Analysis
- max time kernel
150s - max time network
108s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
20/05/2024, 02:11
Behavioral task
behavioral1
Sample
bc45c51faa69ff002d5c2df5c18ce1eef9a11ee3ddc7d4771123ddcfc4370c9e.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
- Target bc45c51faa69ff002d5c2df5c18ce1eef9a11ee3ddc7d4771123ddcfc4370c9e.exe
- Size 365KB
- Sample240520-cmaspafd41
- SHA256 bc45c51faa69ff002d5c2df5c18ce1eef9a11ee3ddc7d4771123ddcfc4370c9e
- MD5 850a0437d1d02a4cd10351906ba8a4ee
- SHA1 3b3cddeda926c039765540b0bbf6f75aa18f12e4
- SHA512 fca68674f611a21bb8d95c0c3eda35d9696b01cef7123b264e6ea96a8b42988553f257d1ef6517d109ae7a100cd3a15c0af7985017ad41cdedd7b5454128e57a
- SSDEEP 6144:Lcm4FmowdHoSHt251UriZFwu1b26X1wjdgyPPBD:R4wFHoSHYHUrAwqzQ7PPx
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2692-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5056-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3480-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3560-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1772-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3284-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3268-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3308-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2152-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/400-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3512-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2656-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2056-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1836-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/532-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2248-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/392-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1172-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2728-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/964-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3000-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3832-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4128-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1536-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2460-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2192-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3564-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3760-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3704-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1536-504-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3580-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4176-532-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-543-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3360-557-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4312-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2448-610-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/2692-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0005000000023284-3.dat UPX behavioral2/memory/5056-4-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2692-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233fa-9.dat UPX behavioral2/memory/5056-11-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233fb-12.dat UPX behavioral2/memory/3704-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1768-16-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233fd-27.dat UPX behavioral2/memory/3696-32-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233fe-31.dat UPX behavioral2/files/0x00070000000233ff-36.dat UPX behavioral2/files/0x0007000000023400-43.dat UPX