Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 01:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7b4efaf72c980ebcb34f03e02f3b1f871aeb0a8aeab06bd9fdb659aaa8a5ee8e.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
-
Target
7b4efaf72c980ebcb34f03e02f3b1f871aeb0a8aeab06bd9fdb659aaa8a5ee8e.exe
-
Size
275KB
-
MD5
ab54a64b426e6a2116e6cf3f05ad2b9e
-
SHA1
6e45b1278c894a98cd972134b52302c004312f64
-
SHA256
7b4efaf72c980ebcb34f03e02f3b1f871aeb0a8aeab06bd9fdb659aaa8a5ee8e
-
SHA512
cb901ff29f64779cc1d7eb573a5b126407ec6a1f99f6fd415cdca438a5c9757ff2ae2aa919027c3aae634336ebb34308975720258a067b0aed7936cd6cf90c28
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFfR:8cm7ImGddXmNt251UriZFfR
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/2876-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/240-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/984-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/700-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-315-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2760-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1228-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1228-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-717-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2708-716-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1012-746-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/448-815-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-864-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 56 IoCs
Processes:
resource yara_rule behavioral1/memory/2876-0-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2876-7-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2872-9-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2872-19-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2928-28-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2668-30-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2416-46-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2656-55-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2552-64-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2412-65-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2412-74-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2324-83-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2856-92-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1212-101-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/240-136-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1632-154-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2084-173-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1576-199-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1576-207-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1196-209-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