Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 18:32
Behavioral task
behavioral1
Sample
0b424e839f9cbb4717973767b7580a00cad364c9b77985ec3dd3e75db5d9d2f0.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
0b424e839f9cbb4717973767b7580a00cad364c9b77985ec3dd3e75db5d9d2f0.exe
-
Size
61KB
-
MD5
367c2ebaaec4e4c5e090e7634cf67289
-
SHA1
d113c1f7bf2bcc1b572fac85b5b13e1074a659ef
-
SHA256
0b424e839f9cbb4717973767b7580a00cad364c9b77985ec3dd3e75db5d9d2f0
-
SHA512
6fe346e735310626a55ed8e49b68ed440f2de1a8bf8668c9460f1d98319c34c27296189118391780b7c29954ce7be99b239a9304b4ffa8da3e2cb5f59d415ef5
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+EMdbV5f:zhOmTsF93UYfwC6GIoutiTWMdbv
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2300-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/448-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/6072-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3420-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5544-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5772-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5272-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5320-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5204-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5260-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3940-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1256-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3964-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3268-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4840-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1968-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4684-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1704-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3648-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1504-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5552-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2672-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2724-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2556-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5244-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1324-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4312-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/6124-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/748-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/6136-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/6136-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/6016-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5192-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4776-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/600-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3364-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3664-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5180-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1744-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1260-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3028-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5232-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-483-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4444-490-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2480-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5144-563-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/2300-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000232a4-3.dat UPX behavioral2/memory/2300-4-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3604-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00090000000233e9-9.dat