Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 22:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6c3b154dc8ef8c71e6c6b77e39bf8d5145fa3063f5058e461d8bce68007bcfc4.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target 6c3b154dc8ef8c71e6c6b77e39bf8d5145fa3063f5058e461d8bce68007bcfc4.exe
- Size 449KB
- Sample240519-2xebasfg6s
- SHA256 6c3b154dc8ef8c71e6c6b77e39bf8d5145fa3063f5058e461d8bce68007bcfc4
- MD5 44300b2b40d99d0d96503612acd468b5
- SHA1 2b5c21ced77ae1a75a348e19308f03d35447ba8b
- SHA512 765f8896efcb19cd68d2645c0d7fe57f6ac822c5d007a48f39274e89fc29bda7afdf91fe17ea3252e6f05db37c78f7106b8aaca9e3864a5b1604a7d0420fc527
- SSDEEP 6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1068-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3344-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1348-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1324-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/756-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2568-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-627-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-725-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-900-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/1068-7-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/5040-9-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3436-13-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3436-19-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2536-18-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/216-25-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1452-33-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3344-40-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1016-48-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1016-53-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1472-55-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2532-70-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2904-72-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3120-83-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4532-89-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3028-102-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3044-108-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3012-113-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1348-100-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3724-118-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/872-130-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2448-137-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3088-135-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4408-143-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4696-150-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3364-181-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3228-189-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4620-190-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/5084-194-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/5084-198-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3556-202-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3264-206-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/456-210-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/8-211-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1324-224-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1324-228-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1772-234-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