Analysis
- max time kernel
150s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
20/05/2024, 01:47
Behavioral task
behavioral1
Sample
b2d7e73dd357755604ad434784fa1cce11d24cf927cc785e8b9b69a6f449eceb.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target b2d7e73dd357755604ad434784fa1cce11d24cf927cc785e8b9b69a6f449eceb.exe
- Size 65KB
- Sample240520-b7l6saee2t
- SHA256 b2d7e73dd357755604ad434784fa1cce11d24cf927cc785e8b9b69a6f449eceb
- MD5 37a74ae49ca41f8aa52921951e233803
- SHA1 8c3f7cb8c88818084f943a50ed2d6b8cae4539a3
- SHA512 69eb83099700b8ff5d10a830a52e61761a6740f5d6c81ee636a448e8c96f6733c58f426542e0d15016980bac4bae97f6fbe1ee20e6f1fe789698d16ac01429d9
- SSDEEP 1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXN8dI4I9c1CLcxdw/G:khOmTsF93UYfwC6GIoutpYHrgow/G
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1604-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/868-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2700-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1260-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3780-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3812-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1780-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4112-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4532-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3736-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2676-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4188-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4052-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2948-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/556-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1100-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/816-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2416-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1816-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2700-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5088-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1432-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2760-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2748-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3936-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2808-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2572-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1384-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/908-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2808-509-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-523-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1128-573-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4112-606-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-670-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4196-756-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2252-844-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-1008-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-1028-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-1112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/1604-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023270-3.dat UPX behavioral2/memory/1604-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/868-10-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00090000000233a6-12.dat UPX behavioral2/files/0x00070000000233b2-13.dat UPX behavioral2/memory/1524-21-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233b3-23.dat UPX behavioral2/memory/2700-19-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233b4-27.dat