UPX behavioral2/files/0x00070000000233fb-11.dat UPX behavioral2/memory/448-16-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233fc-18.dat UPX behavioral2/files/0x00070000000233fe-23.dat UPX behavioral2/memory/6072-21-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3420-26-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ff-28.dat UPX behavioral2/memory/5544-30-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5544-34-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023400-33.dat UPX behavioral2/files/0x0007000000023401-39.dat UPX behavioral2/memory/5772-41-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023402-43.dat UPX behavioral2/memory/5272-45-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023403-48.dat UPX behavioral2/memory/4656-50-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023404-54.dat UPX behavioral2/memory/4656-53-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023405-58.dat UPX behavioral2/memory/5320-59-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023406-63.dat UPX behavioral2/memory/5204-64-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023407-68.dat UPX behavioral2/memory/5260-69-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023408-73.dat UPX behavioral2/memory/8-74-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3940-76-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023409-79.dat UPX behavioral2/memory/3940-80-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1256-83-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002340a-85.dat UPX behavioral2/files/0x000700000002340b-91.dat UPX behavioral2/memory/3964-90-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002340c-94.dat UPX behavioral2/memory/5112-95-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002340d-99.dat UPX behavioral2/memory/3616-101-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5076-103-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002340e-105.dat UPX behavioral2/files/0x000700000002340f-109.dat UPX behavioral2/memory/3328-110-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023410-115.dat UPX behavioral2/memory/3268-114-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4840-120-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023411-119.dat UPX behavioral2/memory/1968-125-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023412-124.dat UPX behavioral2/memory/4684-128-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023413-130.dat UPX behavioral2/memory/1704-134-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023414-136.dat UPX behavioral2/files/0x0007000000023415-139.dat UPX behavioral2/files/0x0007000000023416-143.dat UPX behavioral2/files/0x0007000000023417-147.dat UPX behavioral2/files/0x0007000000023418-152.dat UPX behavioral2/memory/3648-151-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000b0000000233ee-156.dat UPX behavioral2/memory/4552-160-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4984-161-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3604 tnttbb.exe 3716 vjjjd.exe 448 vvvdp.exe 6072 xrffrlx.exe 3420 9tbthb.exe 5544 hhtnhh.exe 5272 xllffff.exe 5772 frrxxll.exe 3084 hhhthb.exe 4656 nhbhtt.exe 5320 djpjd.exe 5204 rlxxrlf.exe 5260 ntnhbt.exe 8 nnbbtn.exe 3940 pdjdv.exe 1256 xxfrxrr.exe 3964 thhnhn.exe 5112 jjvvp.exe 3616 vpvjd.exe 5076 5frlfxr.exe 3328 tnnhhb.exe 3268 pdjjj.exe 4840 djppp.exe 1968 ffffxff.exe 4684 7nttbb.exe 1704 pddvp.exe 2420 lfrlllx.exe 5708 xrlfllr.exe 1784 5ttnnn.exe 3648 3hbtbt.exe 5740 7vvpd.exe 4552 fxrrrrl.exe 4984 rlllffx.exe 5160 bnhhbb.exe 1352 ppdjj.exe 1504 jvvjd.exe 5552 xrllffx.exe 1548 nhbtnn.exe 1992 btbttt.exe 2672 vvppd.exe 4968 ddjpd.exe 2020 7frxxfl.exe 3296 vppjj.exe 2724 3dddv.exe 2556 9xffxxr.exe 2348 9rfrlxr.exe 1760 bnbttn.exe 2484 5vddj.exe 3068 pdjjd.exe 5244 xxxxxrx.exe 2828 1htbtb.exe 428 vvdvj.exe 2992 vpjpp.exe 3500 llrrffr.exe 4540 lfffxfx.exe 5624 bttttt.exe 1324 nhhhbb.exe 316 9pvpv.exe 5032 rlrlrll.exe 4112 llrlxxf.exe 1212 3nnhbh.exe 1664 3jpdv.exe 4536 xxffxlr.exe 5660 xxrrrrf.exe -