2924-225-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/984-244-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2272-259-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1580-268-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/700-277-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2252-294-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1440-295-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2236-303-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2236-312-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2760-338-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2216-346-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2656-360-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1564-387-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2472-407-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2708-420-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2024-458-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2056-483-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2924-520-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1228-528-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1228-535-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1224-584-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2648-623-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2628-652-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1584-672-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2708-717-0x0000000000220000-0x000000000024A000-memory.dmp UPX behavioral1/memory/240-724-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2136-731-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1244-753-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1416-780-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/980-794-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/448-815-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2036-864-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2200-872-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2688-898-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2612-913-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2660-938-0x0000000000400000-0x000000000042A000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
rlffffr.exeppjpv.exenbbtbb.exepjjpv.exefxflrxl.exehhbhbn.exedvdjp.exexxllxxr.exenbbhbb.exedvpdj.exeffflxlx.exe3tthnt.exe5dvdj.exelffrrxl.exebbnthn.exejpdpj.exethhhbh.exe3nbhnn.exefrrfxrf.exehthttb.exeffrxllf.exetnttnb.exevvjvj.exelfflrxx.exennhnbt.exevjpjj.exefxrxlxr.exebnnbbn.exejpjjv.exexrflrxr.exe1nbhnt.exejvvjj.exexxxlxlf.exe3ntbhh.exe1ttnbh.exejpvpp.exe5rrxflr.exetnbttn.exetnbnbt.exejdvdv.exellrrxll.exe7hbhbh.exettntbn.exejdvdv.exerrrlxlf.exehbbtnb.exepjdjj.exevvdvv.exerlxfllr.exetbtbhh.exepjdpd.exelxrfllr.exefxlxxll.exenbnbtb.exeddpdd.exeffxlrlf.exenhnhtt.exe5ddjj.exejdvjv.exe9lflrrf.exexxrxllx.exethttht.exepjdjv.exe1frfrxl.exepid