Analysis
- max time kernel
148s - max time network
112s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
20/05/2024, 03:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d39cb9ba600f1561638f51e2f3c393adf3cbd4d3fa84451d3729c2f695f36531.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
- Target d39cb9ba600f1561638f51e2f3c393adf3cbd4d3fa84451d3729c2f695f36531.exe
- Size 329KB
- Sample240520-dnenpsgh62
- SHA256 d39cb9ba600f1561638f51e2f3c393adf3cbd4d3fa84451d3729c2f695f36531
- MD5 910a23077d81eefd6b6a9e2fc9cb4561
- SHA1 31a3fbfebf9e651d31f8f2072079774c4f10176d
- SHA512 7b2d1a3448c1eb9e3c472e9527ce8fc8710f73f847c7b609f6cd09b35aad8939066ae9724f2db2b1eac843af6dee36522be64b65c9976f4002bf57212acf8a59
- SSDEEP 6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhb:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTL
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3164-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3344-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/720-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/688-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1516-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/720-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/756-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/428-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-763-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-807-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-811-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-815-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/3164-5-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3980-10-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4744-19-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4828-20-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4648-43-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4276-36-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1032-48-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4928-31-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3344-25-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/720-55-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4936-62-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2968-67-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3184-77-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4844-82-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3256-89-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2384-100-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4368-108-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4240-122-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1312-127-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1312-132-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3512-134-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3512-140-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4908-141-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/688-150-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1624-156-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1612-163-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4384-170-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4384-176-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3220-190-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2084-194-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4064-198-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/228-199-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4752-206-