resource yara_rule behavioral2/memory/2300-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000232a4-3.dat upx behavioral2/memory/2300-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3604-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233e9-9.dat upx behavioral2/files/0x00070000000233fb-11.dat upx behavioral2/memory/448-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fc-18.dat upx behavioral2/files/0x00070000000233fe-23.dat upx behavioral2/memory/6072-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3420-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ff-28.dat upx behavioral2/memory/5544-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5544-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023400-33.dat upx behavioral2/files/0x0007000000023401-39.dat upx behavioral2/memory/5772-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023402-43.dat upx behavioral2/memory/5272-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023403-48.dat upx behavioral2/memory/4656-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023404-54.dat upx behavioral2/memory/4656-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023405-58.dat upx behavioral2/memory/5320-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023406-63.dat upx behavioral2/memory/5204-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023407-68.dat upx behavioral2/memory/5260-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023408-73.dat upx behavioral2/memory/8-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3940-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023409-79.dat upx behavioral2/memory/3940-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1256-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340a-85.dat upx behavioral2/files/0x000700000002340b-91.dat upx behavioral2/memory/3964-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340c-94.dat upx behavioral2/memory/5112-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340d-99.dat upx behavioral2/memory/3616-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5076-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340e-105.dat upx behavioral2/files/0x000700000002340f-109.dat upx behavioral2/memory/3328-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023410-115.dat upx behavioral2/memory/3268-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4840-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023411-119.dat upx behavioral2/memory/1968-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023412-124.dat upx behavioral2/memory/4684-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023413-130.dat upx behavioral2/memory/1704-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023414-136.dat upx behavioral2/files/0x0007000000023415-139.dat upx behavioral2/files/0x0007000000023416-143.dat upx behavioral2/files/0x0007000000023417-147.dat upx behavioral2/files/0x0007000000023418-152.dat upx behavioral2/memory/3648-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b0000000233ee-156.dat upx behavioral2/memory/4552-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4984-161-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2300 