Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 23:20
Behavioral task
behavioral1
Sample
747b80deca45767fa87c99276663c4463063c8a77b79b029ce32e40a6306cca7.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
- Target 747b80deca45767fa87c99276663c4463063c8a77b79b029ce32e40a6306cca7.exe
- Size 334KB
- Sample240519-3bc2sagf4y
- SHA256 747b80deca45767fa87c99276663c4463063c8a77b79b029ce32e40a6306cca7
- MD5 574856122a15d14c8e093700944bb541
- SHA1 552f154f05b7d11d7fb474c5b9a8dfd4a4a25699
- SHA512 159a9813a684b1195a68e81c1cd45c582105a8cc0ed61dfbb6b94462c8feba81339b8f5624dda02869e33afa4c68b689f016d25972c36819b14e466cce016f07
- SSDEEP 6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1i/0:x4wFHoS3eFaKHpv/VycgE8o0
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3032-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2676-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1556-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2760-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1292-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2168-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2680-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1388-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1436-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1508-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2724-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2968-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3476-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/444-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3024-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/868-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1236-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/836-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3324-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1932-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2596-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2836-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4016-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4844-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/428-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1892-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3052-478-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3296-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2460-508-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-515-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-534-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4844-579-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-645-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-661-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-748-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/548-773-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-1151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-1251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/2644-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000600000002328f-3.dat UPX behavioral2/memory/3032-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2644-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000800000002340f-10.dat UPX behavioral2/memory/2676-12-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023413-14.dat UPX behavioral2/files/0x0007000000023414-25.dat UPX behavioral2/memory/4852-21-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2676-20-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023415-28.dat