UPX behavioral2/memory/1260-29-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4148-31-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233b5-34.dat UPX behavioral2/memory/4148-36-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3196-41-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233b6-40.dat UPX behavioral2/files/0x00070000000233b7-45.dat UPX behavioral2/memory/4376-48-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233b8-51.dat UPX behavioral2/memory/5004-54-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2008-55-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233b9-58.dat UPX behavioral2/memory/2008-61-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3780-67-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ba-65.dat UPX behavioral2/files/0x00070000000233bb-70.dat UPX behavioral2/memory/3020-72-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233bc-76.dat UPX behavioral2/files/0x00070000000233bd-82.dat UPX behavioral2/memory/3812-85-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233be-89.dat UPX behavioral2/files/0x00070000000233bf-92.dat UPX behavioral2/memory/1780-94-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233c0-98.dat UPX behavioral2/memory/4112-99-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233c1-105.dat UPX behavioral2/files/0x00070000000233c2-109.dat UPX behavioral2/memory/4532-112-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233c3-115.dat UPX behavioral2/files/0x00070000000233c4-120.dat UPX behavioral2/files/0x00070000000233c5-124.dat UPX behavioral2/memory/3736-126-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233c6-130.dat UPX behavioral2/memory/2676-139-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233c8-142.dat UPX behavioral2/files/0x000a0000000233ac-136.dat UPX behavioral2/files/0x00070000000233c9-147.dat UPX behavioral2/files/0x00070000000233ca-151.dat UPX behavioral2/memory/4188-159-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233cb-157.dat UPX behavioral2/memory/4052-161-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233cc-164.dat UPX behavioral2/files/0x00070000000233cd-169.dat UPX behavioral2/files/0x00070000000233ce-175.dat UPX behavioral2/files/0x00070000000233cf-179.dat UPX behavioral2/memory/4764-178-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2948-183-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/556-192-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2012-202-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1100-206-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/816-213-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2416-215-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1816-221-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4912-223-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 868 lflrxll.exe 2700 bntbnn.exe 1524 rffxrll.exe 1260 xrxfrlx.exe 4148 pddjj.exe 3196 lxfxlrx.exe 4376 hhnbbt.exe 5004 1jddd.exe 2008 3lfrffr.exe 3780 rlxxxff.exe 3020 9pvjj.exe 4068 xflllrx.exe 5108 tbnbnh.exe 3812 vvvvv.exe 1780 xlffflf.exe 4112 nntnhn.exe 3684 5jvvp.exe 4272 xxfxffx.exe 4532 xxxrfrl.exe 4896 nnnhtn.exe 3736 jjddj.exe 2156 1lrrlrr.exe 3960 xxfxxfx.exe 2676 nnbbbb.exe 2308 ppdvj.exe 2444 jdpdp.exe 4188 rlffflx.exe 4052 hbbtnt.exe 4076 thhbhh.exe 2936 llfxxrr.exe 4764 lrffxxx.exe 2948 7hnttt.exe 3464 pdppj.exe 556 fxxrlll.exe 3248 lxflllr.exe 1492 bthhnh.exe 2012 jvpdv.exe 1100 xxffrlr.exe 3932 xlrrlfr.exe 816 hbtntt.exe 2416 djjvp.exe 1816 xxfrflf.exe 4912 tbhnth.exe 4120 5hnhbh.exe 2700 9flfxxx.exe 1260 ffxxxxx.exe 2608 nnnhhh.exe 4576 7ttnbb.exe 3196 jjjdd.exe 2224 lllffll.exe 4724 xflfffl.exe 5088 9btbtb.exe 1432 vdvpj.exe 2096 1pvdj.exe 1660 frrrffr.exe 4012 btbbtt.exe 2760 nbnhtb.exe 3252 dpvvv.exe 4832 fxlrrlr.exe 4508 ntbntn.exe 4380 btnttt.exe 4816 djjpp.exe 5116 9flrrll.exe 2748 flxxrxr.exe -