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4416-213-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4428-217-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2220-221-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/532-223-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1516-229-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4928-237-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/5004-243-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3584-251-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/720-257-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4060-262-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3592-261-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4060-266-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4872-277-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2480-278-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2588-285-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/756-292-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/756-296-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4592-300-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3332-307-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2960-315-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3024-324-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4672-343-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1608-344-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2460-347-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4712-358-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2316-380-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4388-388-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4492-394-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1944-405-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4796-426-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4652-439-0x0000000000400000-0x000000000042A000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 3980 vdpjv.exe 4744 fxxrllf.exe 4828 tbntth.exe 3344 djdjj.exe 4928 rlrrrxf.exe 4276 nbbnhb.exe 4648 hhhbtn.exe 1032 pddvv.exe 720 tnbhnt.exe 4936 xflrxrr.exe 2968 htnhbh.exe 3184 lrrrffx.exe 4844 bhnhtb.exe 3256 ddjjp.exe 3056 5ntntb.exe 2384 7jpdv.exe 1412 lxrrfrl.exe 4368 nnhbtn.exe 5044 9dvpd.exe 4552 7xlxxrl.exe 4240 bbnhbb.exe 1312 dvvdv.exe 3512 htbtnh.exe 4908 dpvvp.exe 688 1rrllll.exe 1624 btnbnb.exe 1612 rxrfffx.exe 3796 htbttn.exe 4384 htttht.exe 1132 lxxxrrf.exe 4016 tntthn.exe 3220 lflfflf.exe 2084 djvjp.exe 4064 xrrlrxr.exe 228 xfffxxx.exe 4752 ttbbtn.exe 3416 ppdvd.exe 4416 7vvpp.exe 4428 xlrrlrr.exe 2220 tnhbnt.exe 532 jvddd.exe 1516 pjpvd.exe 364 ffrlrlr.exe 5028 hbhhhh.exe 4928 vpvvv.exe 5004 rxllxxx.exe 4000 nntbbh.exe 4648 pvvpp.exe 3584 lfrllxx.exe 720 bttttb.exe 3592 jvdjv.exe 4060 frfxxff.exe 4876 hthbhb.exe 4836 vvvvp.exe 4872 llrfxxf.exe 2480 tbnnth.exe 2588 dppjd.exe 1644 lflffll.exe 3568 nbnnhn.exe 756 jpddp.exe 4292 llrrxfl.exe 4592 nbntbh.exe 3996 nnbhbt.exe 3332 jvppp.exe -
resource yara_rule behavioral2/memory/3164-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3344-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/720-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/688-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1516-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/720-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-439-0x0000000000400000-0x000000000042A000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3164 wrote to memory of 3980 3164 