behavioral2/memory/2460-49-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3192-55-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023403-59.dat UPX behavioral2/files/0x0007000000023404-64.dat UPX behavioral2/memory/4576-69-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3480-74-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023407-78.dat UPX behavioral2/memory/4580-83-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4580-87-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5116-91-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4848-99-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002340b-98.dat UPX behavioral2/files/0x000700000002340c-102.dat UPX behavioral2/files/0x00080000000233f7-109.dat UPX behavioral2/memory/3560-114-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1716-120-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002340f-124.dat UPX behavioral2/files/0x0007000000023412-138.dat UPX behavioral2/files/0x0007000000023413-143.dat UPX behavioral2/files/0x0007000000023414-148.dat UPX behavioral2/memory/1772-152-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023416-156.dat UPX behavioral2/files/0x0007000000023417-162.dat UPX behavioral2/memory/3284-165-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2692-183-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3268-202-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3308-217-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2044-220-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4712-244-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2152-263-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4556-273-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4556-276-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2352-281-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/400-292-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4888-327-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4336-330-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/396-343-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2884-349-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2056-375-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3732-403-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4336-424-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4336-421-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3512-429-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1020-406-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1424-400-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2656-385-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2056-378-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2244-360-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/396-346-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1836-336-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 5056 rxrxrfr.exe 1768 bhbbhh.exe 3704 frffxxx.exe 3760 1tbtbb.exe 3696 vddvd.exe 5040 xfrlfrf.exe 3564 bthhtn.exe 3516 fxflfff.exe 2460 nbhhbn.exe 3192 vpjdp.exe 1536 9lrlxlx.exe 3348 hhhbhb.exe 4576 ttbtht.exe 3480 dvvjd.exe 2004 flfxrxl.exe 4580 pdddv.exe 5116 lrfxxlx.exe 4848 bhbthh.exe 4128 vdjjj.exe 4952 tnntnb.exe 3560 pvdvp.exe 3832 hhbthn.exe 1716 jpppv.exe 5020 lrlffll.exe 3596 tbhhbb.exe 3000 jdpvd.exe 964 ddpvd.exe 2728 rflfxxx.exe 1772 btnhnn.exe 3636 dvvpj.exe 3304 9ttnbb.exe 3284 3djdv.exe 1172 frxrllf.exe 852 pjjdv.exe 1812 ppddd.exe 4108 nnnhbb.exe 392 jdjdd.exe 1152 ppvpj.exe 2692 rrfffxx.exe 3320 bbhbbb.exe 4088 djvdv.exe 1624 xxfflrl.exe 4716 5lrllll.exe 3696 nbbhbb.exe 1032 djpdj.exe 1424 xlrrllf.exe 3732 bnhhhb.exe 3268 vdvdp.exe 2248 5hhhbb.exe 1956 llrlxxx.exe 3708 bbnttt.exe 4888 vdppj.exe 3308 xlrrlrl.exe 2044 ntbttt.exe 3480 pvddj.exe 4816 1llflll.exe 2280 htnhbb.exe 2652 vppjv.exe 4508 xlrlrlr.exe 1520 bttnhh.exe 4828 hhhtnt.exe 2624 pvdvv.exe 2884 ffrrrrl.exe 2040 bnnhbb.exe -