resource yara_rule behavioral2/memory/1604-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023270-3.dat upx behavioral2/memory/1604-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/868-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233a6-12.dat upx behavioral2/files/0x00070000000233b2-13.dat upx behavioral2/memory/1524-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233b3-23.dat upx behavioral2/memory/2700-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233b4-27.dat upx behavioral2/memory/1260-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4148-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233b5-34.dat upx behavioral2/memory/4148-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3196-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233b6-40.dat upx behavioral2/files/0x00070000000233b7-45.dat upx behavioral2/memory/4376-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233b8-51.dat upx behavioral2/memory/5004-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2008-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233b9-58.dat upx behavioral2/memory/2008-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3780-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ba-65.dat upx behavioral2/files/0x00070000000233bb-70.dat upx behavioral2/memory/3020-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233bc-76.dat upx behavioral2/files/0x00070000000233bd-82.dat upx behavioral2/memory/3812-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233be-89.dat upx behavioral2/files/0x00070000000233bf-92.dat upx behavioral2/memory/1780-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c0-98.dat upx behavioral2/memory/4112-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c1-105.dat upx behavioral2/files/0x00070000000233c2-109.dat upx behavioral2/memory/4532-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c3-115.dat upx behavioral2/files/0x00070000000233c4-120.dat upx behavioral2/files/0x00070000000233c5-124.dat upx behavioral2/memory/3736-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c6-130.dat upx behavioral2/memory/2676-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c8-142.dat upx behavioral2/files/0x000a0000000233ac-136.dat upx behavioral2/files/0x00070000000233c9-147.dat upx behavioral2/files/0x00070000000233ca-151.dat upx behavioral2/memory/4188-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233cb-157.dat upx behavioral2/memory/4052-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233cc-164.dat upx behavioral2/files/0x00070000000233cd-169.dat upx behavioral2/files/0x00070000000233ce-175.dat upx behavioral2/files/0x00070000000233cf-179.dat upx behavioral2/memory/4764-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2948-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/556-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2012-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1100-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/816-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2416-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1816-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4912-223-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1604 wrote to memory of 868 1604 b2d7e73dd357755604ad434784fa1cce11d24cf927cc785e8b9b69a6f449eceb.exe 