process 2872 rlffffr.exe 2928 ppjpv.exe 2668 nbbtbb.exe 2416 pjjpv.exe 2656 fxflrxl.exe 2552 hhbhbn.exe 2412 dvdjp.exe 2324 xxllxxr.exe 2856 nbbhbb.exe 1212 dvpdj.exe 2700 ffflxlx.exe 2308 3tthnt.exe 320 5dvdj.exe 240 lffrrxl.exe 1628 bbnthn.exe 2140 jpdpj.exe 1632 thhhbh.exe 2044 3nbhnn.exe 2084 frrfxrf.exe 268 hthttb.exe 784 ffrxllf.exe 1576 tnttnb.exe 1196 vvjvj.exe 2924 lfflrxx.exe 1160 nnhnbt.exe 2328 vjpjj.exe 984 fxrxlxr.exe 2272 bnnbbn.exe 1580 jpjjv.exe 700 xrflrxr.exe 572 1nbhnt.exe 2252 jvvjj.exe 1440 xxxlxlf.exe 2236 3ntbhh.exe 2908 1ttnbh.exe 2504 jpvpp.exe 2540 5rrxflr.exe 2760 tnbttn.exe 2516 tnbnbt.exe 2216 jdvdv.exe 2500 llrrxll.exe 2656 7hbhbh.exe 2584 ttntbn.exe 2836 jdvdv.exe 2916 rrrlxlf.exe 1564 hbbtnb.exe 1272 pjdjj.exe 2472 vvdvv.exe 1528 rlxfllr.exe 2708 tbtbhh.exe 1588 pjdpd.exe 2280 lxrfllr.exe 2156 fxlxxll.exe 1592 nbnbtb.exe 1456 ddpdd.exe 1372 ffxlrlf.exe 2024 nhnhtt.exe 1704 5ddjj.exe 1876 jdvjv.exe 2056 9lflrrf.exe 336 xxrxllx.exe 488 thttht.exe 1420 pjdjv.exe 2312 1frfrxl.exe -
Processes:
resource yara_rule behavioral1/memory/2876-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/240-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-717-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/240-724-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-780-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-864-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-898-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-913-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-938-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7b4efaf72c980ebcb34f03e02f3b1f871aeb0a8aeab06bd9fdb659aaa8a5ee8e.exerlffffr.exeppjpv.exenbbtbb.exepjjpv.exefxflrxl.exehhbhbn.exedvdjp.exexxllxxr.exenbbhbb.exedvpdj.exeffflxlx.exe3tthnt.exe5dvdj.exelffrrxl.exebbnthn.exedescription pid process target process PID 2876 wrote to memory of 2872 2876 7b4efaf72c980ebcb34f03e02f3b1f871aeb0a8aeab06bd9fdb659aaa8a5ee8e.exe rlffffr.exe PID 2876 wrote to memory of 2872 2876 7b4efaf72c980ebcb34f03e02f3b1f871aeb0a8aeab06bd9fdb659aaa8a5ee8e.exe rlffffr.exe PID 2876 wrote to memory of 2872 2876 7b4efaf72c980ebcb34f03e02f3b1f871aeb0a8aeab06bd9fdb659aaa8a5ee8e.exe rlffffr.exe PID 2876 wrote to memory of 2872 2876 7b4efaf72c980ebcb34f03e02f3b1f871aeb0a8aeab06bd9fdb659aaa8a5ee8e.exe rlffffr.exe PID 2872 wrote to memory of 2928 2872 rlffffr.exe ppjpv.exe PID 2872 wrote to memory of 2928 2872 rlffffr.exe ppjpv.exe PID 2872 wrote to memory of 2928 2872 rlffffr.exe ppjpv.exe PID 2872 wrote to memory of 2928 2872 rlffffr.exe ppjpv.exe PID 2928 wrote to memory of 2668 2928 ppjpv.exe nbbtbb.exe PID 2928 