resource yara_rule behavioral2/memory/2692-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0005000000023284-3.dat upx behavioral2/memory/5056-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2692-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fa-9.dat upx behavioral2/memory/5056-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fb-12.dat upx behavioral2/memory/3704-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1768-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fd-27.dat upx behavioral2/memory/3696-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fe-31.dat upx behavioral2/files/0x00070000000233ff-36.dat upx behavioral2/files/0x0007000000023400-43.dat upx behavioral2/memory/2460-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3192-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023403-59.dat upx behavioral2/files/0x0007000000023404-64.dat upx behavioral2/memory/4576-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3480-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023407-78.dat upx behavioral2/memory/4580-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4580-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5116-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4848-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340b-98.dat upx behavioral2/files/0x000700000002340c-102.dat upx behavioral2/files/0x00080000000233f7-109.dat upx behavioral2/memory/3560-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1716-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340f-124.dat upx behavioral2/files/0x0007000000023412-138.dat upx behavioral2/files/0x0007000000023413-143.dat upx behavioral2/files/0x0007000000023414-148.dat upx behavioral2/memory/1772-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-156.dat upx behavioral2/files/0x0007000000023417-162.dat upx behavioral2/memory/3284-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2692-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3268-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3308-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2044-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4712-244-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2152-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4556-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4556-276-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2352-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/400-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4888-327-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4336-330-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/396-343-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2884-349-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2056-375-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3732-403-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4336-424-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4336-421-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3512-429-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1020-406-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1424-400-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2656-385-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2056-378-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2244-360-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/396-346-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1836-336-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2692 