83 PID 1604 wrote to memory of 868 1604 b2d7e73dd357755604ad434784fa1cce11d24cf927cc785e8b9b69a6f449eceb.exe 83 PID 1604 wrote to memory of 868 1604 b2d7e73dd357755604ad434784fa1cce11d24cf927cc785e8b9b69a6f449eceb.exe 83 PID 868 wrote to memory of 2700 868 lflrxll.exe 84 PID 868 wrote to memory of 2700 868 lflrxll.exe 84 PID 868 wrote to memory of 2700 868 lflrxll.exe 84 PID 2700 wrote to memory of 1524 2700 bntbnn.exe 85 PID 2700 wrote to memory of 1524 2700 bntbnn.exe 85 PID 2700 wrote to memory of 1524 2700 bntbnn.exe 85 PID 1524 wrote to memory of 1260 1524 rffxrll.exe 86 PID 1524 wrote to memory of 1260 1524 rffxrll.exe 86 PID 1524 wrote to memory of 1260 1524 rffxrll.exe 86 PID 1260 wrote to memory of 4148 1260 xrxfrlx.exe 87 PID 1260 wrote to memory of 4148 1260 xrxfrlx.exe 87 PID 1260 wrote to memory of 4148 1260 xrxfrlx.exe 87 PID 4148 wrote to memory of 3196 4148 pddjj.exe 88 PID 4148 wrote to memory of 3196 4148 pddjj.exe 88 PID 4148 wrote to memory of 3196 4148 pddjj.exe 88 PID 3196 wrote to memory of 4376 3196 lxfxlrx.exe 89 PID 3196 wrote to memory of 4376 3196 lxfxlrx.exe 89 PID 3196 wrote to memory of 4376 3196 lxfxlrx.exe 89 PID 4376 wrote to memory of 5004 4376 hhnbbt.exe 90 PID 4376 wrote to memory of 5004 4376 hhnbbt.exe 90 PID 4376 wrote to memory of 5004 4376 hhnbbt.exe 90 PID 5004 wrote to memory of 2008 5004 1jddd.exe 91 PID 5004 wrote to memory of 2008 5004 1jddd.exe 91 PID 5004 wrote to memory of 2008 5004 1jddd.exe 91 PID 2008 wrote to memory of 3780 2008 3lfrffr.exe 92 PID 2008 wrote to memory of 3780 2008 3lfrffr.exe 92 PID 2008 wrote to memory of 3780 2008 3lfrffr.exe 92 PID 3780 wrote to memory of 3020 3780 rlxxxff.exe 93 PID 3780 wrote to memory of 3020 3780 rlxxxff.exe 93 PID 3780 wrote to memory of 3020 3780 rlxxxff.exe 93 PID 3020 wrote to memory of 4068 3020 9pvjj.exe 94 PID 3020 wrote to memory of 4068 3020 9pvjj.exe 94 PID 3020 wrote to memory of 4068 3020 9pvjj.exe 94 PID 4068 wrote to memory of 5108 4068 xflllrx.exe 95 PID 4068 wrote to memory of 5108 4068 xflllrx.exe 95 PID 4068 wrote to memory of 5108 4068 xflllrx.exe 95 PID 5108 wrote to memory of 3812 5108 tbnbnh.exe 96 PID 5108 wrote to memory of 3812 5108 tbnbnh.exe 96 PID 5108 wrote to memory of 3812 5108 tbnbnh.exe 96 PID 3812 wrote to memory of 1780 3812 vvvvv.exe 97 PID 3812 wrote to memory of 1780 3812 vvvvv.exe 97 PID 3812 wrote to memory of 1780 3812 vvvvv.exe 97 PID 1780 wrote to memory of 4112 1780 xlffflf.exe 99 PID 1780 wrote to memory of 4112 1780 xlffflf.exe 99 PID 1780 wrote to memory of 4112 1780 xlffflf.exe 99 PID 4112 wrote to memory of 3684 4112 nntnhn.exe 100 PID 4112 wrote to memory of 3684 4112 nntnhn.exe 100 PID 4112 wrote to memory of 3684 4112 nntnhn.exe 100 PID 3684 wrote to memory of 4272 3684 5jvvp.exe 101 PID 3684 wrote to memory of 4272 3684 5jvvp.exe 101 PID 3684 wrote to memory of 4272 3684 5jvvp.exe 101 PID 4272 wrote to memory of 4532 4272 xxfxffx.exe 102 PID 4272 wrote to memory of 4532 4272 xxfxffx.exe 102 PID 4272 wrote to memory of 4532 4272 xxfxffx.exe 102 PID 4532 wrote to memory of 4896 4532 xxxrfrl.exe 103 PID 4532 wrote to memory of 4896 4532 xxxrfrl.exe 103 PID 4532 wrote to memory of 4896 4532 xxxrfrl.exe 103 PID 4896 wrote to memory of 3736 4896 nnnhtn.exe 104 PID 4896 wrote to memory of 3736 4896 nnnhtn.exe 104 PID 4896 wrote to memory of 3736 4896 nnnhtn.exe 104 PID 3736 wrote to memory of 2156 3736 