djvv.exe 2224 lfrllll.exe 3904 nnhttb.exe 4376 vjppj.exe 1528 fffxffr.exe 2792 dvpdd.exe 3608 nhttbn.exe 3628 rrlxfff.exe 3892 bbnhhh.exe 4564 rrxlffx.exe 3552 5nhnhn.exe 1364 pjpdj.exe 2400 7rrlffx.exe 4832 jjppj.exe 468 ttnhtn.exe 4304 7rlflrr.exe 1592 ppjvj.exe 3652 xlfllrx.exe 560 hhhhhh.exe 2944 xlrlffx.exe 5064 1hbnhn.exe 1648 9bbttt.exe 4872 rflfxxr.exe 2032 vvjjj.exe 872 pjvpv.exe 4180 fxxxfxx.exe 2704 frxfxll.exe 3028 fflrfll.exe 1028 pdvvd.exe 3504 nhhntt.exe 2864 jpdvj.exe 1596 vdpdv.exe 4012 bhnttb.exe 920 vdjpv.exe 2296 xffrfrl.exe 2656 pjpjd.exe 1316 jdjpv.exe 2096 lrxxffl.exe 2472 bntnnh.exe 836 bnnhnb.exe 444 vvpjp.exe 3840 lxrlflf.exe 1224 fxrllff.exe 5112 nhbbhb.exe 4948 djvvp.exe 1680 lrxxxxf.exe 1432 bbtnnb.exe 4148 vppjd.exe 968 dpjdp.exe 3220 xxrlfxr.exe 3196 pvjvj.exe 2320 lxrlfxr.exe 4960 hhttnt.exe 2084 djpjd.exe 3844 xfxxrrr.exe 4312 bbtnhb.exe 4896 3pvpp.exe 3612 1ffrlff.exe 4660 tnbbnt.exe 1480 9dvjv.exe 1592 ttthhb.exe 3652 9nhbtt.exe 4188 jvdvv.exe 1704 1llffff.exe -
resource yara_rule behavioral2/memory/348-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/348-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022f51-5.dat upx behavioral2/memory/2388-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a0000000233f2-10.dat upx behavioral2/memory/2224-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fb-16.dat upx behavioral2/memory/4376-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1528-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fd-29.dat upx behavioral2/files/0x00070000000233fc-23.dat upx behavioral2/memory/3904-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ff-34.dat upx behavioral2/memory/1528-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2792-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023400-43.dat upx behavioral2/files/0x0007000000023401-46.dat upx behavioral2/files/0x0007000000023402-51.dat upx behavioral2/memory/3628-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023403-56.dat upx behavioral2/memory/3892-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023404-62.dat upx behavioral2/files/0x0007000000023405-71.dat upx behavioral2/memory/1364-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3552-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4564-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023406-75.dat upx behavioral2/memory/1364-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023407-81.dat upx behavioral2/memory/2400-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a0000000233f3-87.dat upx behavioral2/memory/4832-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/468-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023408-93.dat upx behavioral2/files/0x0007000000023409-99.dat upx behavioral2/files/0x000700000002340a-104.dat upx behavioral2/memory/1592-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340c-112.dat upx behavioral2/memory/3652-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/560-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340d-118.dat