wrote to memory of 2668 2928 ppjpv.exe nbbtbb.exe PID 2928 wrote to memory of 2668 2928 ppjpv.exe nbbtbb.exe PID 2928 wrote to memory of 2668 2928 ppjpv.exe nbbtbb.exe PID 2668 wrote to memory of 2416 2668 nbbtbb.exe pjjpv.exe PID 2668 wrote to memory of 2416 2668 nbbtbb.exe pjjpv.exe PID 2668 wrote to memory of 2416 2668 nbbtbb.exe pjjpv.exe PID 2668 wrote to memory of 2416 2668 nbbtbb.exe pjjpv.exe PID 2416 wrote to memory of 2656 2416 pjjpv.exe fxflrxl.exe PID 2416 wrote to memory of 2656 2416 pjjpv.exe fxflrxl.exe PID 2416 wrote to memory of 2656 2416 pjjpv.exe fxflrxl.exe PID 2416 wrote to memory of 2656 2416 pjjpv.exe fxflrxl.exe PID 2656 wrote to memory of 2552 2656 fxflrxl.exe hhbhbn.exe PID 2656 wrote to memory of 2552 2656 fxflrxl.exe hhbhbn.exe PID 2656 wrote to memory of 2552 2656 fxflrxl.exe hhbhbn.exe PID 2656 wrote to memory of 2552 2656 fxflrxl.exe hhbhbn.exe PID 2552 wrote to memory of 2412 2552 hhbhbn.exe dvdjp.exe PID 2552 wrote to memory of 2412 2552 hhbhbn.exe dvdjp.exe PID 2552 wrote to memory of 2412 2552 hhbhbn.exe dvdjp.exe PID 2552 wrote to memory of 2412 2552 hhbhbn.exe dvdjp.exe PID 2412 wrote to memory of 2324 2412 dvdjp.exe xxllxxr.exe PID 2412 wrote to memory of 2324 2412 dvdjp.exe xxllxxr.exe PID 2412 wrote to memory of 2324 2412 dvdjp.exe xxllxxr.exe PID 2412 wrote to memory of 2324 2412 dvdjp.exe xxllxxr.exe PID 2324 wrote to memory of 2856 2324 xxllxxr.exe nbbhbb.exe PID 2324 wrote to memory of 2856 2324 xxllxxr.exe nbbhbb.exe PID 2324 wrote to memory of 2856 2324 xxllxxr.exe nbbhbb.exe PID 2324 wrote to memory of 2856 2324 xxllxxr.exe nbbhbb.exe PID 2856 wrote to memory of 1212 2856 nbbhbb.exe dvpdj.exe PID 2856 wrote to memory of 1212 2856 nbbhbb.exe dvpdj.exe PID 2856 wrote to memory of 1212 2856 nbbhbb.exe dvpdj.exe PID 2856 wrote to memory of 1212 2856 nbbhbb.exe dvpdj.exe PID 1212 wrote to memory of 2700 1212 dvpdj.exe ffflxlx.exe PID 1212 wrote to memory of 2700 1212 dvpdj.exe ffflxlx.exe PID 1212 wrote to memory of 2700 1212 dvpdj.exe ffflxlx.exe PID 1212 wrote to memory of 2700 1212 dvpdj.exe ffflxlx.exe PID 2700 wrote to memory of 2308 2700 ffflxlx.exe 3tthnt.exe PID 2700 wrote to memory of 2308 2700 ffflxlx.exe 3tthnt.exe PID 2700 wrote to memory of 2308 2700 ffflxlx.exe 3tthnt.exe PID 2700 wrote to memory of 2308 2700 ffflxlx.exe 3tthnt.exe PID 2308 wrote to memory of 320 2308 3tthnt.exe 5dvdj.exe PID 2308 wrote to memory of 320 2308 3tthnt.exe 5dvdj.exe PID 2308 wrote to memory of 320 2308 3tthnt.exe 5dvdj.exe PID 2308 wrote to memory of 320 2308 3tthnt.exe 5dvdj.exe PID 320 wrote to memory of 240 320 5dvdj.exe lffrrxl.exe PID 320 wrote to memory of 240 320 5dvdj.exe lffrrxl.exe PID 320 wrote to memory of 240 320 5dvdj.exe lffrrxl.exe PID 320 wrote to memory of 240 320 5dvdj.exe lffrrxl.exe PID 