jjddj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2d7e73dd357755604ad434784fa1cce11d24cf927cc785e8b9b69a6f449eceb.exe"C:\Users\Admin\AppData\Local\Temp\b2d7e73dd357755604ad434784fa1cce11d24cf927cc785e8b9b69a6f449eceb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\lflrxll.exec:\lflrxll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\bntbnn.exec:\bntbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\rffxrll.exec:\rffxrll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\xrxfrlx.exec:\xrxfrlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\pddjj.exec:\pddjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\lxfxlrx.exec:\lxfxlrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\hhnbbt.exec:\hhnbbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\1jddd.exec:\1jddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\3lfrffr.exec:\3lfrffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\rlxxxff.exec:\rlxxxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\9pvjj.exec:\9pvjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\xflllrx.exec:\xflllrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\tbnbnh.exec:\tbnbnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\vvvvv.exec:\vvvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\xlffflf.exec:\xlffflf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\nntnhn.exec:\nntnhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\5jvvp.exec:\5jvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\xxfxffx.exec:\xxfxffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\xxxrfrl.exec:\xxxrfrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\nnnhtn.exec:\nnnhtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\jjddj.exec:\jjddj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\1lrrlrr.exec:\1lrrlrr.exe23⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xxfxxfx.exec:\xxfxxfx.exe24⤵
- Executes dropped EXE
PID:3960 -
\??\c:\nnbbbb.exec:\nnbbbb.exe25⤵
- Executes dropped EXE
PID:2676 -
\??\c:\ppdvj.exec:\ppdvj.exe26⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jdpdp.exec:\jdpdp.exe27⤵
- Executes dropped EXE
PID:2444 -
\??\c:\rlffflx.exec:\rlffflx.exe28⤵
- Executes dropped EXE
PID:4188 -
\??\c:\hbbtnt.exec:\hbbtnt.exe29⤵
- Executes dropped EXE
PID:4052 -
\??\c:\thhbhh.exec:\thhbhh.exe30⤵
- Executes dropped EXE
PID:4076 -
\??\c:\llfxxrr.exec:\llfxxrr.exe31⤵
- Executes dropped EXE
PID:2936 -
\??\c:\lrffxxx.exec:\lrffxxx.exe32⤵
- Executes dropped EXE
PID:4764 -
\??\c:\7hnttt.exec:\7hnttt.exe33⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pdppj.exec:\pdppj.exe34⤵
- Executes dropped EXE
PID:3464 -
\??\c:\fxxrlll.exec:\fxxrlll.exe35⤵
- Executes dropped EXE
PID:556 -
\??\c:\lxflllr.exec:\lxflllr.exe36⤵
- Executes dropped EXE
PID:3248 -
\??\c:\bthhnh.exec:\bthhnh.exe37⤵
- Executes dropped EXE
PID:1492 -
\??\c:\jvpdv.exec:\jvpdv.exe38⤵
- Executes dropped EXE
PID:2012 -
\??\c:\xxffrlr.exec:\xxffrlr.exe39⤵
- Executes dropped EXE
PID:1100 -
\??\c:\xlrrlfr.exec:\xlrrlfr.exe40⤵
- Executes dropped EXE
PID:3932 -
\??\c:\hbtntt.exec:\hbtntt.exe41⤵
- Executes dropped EXE
PID:816 -
\??\c:\djjvp.exec:\djjvp.exe42⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xxfrflf.exec:\xxfrflf.exe43⤵
- Executes dropped EXE
PID:1816 -
\??\c:\tbhnth.exec:\tbhnth.exe44⤵
- Executes dropped EXE
PID:4912 -
\??\c:\5hnhbh.exec:\5hnhbh.exe45⤵
- Executes dropped EXE
PID:4120 -
\??\c:\9flfxxx.exec:\9flfxxx.exe46⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ffxxxxx.exec:\ffxxxxx.exe47⤵
- Executes dropped EXE
PID:1260 -
\??\c:\nnnhhh.exec:\nnnhhh.exe48⤵
- Executes dropped EXE
PID:2608 -
\??\c:\7ttnbb.exec:\7ttnbb.exe49⤵
- Executes dropped EXE
PID:4576 -
\??\c:\jjjdd.exec:\jjjdd.exe50⤵
- Executes dropped EXE
PID:3196 -