upx behavioral2/files/0x000700000002340e-123.dat upx behavioral2/memory/5064-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340f-130.dat upx behavioral2/memory/2944-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023410-134.dat upx behavioral2/files/0x0007000000023411-140.dat upx behavioral2/memory/4872-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2032-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023412-146.dat upx behavioral2/memory/872-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023413-153.dat upx behavioral2/memory/2032-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023414-158.dat upx behavioral2/memory/4180-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2704-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023415-165.dat upx behavioral2/files/0x0007000000023416-172.dat upx behavioral2/memory/3028-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1028-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023417-178.dat upx behavioral2/files/0x0007000000023418-182.dat upx behavioral2/files/0x0007000000023419-187.dat upx behavioral2/memory/4012-196-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 348 wrote to memory of 2388 348 6a74c9abd6b4b7f9a7e5b80238d407bf0295c91276c81e84618ae87e45aad9db.exe 84 PID 348 wrote to memory of 2388 348 6a74c9abd6b4b7f9a7e5b80238d407bf0295c91276c81e84618ae87e45aad9db.exe 84 PID 348 wrote to memory of 2388 348 6a74c9abd6b4b7f9a7e5b80238d407bf0295c91276c81e84618ae87e45aad9db.exe 84 PID 2388 wrote to memory of 2224 2388 7djvv.exe 85 PID 2388 wrote to memory of 2224 2388 7djvv.exe 85 PID 2388 wrote to memory of 2224 2388 7djvv.exe 85 PID 2224 wrote to memory of 3904 2224 lfrllll.exe 86 PID 2224 wrote to memory of 3904 2224 lfrllll.exe 86 PID 2224 wrote to memory of 3904 2224 lfrllll.exe 86 PID 3904 wrote to memory of 4376 3904 nnhttb.exe 87 PID 3904 wrote to memory of 4376 3904 nnhttb.exe 87 PID 3904 wrote to memory of 4376 3904 nnhttb.exe 87 PID 4376 wrote to memory of 1528 4376 vjppj.exe 88 PID 4376 wrote to memory of 1528 4376 vjppj.exe 88 PID 4376 wrote to memory of 1528 4376 vjppj.exe 88 PID 1528 wrote to memory of 2792 1528 fffxffr.exe 89 PID 1528 wrote to memory of 2792 1528 fffxffr.exe 89 PID 1528 wrote to memory of 2792 1528 fffxffr.exe 89 PID 2792 wrote to memory of 3608 2792 dvpdd.exe 90 PID 2792 wrote to memory of 3608 2792 dvpdd.exe 90 PID 2792 wrote to memory of 3608 2792 dvpdd.exe 90 PID 3608 wrote to memory of 3628 3608 nhttbn.exe 91 PID 3608 wrote to memory of 3628 3608 nhttbn.exe 91 PID 3608 wrote to memory of 3628 3608 nhttbn.exe 91 PID 3628 wrote to memory of 3892 3628 rrlxfff.exe 92 PID 3628 wrote to memory of 3892 3628 rrlxfff.exe 92 PID 3628 wrote to memory of 3892 3628 rrlxfff.exe 92 PID 3892 wrote to memory of 4564 3892 bbnhhh.exe 93 PID 3892 wrote to memory of 4564 3892 bbnhhh.exe 93 PID 3892 wrote to memory of 4564 3892 bbnhhh.exe 93 PID 4564 wrote to memory of 3552 4564 rrxlffx.exe 