d39cb9ba600f1561638f51e2f3c393adf3cbd4d3fa84451d3729c2f695f36531.exe 82 PID 3164 wrote to memory of 3980 3164 d39cb9ba600f1561638f51e2f3c393adf3cbd4d3fa84451d3729c2f695f36531.exe 82 PID 3164 wrote to memory of 3980 3164 d39cb9ba600f1561638f51e2f3c393adf3cbd4d3fa84451d3729c2f695f36531.exe 82 PID 3980 wrote to memory of 4744 3980 vdpjv.exe 83 PID 3980 wrote to memory of 4744 3980 vdpjv.exe 83 PID 3980 wrote to memory of 4744 3980 vdpjv.exe 83 PID 4744 wrote to memory of 4828 4744 fxxrllf.exe 84 PID 4744 wrote to memory of 4828 4744 fxxrllf.exe 84 PID 4744 wrote to memory of 4828 4744 fxxrllf.exe 84 PID 4828 wrote to memory of 3344 4828 tbntth.exe 85 PID 4828 wrote to memory of 3344 4828 tbntth.exe 85 PID 4828 wrote to memory of 3344 4828 tbntth.exe 85 PID 3344 wrote to memory of 4928 3344 djdjj.exe 86 PID 3344 wrote to memory of 4928 3344 djdjj.exe 86 PID 3344 wrote to memory of 4928 3344 djdjj.exe 86 PID 4928 wrote to memory of 4276 4928 rlrrrxf.exe 87 PID 4928 wrote to memory of 4276 4928 rlrrrxf.exe 87 PID 4928 wrote to memory of 4276 4928 rlrrrxf.exe 87 PID 4276 wrote to memory of 4648 4276 nbbnhb.exe 88 PID 4276 wrote to memory of 4648 4276 nbbnhb.exe 88 PID 4276 wrote to memory of 4648 4276 nbbnhb.exe 88 PID 4648 wrote to memory of 1032 4648 hhhbtn.exe 89 PID 4648 wrote to memory of 1032 4648 hhhbtn.exe 89 PID 4648 wrote to memory of 1032 4648 hhhbtn.exe 89 PID 1032 wrote to memory of 720 1032 pddvv.exe 90 PID 1032 wrote to memory of 720 1032 pddvv.exe 90 PID 1032 wrote to memory of 720 1032 pddvv.exe 90 PID 720 wrote to memory of 4936 720 tnbhnt.exe 91 PID 720 wrote to memory of 4936 720 tnbhnt.exe 91 PID 720 wrote to memory of 4936 720 tnbhnt.exe 91 PID 4936 wrote to memory of 2968 4936 xflrxrr.exe 92 PID 4936 wrote to memory of 2968 4936 xflrxrr.exe 92 PID 4936 wrote to memory of 2968 4936 xflrxrr.exe 92 PID 2968 wrote to memory of 3184 2968 htnhbh.exe 93 PID 2968 wrote to memory of 3184 2968 htnhbh.exe 93 PID 2968 wrote to memory of 3184 2968 htnhbh.exe 93 PID 3184 wrote to memory of 4844 3184 lrrrffx.exe 94 PID 3184 wrote to memory of 4844 3184 lrrrffx.exe 94 PID 3184 wrote to memory of 4844 3184 lrrrffx.exe 94 PID 4844 wrote to memory of 3256 4844 bhnhtb.exe 95 PID 4844 wrote to memory of 3256 4844 bhnhtb.exe 95 PID 4844 wrote to memory of 3256 4844 bhnhtb.exe 95 PID 3256 wrote to memory of 3056 3256 ddjjp.exe 96 PID 3256 wrote to memory of 3056 3256 ddjjp.exe 96 PID 3256 wrote to memory of 3056 3256 ddjjp.exe 96 PID 3056 wrote to memory of 2384 3056 5ntntb.exe 97 PID 3056 wrote to memory of 2384 3056 5ntntb.exe 97 PID 3056 wrote to memory of 2384 3056 5ntntb.exe 97 PID 2384 wrote to memory of 1412 2384 7jpdv.exe 98 PID 2384 wrote to memory of 1412 2384 7jpdv.exe 98 PID 2384 wrote to memory of 1412 2384 7jpdv.exe 98 PID 1412 wrote to memory of 4368 1412 lxrrfrl.exe 99 PID 1412 wrote to memory of 4368 1412 lxrrfrl.exe 99 PID 1412 wrote to memory of 4368 1412 lxrrfrl.exe 99 PID 4368 wrote to memory of 5044 4368 nnhbtn.exe 100 PID 4368 wrote to memory of 5044 4368 nnhbtn.exe 100 PID 4368 wrote to memory of 5044 4368 nnhbtn.exe 100 PID 5044 wrote to memory of 4552 5044 9dvpd.exe 101 PID 5044 wrote to memory of 4552 5044 9dvpd.exe 101 PID 5044 wrote to memory of 4552 5044 9dvpd.exe 101 PID 4552 wrote to memory of 4240 4552 7xlxxrl.exe 102 PID 4552 wrote to memory of 4240 4552 7xlxxrl.exe 102 PID 4552 wrote to memory of 4240 4552 7xlxxrl.exe 102 PID 4240 wrote to memory of 1312 4240 bbnhbb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\d39cb9ba600f1561638f51e2f3c393adf3cbd4d3fa84451d3729c2f695f36531.exe"C:\Users\Admin\AppData\Local\Temp\d39cb9ba600f1561638f51e2f3c393adf3cbd4d3fa84451d3729c2f695f36531.