Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 01:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7b4efaf72c980ebcb34f03e02f3b1f871aeb0a8aeab06bd9fdb659aaa8a5ee8e.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
7b4efaf72c980ebcb34f03e02f3b1f871aeb0a8aeab06bd9fdb659aaa8a5ee8e.exe
-
Size
275KB
-
MD5
ab54a64b426e6a2116e6cf3f05ad2b9e
-
SHA1
6e45b1278c894a98cd972134b52302c004312f64
-
SHA256
7b4efaf72c980ebcb34f03e02f3b1f871aeb0a8aeab06bd9fdb659aaa8a5ee8e
-
SHA512
cb901ff29f64779cc1d7eb573a5b126407ec6a1f99f6fd415cdca438a5c9757ff2ae2aa919027c3aae634336ebb34308975720258a067b0aed7936cd6cf90c28
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFfR:8cm7ImGddXmNt251UriZFfR
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2844-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1324-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1760-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3160-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-658-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-675-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1756-730-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-746-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2844-5-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3592-8-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3056-15-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1648-24-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4076-31-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4676-35-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4676-44-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1620-49-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1620-55-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3868-57-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3052-42-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3036-63-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2152-67-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2152-73-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1584-79-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2512-81-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/968-88-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4008-96-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4896-99-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4896-103-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4940-109-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2584-118-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3916-112-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/532-129-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1324-135-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/396-149-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/392-154-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2568-157-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4224-174-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3980-173-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4596-181-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/444-190-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2432-195-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1760-203-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4524-206-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4524-210-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4548-214-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4360-220-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1260-224-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2576-231-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1804-235-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1804-239-