wrote to memory of 3604 2300 0b424e839f9cbb4717973767b7580a00cad364c9b77985ec3dd3e75db5d9d2f0.exe 82 PID 2300 wrote to memory of 3604 2300 0b424e839f9cbb4717973767b7580a00cad364c9b77985ec3dd3e75db5d9d2f0.exe 82 PID 2300 wrote to memory of 3604 2300 0b424e839f9cbb4717973767b7580a00cad364c9b77985ec3dd3e75db5d9d2f0.exe 82 PID 3604 wrote to memory of 3716 3604 tnttbb.exe 83 PID 3604 wrote to memory of 3716 3604 tnttbb.exe 83 PID 3604 wrote to memory of 3716 3604 tnttbb.exe 83 PID 3716 wrote to memory of 448 3716 vjjjd.exe 84 PID 3716 wrote to memory of 448 3716 vjjjd.exe 84 PID 3716 wrote to memory of 448 3716 vjjjd.exe 84 PID 448 wrote to memory of 6072 448 vvvdp.exe 85 PID 448 wrote to memory of 6072 448 vvvdp.exe 85 PID 448 wrote to memory of 6072 448 vvvdp.exe 85 PID 6072 wrote to memory of 3420 6072 xrffrlx.exe 86 PID 6072 wrote to memory of 3420 6072 xrffrlx.exe 86 PID 6072 wrote to memory of 3420 6072 xrffrlx.exe 86 PID 3420 wrote to memory of 5544 3420 9tbthb.exe 87 PID 3420 wrote to memory of 5544 3420 9tbthb.exe 87 PID 3420 wrote to memory of 5544 3420 9tbthb.exe 87 PID 5544 wrote to memory of 5272 5544 hhtnhh.exe 88 PID 5544 wrote to memory of 5272 5544 hhtnhh.exe 88 PID 5544 wrote to memory of 5272 5544 hhtnhh.exe 88 PID 5272 wrote to memory of 5772 5272 xllffff.exe 89 PID 5272 wrote to memory of 5772 5272 xllffff.exe 89 PID 5272 wrote to memory of 5772 5272 xllffff.exe 89 PID 5772 wrote to memory of 3084 5772 frrxxll.exe 90 PID 5772 wrote to memory of 3084 5772 frrxxll.exe 90 PID 5772 wrote to memory of 3084 5772 frrxxll.exe 90 PID 3084 wrote to memory of 4656 3084 hhhthb.exe 91 PID 3084 wrote to memory of 4656 3084 hhhthb.exe 91 PID 3084 wrote to memory of 4656 3084 hhhthb.exe 91 PID 4656 wrote to memory of 5320 4656 nhbhtt.exe 92 PID 4656 wrote to memory of 5320 4656 nhbhtt.exe 92 PID 4656 wrote to memory of 5320 4656 nhbhtt.exe 92 PID 5320 wrote to memory of 5204 5320 djpjd.exe 93 PID 5320 wrote to memory of 5204 5320 djpjd.exe 93 PID 5320 wrote to memory of 5204 5320 djpjd.exe 93 PID 5204 wrote to memory of 5260 5204 rlxxrlf.exe 94 PID 5204 wrote to memory of 5260 5204 rlxxrlf.exe 94 PID 5204 wrote to memory of 5260 5204 rlxxrlf.exe 94 PID 5260 wrote to memory of 8 5260 ntnhbt.exe 95 PID 5260 wrote to memory of 8 5260 ntnhbt.exe 95 PID 5260 wrote to memory of 8 5260 ntnhbt.exe 95 PID 8 wrote to memory of 3940 8 nnbbtn.exe 96 PID 8 wrote to memory of 3940 8 nnbbtn.exe 96 PID 8 wrote to memory of 3940 8 nnbbtn.exe 96 PID 3940 wrote to memory of 1256 3940 pdjdv.exe 97 PID 3940 wrote to memory of 1256 3940 pdjdv.exe 97 PID 3940 wrote to memory of 1256 3940 pdjdv.exe 97 PID 1256 wrote to memory of 3964 1256 xxfrxrr.exe 98 PID 1256 wrote to memory of 3964 1256 xxfrxrr.exe 98 PID 1256 wrote to memory of 3964 1256 xxfrxrr.exe 98 PID 3964 wrote to memory of 5112 3964 thhnhn.exe 99 PID 3964 wrote to memory of 5112 3964 thhnhn.exe 99 PID 3964 wrote to memory of 5112 3964 thhnhn.exe 99 PID 5112 wrote to memory of 3616 5112 jjvvp.exe 100 PID 5112 wrote to memory of 3616 5112 jjvvp.exe 100 PID 5112 wrote to memory of 3616 5112 jjvvp.exe 100 PID 3616 wrote to memory of 5076 3616 vpvjd.exe 101 PID 3616 wrote to memory of 5076 3616 vpvjd.exe 101 PID 3616 wrote to memory of 5076 3616 vpvjd.exe 101 PID 5076 wrote to memory of 3328 5076 5frlfxr.exe 102 PID 5076 wrote to memory of 3328 5076 5frlfxr.exe 102 PID 5076 wrote to memory of 3328 5076 5frlfxr.exe 102 PID 3328 wrote to memory of 3268 3328 tnnhhb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b424e839f9cbb4717973767b7580a00cad364c9b77985ec3dd3e75db5d9d2f0.exe"C:\Users\Admin\AppData\Local\Temp\0b424e839f9cbb4717973767b7580a00cad364c9b77985ec3dd3e75db5d9d2f0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\tnttbb.exec:\tnttbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\vjjjd.exec:\vjjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\vvvdp.exec:\vvvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\xrffrlx.exec:\xrffrlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