UPX behavioral2/memory/4716-33-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/224-31-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023416-35.dat UPX behavioral2/files/0x0007000000023418-40.dat UPX behavioral2/memory/2076-43-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023419-46.dat UPX behavioral2/memory/1556-50-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341a-52.dat UPX behavioral2/files/0x000700000002341b-57.dat UPX behavioral2/memory/4944-60-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2760-64-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341c-63.dat UPX behavioral2/files/0x000700000002341d-69.dat UPX behavioral2/memory/1292-71-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341e-74.dat UPX behavioral2/memory/2168-75-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2680-77-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341f-80.dat UPX behavioral2/memory/2680-82-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023420-89.dat UPX behavioral2/memory/1388-88-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1436-91-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023421-93.dat UPX behavioral2/files/0x0007000000023422-100.dat UPX behavioral2/files/0x0007000000023423-103.dat UPX behavioral2/memory/1508-106-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4524-108-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341d-110.dat UPX behavioral2/memory/4468-114-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0008000000023410-116.dat UPX behavioral2/memory/2724-118-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023424-122.dat UPX behavioral2/files/0x0007000000023425-127.dat UPX behavioral2/memory/2968-129-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3476-132-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023426-135.dat UPX behavioral2/files/0x0007000000023428-140.dat UPX behavioral2/files/0x0007000000023429-145.dat UPX behavioral2/files/0x000700000002342a-150.dat UPX behavioral2/memory/4960-149-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342b-157.dat UPX behavioral2/files/0x000700000002342c-162.dat UPX behavioral2/memory/444-161-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342d-167.dat UPX behavioral2/files/0x000700000002342e-172.dat UPX behavioral2/memory/3024-175-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342f-177.dat UPX behavioral2/memory/868-180-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023430-183.dat UPX behavioral2/memory/4604-189-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5080-190-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1236-203-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4392-208-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 3032 fxrrlrf.exe 2676 fxllxxf.exe 4852 tttnnn.exe 224 jdddd.exe 4716 llrxxff.exe 1384 rrlrrlf.exe 2076 7ddvp.exe 1556 lfrrrll.exe 4944 ddddv.exe 2760 pjdvp.exe 1292 ntnhbt.exe 2168 ddvvv.exe 2680 1xxxrrr.exe 1388 1pvpp.exe 1436 bnnhhn.exe 4388 jpvpj.exe 4524 3ffxxxx.exe 1508 1nnntn.exe 4468 ddvvv.exe 2724 hhhtbb.exe 2968 3jppv.exe 3476 1flffff.exe 2256 bttnhb.exe 1032 pvpjj.exe 4960 3fllrrx.exe 408 7hnntt.exe 444 ppjjp.exe 4376 frfxxxr.exe 3052 7nhhhn.exe 3024 frrrlff.exe 868 5ttnhh.exe 4604 ppvpp.exe 5080 tbhnhh.exe 5052 ppppj.exe 3296 5ddpj.exe 1236 9rlxrrl.exe 4724 hnhbtn.exe 4392 vvpjd.exe 2004 3xxxxff.exe 3260 tnnnnn.exe 4852 hnhhtb.exe 3264 1flxxxx.exe 4820 rrxrffr.exe 224 nhbtnn.exe 1420 dvpdv.exe 2268 thtttt.exe 836 vdjdj.exe 2696 bhnhbb.exe 3324 rlfffff.exe 4020 nhnhhh.exe 2760 pjvpj.exe 1932 fxlflrl.exe 3060 hnbbhn.exe 1664 pjjdd.exe 2596 9vvjv.exe 1348 5rxrrrl.exe 4688 7tbbtt.exe 2836 vpvpd.exe 4016 fxllllr.exe 4012 xlfffff.exe 4484 dppjd.exe 4472 lfllxlr.exe 1508 nhnhhn.exe 3892 5ppjj.exe -