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\vdpjv.exec:\vdpjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\fxxrllf.exec:\fxxrllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\tbntth.exec:\tbntth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\djdjj.exec:\djdjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\rlrrrxf.exec:\rlrrrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\nbbnhb.exec:\nbbnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\hhhbtn.exec:\hhhbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\pddvv.exec:\pddvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\tnbhnt.exec:\tnbhnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\xflrxrr.exec:\xflrxrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\htnhbh.exec:\htnhbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\lrrrffx.exec:\lrrrffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\bhnhtb.exec:\bhnhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\ddjjp.exec:\ddjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\5ntntb.exec:\5ntntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\7jpdv.exec:\7jpdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\lxrrfrl.exec:\lxrrfrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\nnhbtn.exec:\nnhbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\9dvpd.exec:\9dvpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\7xlxxrl.exec:\7xlxxrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\bbnhbb.exec:\bbnhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\dvvdv.exec:\dvvdv.exe23⤵
- Executes dropped EXE
PID:1312 -
\??\c:\htbtnh.exec:\htbtnh.exe24⤵
- Executes dropped EXE
PID:3512 -
\??\c:\dpvvp.exec:\dpvvp.exe25⤵
- Executes dropped EXE
PID:4908 -
\??\c:\1rrllll.exec:\1rrllll.exe26⤵
- Executes dropped EXE
PID:688 -
\??\c:\btnbnb.exec:\btnbnb.exe27⤵
- Executes dropped EXE
PID:1624 -
\??\c:\rxrfffx.exec:\rxrfffx.exe28⤵
- Executes dropped EXE
PID:1612 -
\??\c:\htbttn.exec:\htbttn.exe29⤵
- Executes dropped EXE
PID:3796 -
\??\c:\htttht.exec:\htttht.exe30⤵
- Executes dropped EXE
PID:4384 -
\??\c:\lxxxrrf.exec:\lxxxrrf.exe31⤵
- Executes dropped EXE
PID:1132 -
\??\c:\tntthn.exec:\tntthn.exe32⤵
- Executes dropped EXE
PID:4016 -
\??\c:\lflfflf.exec:\lflfflf.exe33⤵
- Executes dropped EXE
PID:3220 -
\??\c:\djvjp.exec:\djvjp.exe34⤵
- Executes dropped EXE
PID:2084 -
\??\c:\xrrlrxr.exec:\xrrlrxr.exe35⤵
- Executes dropped EXE
PID:4064 -
\??\c:\xfffxxx.exec:\xfffxxx.exe36⤵
- Executes dropped EXE
PID:228 -
\??\c:\ttbbtn.exec:\ttbbtn.exe37⤵
- Executes dropped EXE
PID:4752 -
\??\c:\ppdvd.exec:\ppdvd.exe38⤵
- Executes dropped EXE
PID:3416 -
\??\c:\7vvpp.exec:\7vvpp.exe39⤵
- Executes dropped EXE
PID:4416 -
\??\c:\xlrrlrr.exec:\xlrrlrr.exe40⤵
- Executes dropped EXE
PID:4428 -
\??\c:\tnhbnt.exec:\tnhbnt.exe41⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jvddd.exec:\jvddd.exe42⤵
- Executes dropped EXE
PID:532 -
\??\c:\pjpvd.exec:\pjpvd.exe43⤵
- Executes dropped EXE
PID:1516 -
\??\c:\ffrlrlr.exec:\ffrlrlr.exe44⤵
- Executes dropped EXE
PID:364 -
\??\c:\hbhhhh.exec:\hbhhhh.exe45⤵
- Executes dropped EXE
PID:5028 -
\??\c:\vpvvv.exec:\vpvvv.exe46⤵
- Executes dropped EXE
PID:4928 -
\??\c:\rxllxxx.exec:\rxllxxx.exe47⤵
- Executes dropped EXE
PID:5004 -
\??\c:\nntbbh.exec:\nntbbh.exe48⤵
- Executes dropped EXE
PID:4000 -
\??\c:\pvvpp.exec:\pvvpp.exe49⤵
- Executes dropped EXE
PID:4648 -
\??\c:\lfrllxx.exec:\lfrllxx.exe50⤵
- Executes dropped EXE
PID:3584 -
\??\c:\bttttb.exec:\bttttb.exe51⤵