\??\c:\9tbthb.exec:\9tbthb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\hhtnhh.exec:\hhtnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5544 -
\??\c:\xllffff.exec:\xllffff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5272 -
\??\c:\frrxxll.exec:\frrxxll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5772 -
\??\c:\hhhthb.exec:\hhhthb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\nhbhtt.exec:\nhbhtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\djpjd.exec:\djpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
\??\c:\rlxxrlf.exec:\rlxxrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5204 -
\??\c:\ntnhbt.exec:\ntnhbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
\??\c:\nnbbtn.exec:\nnbbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\pdjdv.exec:\pdjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\xxfrxrr.exec:\xxfrxrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\thhnhn.exec:\thhnhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\jjvvp.exec:\jjvvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\vpvjd.exec:\vpvjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\5frlfxr.exec:\5frlfxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\tnnhhb.exec:\tnnhhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\pdjjj.exec:\pdjjj.exe23⤵
- Executes dropped EXE
PID:3268 -
\??\c:\djppp.exec:\djppp.exe24⤵
- Executes dropped EXE
PID:4840 -
\??\c:\ffffxff.exec:\ffffxff.exe25⤵
- Executes dropped EXE
PID:1968 -
\??\c:\7nttbb.exec:\7nttbb.exe26⤵
- Executes dropped EXE
PID:4684 -
\??\c:\pddvp.exec:\pddvp.exe27⤵
- Executes dropped EXE
PID:1704 -
\??\c:\lfrlllx.exec:\lfrlllx.exe28⤵
- Executes dropped EXE
PID:2420 -
\??\c:\xrlfllr.exec:\xrlfllr.exe29⤵
- Executes dropped EXE
PID:5708 -
\??\c:\5ttnnn.exec:\5ttnnn.exe30⤵
- Executes dropped EXE
PID:1784 -
\??\c:\3hbtbt.exec:\3hbtbt.exe31⤵
- Executes dropped EXE
PID:3648 -
\??\c:\7vvpd.exec:\7vvpd.exe32⤵
- Executes dropped EXE
PID:5740 -
\??\c:\fxrrrrl.exec:\fxrrrrl.exe33⤵
- Executes dropped EXE
PID:4552 -
\??\c:\rlllffx.exec:\rlllffx.exe34⤵
- Executes dropped EXE
PID:4984 -
\??\c:\bnhhbb.exec:\bnhhbb.exe35⤵
- Executes dropped EXE
PID:5160 -
\??\c:\ppdjj.exec:\ppdjj.exe36⤵
- Executes dropped EXE
PID:1352 -
\??\c:\jvvjd.exec:\jvvjd.exe37⤵
- Executes dropped EXE
PID:1504 -
\??\c:\xrllffx.exec:\xrllffx.exe38⤵
- Executes dropped EXE
PID:5552 -
\??\c:\nhbtnn.exec:\nhbtnn.exe39⤵
- Executes dropped EXE
PID:1548 -
\??\c:\btbttt.exec:\btbttt.exe40⤵
- Executes dropped EXE
PID:1992 -
\??\c:\vvppd.exec:\vvppd.exe41⤵
- Executes dropped EXE
PID:2672 -
\??\c:\ddjpd.exec:\ddjpd.exe42⤵
- Executes dropped EXE
PID:4968 -
\??\c:\7frxxfl.exec:\7frxxfl.exe43⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vppjj.exec:\vppjj.exe44⤵
- Executes dropped EXE
PID:3296 -
\??\c:\3dddv.exec:\3dddv.exe45⤵
- Executes dropped EXE
PID:2724 -
\??\c:\9xffxxr.exec:\9xffxxr.exe46⤵
- Executes dropped EXE
PID:2556 -
\??\c:\9rfrlxr.exec:\9rfrlxr.exe47⤵
- Executes dropped EXE
PID:2348 -
\??\c:\bnbttn.exec:\bnbttn.exe48⤵
- Executes dropped EXE
PID:1760 -
\??\c:\5vddj.exec:\5vddj.exe49⤵
- Executes dropped EXE
PID:2484 -
\??\c:\pdjjd.exec:\pdjjd.exe50⤵
- Executes dropped EXE
PID:3068 -