wrote to memory of 5056 2692 bc45c51faa69ff002d5c2df5c18ce1eef9a11ee3ddc7d4771123ddcfc4370c9e.exe 83 PID 2692 wrote to memory of 5056 2692 bc45c51faa69ff002d5c2df5c18ce1eef9a11ee3ddc7d4771123ddcfc4370c9e.exe 83 PID 2692 wrote to memory of 5056 2692 bc45c51faa69ff002d5c2df5c18ce1eef9a11ee3ddc7d4771123ddcfc4370c9e.exe 83 PID 5056 wrote to memory of 1768 5056 rxrxrfr.exe 84 PID 5056 wrote to memory of 1768 5056 rxrxrfr.exe 84 PID 5056 wrote to memory of 1768 5056 rxrxrfr.exe 84 PID 1768 wrote to memory of 3704 1768 bhbbhh.exe 175 PID 1768 wrote to memory of 3704 1768 bhbbhh.exe 175 PID 1768 wrote to memory of 3704 1768 bhbbhh.exe 175 PID 3704 wrote to memory of 3760 3704 frffxxx.exe 86 PID 3704 wrote to memory of 3760 3704 frffxxx.exe 86 PID 3704 wrote to memory of 3760 3704 frffxxx.exe 86 PID 3760 wrote to memory of 3696 3760 1tbtbb.exe 129 PID 3760 wrote to memory of 3696 3760 1tbtbb.exe 129 PID 3760 wrote to memory of 3696 3760 1tbtbb.exe 129 PID 3696 wrote to memory of 5040 3696 vddvd.exe 88 PID 3696 wrote to memory of 5040 3696 vddvd.exe 88 PID 3696 wrote to memory of 5040 3696 vddvd.exe 88 PID 5040 wrote to memory of 3564 5040 xfrlfrf.exe 181 PID 5040 wrote to memory of 3564 5040 xfrlfrf.exe 181 PID 5040 wrote to memory of 3564 5040 xfrlfrf.exe 181 PID 3564 wrote to memory of 3516 3564 bthhtn.exe 90 PID 3564 wrote to memory of 3516 3564 bthhtn.exe 90 PID 3564 wrote to memory of 3516 3564 bthhtn.exe 90 PID 3516 wrote to memory of 2460 3516 fxflfff.exe 91 PID 3516 wrote to memory of 2460 3516 fxflfff.exe 91 PID 3516 wrote to memory of 2460 3516 fxflfff.exe 91 PID 2460 wrote to memory of 3192 2460 nbhhbn.exe 92 PID 2460 wrote to memory of 3192 2460 nbhhbn.exe 92 PID 2460 wrote to memory of 3192 2460 nbhhbn.exe 92 PID 3192 wrote to memory of 1536 3192 vpjdp.exe 93 PID 3192 wrote to memory of 1536 3192 vpjdp.exe 93 PID 3192 wrote to memory of 1536 3192 vpjdp.exe 93 PID 1536 wrote to memory of 3348 1536 9lrlxlx.exe 95 PID 1536 wrote to memory of 3348 1536 9lrlxlx.exe 95 PID 1536 wrote to memory of 3348 1536 9lrlxlx.exe 95 PID 3348 wrote to memory of 4576 3348 hhhbhb.exe 96 PID 3348 wrote to memory of 4576 3348 hhhbhb.exe 96 PID 3348 wrote to memory of 4576 3348 hhhbhb.exe 96 PID 4576 wrote to memory of 3480 4576 ttbtht.exe 97 PID 4576 wrote to memory of 3480 4576 ttbtht.exe 97 PID 4576 wrote to memory of 3480 4576 ttbtht.exe 97 PID 3480 wrote to memory of 2004 3480 dvvjd.exe 98 PID 3480 wrote to memory of 2004 3480 dvvjd.exe 98 PID 3480 wrote to memory of 2004 3480 dvvjd.exe 98 PID 2004 wrote to memory of 4580 2004 flfxrxl.exe 100 PID 2004 wrote to memory of 4580 2004 flfxrxl.exe 100 PID 2004 wrote to memory of 4580 2004 flfxrxl.exe 100 PID 4580 wrote to memory of 5116 4580 pdddv.exe 101 PID 4580 wrote to memory of 5116 4580 pdddv.exe 101 PID 4580 wrote to memory of 5116 4580 pdddv.exe 101 PID 5116 wrote to memory of 4848 5116 lrfxxlx.exe 103 PID 5116 wrote to memory of 4848 5116 lrfxxlx.exe 103 PID 5116 wrote to memory of 4848 5116 lrfxxlx.exe 103 PID 4848 wrote to memory of 4128 4848 bhbthh.exe 104 PID 4848 wrote to memory of 4128 4848 bhbthh.exe 104 PID 4848 wrote to memory of 4128 4848 bhbthh.exe 104 PID 4128 wrote to memory of 4952 4128 vdjjj.exe 105 PID 4128 wrote to memory of 4952 4128 vdjjj.exe 105 PID 4128 wrote to memory of 4952 4128 vdjjj.exe 105 PID 4952 wrote to memory of 3560 4952 tnntnb.exe 106 PID 4952 wrote to memory of 3560 4952 tnntnb.exe 106 PID 4952 wrote to memory of 3560 4952 tnntnb.exe 106 PID 3560 wrote to memory of 3832 3560 pvdvp.