3324-237-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2800-245-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4896-251-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1164-255-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4296-259-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4048-267-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4792-277-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3212-290-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1092-303-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3520-313-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3752-317-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1648-327-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3796-334-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3948-338-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3508-342-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4628-343-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3244-359-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/756-363-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4328-364-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3456-375-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3968-417-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3268-459-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2616-470-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3740-477-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3740-481-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1544-494-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4704-504-0x0000000000400000-0x000000000042A000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 5040 xlxxrxx.exe 3436 nhtttn.exe 2536 fllrfrx.exe 216 bhhhhn.exe 1452 xflxxrx.exe 3344 dvddd.exe 2800 fflllrx.exe 1016 nnbbbn.exe 1472 djjvj.exe 2240 vvpvv.exe 2532 nttnhb.exe 2904 rrlxfrx.exe 3968 nttnnn.exe 3120 bhnhbb.exe 4532 lrxxffl.exe 1348 vdvvp.exe 3028 bnbbbh.exe 3044 vdjjd.exe 3012 fxflffx.exe 3724 httttt.exe 872 lllflxx.exe 2448 jpddv.exe 3088 nbhhhn.exe 4408 vppvp.exe 4696 rflrxll.exe 2692 vddpv.exe 904 5frlrxr.exe 3996 9bnnnn.exe 4816 nbbhhh.exe 3364 vpvvd.exe 3956 tbttbn.exe 3228 vvdvd.exe 4620 dvpjv.exe 5084 lfxxxrr.exe 3556 hhbbhn.exe 3264 jdvjv.exe 456 fxlxfxx.exe 8 hntnnb.exe 848 xlxxxrl.exe 208 nbnbbb.exe 1996 jdpdp.exe 1324 lrrxxlx.exe 4372 tnnnnt.exe 1772 djppp.exe 3324 lrrxxrr.exe 4708 7xlxxxx.exe 2800 nttnbt.exe 4088 dpddv.exe 4896 rrxxllf.exe 1164 hhnhhn.exe 4296 flrlfff.exe 4480 thhhbb.exe 4048 7jvvv.exe 2904 llrrrlr.exe 520 bnnnhh.exe 4792 flxffrx.exe 1940 tnttbb.exe 4872 vpvvp.exe 1600 lxxxrlf.exe 3212 thnhtb.exe 4904 jdpdp.exe 1956 lllfllr.exe 952 hnnnnh.exe 1092 dpppj.exe -
resource yara_rule behavioral2/memory/1068-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3344-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1348-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1164-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-504-0x0000000000400000-0x000000000042A000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1068 wrote to memory of 5040 1068 6c3b154dc8ef8c71e6c6b77e39bf8d5145fa3063f5058e461d8bce68007bcfc4.exe 83 PID 1068 wrote to memory of 5040 1068 6c3b154dc8ef8c71e6c6b77e39bf8d5145fa3063f5058e461d8bce68007bcfc4.exe 83 PID 1068 wrote to memory of 5040 1068 6c3b154dc8ef8c71e6c6b77e39bf8d5145fa3063f5058e461d8bce68007bcfc4.exe 83 PID 5040 wrote to memory of 3436 5040 