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2824-243-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1176-250-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2444-264-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3080-270-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3080-274-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3160-275-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2128-287-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1872-296-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3060-298-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4692-308-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1592-323-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4724-329-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4952-364-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3188-380-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4856-384-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4668-388-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1656-417-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3524-432-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3916-451-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1068-461-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1364-468-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3216-472-0x0000000000400000-0x000000000042A000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
tnnbbt.exebthbhh.exelllfflr.exe0664606.exeq62266.exe802840.exe82226.exerrrxrlx.exejdjvd.exefxrllrr.exejvddd.exe1tbtnh.exebbhbhn.exe682462.exe7bhbtt.exehbnbth.exew02266.exe84660.exe8800068.exepjjpj.exefxllllf.exepjjpj.exefflflll.exefrxrrlx.exehhbbhb.exe4648826.exe6206060.exem6266.exe828200.exetbtthn.exe22826.exes0648.exe2664482.exe0882260.exe80666.exerxffxxr.exerfrffff.exe9ffrlrx.exe20688.exe2086206.exeu064820.exe888244.exerffxrfl.exevvdvp.exec448260.exethbnbt.exe20082.exe3btnbb.exedvdvv.exebnhtbt.exenhnhbh.exe1bhbbt.exe248824.exei060882.exe424428.exejjvpv.exe0448484.exe0848824.exehbthtb.exetntntt.exetbnbnn.exethbbtn.exehhhbnh.exejpjdp.exepid process 3592 tnnbbt.exe 3056 bthbhh.exe 1648 lllfflr.exe 2672 0664606.exe 4076 q62266.exe 4676 802840.exe 3052 82226.exe 1620 rrrxrlx.exe 3868 jdjvd.exe 3036 fxrllrr.exe 2152 jvddd.exe 1584 1tbtnh.exe 2512 bbhbhn.exe 968 682462.exe 4008 7bhbtt.exe 4896 hbnbth.exe 4940 w02266.exe 3916 84660.exe 2584 8800068.exe 3092 pjjpj.exe 532 fxllllf.exe 1324 pjjpj.exe 4840 fflflll.exe 396 frxrrlx.exe 392 hhbbhb.exe 2568 4648826.exe 4672 6206060.exe 3980 m6266.exe 4224 828200.exe 4596 tbtthn.exe 2204 22826.exe 444 s0648.exe 2432 2664482.exe 4420 0882260.exe 1760 80666.exe 4524 rxffxxr.exe 3844 rfrffff.exe 4548 9ffrlrx.exe 4360 20688.exe 1260 2086206.exe 3988 u064820.exe 2576 888244.exe 4336 rffxrfl.exe 1804 vvdvp.exe 2824 c448260.exe 2476 thbnbt.exe 1176 20082.exe 2972 3btnbb.exe 628 dvdvv.exe 3036 bnhtbt.exe 4328 nhnhbh.exe 2444 1bhbbt.exe 2108 248824.exe 3080 i060882.exe 3160 424428.exe 3064 jjvpv.exe 4008 0448484.exe 2128 0848824.exe 1680 hbthtb.exe 1872 tntntt.exe 3060 tbnbnn.exe 4456 thbbtn.exe 4920 hhhbnh.exe 4692 jpjdp.exe -
Processes:
resource yara_rule behavioral2/memory/2844-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2568-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3160-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-472-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7b4efaf72c980ebcb34f03e02f3b1f871aeb0a8aeab06bd9fdb659aaa8a5ee8e.exetnnbbt.exebthbhh.exelllfflr.exe0664606.exeq62266.exe802840.exe82226.exerrrxrlx.exejdjvd.exefxrllrr.exejvddd.exe1tbtnh.exebbhbhn.exe682462.exe7bhbtt.exehbnbth.exew02266.exe84660.exe8800068.exepjjpj.exefxllllf.exedescription pid process target process PID 2844 wrote to memory of 3592 2844 