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc45c51faa69ff002d5c2df5c18ce1eef9a11ee3ddc7d4771123ddcfc4370c9e.exe"C:\Users\Admin\AppData\Local\Temp\bc45c51faa69ff002d5c2df5c18ce1eef9a11ee3ddc7d4771123ddcfc4370c9e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\rxrxrfr.exec:\rxrxrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\bhbbhh.exec:\bhbbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\frffxxx.exec:\frffxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\1tbtbb.exec:\1tbtbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\vddvd.exec:\vddvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\xfrlfrf.exec:\xfrlfrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\bthhtn.exec:\bthhtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\fxflfff.exec:\fxflfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\nbhhbn.exec:\nbhhbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\vpjdp.exec:\vpjdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\9lrlxlx.exec:\9lrlxlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\hhhbhb.exec:\hhhbhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\ttbtht.exec:\ttbtht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\dvvjd.exec:\dvvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\flfxrxl.exec:\flfxrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\pdddv.exec:\pdddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\lrfxxlx.exec:\lrfxxlx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\bhbthh.exec:\bhbthh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\vdjjj.exec:\vdjjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\tnntnb.exec:\tnntnb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\pvdvp.exec:\pvdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\hhbthn.exec:\hhbthn.exe23⤵
- Executes dropped EXE
PID:3832 -
\??\c:\jpppv.exec:\jpppv.exe24⤵
- Executes dropped EXE
PID:1716 -
\??\c:\lrlffll.exec:\lrlffll.exe25⤵
- Executes dropped EXE
PID:5020 -
\??\c:\tbhhbb.exec:\tbhhbb.exe26⤵
- Executes dropped EXE
PID:3596 -
\??\c:\jdpvd.exec:\jdpvd.exe27⤵
- Executes dropped EXE
PID:3000 -
\??\c:\ddpvd.exec:\ddpvd.exe28⤵
- Executes dropped EXE
PID:964 -
\??\c:\rflfxxx.exec:\rflfxxx.exe29⤵
- Executes dropped EXE
PID:2728 -
\??\c:\btnhnn.exec:\btnhnn.exe30⤵
- Executes dropped EXE
PID:1772 -
\??\c:\dvvpj.exec:\dvvpj.exe31⤵
- Executes dropped EXE
PID:3636 -
\??\c:\9ttnbb.exec:\9ttnbb.exe32⤵
- Executes dropped EXE
PID:3304 -
\??\c:\3djdv.exec:\3djdv.exe33⤵
- Executes dropped EXE
PID:3284 -
\??\c:\frxrllf.exec:\frxrllf.exe34⤵
- Executes dropped EXE
PID:1172 -
\??\c:\pjjdv.exec:\pjjdv.exe35⤵
- Executes dropped EXE
PID:852 -
\??\c:\ppddd.exec:\ppddd.exe36⤵
- Executes dropped EXE
PID:1812 -
\??\c:\nnnhbb.exec:\nnnhbb.exe37⤵
- Executes dropped EXE
PID:4108 -
\??\c:\jdjdd.exec:\jdjdd.exe38⤵
- Executes dropped EXE
PID:392 -
\??\c:\ppvpj.exec:\ppvpj.exe39⤵
- Executes dropped EXE
PID:1152 -
\??\c:\rrfffxx.exec:\rrfffxx.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\bbhbbb.exec:\bbhbbb.exe41⤵
- Executes dropped EXE
PID:3320 -
\??\c:\djvdv.exec:\djvdv.exe42⤵
- Executes dropped EXE
PID:4088 -
\??\c:\xxfflrl.exec:\xxfflrl.exe43⤵
- Executes dropped EXE
PID:1624 -
\??\c:\5lrllll.exec:\5lrllll.exe44⤵
- Executes dropped EXE
PID:4716 -
\??\c:\nbbhbb.exec:\nbbhbb.exe45⤵
- Executes dropped EXE
PID:3696 -
\??\c:\djpdj.exec:\djpdj.exe46⤵
- Executes dropped EXE
PID:1032 -
\??\c:\xlrrllf.exec:\xlrrllf.exe47⤵
- Executes dropped EXE
PID:1424 -
\??\c:\bnhhhb.exec:\bnhhhb.exe48⤵
- Executes dropped EXE
PID:3732 -
\??\c:\vdvdp.exec:\vdvdp.exe49⤵
- Executes dropped EXE
PID:3268 -
\??\c:\5hhhbb.exec:\5hhhbb.exe50⤵