xlxxrxx.exe 84 PID 5040 wrote to memory of 3436 5040 xlxxrxx.exe 84 PID 5040 wrote to memory of 3436 5040 xlxxrxx.exe 84 PID 3436 wrote to memory of 2536 3436 nhtttn.exe 85 PID 3436 wrote to memory of 2536 3436 nhtttn.exe 85 PID 3436 wrote to memory of 2536 3436 nhtttn.exe 85 PID 2536 wrote to memory of 216 2536 fllrfrx.exe 86 PID 2536 wrote to memory of 216 2536 fllrfrx.exe 86 PID 2536 wrote to memory of 216 2536 fllrfrx.exe 86 PID 216 wrote to memory of 1452 216 bhhhhn.exe 87 PID 216 wrote to memory of 1452 216 bhhhhn.exe 87 PID 216 wrote to memory of 1452 216 bhhhhn.exe 87 PID 1452 wrote to memory of 3344 1452 xflxxrx.exe 88 PID 1452 wrote to memory of 3344 1452 xflxxrx.exe 88 PID 1452 wrote to memory of 3344 1452 xflxxrx.exe 88 PID 3344 wrote to memory of 2800 3344 dvddd.exe 89 PID 3344 wrote to memory of 2800 3344 dvddd.exe 89 PID 3344 wrote to memory of 2800 3344 dvddd.exe 89 PID 2800 wrote to memory of 1016 2800 fflllrx.exe 90 PID 2800 wrote to memory of 1016 2800 fflllrx.exe 90 PID 2800 wrote to memory of 1016 2800 fflllrx.exe 90 PID 1016 wrote to memory of 1472 1016 nnbbbn.exe 91 PID 1016 wrote to memory of 1472 1016 nnbbbn.exe 91 PID 1016 wrote to memory of 1472 1016 nnbbbn.exe 91 PID 1472 wrote to memory of 2240 1472 djjvj.exe 93 PID 1472 wrote to memory of 2240 1472 djjvj.exe 93 PID 1472 wrote to memory of 2240 1472 djjvj.exe 93 PID 2240 wrote to memory of 2532 2240 vvpvv.exe 94 PID 2240 wrote to memory of 2532 2240 vvpvv.exe 94 PID 2240 wrote to memory of 2532 2240 vvpvv.exe 94 PID 2532 wrote to memory of 2904 2532 nttnhb.exe 95 PID 2532 wrote to memory of 2904 2532 nttnhb.exe 95 PID 2532 wrote to memory of 2904 2532 nttnhb.exe 95 PID 2904 wrote to memory of 3968 2904 rrlxfrx.exe 97 PID 2904 wrote to memory of 3968 2904 rrlxfrx.exe 97 PID 2904 wrote to memory of 3968 2904 rrlxfrx.exe 97 PID 3968 wrote to memory of 3120 3968 nttnnn.exe 98 PID 3968 wrote to memory of 3120 3968 nttnnn.exe 98 PID 3968 wrote to memory of 3120 3968 nttnnn.exe 98 PID 3120 wrote to memory of 4532 3120 bhnhbb.exe 99 PID 3120 wrote to memory of 4532 3120 bhnhbb.exe 99 PID 3120 wrote to memory of 4532 3120 bhnhbb.exe 99 PID 4532 wrote to memory of 1348 4532 lrxxffl.exe 100 PID 4532 wrote to memory of 1348 4532 lrxxffl.exe 100 PID 4532 wrote to memory of 1348 4532 lrxxffl.exe 100 PID 1348 wrote to memory of 3028 1348 vdvvp.exe 102 PID 1348 wrote to memory of 3028 1348 vdvvp.exe 102 PID 1348 wrote to memory of 3028 1348 vdvvp.exe 102 PID 3028 wrote to memory of 3044 3028 bnbbbh.exe 103 PID 3028 wrote to memory of 3044 3028 bnbbbh.exe 103 PID 3028 wrote to memory of 3044 3028 bnbbbh.exe 103 PID 3044 wrote to memory of 3012 3044 vdjjd.exe 104 PID 3044 wrote to memory of 3012 3044 vdjjd.exe 104 PID 3044 wrote to memory of 3012 3044 vdjjd.exe 104 PID 3012 wrote to memory of 3724 3012 fxflffx.exe 105 PID 3012 wrote to memory of 3724 3012 fxflffx.exe 105 PID 3012 wrote to memory of 3724 3012 fxflffx.exe 105 PID 3724 wrote to memory of 872 3724 httttt.exe 106 PID 3724 wrote to memory of 872 3724 httttt.exe 106 PID 3724 wrote to memory of 872 3724 httttt.exe 106 PID 872 wrote to memory of 2448 872 lllflxx.