\??\c:\xxxxxrx.exec:\xxxxxrx.exe51⤵
- Executes dropped EXE
PID:5244 -
\??\c:\1htbtb.exec:\1htbtb.exe52⤵
- Executes dropped EXE
PID:2828 -
\??\c:\vvdvj.exec:\vvdvj.exe53⤵
- Executes dropped EXE
PID:428 -
\??\c:\vpjpp.exec:\vpjpp.exe54⤵
- Executes dropped EXE
PID:2992 -
\??\c:\llrrffr.exec:\llrrffr.exe55⤵
- Executes dropped EXE
PID:3500 -
\??\c:\lfffxfx.exec:\lfffxfx.exe56⤵
- Executes dropped EXE
PID:4540 -
\??\c:\bttttt.exec:\bttttt.exe57⤵
- Executes dropped EXE
PID:5624 -
\??\c:\nhhhbb.exec:\nhhhbb.exe58⤵
- Executes dropped EXE
PID:1324 -
\??\c:\9pvpv.exec:\9pvpv.exe59⤵
- Executes dropped EXE
PID:316 -
\??\c:\rlrlrll.exec:\rlrlrll.exe60⤵
- Executes dropped EXE
PID:5032 -
\??\c:\llrlxxf.exec:\llrlxxf.exe61⤵
- Executes dropped EXE
PID:4112 -
\??\c:\3nnhbh.exec:\3nnhbh.exe62⤵
- Executes dropped EXE
PID:1212 -
\??\c:\3jpdv.exec:\3jpdv.exe63⤵
- Executes dropped EXE
PID:1664 -
\??\c:\xxffxlr.exec:\xxffxlr.exe64⤵
- Executes dropped EXE
PID:4536 -
\??\c:\xxrrrrf.exec:\xxrrrrf.exe65⤵
- Executes dropped EXE
PID:5660 -
\??\c:\htbbtb.exec:\htbbtb.exe66⤵PID:4312
-
\??\c:\pvvpj.exec:\pvvpj.exe67⤵PID:6048
-
\??\c:\vvvvv.exec:\vvvvv.exe68⤵PID:1320
-
\??\c:\fxxrlrx.exec:\fxxrlrx.exe69⤵PID:916
-
\??\c:\1frrffr.exec:\1frrffr.exe70⤵PID:6124
-
\??\c:\7hnntt.exec:\7hnntt.exe71⤵PID:2432
-
\??\c:\7bhhhn.exec:\7bhhhn.exe72⤵PID:3060
-
\??\c:\7jjdv.exec:\7jjdv.exe73⤵PID:5616
-
\??\c:\jdvvv.exec:\jdvvv.exe74⤵PID:2788
-
\??\c:\xlrrrfl.exec:\xlrrrfl.exe75⤵PID:2544
-
\??\c:\frllllx.exec:\frllllx.exe76⤵PID:748
-
\??\c:\3hbbnn.exec:\3hbbnn.exe77⤵PID:5652
-
\??\c:\nbhbtt.exec:\nbhbtt.exe78⤵PID:6136
-
\??\c:\1vddd.exec:\1vddd.exe79⤵PID:4300
-
\??\c:\frxxxxx.exec:\frxxxxx.exe80⤵PID:4668
-
\??\c:\1rfxllx.exec:\1rfxllx.exe81⤵PID:4924
-
\??\c:\bthhhh.exec:\bthhhh.exe82⤵PID:6016
-
\??\c:\ppddp.exec:\ppddp.exe83⤵PID:1524
-
\??\c:\rrlfrrr.exec:\rrlfrrr.exe84⤵PID:4436
-
\??\c:\xfxrxxx.exec:\xfxrxxx.exe85⤵PID:5192
-
\??\c:\htnbbh.exec:\htnbbh.exe86⤵PID:4776
-
\??\c:\tnhhtt.exec:\tnhhtt.exe87⤵PID:600
-
\??\c:\pjvjv.exec:\pjvjv.exe88⤵PID:3604
-
\??\c:\vvjpj.exec:\vvjpj.exe89⤵PID:1160
-
\??\c:\3frlllf.exec:\3frlllf.exe90⤵PID:5960
-
\??\c:\lrlllll.exec:\lrlllll.exe91⤵PID:556
-
\??\c:\7hhhhn.exec:\7hhhhn.exe92⤵PID:1312
-
\??\c:\7tbbtb.exec:\7tbbtb.exe93⤵PID:3044
-
\??\c:\jpddd.exec:\jpddd.exe94⤵PID:6096
-
\??\c:\3lxxxxx.exec:\3lxxxxx.exe95⤵PID:3364
-
\??\c:\thtttt.exec:\thtttt.exe96⤵PID:5272
-
\??\c:\7lxrrlr.exec:\7lxrrlr.exe97⤵PID:5732
-
\??\c:\rlxxffx.exec:\rlxxffx.exe98⤵PID:5744
-
\??\c:\nnhhhn.exec:\nnhhhn.exe99⤵PID:5100
-
\??\c:\9nhhbt.exec:\9nhhbt.exe100⤵PID:4696
-
\??\c:\5jjdd.exec:\5jjdd.exe101⤵PID:3596
-
\??\c:\xflllll.exec:\xflllll.exe102⤵PID:2196
-
\??\c:\lffrrrr.exec:\lffrrrr.exe103⤵PID:5204
-
\??\c:\htbbbb.exec:\htbbbb.exe104⤵PID:4168
-
\??\c:\dddvp.exec:\dddvp.exe105⤵PID:8
-
\??\c:\pvdjj.exec:\pvdjj.exe106⤵PID:3664
-
\??\c:\flrffxf.exec:\flrffxf.exe107⤵PID:1564
-
\??\c:\ffrrlxx.exec:\ffrrlxx.exe108⤵PID:5116
-
\??\c:\tnnhbt.exec:\tnnhbt.exe109⤵PID:1736
-
\??\c:\ddpvp.exec:\ddpvp.exe110⤵PID:3128
-
\??\c:\jjjvp.exec:\jjjvp.exe111⤵PID:5172
-
\??\c:\5lllffl.exec:\5lllffl.exe112⤵PID:5180
-
\??\c:\fllxrrr.exec:\fllxrrr.exe113⤵PID:3868
-
\??\c:\tnbthh.exec:\tnbthh.exe114⤵PID:5076
-
\??\c:\vvvpj.exec:\vvvpj.exe115⤵PID:3624
-
\??\c:\vdddj.exec:\vdddj.exe116⤵PID:392
-
\??\c:\9rxxrrr.exec:\9rxxrrr.exe117⤵PID:2940
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe118⤵PID:5632
-
\??\c:\btbbbt.exec:\btbbbt.exe119⤵PID:1200
-
\??\c:\btnnhh.exec:\btnnhh.exe120⤵PID:3592
-
\??\c:\vpjvp.exec:\vpjvp.exe121⤵PID:1744
-
\??\c:\dpjdd.exec:\dpjdd.exe122⤵PID:2288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-