95 PID 4564 wrote to memory of 3552 4564 rrxlffx.exe 95 PID 4564 wrote to memory of 3552 4564 rrxlffx.exe 95 PID 3552 wrote to memory of 1364 3552 5nhnhn.exe 96 PID 3552 wrote to memory of 1364 3552 5nhnhn.exe 96 PID 3552 wrote to memory of 1364 3552 5nhnhn.exe 96 PID 1364 wrote to memory of 2400 1364 pjpdj.exe 97 PID 1364 wrote to memory of 2400 1364 pjpdj.exe 97 PID 1364 wrote to memory of 2400 1364 pjpdj.exe 97 PID 2400 wrote to memory of 4832 2400 7rrlffx.exe 98 PID 2400 wrote to memory of 4832 2400 7rrlffx.exe 98 PID 2400 wrote to memory of 4832 2400 7rrlffx.exe 98 PID 4832 wrote to memory of 468 4832 jjppj.exe 99 PID 4832 wrote to memory of 468 4832 jjppj.exe 99 PID 4832 wrote to memory of 468 4832 jjppj.exe 99 PID 468 wrote to memory of 4304 468 ttnhtn.exe 101 PID 468 wrote to memory of 4304 468 ttnhtn.exe 101 PID 468 wrote to memory of 4304 468 ttnhtn.exe 101 PID 4304 wrote to memory of 1592 4304 7rlflrr.exe 102 PID 4304 wrote to memory of 1592 4304 7rlflrr.exe 102 PID 4304 wrote to memory of 1592 4304 7rlflrr.exe 102 PID 1592 wrote to memory of 3652 1592 ppjvj.exe 103 PID 1592 wrote to memory of 3652 1592 ppjvj.exe 103 PID 1592 wrote to memory of 3652 1592 ppjvj.exe 103 PID 3652 wrote to memory of 560 3652 xlfllrx.exe 104 PID 3652 wrote to memory of 560 3652 xlfllrx.exe 104 PID 3652 wrote to memory of 560 3652 xlfllrx.exe 104 PID 560 wrote to memory of 2944 560 hhhhhh.exe 105 PID 560 wrote to memory of 2944 560 hhhhhh.exe 105 PID 560 wrote to memory of 2944 560 hhhhhh.exe 105 PID 2944 wrote to memory of 5064 2944 xlrlffx.exe 106 PID 2944 wrote to memory of 5064 2944 xlrlffx.exe 106 PID 2944 wrote to memory of 5064 2944 xlrlffx.exe 106 PID 5064 wrote to memory of 1648 5064 1hbnhn.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a74c9abd6b4b7f9a7e5b80238d407bf0295c91276c81e84618ae87e45aad9db.exe"C:\Users\Admin\AppData\Local\Temp\6a74c9abd6b4b7f9a7e5b80238d407bf0295c91276c81e84618ae87e45aad9db.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\7djvv.exec:\7djvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\lfrllll.exec:\lfrllll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\nnhttb.exec:\nnhttb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\vjppj.exec:\vjppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\fffxffr.exec:\fffxffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\dvpdd.exec:\dvpdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\nhttbn.exec:\nhttbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\rrlxfff.exec:\rrlxfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\bbnhhh.exec:\bbnhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\rrxlffx.exec:\rrxlffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\5nhnhn.exec:\5nhnhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\pjpdj.exec:\pjpdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\7rrlffx.exec:\7rrlffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\jjppj.exec:\jjppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