240 wrote to memory of 1628 240 lffrrxl.exe bbnthn.exe PID 240 wrote to memory of 1628 240 lffrrxl.exe bbnthn.exe PID 240 wrote to memory of 1628 240 lffrrxl.exe bbnthn.exe PID 240 wrote to memory of 1628 240 lffrrxl.exe bbnthn.exe PID 1628 wrote to memory of 2140 1628 bbnthn.exe jpdpj.exe PID 1628 wrote to memory of 2140 1628 bbnthn.exe jpdpj.exe PID 1628 wrote to memory of 2140 1628 bbnthn.exe jpdpj.exe PID 1628 wrote to memory of 2140 1628 bbnthn.exe jpdpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b4efaf72c980ebcb34f03e02f3b1f871aeb0a8aeab06bd9fdb659aaa8a5ee8e.exe"C:\Users\Admin\AppData\Local\Temp\7b4efaf72c980ebcb34f03e02f3b1f871aeb0a8aeab06bd9fdb659aaa8a5ee8e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\rlffffr.exec:\rlffffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppjpv.exec:\ppjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbbtbb.exec:\nbbtbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjjpv.exec:\pjjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxflrxl.exec:\fxflrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhbhbn.exec:\hhbhbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvdjp.exec:\dvdjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxllxxr.exec:\xxllxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbbhbb.exec:\nbbhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvpdj.exec:\dvpdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffflxlx.exec:\ffflxlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3tthnt.exec:\3tthnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5dvdj.exec:\5dvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lffrrxl.exec:\lffrrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbnthn.exec:\bbnthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpdpj.exec:\jpdpj.exe17⤵
- Executes dropped EXE
-
\??\c:\thhhbh.exec:\thhhbh.exe18⤵
- Executes dropped EXE
-
\??\c:\3nbhnn.exec:\3nbhnn.exe19⤵
- Executes dropped EXE
-
\??\c:\frrfxrf.exec:\frrfxrf.exe20⤵
- Executes dropped EXE
-
\??\c:\hthttb.exec:\hthttb.exe21⤵
- Executes dropped EXE
-
\??\c:\ffrxllf.exec:\ffrxllf.exe22⤵
- Executes dropped EXE
-
\??\c:\tnttnb.exec:\tnttnb.exe23⤵
- Executes dropped EXE
-
\??\c:\vvjvj.exec:\vvjvj.exe24⤵
- Executes dropped EXE
-
\??\c:\lfflrxx.exec:\lfflrxx.exe25⤵
- Executes dropped EXE
-
\??\c:\nnhnbt.exec:\nnhnbt.exe26⤵
- Executes dropped EXE
-
\??\c:\vjpjj.exec:\vjpjj.exe27⤵
- Executes dropped EXE
-
\??\c:\fxrxlxr.exec:\fxrxlxr.exe28⤵
- Executes dropped EXE
-
\??\c:\bnnbbn.exec:\bnnbbn.exe29⤵
- Executes dropped EXE
-
\??\c:\jpjjv.exec:\jpjjv.exe30⤵
- Executes dropped EXE
-
\??\c:\xrflrxr.exec:\xrflrxr.exe31⤵
- Executes dropped EXE
-
\??\c:\1nbhnt.exec:\1nbhnt.exe32⤵
- Executes dropped EXE
-
\??\c:\jvvjj.exec:\jvvjj.exe33⤵
- Executes dropped EXE
-