resource yara_rule behavioral2/memory/2644-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000600000002328f-3.dat upx behavioral2/memory/3032-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2644-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002340f-10.dat upx behavioral2/memory/2676-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023413-14.dat upx behavioral2/files/0x0007000000023414-25.dat upx behavioral2/memory/4852-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2676-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023415-28.dat upx behavioral2/memory/4716-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/224-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-35.dat upx behavioral2/files/0x0007000000023418-40.dat upx behavioral2/memory/2076-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023419-46.dat upx behavioral2/memory/1556-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341a-52.dat upx behavioral2/files/0x000700000002341b-57.dat upx behavioral2/memory/4944-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2760-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341c-63.dat upx behavioral2/files/0x000700000002341d-69.dat upx behavioral2/memory/1292-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341e-74.dat upx behavioral2/memory/2168-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2680-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341f-80.dat upx behavioral2/memory/2680-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-89.dat upx behavioral2/memory/1388-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1436-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-93.dat upx behavioral2/files/0x0007000000023422-100.dat upx behavioral2/files/0x0007000000023423-103.dat upx behavioral2/memory/1508-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4524-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341d-110.dat upx behavioral2/memory/4468-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023410-116.dat upx behavioral2/memory/2724-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-122.dat upx behavioral2/files/0x0007000000023425-127.dat upx behavioral2/memory/2968-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3476-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-135.dat upx behavioral2/files/0x0007000000023428-140.dat upx behavioral2/files/0x0007000000023429-145.dat upx behavioral2/files/0x000700000002342a-150.dat upx behavioral2/memory/4960-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342b-157.dat upx behavioral2/files/0x000700000002342c-162.dat upx behavioral2/memory/444-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-167.dat upx behavioral2/files/0x000700000002342e-172.dat upx behavioral2/memory/3024-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342f-177.dat upx behavioral2/memory/868-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023430-183.dat upx behavioral2/memory/4604-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5080-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1236-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4392-208-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 3032 2644 747b80deca45767fa87c99276663c4463063c8a77b79b029ce32e40a6306cca7.exe 86 PID 2644 wrote to memory of 3032 2644 