\ttnhtn.exec:\ttnhtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\7rlflrr.exec:\7rlflrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\ppjvj.exec:\ppjvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\xlfllrx.exec:\xlfllrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\hhhhhh.exec:\hhhhhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\xlrlffx.exec:\xlrlffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\1hbnhn.exec:\1hbnhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\9bbttt.exec:\9bbttt.exe23⤵
- Executes dropped EXE
PID:1648 -
\??\c:\rflfxxr.exec:\rflfxxr.exe24⤵
- Executes dropped EXE
PID:4872 -
\??\c:\vvjjj.exec:\vvjjj.exe25⤵
- Executes dropped EXE
PID:2032 -
\??\c:\pjvpv.exec:\pjvpv.exe26⤵
- Executes dropped EXE
PID:872 -
\??\c:\fxxxfxx.exec:\fxxxfxx.exe27⤵
- Executes dropped EXE
PID:4180 -
\??\c:\frxfxll.exec:\frxfxll.exe28⤵
- Executes dropped EXE
PID:2704 -
\??\c:\fflrfll.exec:\fflrfll.exe29⤵
- Executes dropped EXE
PID:3028 -
\??\c:\pdvvd.exec:\pdvvd.exe30⤵
- Executes dropped EXE
PID:1028 -
\??\c:\nhhntt.exec:\nhhntt.exe31⤵
- Executes dropped EXE
PID:3504 -
\??\c:\jpdvj.exec:\jpdvj.exe32⤵
- Executes dropped EXE
PID:2864 -
\??\c:\vdpdv.exec:\vdpdv.exe33⤵
- Executes dropped EXE
PID:1596 -
\??\c:\bhnttb.exec:\bhnttb.exe34⤵
- Executes dropped EXE
PID:4012 -
\??\c:\vdjpv.exec:\vdjpv.exe35⤵
- Executes dropped EXE
PID:920 -
\??\c:\xffrfrl.exec:\xffrfrl.exe36⤵
- Executes dropped EXE
PID:2296 -
\??\c:\pjpjd.exec:\pjpjd.exe37⤵
- Executes dropped EXE
PID:2656 -
\??\c:\bbttnt.exec:\bbttnt.exe38⤵PID:4488
-
\??\c:\jdjpv.exec:\jdjpv.exe39⤵
- Executes dropped EXE
PID:1316 -
\??\c:\lrxxffl.exec:\lrxxffl.exe40⤵
- Executes dropped EXE
PID:2096 -
\??\c:\bntnnh.exec:\bntnnh.exe41⤵
- Executes dropped EXE
PID:2472 -
\??\c:\bnnhnb.exec:\bnnhnb.exe42⤵
- Executes dropped EXE
PID:836 -
\??\c:\vvpjp.exec:\vvpjp.exe43⤵
- Executes dropped EXE
PID:444 -
\??\c:\lxrlflf.exec:\lxrlflf.exe44⤵
- Executes dropped EXE
PID:3840 -
\??\c:\fxrllff.exec:\fxrllff.exe45⤵
- Executes dropped EXE
PID:1224 -
\??\c:\nhbbhb.exec:\nhbbhb.exe46⤵
- Executes dropped EXE
PID:5112 -
\??\c:\djvvp.exec:\djvvp.exe47⤵
- Executes dropped EXE
PID:4948 -
\??\c:\lrxxxxf.exec:\lrxxxxf.exe48⤵
- Executes dropped EXE
PID:1680 -
\??\c:\bbtnnb.exec:\bbtnnb.exe49⤵
- Executes dropped EXE
PID:1432 -
\??\c:\vppjd.exec:\vppjd.exe50⤵
- Executes dropped EXE
PID:4148 -
\??\c:\dpjdp.exec:\dpjdp.exe51⤵
- Executes dropped EXE
PID:968 -
\??\c:\xxrlfxr.exec:\xxrlfxr.exe52⤵
- Executes dropped EXE
PID:3220 -
\??\c:\pvjvj.exec:\pvjvj.exe53⤵
- Executes dropped EXE
PID:3196 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe54⤵
- Executes dropped EXE
PID:2320 -
\??\c:\hhttnt.exec:\hhttnt.exe55⤵
- Executes dropped EXE
PID:4960 -
\??\c:\djpjd.exec:\djpjd.exe56⤵
- Executes dropped EXE
PID:2084 -
\??\c:\xfxxrrr.exec:\xfxxrrr.exe57⤵
- Executes dropped EXE
PID:3844 -
\??\c:\bbtnhb.exec:\bbtnhb.exe58⤵
- Executes dropped EXE
PID:4312 -
\??\c:\3pvpp.exec:\3pvpp.exe59⤵
- Executes dropped EXE