\??\c:\xxxlxlf.exec:\xxxlxlf.exe34⤵
- Executes dropped EXE
-
\??\c:\3ntbhh.exec:\3ntbhh.exe35⤵
- Executes dropped EXE
-
\??\c:\1ttnbh.exec:\1ttnbh.exe36⤵
- Executes dropped EXE
-
\??\c:\jpvpp.exec:\jpvpp.exe37⤵
- Executes dropped EXE
-
\??\c:\5rrxflr.exec:\5rrxflr.exe38⤵
- Executes dropped EXE
-
\??\c:\tnbttn.exec:\tnbttn.exe39⤵
- Executes dropped EXE
-
\??\c:\tnbnbt.exec:\tnbnbt.exe40⤵
- Executes dropped EXE
-
\??\c:\jdvdv.exec:\jdvdv.exe41⤵
- Executes dropped EXE
-
\??\c:\llrrxll.exec:\llrrxll.exe42⤵
- Executes dropped EXE
-
\??\c:\7hbhbh.exec:\7hbhbh.exe43⤵
- Executes dropped EXE
-
\??\c:\ttntbn.exec:\ttntbn.exe44⤵
- Executes dropped EXE
-
\??\c:\jdvdv.exec:\jdvdv.exe45⤵
- Executes dropped EXE
-
\??\c:\rrrlxlf.exec:\rrrlxlf.exe46⤵
- Executes dropped EXE
-
\??\c:\hbbtnb.exec:\hbbtnb.exe47⤵
- Executes dropped EXE
-
\??\c:\pjdjj.exec:\pjdjj.exe48⤵
- Executes dropped EXE
-
\??\c:\vvdvv.exec:\vvdvv.exe49⤵
- Executes dropped EXE
-
\??\c:\rlxfllr.exec:\rlxfllr.exe50⤵
- Executes dropped EXE
-
\??\c:\tbtbhh.exec:\tbtbhh.exe51⤵
- Executes dropped EXE
-
\??\c:\pjdpd.exec:\pjdpd.exe52⤵
- Executes dropped EXE
-
\??\c:\lxrfllr.exec:\lxrfllr.exe53⤵
- Executes dropped EXE
-
\??\c:\fxlxxll.exec:\fxlxxll.exe54⤵
- Executes dropped EXE
-
\??\c:\nbnbtb.exec:\nbnbtb.exe55⤵
- Executes dropped EXE
-
\??\c:\ddpdd.exec:\ddpdd.exe56⤵
- Executes dropped EXE
-
\??\c:\ffxlrlf.exec:\ffxlrlf.exe57⤵
- Executes dropped EXE
-
\??\c:\nhnhtt.exec:\nhnhtt.exe58⤵
- Executes dropped EXE
-
\??\c:\5ddjj.exec:\5ddjj.exe59⤵
- Executes dropped EXE
-
\??\c:\jdvjv.exec:\jdvjv.exe60⤵
- Executes dropped EXE
-
\??\c:\9lflrrf.exec:\9lflrrf.exe61⤵
- Executes dropped EXE
-
\??\c:\xxrxllx.exec:\xxrxllx.exe62⤵
- Executes dropped EXE
-
\??\c:\thttht.exec:\thttht.exe63⤵
- Executes dropped EXE
-
\??\c:\pjdjv.exec:\pjdjv.exe64⤵
- Executes dropped EXE
-
\??\c:\1frfrxl.exec:\1frfrxl.exe65⤵
- Executes dropped EXE
-
\??\c:\fxfrrxr.exec:\fxfrrxr.exe66⤵
-
\??\c:\nthhbt.exec:\nthhbt.exe67⤵
-
\??\c:\btntnn.exec:\btntnn.exe68⤵
-
\??\c:\vpdpd.exec:\vpdpd.exe69⤵
-
\??\c:\lfrrflx.exec:\lfrrflx.exe70⤵
-
\??\c:\fxffrrf.exec:\fxffrrf.exe71⤵
-
\??\c:\hhhnbh.exec:\hhhnbh.exe72⤵
-
\??\c:\ddpjp.exec:\ddpjp.exe73⤵
-
\??\c:\ddpvv.exec:\ddpvv.exe74⤵
-
\??\c:\7rllxfr.exec:\7rllxfr.exe75⤵
-
\??\c:\nhbnbh.exec:\nhbnbh.exe76⤵
-
\??\c:\btnnbb.exec:\btnnbb.exe77⤵
-
\??\c:\7ddpv.exec:\7ddpv.exe78⤵
-
\??\c:\xrrrllr.exec:\xrrrllr.exe79⤵
-
\??\c:\rlxlrxf.exec:\rlxlrxf.exe80⤵
-
\??\c:\hhbnhn.exec:\hhbnhn.exe81⤵
-
\??\c:\nnhbnt.exec:\nnhbnt.exe82⤵
-
\??\c:\jdpvd.exec:\jdpvd.exe83⤵
-
\??\c:\rfrrfrr.exec:\rfrrfrr.exe84⤵
-
\??\c:\9fffrrf.exec:\9fffrrf.exe85⤵
-
\??\c:\tnhtnt.exec:\tnhtnt.exe86⤵
-
\??\c:\vvjvv.exec:\vvjvv.exe87⤵
-
\??\c:\llffrfr.exec:\llffrfr.exe88⤵
-
\??\c:\tbnhtb.exec:\tbnhtb.exe89⤵
-
\??\c:\dvvvv.exec:\dvvvv.exe90⤵
-