747b80deca45767fa87c99276663c4463063c8a77b79b029ce32e40a6306cca7.exe 86 PID 2644 wrote to memory of 3032 2644 747b80deca45767fa87c99276663c4463063c8a77b79b029ce32e40a6306cca7.exe 86 PID 3032 wrote to memory of 2676 3032 fxrrlrf.exe 87 PID 3032 wrote to memory of 2676 3032 fxrrlrf.exe 87 PID 3032 wrote to memory of 2676 3032 fxrrlrf.exe 87 PID 2676 wrote to memory of 4852 2676 fxllxxf.exe 88 PID 2676 wrote to memory of 4852 2676 fxllxxf.exe 88 PID 2676 wrote to memory of 4852 2676 fxllxxf.exe 88 PID 4852 wrote to memory of 224 4852 tttnnn.exe 89 PID 4852 wrote to memory of 224 4852 tttnnn.exe 89 PID 4852 wrote to memory of 224 4852 tttnnn.exe 89 PID 224 wrote to memory of 4716 224 jdddd.exe 90 PID 224 wrote to memory of 4716 224 jdddd.exe 90 PID 224 wrote to memory of 4716 224 jdddd.exe 90 PID 4716 wrote to memory of 1384 4716 llrxxff.exe 91 PID 4716 wrote to memory of 1384 4716 llrxxff.exe 91 PID 4716 wrote to memory of 1384 4716 llrxxff.exe 91 PID 1384 wrote to memory of 2076 1384 rrlrrlf.exe 92 PID 1384 wrote to memory of 2076 1384 rrlrrlf.exe 92 PID 1384 wrote to memory of 2076 1384 rrlrrlf.exe 92 PID 2076 wrote to memory of 1556 2076 7ddvp.exe 93 PID 2076 wrote to memory of 1556 2076 7ddvp.exe 93 PID 2076 wrote to memory of 1556 2076 7ddvp.exe 93 PID 1556 wrote to memory of 4944 1556 lfrrrll.exe 94 PID 1556 wrote to memory of 4944 1556 lfrrrll.exe 94 PID 1556 wrote to memory of 4944 1556 lfrrrll.exe 94 PID 4944 wrote to memory of 2760 4944 ddddv.exe 95 PID 4944 wrote to memory of 2760 4944 ddddv.exe 95 PID 4944 wrote to memory of 2760 4944 ddddv.exe 95 PID 2760 wrote to memory of 1292 2760 pjdvp.exe 97 PID 2760 wrote to memory of 1292 2760 pjdvp.exe 97 PID 2760 wrote to memory of 1292 2760 pjdvp.exe 97 PID 1292 wrote to memory of 2168 1292 ntnhbt.exe 98 PID 1292 wrote to memory of 2168 1292 ntnhbt.exe 98 PID 1292 wrote to memory of 2168 1292 ntnhbt.exe 98 PID 2168 wrote to memory of 2680 2168 ddvvv.exe 99 PID 2168 wrote to memory of 2680 2168 ddvvv.exe 99 PID 2168 wrote to memory of 2680 2168 ddvvv.exe 99 PID 2680 wrote to memory of 1388 2680 1xxxrrr.exe 100 PID 2680 wrote to memory of 1388 2680 1xxxrrr.exe 100 PID 2680 wrote to memory of 1388 2680 1xxxrrr.exe 100 PID 1388 wrote to memory of 1436 1388 1pvpp.exe 101 PID 1388 wrote to memory of 1436 1388 1pvpp.exe 101 PID 1388 wrote to memory of 1436 1388 1pvpp.exe 101 PID 1436 wrote to memory of 4388 1436 bnnhhn.exe 103 PID 1436 wrote to memory of 4388 1436 bnnhhn.exe 103 PID 1436 wrote to memory of 4388 1436 bnnhhn.exe 103 PID 4388 wrote to memory of 4524 4388 jpvpj.exe 104 PID 4388 wrote to memory of 4524 4388 jpvpj.exe 104 PID 4388 wrote to memory of 4524 4388 jpvpj.exe 104 PID 4524 wrote to memory of 1508 4524 3ffxxxx.exe 105 PID 4524 wrote to memory of 1508 4524 3ffxxxx.exe 105 PID 4524 wrote to memory of 1508 4524 3ffxxxx.exe 105 PID 1508 wrote to memory of 4468 1508 1nnntn.exe 106 PID 1508 wrote to memory of 4468 1508 1nnntn.exe 106 PID 1508 wrote to memory of 4468 1508 1nnntn.exe 106 PID 4468 wrote to memory of 2724 4468 ddvvv.exe 107 PID 4468 wrote to memory of 2724 4468 ddvvv.exe 107 PID 4468 wrote to memory of 2724 4468 ddvvv.exe 107 PID 2724 wrote to memory of 2968 2724 hhhtbb.exe 108 PID 2724 wrote to memory of 2968 2724 hhhtbb.exe 108 PID 2724 wrote to memory of 2968 2724 hhhtbb.exe 108 PID 2968 wrote to memory of 3476 2968 3jppv.