7b4efaf72c980ebcb34f03e02f3b1f871aeb0a8aeab06bd9fdb659aaa8a5ee8e.exe tnnbbt.exe PID 2844 wrote to memory of 3592 2844 7b4efaf72c980ebcb34f03e02f3b1f871aeb0a8aeab06bd9fdb659aaa8a5ee8e.exe tnnbbt.exe PID 2844 wrote to memory of 3592 2844 7b4efaf72c980ebcb34f03e02f3b1f871aeb0a8aeab06bd9fdb659aaa8a5ee8e.exe tnnbbt.exe PID 3592 wrote to memory of 3056 3592 tnnbbt.exe bthbhh.exe PID 3592 wrote to memory of 3056 3592 tnnbbt.exe bthbhh.exe PID 3592 wrote to memory of 3056 3592 tnnbbt.exe bthbhh.exe PID 3056 wrote to memory of 1648 3056 bthbhh.exe lllfflr.exe PID 3056 wrote to memory of 1648 3056 bthbhh.exe lllfflr.exe PID 3056 wrote to memory of 1648 3056 bthbhh.exe lllfflr.exe PID 1648 wrote to memory of 2672 1648 lllfflr.exe 0664606.exe PID 1648 wrote to memory of 2672 1648 lllfflr.exe 0664606.exe PID 1648 wrote to memory of 2672 1648 lllfflr.exe 0664606.exe PID 2672 wrote to memory of 4076 2672 0664606.exe q62266.exe PID 2672 wrote to memory of 4076 2672 0664606.exe q62266.exe PID 2672 wrote to memory of 4076 2672 0664606.exe q62266.exe PID 4076 wrote to memory of 4676 4076 q62266.exe 802840.exe PID 4076 wrote to memory of 4676 4076 q62266.exe 802840.exe PID 4076 wrote to memory of 4676 4076 q62266.exe 802840.exe PID 4676 wrote to memory of 3052 4676 802840.exe 82226.exe PID 4676 wrote to memory of 3052 4676 802840.exe 82226.exe PID 4676 wrote to memory of 3052 4676 802840.exe 82226.exe PID 3052 wrote to memory of 1620 3052 82226.exe rrrxrlx.exe PID 3052 wrote to memory of 1620 3052 82226.exe rrrxrlx.exe PID 3052 wrote to memory of 1620 3052 82226.exe rrrxrlx.exe PID 1620 wrote to memory of 3868 1620 rrrxrlx.exe jdjvd.exe PID 1620 wrote to memory of 3868 1620 rrrxrlx.exe jdjvd.exe PID 1620 wrote to memory of 3868 1620 rrrxrlx.exe jdjvd.exe PID 3868 wrote to memory of 3036 3868 jdjvd.exe fxrllrr.exe PID 3868 wrote to memory of 3036 3868 jdjvd.exe fxrllrr.exe PID 3868 wrote to memory of 3036 3868 jdjvd.exe fxrllrr.exe PID 3036 wrote to memory of 2152 3036 fxrllrr.exe jvddd.exe PID 3036 wrote to memory of 2152 3036 fxrllrr.exe jvddd.exe PID 3036 wrote to memory of 2152 3036 fxrllrr.exe jvddd.exe PID 2152 wrote to memory of 1584 2152 jvddd.exe 1tbtnh.exe PID 2152 wrote to memory of 1584 2152 jvddd.exe 1tbtnh.exe PID 2152 wrote to memory of 1584 2152 jvddd.exe 1tbtnh.exe PID 1584 wrote to memory of 2512 1584 1tbtnh.exe bbhbhn.exe PID 1584 wrote to memory of 2512 1584 1tbtnh.exe bbhbhn.exe PID 1584 wrote to memory of 2512 1584 1tbtnh.exe bbhbhn.exe PID 2512 wrote to memory of 968 2512 bbhbhn.exe 682462.exe PID 2512 wrote to memory of 968 2512 bbhbhn.exe 682462.exe PID 2512 wrote to memory of 968 2512 bbhbhn.exe 682462.exe PID 968 wrote to memory of 4008 968 682462.exe 7bhbtt.exe PID 968 wrote to memory of 4008 968 682462.exe 7bhbtt.exe PID 968 wrote to memory of 4008 968 682462.exe 7bhbtt.exe PID 4008 wrote to memory of 4896 4008 7bhbtt.exe hbnbth.exe PID 4008 wrote to memory of 4896 4008 7bhbtt.exe hbnbth.exe PID 4008 wrote to memory of 4896 4008 7bhbtt.exe hbnbth.exe PID 4896 wrote to memory of 4940 4896 hbnbth.exe w02266.exe PID 4896 wrote to memory of 4940 4896 hbnbth.exe w02266.exe PID 4896 wrote to memory of 4940 4896 hbnbth.exe w02266.exe PID 4940 wrote to memory of 3916 4940 w02266.exe 84660.exe PID 4940 wrote to memory of 3916 4940 w02266.exe 84660.exe PID 4940 wrote to memory of 3916 4940 w02266.exe 84660.exe PID 3916 wrote to memory of 2584 3916 84660.exe 8800068.exe PID 3916 wrote to memory of 2584 3916 84660.exe 8800068.exe PID 3916 wrote to memory of 2584 3916 84660.exe 8800068.exe PID 2584 wrote to memory of 3092 2584 8800068.exe pjjpj.exe PID 2584 wrote to memory of 3092 2584 8800068.exe pjjpj.exe PID 2584 wrote to memory of 3092 2584 8800068.exe pjjpj.exe PID 3092 wrote to memory of 532 