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c3b154dc8ef8c71e6c6b77e39bf8d5145fa3063f5058e461d8bce68007bcfc4.exe"C:\Users\Admin\AppData\Local\Temp\6c3b154dc8ef8c71e6c6b77e39bf8d5145fa3063f5058e461d8bce68007bcfc4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\xlxxrxx.exec:\xlxxrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\nhtttn.exec:\nhtttn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\fllrfrx.exec:\fllrfrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\bhhhhn.exec:\bhhhhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\xflxxrx.exec:\xflxxrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\dvddd.exec:\dvddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\fflllrx.exec:\fflllrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\nnbbbn.exec:\nnbbbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\djjvj.exec:\djjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\vvpvv.exec:\vvpvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\nttnhb.exec:\nttnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\rrlxfrx.exec:\rrlxfrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\nttnnn.exec:\nttnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\bhnhbb.exec:\bhnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\lrxxffl.exec:\lrxxffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\vdvvp.exec:\vdvvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\bnbbbh.exec:\bnbbbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\vdjjd.exec:\vdjjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\fxflffx.exec:\fxflffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\httttt.exec:\httttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\lllflxx.exec:\lllflxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\jpddv.exec:\jpddv.exe23⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nbhhhn.exec:\nbhhhn.exe24⤵
- Executes dropped EXE
PID:3088 -
\??\c:\vppvp.exec:\vppvp.exe25⤵
- Executes dropped EXE
PID:4408 -
\??\c:\rflrxll.exec:\rflrxll.exe26⤵
- Executes dropped EXE
PID:4696 -
\??\c:\vddpv.exec:\vddpv.exe27⤵
- Executes dropped EXE
PID:2692 -
\??\c:\5frlrxr.exec:\5frlrxr.exe28⤵
- Executes dropped EXE
PID:904 -
\??\c:\9bnnnn.exec:\9bnnnn.exe29⤵
- Executes dropped EXE
PID:3996 -
\??\c:\nbbhhh.exec:\nbbhhh.exe30⤵
- Executes dropped EXE
PID:4816 -
\??\c:\vpvvd.exec:\vpvvd.exe31⤵
- Executes dropped EXE
PID:3364 -
\??\c:\tbttbn.exec:\tbttbn.exe32⤵
- Executes dropped EXE
PID:3956 -
\??\c:\vvdvd.exec:\vvdvd.exe33⤵
- Executes dropped EXE
PID:3228 -
\??\c:\dvpjv.exec:\dvpjv.exe34⤵
- Executes dropped EXE
PID:4620 -
\??\c:\lfxxxrr.exec:\lfxxxrr.exe35⤵
- Executes dropped EXE
PID:5084 -
\??\c:\hhbbhn.exec:\hhbbhn.exe36⤵
- Executes dropped EXE
PID:3556 -
\??\c:\jdvjv.exec:\jdvjv.exe37⤵
- Executes dropped EXE
PID:3264 -
\??\c:\fxlxfxx.exec:\fxlxfxx.exe38⤵
- Executes dropped EXE
PID:456 -
\??\c:\hntnnb.exec:\hntnnb.exe39⤵
- Executes dropped EXE
PID:8 -
\??\c:\xlxxxrl.exec:\xlxxxrl.exe40⤵
- Executes dropped EXE
PID:848 -
\??\c:\nbnbbb.exec:\nbnbbb.exe41⤵
- Executes dropped EXE
PID:208 -
\??\c:\jdpdp.exec:\jdpdp.exe42⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lrrxxlx.exec:\lrrxxlx.exe43⤵
- Executes dropped EXE
PID:1324 -
\??\c:\tnnnnt.exec:\tnnnnt.exe44⤵
- Executes dropped EXE
PID:4372 -
\??\c:\djppp.exec:\djppp.exe45⤵
- Executes dropped EXE
PID:1772 -
\??\c:\lrrxxrr.exec:\lrrxxrr.exe46⤵
- Executes dropped EXE
PID:3324 -
\??\c:\7xlxxxx.exec:\7xlxxxx.exe47⤵
- Executes dropped EXE
PID:4708 -
\??\c:\nttnbt.exec:\nttnbt.exe48⤵
- Executes dropped EXE
PID:2800 -
\??\c:\dpddv.exec:\dpddv.exe49⤵
- Executes dropped EXE
PID:4088 -
\??\c:\rrxxllf.exec:\rrxxllf.exe50⤵
- Executes dropped EXE
PID:4896 -
\??\c:\hhnhhn.exec:\hhnhhn.exe51⤵
- Executes dropped EXE
PID:1164 -
\??\c:\flrlfff.exec:\flrlfff.exe52⤵
- Executes dropped EXE