\??\c:\jddpj.exec:\jddpj.exe91⤵
-
\??\c:\xflrrrr.exec:\xflrrrr.exe92⤵
-
\??\c:\tbnnhh.exec:\tbnnhh.exe93⤵
-
\??\c:\1djpv.exec:\1djpv.exe94⤵
-
\??\c:\ddvdp.exec:\ddvdp.exe95⤵
-
\??\c:\lllxxll.exec:\lllxxll.exe96⤵
-
\??\c:\7hbhhh.exec:\7hbhhh.exe97⤵
-
\??\c:\nnntnn.exec:\nnntnn.exe98⤵
-
\??\c:\dpdjp.exec:\dpdjp.exe99⤵
-
\??\c:\rfxrxfl.exec:\rfxrxfl.exe100⤵
-
\??\c:\thtntt.exec:\thtntt.exe101⤵
-
\??\c:\5htttt.exec:\5htttt.exe102⤵
-
\??\c:\jdpjp.exec:\jdpjp.exe103⤵
-
\??\c:\rrrxlxf.exec:\rrrxlxf.exe104⤵
-
\??\c:\9ffrfrx.exec:\9ffrfrx.exe105⤵
-
\??\c:\bhtnbh.exec:\bhtnbh.exe106⤵
-
\??\c:\hhthtb.exec:\hhthtb.exe107⤵
-
\??\c:\djjpd.exec:\djjpd.exe108⤵
-
\??\c:\lfxlrxf.exec:\lfxlrxf.exe109⤵
-
\??\c:\1bhnbh.exec:\1bhnbh.exe110⤵
-
\??\c:\bbtbnt.exec:\bbtbnt.exe111⤵
-
\??\c:\ddpvp.exec:\ddpvp.exe112⤵
-
\??\c:\xrlrrfr.exec:\xrlrrfr.exe113⤵
-
\??\c:\xrfrrrf.exec:\xrfrrrf.exe114⤵
-
\??\c:\ttttnt.exec:\ttttnt.exe115⤵
-
\??\c:\dvppv.exec:\dvppv.exe116⤵
-
\??\c:\vvjdd.exec:\vvjdd.exe117⤵
-
\??\c:\ffrlxfr.exec:\ffrlxfr.exe118⤵
-
\??\c:\thtbhh.exec:\thtbhh.exe119⤵
-
\??\c:\bthttb.exec:\bthttb.exe120⤵
-
\??\c:\3pddp.exec:\3pddp.exe121⤵
-
\??\c:\rrlxllx.exec:\rrlxllx.exe122⤵
-
\??\c:\lxfflrf.exec:\lxfflrf.exe123⤵
-
\??\c:\tttbtb.exec:\tttbtb.exe124⤵
-
\??\c:\ppdpv.exec:\ppdpv.exe125⤵
-
\??\c:\jjdjd.exec:\jjdjd.exe126⤵
-
\??\c:\llfrlrl.exec:\llfrlrl.exe127⤵
-
\??\c:\rlflflx.exec:\rlflflx.exe128⤵
-
\??\c:\bbtbtb.exec:\bbtbtb.exe129⤵
-
\??\c:\vpjdp.exec:\vpjdp.exe130⤵
-
\??\c:\vvpdj.exec:\vvpdj.exe131⤵
-
\??\c:\rlfrlll.exec:\rlfrlll.exe132⤵
-
\??\c:\xxrlfxf.exec:\xxrlfxf.exe133⤵
-
\??\c:\bbtnbh.exec:\bbtnbh.exe134⤵
-
\??\c:\ppddv.exec:\ppddv.exe135⤵
-
\??\c:\jpjjp.exec:\jpjjp.exe136⤵
-
\??\c:\lllrflr.exec:\lllrflr.exe137⤵
-
\??\c:\dvpvp.exec:\dvpvp.exe138⤵
-
\??\c:\ddppv.exec:\ddppv.exe139⤵
-
\??\c:\9fxxffl.exec:\9fxxffl.exe140⤵
-
\??\c:\rrlxllr.exec:\rrlxllr.exe141⤵
-
\??\c:\hbttbb.exec:\hbttbb.exe142⤵
-
\??\c:\dddjv.exec:\dddjv.exe143⤵
-
\??\c:\5lxfrlr.exec:\5lxfrlr.exe144⤵
-
\??\c:\fflfrff.exec:\fflfrff.exe145⤵
-
\??\c:\7vddd.exec:\7vddd.exe146⤵
-
\??\c:\jjvpv.exec:\jjvpv.exe147⤵
-
\??\c:\5flrrfx.exec:\5flrrfx.exe148⤵
-
\??\c:\5bbntt.exec:\5bbntt.exe149⤵
-
\??\c:\hhtbhn.exec:\hhtbhn.exe150⤵
-
\??\c:\jvjjj.exec:\jvjjj.exe151⤵
-
\??\c:\ffrxffl.exec:\ffrxffl.exe152⤵
-
\??\c:\lxrxfxx.exec:\lxrxfxx.exe153⤵
-
\??\c:\nbnbhn.exec:\nbnbhn.exe154⤵
-
\??\c:\bnbbnh.exec:\bnbbnh.exe155⤵
-
\??\c:\7pddp.exec:\7pddp.exe156⤵
-
\??\c:\rrflfff.exec:\rrflfff.exe157⤵
-
\??\c:\lfrlxxl.exec:\lfrlxxl.exe158⤵
-
\??\c:\1tttbh.exec:\1tttbh.exe159⤵
-
\??\c:\nnhhnt.exec:\nnhhnt.exe160⤵
-
\??\c:\1jvdd.exec:\1jvdd.exe161⤵
-
\??\c:\7flfxxf.exec:\7flfxxf.exe162⤵
-
\??\c:\lxxrxxf.exec:\lxxrxxf.exe163⤵
-
\??\c:\hhntbh.exec:\hhntbh.exe164⤵
-
\??\c:\3bnthh.exec:\3bnthh.exe165⤵
-
\??\c:\3pjvv.exec:\3pjvv.exe166⤵