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\747b80deca45767fa87c99276663c4463063c8a77b79b029ce32e40a6306cca7.exe"C:\Users\Admin\AppData\Local\Temp\747b80deca45767fa87c99276663c4463063c8a77b79b029ce32e40a6306cca7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\fxrrlrf.exec:\fxrrlrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\fxllxxf.exec:\fxllxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\tttnnn.exec:\tttnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\jdddd.exec:\jdddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\llrxxff.exec:\llrxxff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\rrlrrlf.exec:\rrlrrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\7ddvp.exec:\7ddvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\lfrrrll.exec:\lfrrrll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\ddddv.exec:\ddddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\pjdvp.exec:\pjdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\ntnhbt.exec:\ntnhbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\ddvvv.exec:\ddvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\1xxxrrr.exec:\1xxxrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\1pvpp.exec:\1pvpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\bnnhhn.exec:\bnnhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\jpvpj.exec:\jpvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\3ffxxxx.exec:\3ffxxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\1nnntn.exec:\1nnntn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\ddvvv.exec:\ddvvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\hhhtbb.exec:\hhhtbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\3jppv.exec:\3jppv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\1flffff.exec:\1flffff.exe23⤵
- Executes dropped EXE
PID:3476 -
\??\c:\bttnhb.exec:\bttnhb.exe24⤵
- Executes dropped EXE
PID:2256 -
\??\c:\pvpjj.exec:\pvpjj.exe25⤵
- Executes dropped EXE
PID:1032 -
\??\c:\3fllrrx.exec:\3fllrrx.exe26⤵
- Executes dropped EXE
PID:4960 -
\??\c:\7hnntt.exec:\7hnntt.exe27⤵
- Executes dropped EXE
PID:408 -
\??\c:\ppjjp.exec:\ppjjp.exe28⤵
- Executes dropped EXE
PID:444 -
\??\c:\frfxxxr.exec:\frfxxxr.exe29⤵
- Executes dropped EXE
PID:4376 -
\??\c:\7nhhhn.exec:\7nhhhn.exe30⤵
- Executes dropped EXE
PID:3052 -
\??\c:\frrrlff.exec:\frrrlff.exe31⤵
- Executes dropped EXE
PID:3024 -
\??\c:\5ttnhh.exec:\5ttnhh.exe32⤵
- Executes dropped EXE
PID:868 -
\??\c:\ppvpp.exec:\ppvpp.exe33⤵
- Executes dropped EXE
PID:4604 -
\??\c:\tbhnhh.exec:\tbhnhh.exe34⤵
- Executes dropped EXE
PID:5080 -
\??\c:\ppppj.exec:\ppppj.exe35⤵
- Executes dropped EXE
PID:5052 -
\??\c:\5ddpj.exec:\5ddpj.exe36⤵
- Executes dropped EXE
PID:3296 -
\??\c:\9rlxrrl.exec:\9rlxrrl.exe37⤵
- Executes dropped EXE
PID:1236 -
\??\c:\hnhbtn.exec:\hnhbtn.exe38⤵
- Executes dropped EXE
PID:4724 -
\??\c:\vvpjd.exec:\vvpjd.exe39⤵
- Executes dropped EXE
PID:4392 -
\??\c:\3xxxxff.exec:\3xxxxff.exe40⤵
- Executes dropped EXE
PID:2004 -
\??\c:\tnnnnn.exec:\tnnnnn.exe41⤵
- Executes dropped EXE
PID:3260 -
\??\c:\hnhhtb.exec:\hnhhtb.exe42⤵
- Executes dropped EXE
PID:4852 -
\??\c:\1flxxxx.exec:\1flxxxx.exe43⤵
- Executes dropped EXE
PID:3264 -
\??\c:\rrxrffr.exec:\rrxrffr.exe44⤵
- Executes dropped EXE
PID:4820 -
\??\c:\nhbtnn.exec:\nhbtnn.exe45⤵
- Executes dropped EXE
PID:224 -
\??\c:\dvpdv.exec:\dvpdv.exe46⤵
- Executes dropped EXE
PID:1420 -
\??\c:\thtttt.exec:\thtttt.exe47⤵
- Executes dropped EXE
PID:2268 -
\??\c:\vdjdj.exec:\vdjdj.exe48⤵
- Executes dropped EXE
PID:836 -
\??\c:\bhnhbb.exec:\bhnhbb.exe49⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rlfffff.exec:\rlfffff.exe50⤵
- Executes dropped EXE
PID:3324 -
\??\c:\nhnhhh.exec:\nhnhhh.exe51⤵
- Executes dropped EXE