PID:4296 -
\??\c:\thhhbb.exec:\thhhbb.exe53⤵
- Executes dropped EXE
PID:4480 -
\??\c:\7jvvv.exec:\7jvvv.exe54⤵
- Executes dropped EXE
PID:4048 -
\??\c:\llrrrlr.exec:\llrrrlr.exe55⤵
- Executes dropped EXE
PID:2904 -
\??\c:\bnnnhh.exec:\bnnnhh.exe56⤵
- Executes dropped EXE
PID:520 -
\??\c:\flxffrx.exec:\flxffrx.exe57⤵
- Executes dropped EXE
PID:4792 -
\??\c:\tnttbb.exec:\tnttbb.exe58⤵
- Executes dropped EXE
PID:1940 -
\??\c:\vpvvp.exec:\vpvvp.exe59⤵
- Executes dropped EXE
PID:4872 -
\??\c:\lxxxrlf.exec:\lxxxrlf.exe60⤵
- Executes dropped EXE
PID:1600 -
\??\c:\thnhtb.exec:\thnhtb.exe61⤵
- Executes dropped EXE
PID:3212 -
\??\c:\jdpdp.exec:\jdpdp.exe62⤵
- Executes dropped EXE
PID:4904 -
\??\c:\lllfllr.exec:\lllfllr.exe63⤵
- Executes dropped EXE
PID:1956 -
\??\c:\hnnnnh.exec:\hnnnnh.exe64⤵
- Executes dropped EXE
PID:952 -
\??\c:\dpppj.exec:\dpppj.exe65⤵
- Executes dropped EXE
PID:1092 -
\??\c:\xxrrlrr.exec:\xxrrlrr.exe66⤵PID:804
-
\??\c:\lrfxxxx.exec:\lrfxxxx.exe67⤵PID:736
-
\??\c:\9ttttn.exec:\9ttttn.exe68⤵PID:624
-
\??\c:\vjddv.exec:\vjddv.exe69⤵PID:3520
-
\??\c:\bbntth.exec:\bbntth.exe70⤵PID:3752
-
\??\c:\xxffffl.exec:\xxffffl.exe71⤵PID:4180
-
\??\c:\nthbtn.exec:\nthbtn.exe72⤵PID:3412
-
\??\c:\jjppj.exec:\jjppj.exe73⤵PID:1648
-
\??\c:\xllllxr.exec:\xllllxr.exe74⤵PID:3796
-
\??\c:\hbhthb.exec:\hbhthb.exe75⤵PID:3948
-
\??\c:\dvppd.exec:\dvppd.exe76⤵PID:3508
-
\??\c:\5lflxlx.exec:\5lflxlx.exe77⤵PID:4628
-
\??\c:\hnbbbh.exec:\hnbbbh.exe78⤵PID:3364
-
\??\c:\dvddd.exec:\dvddd.exe79⤵PID:3612
-
\??\c:\xfrflfr.exec:\xfrflfr.exe80⤵PID:1244
-
\??\c:\nbthtt.exec:\nbthtt.exe81⤵PID:3244
-
\??\c:\jdjjj.exec:\jdjjj.exe82⤵PID:756
-
\??\c:\fxxfxxx.exec:\fxxfxxx.exe83⤵PID:4328
-
\??\c:\btnnbt.exec:\btnnbt.exe84⤵PID:8
-
\??\c:\jpddv.exec:\jpddv.exe85⤵PID:208
-
\??\c:\jjjdv.exec:\jjjdv.exe86⤵PID:3456
-
\??\c:\7xrlffx.exec:\7xrlffx.exe87⤵PID:224
-
\??\c:\bbbttt.exec:\bbbttt.exe88⤵PID:408
-
\??\c:\jdjdd.exec:\jdjdd.exe89⤵PID:3324
-
\??\c:\rxfffll.exec:\rxfffll.exe90⤵PID:1192
-
\??\c:\hbnnnh.exec:\hbnnnh.exe91⤵PID:3348
-
\??\c:\fffxrll.exec:\fffxrll.exe92⤵PID:2152
-
\??\c:\frffxff.exec:\frffxff.exe93⤵PID:4404
-
\??\c:\dpvdv.exec:\dpvdv.exe94⤵PID:2148
-
\??\c:\pjdvv.exec:\pjdvv.exe95⤵PID:1624
-
\??\c:\bnhhbb.exec:\bnhhbb.exe96⤵PID:2012
-
\??\c:\bntttb.exec:\bntttb.exe97⤵PID:2532
-
\??\c:\3hbhnh.exec:\3hbhnh.exe98⤵PID:2172
-
\??\c:\vvjdv.exec:\vvjdv.exe99⤵PID:3968
-
\??\c:\fffffll.exec:\fffffll.exe100⤵PID:1264
-
\??\c:\5bhbbn.exec:\5bhbbn.exe101⤵PID:2288
-
\??\c:\pvvvv.exec:\pvvvv.exe102⤵PID:4532
-
\??\c:\fxxrllf.exec:\fxxrllf.exe103⤵PID:3712
-
\??\c:\lxfrlfl.exec:\lxfrlfl.exe104⤵PID:1036
-
\??\c:\bththt.exec:\bththt.exe105⤵PID:4760
-
\??\c:\vjvvp.exec:\vjvvp.exe106⤵PID:3516
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe107⤵PID:3012
-
\??\c:\nbnhbt.exec:\nbnhbt.exe108⤵PID:2624
-
\??\c:\jppjj.exec:\jppjj.exe109⤵PID:1232
-
\??\c:\lllfxrl.exec:\lllfxrl.exe110⤵PID:2448
-
\??\c:\thbthh.exec:\thbthh.exe111⤵PID:1580
-
\??\c:\3jvvp.exec:\3jvvp.exe112⤵PID:400
-
\??\c:\rlxxxfl.exec:\rlxxxfl.exe113⤵PID:3268
-
\??\c:\bnnnnb.exec:\bnnnnb.exe114⤵PID:4696
-
\??\c:\ddpjd.exec:\ddpjd.exe115⤵PID:2616
-
\??\c:\ffrxfrx.exec:\ffrxfrx.exe116⤵PID:4956
-
\??\c:\thttnb.exec:\thttnb.exe117⤵PID:3036
-
\??\c:\vdppd.exec:\vdppd.exe118⤵PID:3740
-
\??\c:\fffrlxf.exec:\fffrlxf.exe119⤵PID:5056
-
\??\c:\hhhbnh.exec:\hhhbnh.exe120⤵PID:4628
-
\??\c:\nnnhnb.exec:\nnnhnb.exe121⤵PID:1596
-
\??\c:\pdpjj.exec:\pdpjj.exe122⤵PID:1244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-