- Executes dropped EXE
PID:2248 -
\??\c:\llrlxxx.exec:\llrlxxx.exe51⤵
- Executes dropped EXE
PID:1956 -
\??\c:\bbnttt.exec:\bbnttt.exe52⤵
- Executes dropped EXE
PID:3708 -
\??\c:\vdppj.exec:\vdppj.exe53⤵
- Executes dropped EXE
PID:4888 -
\??\c:\xlrrlrl.exec:\xlrrlrl.exe54⤵
- Executes dropped EXE
PID:3308 -
\??\c:\ntbttt.exec:\ntbttt.exe55⤵
- Executes dropped EXE
PID:2044 -
\??\c:\pvddj.exec:\pvddj.exe56⤵
- Executes dropped EXE
PID:3480 -
\??\c:\1llflll.exec:\1llflll.exe57⤵
- Executes dropped EXE
PID:4816 -
\??\c:\htnhbb.exec:\htnhbb.exe58⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vppjv.exec:\vppjv.exe59⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xlrlrlr.exec:\xlrlrlr.exe60⤵
- Executes dropped EXE
PID:4508 -
\??\c:\bttnhh.exec:\bttnhh.exe61⤵
- Executes dropped EXE
PID:1520 -
\??\c:\hhhtnt.exec:\hhhtnt.exe62⤵
- Executes dropped EXE
PID:4828 -
\??\c:\pvdvv.exec:\pvdvv.exe63⤵
- Executes dropped EXE
PID:2624 -
\??\c:\ffrrrrl.exec:\ffrrrrl.exe64⤵
- Executes dropped EXE
PID:2884 -
\??\c:\bnnhbb.exec:\bnnhbb.exe65⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vddvp.exec:\vddvp.exe66⤵PID:1228
-
\??\c:\xlrllfl.exec:\xlrllfl.exe67⤵PID:4712
-
\??\c:\bbbthb.exec:\bbbthb.exe68⤵PID:2992
-
\??\c:\jpppv.exec:\jpppv.exe69⤵PID:1300
-
\??\c:\ppjdv.exec:\ppjdv.exe70⤵PID:4188
-
\??\c:\lxffffr.exec:\lxffffr.exe71⤵PID:636
-
\??\c:\htthbb.exec:\htthbb.exe72⤵PID:4964
-
\??\c:\vjpdd.exec:\vjpdd.exe73⤵PID:3492
-
\??\c:\lrflrfl.exec:\lrflrfl.exe74⤵PID:2288
-
\??\c:\htthnb.exec:\htthnb.exe75⤵PID:2152
-
\??\c:\tnhbtt.exec:\tnhbtt.exe76⤵PID:4476
-
\??\c:\pvddd.exec:\pvddd.exe77⤵PID:4972
-
\??\c:\rllfxlx.exec:\rllfxlx.exe78⤵PID:3588
-
\??\c:\bbbhtt.exec:\bbbhtt.exe79⤵PID:4556
-
\??\c:\1tnbnb.exec:\1tnbnb.exe80⤵PID:4320
-
\??\c:\9tnthb.exec:\9tnthb.exe81⤵PID:2352
-
\??\c:\vpdjv.exec:\vpdjv.exe82⤵PID:852
-
\??\c:\pjjdd.exec:\pjjdd.exe83⤵PID:220
-
\??\c:\rfxrxxx.exec:\rfxrxxx.exe84⤵PID:4444
-
\??\c:\5ntbtt.exec:\5ntbtt.exe85⤵PID:4876
-
\??\c:\3htnnn.exec:\3htnnn.exe86⤵PID:400
-
\??\c:\dpjjd.exec:\dpjjd.exe87⤵PID:2972
-
\??\c:\frrrllf.exec:\frrrllf.exe88⤵PID:3020
-
\??\c:\lxlxllf.exec:\lxlxllf.exe89⤵PID:532
-
\??\c:\bthhbb.exec:\bthhbb.exe90⤵PID:2768
-
\??\c:\jddvv.exec:\jddvv.exe91⤵PID:3704
-
\??\c:\1dpjv.exec:\1dpjv.exe92⤵PID:3760
-
\??\c:\rrfxlrf.exec:\rrfxlrf.exe93⤵PID:4296
-
\??\c:\hhhtnn.exec:\hhhtnn.exe94⤵PID:1952
-
\??\c:\hbhntb.exec:\hbhntb.exe95⤵PID:3564
-
\??\c:\jpjvv.exec:\jpjvv.exe96⤵PID:1020
-
\??\c:\xrxxrxr.exec:\xrxxrxr.exe97⤵PID:4892
-
\??\c:\tthhbh.exec:\tthhbh.exe98⤵PID:3268
-
\??\c:\hbhtbt.exec:\hbhtbt.exe99⤵PID:2460
-
\??\c:\pppdv.exec:\pppdv.exe100⤵PID:368
-
\??\c:\dvvjd.exec:\dvvjd.exe101⤵PID:1536
-
\??\c:\lrxrxxf.exec:\lrxrxxf.exe102⤵PID:4888
-
\??\c:\frxrffr.exec:\frxrffr.exe103⤵PID:4336
-
\??\c:\hbbthb.exec:\hbbthb.exe104⤵PID:2044
-
\??\c:\vddpv.exec:\vddpv.exe105⤵PID:1248
-
\??\c:\rlxxxll.exec:\rlxxxll.exe106⤵PID:1836
-
\??\c:\lfrfxlx.exec:\lfrfxlx.exe107⤵PID:1200
-
\??\c:\hhhbbt.exec:\hhhbbt.exe108⤵PID:2420
-
\??\c:\1pdvj.exec:\1pdvj.exe109⤵PID:396
-
\??\c:\vdjjj.exec:\vdjjj.exe110⤵PID:2960
-
\??\c:\rffffff.exec:\rffffff.exe111⤵PID:2884
-
\??\c:\rffxlfx.exec:\rffxlfx.exe112⤵PID:908
-
\??\c:\tnnhbb.exec:\tnnhbb.exe113⤵PID:4872
-
\??\c:\dvjvd.exec:\dvjvd.exe114⤵PID:4712
-
\??\c:\9vpjd.exec:\9vpjd.exe115⤵PID:2552
-
\??\c:\rffxlxr.exec:\rffxlxr.exe116⤵PID:2244
-
\??\c:\bnhtnn.exec:\bnhtnn.exe117⤵PID:2520
-
\??\c:\hbnhth.exec:\hbnhth.exe118⤵PID:4052
-
\??\c:\dpdjp.exec:\dpdjp.exe119⤵PID:4584
-
\??\c:\nbhnhh.exec:\nbhnhh.exe120⤵PID:964
-
\??\c:\btbhtn.exec:\btbhtn.exe121⤵PID:2728
-
\??\c:\djjvd.exec:\djjvd.exe122⤵PID:2388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-