3092 pjjpj.exe fxllllf.exe PID 3092 wrote to memory of 532 3092 pjjpj.exe fxllllf.exe PID 3092 wrote to memory of 532 3092 pjjpj.exe fxllllf.exe PID 532 wrote to memory of 1324 532 fxllllf.exe pjjpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b4efaf72c980ebcb34f03e02f3b1f871aeb0a8aeab06bd9fdb659aaa8a5ee8e.exe"C:\Users\Admin\AppData\Local\Temp\7b4efaf72c980ebcb34f03e02f3b1f871aeb0a8aeab06bd9fdb659aaa8a5ee8e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\tnnbbt.exec:\tnnbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\bthbhh.exec:\bthbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\lllfflr.exec:\lllfflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\0664606.exec:\0664606.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\q62266.exec:\q62266.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\802840.exec:\802840.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\82226.exec:\82226.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\rrrxrlx.exec:\rrrxrlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\jdjvd.exec:\jdjvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\fxrllrr.exec:\fxrllrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\jvddd.exec:\jvddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\1tbtnh.exec:\1tbtnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\bbhbhn.exec:\bbhbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\682462.exec:\682462.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\7bhbtt.exec:\7bhbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\hbnbth.exec:\hbnbth.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\w02266.exec:\w02266.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\84660.exec:\84660.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\8800068.exec:\8800068.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\pjjpj.exec:\pjjpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\fxllllf.exec:\fxllllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\pjjpj.exec:\pjjpj.exe23⤵
- Executes dropped EXE
PID:1324 -
\??\c:\fflflll.exec:\fflflll.exe24⤵
- Executes dropped EXE
PID:4840 -
\??\c:\frxrrlx.exec:\frxrrlx.exe25⤵
- Executes dropped EXE
PID:396 -
\??\c:\hhbbhb.exec:\hhbbhb.exe26⤵
- Executes dropped EXE
PID:392 -
\??\c:\4648826.exec:\4648826.exe27⤵
- Executes dropped EXE
PID:2568 -
\??\c:\6206060.exec:\6206060.exe28⤵
- Executes dropped EXE
PID:4672 -
\??\c:\m6266.exec:\m6266.exe29⤵
- Executes dropped EXE
PID:3980 -
\??\c:\828200.exec:\828200.exe30⤵
- Executes dropped EXE
PID:4224 -
\??\c:\tbtthn.exec:\tbtthn.exe31⤵
- Executes dropped EXE
PID:4596 -
\??\c:\22826.exec:\22826.exe32⤵
- Executes dropped EXE
PID:2204 -
\??\c:\s0648.exec:\s0648.exe33⤵
- Executes dropped EXE
PID:444 -
\??\c:\2664482.exec:\2664482.exe34⤵
- Executes dropped EXE
PID:2432 -
\??\c:\0882260.exec:\0882260.exe35⤵
- Executes dropped EXE
PID:4420 -
\??\c:\80666.exec:\80666.exe36⤵
- Executes dropped EXE
PID:1760 -
\??\c:\rxffxxr.exec:\rxffxxr.exe37⤵
- Executes dropped EXE
PID:4524 -
\??\c:\rfrffff.exec:\rfrffff.exe38⤵
- Executes dropped EXE
PID:3844 -
\??\c:\9ffrlrx.exec:\9ffrlrx.exe39⤵
- Executes dropped EXE
PID:4548 -
\??\c:\20688.exec:\20688.exe40⤵
- Executes dropped EXE
PID:4360 -
\??\c:\2086206.exec:\2086206.exe41⤵
- Executes dropped EXE
PID:1260 -
\??\c:\u064820.exec:\u064820.exe42⤵
- Executes dropped EXE
PID:3988 -
\??\c:\888244.exec:\888244.exe43⤵
- Executes dropped EXE
PID:2576 -
\??\c:\rffxrfl.exec:\rffxrfl.exe44⤵
- Executes dropped EXE
PID:4336 -
\??\c:\vvdvp.exec:\vvdvp.exe45⤵
- Executes dropped EXE
PID:1804 -
\??\c:\c448260.exec:\c448260.exe46⤵
- Executes dropped EXE
PID:2824 -
\??\c:\thbnbt.exec:\thbnbt.exe47⤵
- Executes dropped EXE
PID:2476 -
\??\c:\20082.exec:\20082.exe48⤵
- Executes dropped EXE