PID:4020 -
\??\c:\pjvpj.exec:\pjvpj.exe52⤵
- Executes dropped EXE
PID:2760 -
\??\c:\fxlflrl.exec:\fxlflrl.exe53⤵
- Executes dropped EXE
PID:1932 -
\??\c:\hnbbhn.exec:\hnbbhn.exe54⤵
- Executes dropped EXE
PID:3060 -
\??\c:\pjjdd.exec:\pjjdd.exe55⤵
- Executes dropped EXE
PID:1664 -
\??\c:\9vvjv.exec:\9vvjv.exe56⤵
- Executes dropped EXE
PID:2596 -
\??\c:\5rxrrrl.exec:\5rxrrrl.exe57⤵
- Executes dropped EXE
PID:1348 -
\??\c:\7tbbtt.exec:\7tbbtt.exe58⤵
- Executes dropped EXE
PID:4688 -
\??\c:\vpvpd.exec:\vpvpd.exe59⤵
- Executes dropped EXE
PID:2836 -
\??\c:\fxllllr.exec:\fxllllr.exe60⤵
- Executes dropped EXE
PID:4016 -
\??\c:\xlfffff.exec:\xlfffff.exe61⤵
- Executes dropped EXE
PID:4012 -
\??\c:\dppjd.exec:\dppjd.exe62⤵
- Executes dropped EXE
PID:4484 -
\??\c:\lfllxlr.exec:\lfllxlr.exe63⤵
- Executes dropped EXE
PID:4472 -
\??\c:\nhnhhn.exec:\nhnhhn.exe64⤵
- Executes dropped EXE
PID:1508 -
\??\c:\5ppjj.exec:\5ppjj.exe65⤵
- Executes dropped EXE
PID:3892 -
\??\c:\xlllfff.exec:\xlllfff.exe66⤵PID:1544
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe67⤵PID:4844
-
\??\c:\bbbbtb.exec:\bbbbtb.exe68⤵PID:5020
-
\??\c:\vjvvp.exec:\vjvvp.exe69⤵PID:3016
-
\??\c:\xxlxxrl.exec:\xxlxxrl.exe70⤵PID:4976
-
\??\c:\ttnnbh.exec:\ttnnbh.exe71⤵PID:4344
-
\??\c:\dvddd.exec:\dvddd.exe72⤵PID:684
-
\??\c:\llxxxxx.exec:\llxxxxx.exe73⤵PID:692
-
\??\c:\nhhhbh.exec:\nhhhbh.exe74⤵PID:1224
-
\??\c:\hhhnnb.exec:\hhhnnb.exe75⤵PID:2232
-
\??\c:\jpvpj.exec:\jpvpj.exe76⤵PID:4464
-
\??\c:\vdjdv.exec:\vdjdv.exe77⤵PID:2812
-
\??\c:\9tbtnn.exec:\9tbtnn.exe78⤵PID:5048
-
\??\c:\pvppv.exec:\pvppv.exe79⤵PID:4592
-
\??\c:\ppvpp.exec:\ppvpp.exe80⤵PID:3616
-
\??\c:\xrlllrr.exec:\xrlllrr.exe81⤵PID:428
-
\??\c:\thtttt.exec:\thtttt.exe82⤵PID:2824
-
\??\c:\bnbbtb.exec:\bnbbtb.exe83⤵PID:4848
-
\??\c:\9pjvv.exec:\9pjvv.exe84⤵PID:4264
-
\??\c:\xrxrffx.exec:\xrxrffx.exe85⤵PID:1364
-
\??\c:\7xxxrxr.exec:\7xxxrxr.exe86⤵PID:4392
-
\??\c:\thnhbb.exec:\thnhbb.exe87⤵PID:3916
-
\??\c:\5vdpj.exec:\5vdpj.exe88⤵PID:2164
-
\??\c:\vddvp.exec:\vddvp.exe89⤵PID:4560
-
\??\c:\1rlrrxr.exec:\1rlrrxr.exe90⤵PID:2416
-
\??\c:\hnnhhh.exec:\hnnhhh.exe91⤵PID:4772
-
\??\c:\bnnhth.exec:\bnnhth.exe92⤵PID:2268
-
\??\c:\ddvdd.exec:\ddvdd.exe93⤵PID:2076
-
\??\c:\7jjdv.exec:\7jjdv.exe94⤵PID:3212
-
\??\c:\7lrrrxx.exec:\7lrrrxx.exe95⤵PID:4992
-
\??\c:\hntnnh.exec:\hntnnh.exe96⤵PID:2104
-
\??\c:\hbhbtt.exec:\hbhbtt.exe97⤵PID:4104
-
\??\c:\jdjdd.exec:\jdjdd.exe98⤵PID:2892
-
\??\c:\7ddvv.exec:\7ddvv.exe99⤵PID:4896
-
\??\c:\rlfxrrx.exec:\rlfxrrx.exe100⤵PID:4552
-
\??\c:\thhhbb.exec:\thhhbb.exe101⤵PID:5032
-
\??\c:\9btnhh.exec:\9btnhh.exe102⤵PID:4688
-
\??\c:\jdjjp.exec:\jdjjp.exe103⤵PID:5084
-
\??\c:\rrlrffr.exec:\rrlrffr.exe104⤵PID:3796
-
\??\c:\tthtnn.exec:\tthtnn.exe105⤵PID:1892
-
\??\c:\ntttbb.exec:\ntttbb.exe106⤵PID:4544
-
\??\c:\9djjj.exec:\9djjj.exe107⤵PID:728
-
\??\c:\vjpjj.exec:\vjpjj.exe108⤵PID:3008
-
\??\c:\lflllrr.exec:\lflllrr.exe109⤵PID:448
-
\??\c:\nnhhhh.exec:\nnhhhh.exe110⤵PID:4072
-
\??\c:\nbnhbn.exec:\nbnhbn.exe111⤵PID:1464
-
\??\c:\ppvvv.exec:\ppvvv.exe112⤵PID:2952
-
\??\c:\vddjv.exec:\vddjv.exe113⤵PID:4568
-
\??\c:\lllffff.exec:\lllffff.exe114⤵PID:1032
-
\??\c:\hhhbnn.exec:\hhhbnn.exe115⤵PID:64
-
\??\c:\jdjdv.exec:\jdjdv.exe116⤵PID:3824
-
\??\c:\lrrfrrx.exec:\lrrfrrx.exe117⤵PID:4380
-
\??\c:\nnnhbb.exec:\nnnhbb.exe118⤵PID:1260
-
\??\c:\7vvvv.exec:\7vvvv.exe119⤵PID:2424
-
\??\c:\xxxrlrr.exec:\xxxrlrr.exe120⤵PID:3052
-
\??\c:\lfrlffx.exec:\lfrlffx.exe121⤵PID:5048
-
\??\c:\3hbbbb.exec:\3hbbbb.exe122⤵PID:5104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-