-
\??\c:\lxlflrr.exec:\lxlflrr.exe167⤵
-
\??\c:\fxlfrxf.exec:\fxlfrxf.exe168⤵
-
\??\c:\nbbbhb.exec:\nbbbhb.exe169⤵
-
\??\c:\3bttnn.exec:\3bttnn.exe170⤵
-
\??\c:\jddjp.exec:\jddjp.exe171⤵
-
\??\c:\dvjpv.exec:\dvjpv.exe172⤵
-
\??\c:\lfrrflr.exec:\lfrrflr.exe173⤵
-
\??\c:\nhbbhn.exec:\nhbbhn.exe174⤵
-
\??\c:\hhnthh.exec:\hhnthh.exe175⤵
-
\??\c:\7jjjp.exec:\7jjjp.exe176⤵
-
\??\c:\jddjd.exec:\jddjd.exe177⤵
-
\??\c:\ffffrfr.exec:\ffffrfr.exe178⤵
-
\??\c:\hbnbbh.exec:\hbnbbh.exe179⤵
-
\??\c:\bthnhn.exec:\bthnhn.exe180⤵
-
\??\c:\pjdvj.exec:\pjdvj.exe181⤵
-
\??\c:\pjddp.exec:\pjddp.exe182⤵
-
\??\c:\1xxxffr.exec:\1xxxffr.exe183⤵
-
\??\c:\5ttnhh.exec:\5ttnhh.exe184⤵
-
\??\c:\9tnhtn.exec:\9tnhtn.exe185⤵
-
\??\c:\jdpdp.exec:\jdpdp.exe186⤵
-
\??\c:\flfllrl.exec:\flfllrl.exe187⤵
-
\??\c:\frlfxlf.exec:\frlfxlf.exe188⤵
-
\??\c:\bbnntn.exec:\bbnntn.exe189⤵
-
\??\c:\jdpjd.exec:\jdpjd.exe190⤵
-
\??\c:\1jvvd.exec:\1jvvd.exe191⤵
-
\??\c:\7lfxlrx.exec:\7lfxlrx.exe192⤵
-
\??\c:\7ntbhh.exec:\7ntbhh.exe193⤵
-
\??\c:\nhtbhn.exec:\nhtbhn.exe194⤵
-
\??\c:\jdvdp.exec:\jdvdp.exe195⤵
-
\??\c:\vjppd.exec:\vjppd.exe196⤵
-
\??\c:\5xxllrx.exec:\5xxllrx.exe197⤵
-
\??\c:\ttthht.exec:\ttthht.exe198⤵
-
\??\c:\nbnttb.exec:\nbnttb.exe199⤵
-
\??\c:\vvdpd.exec:\vvdpd.exe200⤵
-
\??\c:\jvppj.exec:\jvppj.exe201⤵
-
\??\c:\5flxffr.exec:\5flxffr.exe202⤵
-
\??\c:\9hbbnn.exec:\9hbbnn.exe203⤵
-
\??\c:\bbhnnn.exec:\bbhnnn.exe204⤵
-
\??\c:\5jjpv.exec:\5jjpv.exe205⤵
-
\??\c:\5xlfxxf.exec:\5xlfxxf.exe206⤵
-
\??\c:\3lxflrr.exec:\3lxflrr.exe207⤵
-
\??\c:\thtbtn.exec:\thtbtn.exe208⤵
-
\??\c:\pjdjv.exec:\pjdjv.exe209⤵
-
\??\c:\dpjdj.exec:\dpjdj.exe210⤵
-
\??\c:\rfrrrxl.exec:\rfrrrxl.exe211⤵
-
\??\c:\fxllrrf.exec:\fxllrrf.exe212⤵
-
\??\c:\hthbnn.exec:\hthbnn.exe213⤵
-
\??\c:\9pdpv.exec:\9pdpv.exe214⤵
-
\??\c:\vpppd.exec:\vpppd.exe215⤵
-
\??\c:\fllfllx.exec:\fllfllx.exe216⤵
-
\??\c:\hhhttb.exec:\hhhttb.exe217⤵
-
\??\c:\htttbn.exec:\htttbn.exe218⤵
-
\??\c:\dvddj.exec:\dvddj.exe219⤵
-
\??\c:\ffxfffr.exec:\ffxfffr.exe220⤵
-
\??\c:\3lfrrfx.exec:\3lfrrfx.exe221⤵
-
\??\c:\3ntthh.exec:\3ntthh.exe222⤵
-
\??\c:\3hnthh.exec:\3hnthh.exe223⤵
-
\??\c:\1pvvd.exec:\1pvvd.exe224⤵
-
\??\c:\rfllxfr.exec:\rfllxfr.exe225⤵
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe226⤵
-
\??\c:\bnttbb.exec:\bnttbb.exe227⤵
-
\??\c:\bbbhbh.exec:\bbbhbh.exe228⤵
-
\??\c:\vjvdv.exec:\vjvdv.exe229⤵
-
\??\c:\9fxlffl.exec:\9fxlffl.exe230⤵
-
\??\c:\rrlffrl.exec:\rrlffrl.exe231⤵
-
\??\c:\bbtnth.exec:\bbtnth.exe232⤵
-
\??\c:\bnbbbb.exec:\bnbbbb.exe233⤵
-
\??\c:\dvjjd.exec:\dvjjd.exe234⤵
-
\??\c:\ffrffxx.exec:\ffrffxx.exe235⤵
-
\??\c:\7tbbth.exec:\7tbbth.exe236⤵
-
\??\c:\ttbhht.exec:\ttbhht.exe237⤵
-
\??\c:\vpjpv.exec:\vpjpv.exe238⤵
-
\??\c:\1dpjp.exec:\1dpjp.exe239⤵
-
\??\c:\xxrxxfx.exec:\xxrxxfx.exe240⤵
-
\??\c:\9tnnnn.exec:\9tnnnn.exe241⤵