PID:1176 -
\??\c:\3btnbb.exec:\3btnbb.exe49⤵
- Executes dropped EXE
PID:2972 -
\??\c:\dvdvv.exec:\dvdvv.exe50⤵
- Executes dropped EXE
PID:628 -
\??\c:\bnhtbt.exec:\bnhtbt.exe51⤵
- Executes dropped EXE
PID:3036 -
\??\c:\nhnhbh.exec:\nhnhbh.exe52⤵
- Executes dropped EXE
PID:4328 -
\??\c:\1bhbbt.exec:\1bhbbt.exe53⤵
- Executes dropped EXE
PID:2444 -
\??\c:\248824.exec:\248824.exe54⤵
- Executes dropped EXE
PID:2108 -
\??\c:\i060882.exec:\i060882.exe55⤵
- Executes dropped EXE
PID:3080 -
\??\c:\424428.exec:\424428.exe56⤵
- Executes dropped EXE
PID:3160 -
\??\c:\jjvpv.exec:\jjvpv.exe57⤵
- Executes dropped EXE
PID:3064 -
\??\c:\0448484.exec:\0448484.exe58⤵
- Executes dropped EXE
PID:4008 -
\??\c:\0848824.exec:\0848824.exe59⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hbthtb.exec:\hbthtb.exe60⤵
- Executes dropped EXE
PID:1680 -
\??\c:\tntntt.exec:\tntntt.exe61⤵
- Executes dropped EXE
PID:1872 -
\??\c:\tbnbnn.exec:\tbnbnn.exe62⤵
- Executes dropped EXE
PID:3060 -
\??\c:\thbbtn.exec:\thbbtn.exe63⤵
- Executes dropped EXE
PID:4456 -
\??\c:\hhhbnh.exec:\hhhbnh.exe64⤵
- Executes dropped EXE
PID:4920 -
\??\c:\jpjdp.exec:\jpjdp.exe65⤵
- Executes dropped EXE
PID:4692 -
\??\c:\20266.exec:\20266.exe66⤵PID:4528
-
\??\c:\nhbthb.exec:\nhbthb.exe67⤵PID:848
-
\??\c:\868222.exec:\868222.exe68⤵PID:2836
-
\??\c:\tbbtnh.exec:\tbbtnh.exe69⤵PID:1592
-
\??\c:\xfxlxrf.exec:\xfxlxrf.exe70⤵PID:4036
-
\??\c:\bttnbb.exec:\bttnbb.exe71⤵PID:4900
-
\??\c:\7tnhtn.exec:\7tnhtn.exe72⤵PID:4724
-
\??\c:\vpjdd.exec:\vpjdd.exe73⤵PID:2176
-
\??\c:\s2860.exec:\s2860.exe74⤵PID:2164
-
\??\c:\062604.exec:\062604.exe75⤵PID:3604
-
\??\c:\dvjdp.exec:\dvjdp.exe76⤵PID:3980
-
\??\c:\s6088.exec:\s6088.exe77⤵PID:4620
-
\??\c:\28048.exec:\28048.exe78⤵PID:3452
-
\??\c:\c004260.exec:\c004260.exe79⤵PID:1016
-
\??\c:\5ddvp.exec:\5ddvp.exe80⤵PID:2908
-
\??\c:\60260.exec:\60260.exe81⤵PID:2500
-
\??\c:\862428.exec:\862428.exe82⤵PID:4952
-
\??\c:\bhhhbt.exec:\bhhhbt.exe83⤵PID:2516
-
\??\c:\u220466.exec:\u220466.exe84⤵PID:4380
-
\??\c:\ffxxxxr.exec:\ffxxxxr.exe85⤵PID:3356
-
\??\c:\8244888.exec:\8244888.exe86⤵PID:2492
-
\??\c:\5dvvv.exec:\5dvvv.exe87⤵PID:3188
-
\??\c:\60604.exec:\60604.exe88⤵PID:1684
-
\??\c:\tbnnbb.exec:\tbnnbb.exe89⤵PID:4856
-
\??\c:\a0260.exec:\a0260.exe90⤵PID:4668
-
\??\c:\602222.exec:\602222.exe91⤵PID:4584
-
\??\c:\5flfrrr.exec:\5flfrrr.exe92⤵PID:1900
-
\??\c:\2408886.exec:\2408886.exe93⤵PID:2744
-
\??\c:\o888882.exec:\o888882.exe94⤵PID:2652
-
\??\c:\hbhnnn.exec:\hbhnnn.exe95⤵PID:1108
-
\??\c:\c028260.exec:\c028260.exe96⤵PID:688
-
\??\c:\0288222.exec:\0288222.exe97⤵PID:3504
-
\??\c:\llrrxxr.exec:\llrrxxr.exe98⤵PID:2156
-
\??\c:\5vddv.exec:\5vddv.exe99⤵PID:1656
-
\??\c:\tntttb.exec:\tntttb.exe100⤵PID:1812
-
\??\c:\lllrrrr.exec:\lllrrrr.exe101⤵PID:436
-
\??\c:\ntbttn.exec:\ntbttn.exe102⤵PID:1128
-
\??\c:\nntttt.exec:\nntttt.exe103⤵PID:4332
-
\??\c:\e88080.exec:\e88080.exe104⤵PID:3524
-
\??\c:\84048.exec:\84048.exe105⤵PID:3660
-
\??\c:\9tbbtb.exec:\9tbbtb.exe106⤵PID:1248
-
\??\c:\tthbhb.exec:\tthbhb.exe107⤵PID:4008
-
\??\c:\0842262.exec:\0842262.exe108⤵PID:3976
-
\??\c:\0400004.exec:\0400004.exe109⤵PID:1600
-
\??\c:\8282226.exec:\8282226.exe110⤵PID:3916
-
\??\c:\3jpjj.exec:\3jpjj.exe111⤵PID:2880
-
\??\c:\ffrlllr.exec:\ffrlllr.exe112⤵PID:2008
-
\??\c:\7lrlfff.exec:\7lrlfff.exe113⤵PID:1068
-
\??\c:\u200662.exec:\u200662.exe114⤵PID:1364
-
\??\c:\ppjpj.exec:\ppjpj.exe115⤵PID:4180
-
\??\c:\66600.exec:\66600.exe116⤵PID:3216
-
\??\c:\k24444.exec:\k24444.exe117⤵PID:4196
-
\??\c:\dddjv.exec:\dddjv.exe118⤵PID:4900
-
\??\c:\8022288.exec:\8022288.exe119⤵PID:2112
-
\??\c:\600222.exec:\600222.exe120⤵PID:3772
-
\??\c:\xflfxxr.exec:\xflfxxr.exe121⤵PID:5060
-
\??\c:\806622.exec:\806622.exe122⤵PID:1076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-