PID:4896 -
\??\c:\1ffrlff.exec:\1ffrlff.exe60⤵
- Executes dropped EXE
PID:3612 -
\??\c:\tnbbnt.exec:\tnbbnt.exe61⤵
- Executes dropped EXE
PID:4660 -
\??\c:\9dvjv.exec:\9dvjv.exe62⤵
- Executes dropped EXE
PID:1480 -
\??\c:\ttthhb.exec:\ttthhb.exe63⤵
- Executes dropped EXE
PID:1592 -
\??\c:\9nhbtt.exec:\9nhbtt.exe64⤵
- Executes dropped EXE
PID:3652 -
\??\c:\jvdvv.exec:\jvdvv.exe65⤵
- Executes dropped EXE
PID:4188 -
\??\c:\1llffff.exec:\1llffff.exe66⤵
- Executes dropped EXE
PID:1704 -
\??\c:\httnnh.exec:\httnnh.exe67⤵PID:2944
-
\??\c:\nntthh.exec:\nntthh.exe68⤵PID:4264
-
\??\c:\1ddvp.exec:\1ddvp.exe69⤵PID:4552
-
\??\c:\xxrrxxr.exec:\xxrrxxr.exe70⤵PID:3464
-
\??\c:\tnbthh.exec:\tnbthh.exe71⤵PID:4732
-
\??\c:\jddvp.exec:\jddvp.exe72⤵PID:2180
-
\??\c:\rrxxflx.exec:\rrxxflx.exe73⤵PID:3180
-
\??\c:\lllxxff.exec:\lllxxff.exe74⤵PID:4244
-
\??\c:\hhbbhb.exec:\hhbbhb.exe75⤵PID:60
-
\??\c:\dpddj.exec:\dpddj.exe76⤵PID:4448
-
\??\c:\jdjvv.exec:\jdjvv.exe77⤵PID:4444
-
\??\c:\xfxrlll.exec:\xfxrlll.exe78⤵PID:2436
-
\??\c:\nnnhbt.exec:\nnnhbt.exe79⤵PID:4452
-
\??\c:\bttttt.exec:\bttttt.exe80⤵PID:4568
-
\??\c:\jpddd.exec:\jpddd.exe81⤵PID:5100
-
\??\c:\fxxrffx.exec:\fxxrffx.exe82⤵PID:4840
-
\??\c:\lxllfff.exec:\lxllfff.exe83⤵PID:3300
-
\??\c:\nhhhhn.exec:\nhhhhn.exe84⤵PID:4476
-
\??\c:\jvjjv.exec:\jvjjv.exe85⤵PID:3380
-
\??\c:\jddvv.exec:\jddvv.exe86⤵PID:4772
-
\??\c:\1frxlxf.exec:\1frxlxf.exe87⤵PID:220
-
\??\c:\xxrlxxf.exec:\xxrlxxf.exe88⤵PID:2888
-
\??\c:\hhnnbb.exec:\hhnnbb.exe89⤵PID:4204
-
\??\c:\9djdv.exec:\9djdv.exe90⤵PID:3840
-
\??\c:\fxrlffr.exec:\fxrlffr.exe91⤵PID:4468
-
\??\c:\fxfxxff.exec:\fxfxxff.exe92⤵PID:748
-
\??\c:\bttnnn.exec:\bttnnn.exe93⤵PID:2024
-
\??\c:\vvvvj.exec:\vvvvj.exe94⤵PID:5032
-
\??\c:\vdddv.exec:\vdddv.exe95⤵PID:4900
-
\??\c:\lfffrrx.exec:\lfffrrx.exe96⤵PID:3900
-
\??\c:\nbhbtt.exec:\nbhbtt.exe97⤵PID:4848
-
\??\c:\5ththh.exec:\5ththh.exe98⤵PID:3020
-
\??\c:\pdjjj.exec:\pdjjj.exe99⤵PID:3920
-
\??\c:\lfxlrrl.exec:\lfxlrrl.exe100⤵PID:1688
-
\??\c:\nhnhnn.exec:\nhnhnn.exe101⤵PID:4904
-
\??\c:\pjvvj.exec:\pjvvj.exe102⤵PID:3788
-
\??\c:\llfrrrx.exec:\llfrrrx.exe103⤵PID:3676
-
\??\c:\lffffll.exec:\lffffll.exe104⤵PID:4464
-
\??\c:\3jvpj.exec:\3jvpj.exe105⤵PID:556
-
\??\c:\dpdvp.exec:\dpdvp.exe106⤵PID:944
-
\??\c:\3xfxxff.exec:\3xfxxff.exe107⤵PID:3852
-
\??\c:\djvdd.exec:\djvdd.exe108⤵PID:884
-
\??\c:\jjvvd.exec:\jjvvd.exe109⤵PID:5064
-
\??\c:\rlrrxxl.exec:\rlrrxxl.exe110⤵PID:4936
-
\??\c:\1hbtnn.exec:\1hbtnn.exe111⤵PID:3928
-
\??\c:\ttnhhb.exec:\ttnhhb.exe112⤵PID:1648
-
\??\c:\xrffrll.exec:\xrffrll.exe113⤵PID:3736
-
\??\c:\tbhhhh.exec:\tbhhhh.exe114⤵PID:5084
-
\??\c:\bhntbb.exec:\bhntbb.exe115⤵PID:2032
-
\??\c:\vjvvv.exec:\vjvvv.exe116⤵PID:5016
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe117⤵PID:4480
-
\??\c:\fxxrllf.exec:\fxxrllf.exe118⤵PID:2104
-
\??\c:\jvddv.exec:\jvddv.exe119⤵PID:2704
-
\??\c:\jjdpj.exec:\jjdpj.exe120⤵PID:2364
-
\??\c:\9lxrlrf.exec:\9lxrlrf.exe121⤵PID:2436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-