\??\c:\lllffll.exec:\lllffll.exe51⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xflfffl.exec:\xflfffl.exe52⤵
- Executes dropped EXE
PID:4724 -
\??\c:\9btbtb.exec:\9btbtb.exe53⤵
- Executes dropped EXE
PID:5088 -
\??\c:\vdvpj.exec:\vdvpj.exe54⤵
- Executes dropped EXE
PID:1432 -
\??\c:\1pvdj.exec:\1pvdj.exe55⤵
- Executes dropped EXE
PID:2096 -
\??\c:\frrrffr.exec:\frrrffr.exe56⤵
- Executes dropped EXE
PID:1660 -
\??\c:\btbbtt.exec:\btbbtt.exe57⤵
- Executes dropped EXE
PID:4012 -
\??\c:\nbnhtb.exec:\nbnhtb.exe58⤵
- Executes dropped EXE
PID:2760 -
\??\c:\dpvvv.exec:\dpvvv.exe59⤵
- Executes dropped EXE
PID:3252 -
\??\c:\fxlrrlr.exec:\fxlrrlr.exe60⤵
- Executes dropped EXE
PID:4832 -
\??\c:\ntbntn.exec:\ntbntn.exe61⤵
- Executes dropped EXE
PID:4508 -
\??\c:\btnttt.exec:\btnttt.exe62⤵
- Executes dropped EXE
PID:4380 -
\??\c:\djjpp.exec:\djjpp.exe63⤵
- Executes dropped EXE
PID:4816 -
\??\c:\9flrrll.exec:\9flrrll.exe64⤵
- Executes dropped EXE
PID:5116 -
\??\c:\flxxrxr.exec:\flxxrxr.exe65⤵
- Executes dropped EXE
PID:2748 -
\??\c:\thnhnn.exec:\thnhnn.exe66⤵PID:3964
-
\??\c:\vpppd.exec:\vpppd.exe67⤵PID:3632
-
\??\c:\5jvpj.exec:\5jvpj.exe68⤵PID:1880
-
\??\c:\7hbtnn.exec:\7hbtnn.exe69⤵PID:3692
-
\??\c:\5ddvv.exec:\5ddvv.exe70⤵PID:2384
-
\??\c:\xrlflrx.exec:\xrlflrx.exe71⤵PID:4584
-
\??\c:\btnhnb.exec:\btnhnb.exe72⤵PID:612
-
\??\c:\vpjpd.exec:\vpjpd.exe73⤵PID:2676
-
\??\c:\ppppj.exec:\ppppj.exe74⤵PID:4644
-
\??\c:\xlxlfrf.exec:\xlxlfrf.exe75⤵PID:4844
-
\??\c:\bhhbbt.exec:\bhhbbt.exe76⤵PID:4480
-
\??\c:\jddvv.exec:\jddvv.exe77⤵PID:1872
-
\??\c:\pddvd.exec:\pddvd.exe78⤵PID:2472
-
\??\c:\hnhbhn.exec:\hnhbhn.exe79⤵PID:2488
-
\??\c:\bnttnh.exec:\bnttnh.exe80⤵PID:1584
-
\??\c:\ddpdd.exec:\ddpdd.exe81⤵PID:3936
-
\??\c:\jppjd.exec:\jppjd.exe82⤵PID:2808
-
\??\c:\rfxfrfr.exec:\rfxfrfr.exe83⤵PID:3596
-
\??\c:\bntnnn.exec:\bntnnn.exe84⤵PID:1080
-
\??\c:\bttbbn.exec:\bttbbn.exe85⤵PID:3048
-
\??\c:\pjdvv.exec:\pjdvv.exe86⤵PID:1416
-
\??\c:\llflllr.exec:\llflllr.exe87⤵PID:4596
-
\??\c:\rrlrlxl.exec:\rrlrlxl.exe88⤵PID:4560
-
\??\c:\rlxrllf.exec:\rlxrllf.exe89⤵PID:4920
-
\??\c:\bbhhht.exec:\bbhhht.exe90⤵PID:2616
-
\??\c:\vvvvp.exec:\vvvvp.exe91⤵PID:816
-
\??\c:\vpjdd.exec:\vpjdd.exe92⤵PID:1604
-
\??\c:\xxxffff.exec:\xxxffff.exe93⤵PID:3560
-
\??\c:\btnhbb.exec:\btnhbb.exe94⤵PID:2932
-
\??\c:\pjddd.exec:\pjddd.exe95⤵PID:1848
-
\??\c:\pddvp.exec:\pddvp.exe96⤵PID:396
-
\??\c:\lffffff.exec:\lffffff.exe97⤵PID:64
-
\??\c:\flrfxrr.exec:\flrfxrr.exe98⤵PID:4556
-
\??\c:\nbnnhh.exec:\nbnnhh.exe99⤵PID:1260
-
\??\c:\ddvdd.exec:\ddvdd.exe100⤵PID:2780
-
\??\c:\djvdj.exec:\djvdj.exe101⤵PID:3112
-
\??\c:\hntbnn.exec:\hntbnn.exe102⤵PID:2924
-
\??\c:\pjpvd.exec:\pjpvd.exe103⤵PID:5004
-
\??\c:\vpppv.exec:\vpppv.exe104⤵PID:4028
-
\??\c:\lrrlffx.exec:\lrrlffx.exe105⤵PID:4812
-
\??\c:\xfxxrfl.exec:\xfxxrfl.exe106⤵PID:2008
-
\??\c:\ntbbtt.exec:\ntbbtt.exe107⤵PID:2612
-
\??\c:\lxxrllf.exec:\lxxrllf.exe108⤵PID:3280
-
\??\c:\htbtnn.exec:\htbtnn.exe109⤵PID:4840
-
\??\c:\vpvjv.exec:\vpvjv.exe110⤵PID:3500
-
\??\c:\vjdvj.exec:\vjdvj.exe111⤵PID:920
-
\??\c:\xrflflf.exec:\xrflflf.exe112⤵PID:5108
-
\??\c:\htnbbb.exec:\htnbbb.exe113⤵PID:2572
-
\??\c:\nnhhbb.exec:\nnhhbb.exe114⤵PID:1084
-
\??\c:\vdjdd.exec:\vdjdd.exe115⤵PID:412
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe116⤵PID:4688
-
\??\c:\ttttbb.exec:\ttttbb.exe117⤵PID:3684
-
\??\c:\5tnhtt.exec:\5tnhtt.exe118⤵PID:4432
-
\??\c:\3jdjj.exec:\3jdjj.exe119⤵PID:4896
-
\??\c:\ppddj.exec:\ppddj.exe120⤵PID:1384
-
\??\c:\frxrllf.exec:\frxrllf.exe121⤵PID:1464
-
\??\c:\hhnhbh.exec:\hhnhbh.exe122⤵PID:4340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-