- Executes dropped EXE
PID:720 -
\??\c:\jvdjv.exec:\jvdjv.exe52⤵
- Executes dropped EXE
PID:3592 -
\??\c:\frfxxff.exec:\frfxxff.exe53⤵
- Executes dropped EXE
PID:4060 -
\??\c:\hthbhb.exec:\hthbhb.exe54⤵
- Executes dropped EXE
PID:4876 -
\??\c:\vvvvp.exec:\vvvvp.exe55⤵
- Executes dropped EXE
PID:4836 -
\??\c:\llrfxxf.exec:\llrfxxf.exe56⤵
- Executes dropped EXE
PID:4872 -
\??\c:\tbnnth.exec:\tbnnth.exe57⤵
- Executes dropped EXE
PID:2480 -
\??\c:\dppjd.exec:\dppjd.exe58⤵
- Executes dropped EXE
PID:2588 -
\??\c:\lflffll.exec:\lflffll.exe59⤵
- Executes dropped EXE
PID:1644 -
\??\c:\nbnnhn.exec:\nbnnhn.exe60⤵
- Executes dropped EXE
PID:3568 -
\??\c:\jpddp.exec:\jpddp.exe61⤵
- Executes dropped EXE
PID:756 -
\??\c:\llrrxfl.exec:\llrrxfl.exe62⤵
- Executes dropped EXE
PID:4292 -
\??\c:\nbntbh.exec:\nbntbh.exe63⤵
- Executes dropped EXE
PID:4592 -
\??\c:\nnbhbt.exec:\nnbhbt.exe64⤵
- Executes dropped EXE
PID:3996 -
\??\c:\jvppp.exec:\jvppp.exe65⤵
- Executes dropped EXE
PID:3332 -
\??\c:\flxfrxl.exec:\flxfrxl.exe66⤵PID:3704
-
\??\c:\thhbtn.exec:\thhbtn.exe67⤵PID:2960
-
\??\c:\pjjjv.exec:\pjjjv.exe68⤵PID:3296
-
\??\c:\xrrfxfr.exec:\xrrfxfr.exe69⤵PID:4748
-
\??\c:\lfxrrxf.exec:\lfxrrxf.exe70⤵PID:3024
-
\??\c:\djpjj.exec:\djpjj.exe71⤵PID:3260
-
\??\c:\jvdvp.exec:\jvdvp.exe72⤵PID:4948
-
\??\c:\xflfllf.exec:\xflfllf.exe73⤵PID:3644
-
\??\c:\btbbnn.exec:\btbbnn.exe74⤵PID:3720
-
\??\c:\jdjdv.exec:\jdjdv.exe75⤵PID:4672
-
\??\c:\xxlfrxf.exec:\xxlfrxf.exe76⤵PID:1608
-
\??\c:\tnbhbh.exec:\tnbhbh.exe77⤵PID:2460
-
\??\c:\btttnh.exec:\btttnh.exe78⤵PID:2900
-
\??\c:\1jppj.exec:\1jppj.exe79⤵PID:4712
-
\??\c:\ffxxxff.exec:\ffxxxff.exe80⤵PID:1804
-
\??\c:\3hhhbb.exec:\3hhhbb.exe81⤵PID:1960
-
\??\c:\tnbbtb.exec:\tnbbtb.exe82⤵PID:4448
-
\??\c:\dpvvv.exec:\dpvvv.exe83⤵PID:1632
-
\??\c:\hhhhhn.exec:\hhhhhn.exe84⤵PID:3712
-
\??\c:\vvvdd.exec:\vvvdd.exe85⤵PID:3572
-
\??\c:\fxlffff.exec:\fxlffff.exe86⤵PID:2316
-
\??\c:\1tnnhh.exec:\1tnnhh.exe87⤵PID:3416
-
\??\c:\vppjj.exec:\vppjj.exe88⤵PID:4416
-
\??\c:\5lxxflr.exec:\5lxxflr.exe89⤵PID:4388
-
\??\c:\fxfffxx.exec:\fxfffxx.exe90⤵PID:4492
-
\??\c:\bhnnnt.exec:\bhnnnt.exe91⤵PID:4736
-
\??\c:\jdvvp.exec:\jdvvp.exe92⤵PID:364
-
\??\c:\flrfxfr.exec:\flrfxfr.exe93⤵PID:2204
-
\??\c:\flxlxxl.exec:\flxlxxl.exe94⤵PID:1944
-
\??\c:\7ntnhh.exec:\7ntnhh.exe95⤵PID:628
-
\??\c:\7pvvp.exec:\7pvvp.exe96⤵PID:3700
-
\??\c:\jpvpd.exec:\jpvpd.exe97⤵PID:2344
-
\??\c:\rrffffl.exec:\rrffffl.exe98⤵PID:3584
-
\??\c:\fflllrr.exec:\fflllrr.exe99⤵PID:5052
-
\??\c:\nbnhhh.exec:\nbnhhh.exe100⤵PID:4796
-
\??\c:\ppvpp.exec:\ppvpp.exe101⤵PID:4124
-
\??\c:\ddjjd.exec:\ddjjd.exe102⤵PID:1936
-
\??\c:\xlfxxxl.exec:\xlfxxxl.exe103⤵PID:2520
-
\??\c:\tnnnhh.exec:\tnnnhh.exe104⤵PID:2172
-
\??\c:\hntthn.exec:\hntthn.exe105⤵PID:4652
-
\??\c:\ddddd.exec:\ddddd.exe106⤵PID:2696
-
\??\c:\frfrlxr.exec:\frfrlxr.exe107⤵PID:1812
-
\??\c:\btntnt.exec:\btntnt.exe108⤵PID:4716
-
\??\c:\hbbtnn.exec:\hbbtnn.exe109⤵PID:392
-
\??\c:\vvvvv.exec:\vvvvv.exe110⤵PID:2388
-
\??\c:\xlrlffx.exec:\xlrlffx.exe111⤵PID:2848
-
\??\c:\hhhhhh.exec:\hhhhhh.exe112⤵PID:2396
-
\??\c:\bntnnt.exec:\bntnnt.exe113⤵PID:1044
-
\??\c:\7djdp.exec:\7djdp.exe114⤵PID:2476
-
\??\c:\pdpjv.exec:\pdpjv.exe115⤵PID:4948
-
\??\c:\fxfxlxx.exec:\fxfxlxx.exe116⤵PID:4852
-
\??\c:\bhhhbb.exec:\bhhhbb.exe117⤵PID:2368
-
\??\c:\3thbbt.exec:\3thbbt.exe118⤵PID:4100
-
\??\c:\dpjjj.exec:\dpjjj.exe119⤵PID:100
-
\??\c:\3jjdd.exec:\3jjdd.exe120⤵PID:1448
-
\??\c:\tnnhbt.exec:\tnnhbt.exe121⤵PID:1340
-
\??\c:\tbtnnn.exec:\tbtnnn.exe122⤵PID:3212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-