Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 06:09
Behavioral task
behavioral1
Sample
bb3af1059bcfc5cf4212d6510c4651e1fb4942d0d10383a11db45a7e79c31725.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
-
Target
bb3af1059bcfc5cf4212d6510c4651e1fb4942d0d10383a11db45a7e79c31725.exe
-
Size
369KB
-
MD5
41b85936f8793948c64019bd1703cc37
-
SHA1
13a0e1ff602365d139267a9ba9299944a62893f9
-
SHA256
bb3af1059bcfc5cf4212d6510c4651e1fb4942d0d10383a11db45a7e79c31725
-
SHA512
ece86e48a13855dd0407b96ea22c1ababe881baf79158cbcbfd45877ab699e08d0d55b47b13609516f2b94a4fcd8365d5cd3b0b342e293811464a2d90815cf99
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOFltH4tiAlSpgFZAzwdjcIlSpgFZZr3GSM/xCk5:y4wFHoS3eFplAlSpgFZAKjcIlSpgFZZC
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3492-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2196-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1484-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4812-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1824-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4636-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/368-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2156-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1560-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3080-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2628-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4328-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3872-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2456-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/556-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4684-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3912-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2540-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2952-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2896-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2948-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2800-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2688-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1284-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1148-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4548-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1888-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2528-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2432-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1516-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3452-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2172-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3220-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/336-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1820-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2720-565-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-596-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-652-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-665-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-670-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-674-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3488-699-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-712-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-728-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3492-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nnnhbb.exe UPX behavioral2/memory/3492-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2196-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bbtnnh.exe UPX C:\vvpjj.exe UPX C:\frxxrrl.exe UPX behavioral2/memory/1484-24-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4988-30-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\9tnhnh.exe UPX behavioral2/memory/5112-20-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3020-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\frxxffr.exe UPX C:\hhhbbb.exe UPX behavioral2/memory/3988-41-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xfxrxxr.exe UPX behavioral2/memory/4812-47-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4936-50-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\1hbnhn.exe UPX C:\jpvpp.exe UPX behavioral2/memory/3236-58-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xxlrxxf.exe UPX behavioral2/memory/2204-64-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1824-66-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hbthbb.exe UPX \??\c:\vvvpd.exe UPX behavioral2/memory/4828-78-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lxlffrr.exe UPX behavioral2/memory/4636-84-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pddvp.exe UPX behavioral2/memory/368-92-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\frxxfff.exe UPX behavioral2/memory/2156-96-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hbtbbb.exe UPX C:\9vddv.exe UPX behavioral2/memory/1560-105-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7nbtbb.exe UPX behavioral2/memory/3080-111-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pddvv.exe UPX behavioral2/memory/2628-117-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xflflrr.exe UPX behavioral2/memory/60-123-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pvdvv.exe UPX behavioral2/memory/4328-128-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3872-131-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\rrrfxxl.exe UPX C:\btbttt.exe UPX behavioral2/memory/2456-142-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\vvjjj.exe UPX C:\fxxlllf.exe UPX C:\9bnhnn.exe UPX behavioral2/memory/556-161-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\jjvvd.exe UPX behavioral2/memory/4684-165-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\frrxrxr.exe UPX C:\tnbttt.exe UPX C:\rlflfff.exe UPX behavioral2/memory/3192-178-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\htbnht.exe UPX behavioral2/memory/4976-189-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4976-193-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3912-194-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2540-201-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2952-205-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
nnnhbb.exebbtnnh.exevvpjj.exefrxxrrl.exe9tnhnh.exefrxxffr.exehhhbbb.exexfxrxxr.exe1hbnhn.exejpvpp.exexxlrxxf.exehbthbb.exevvvpd.exelxlffrr.exepddvp.exefrxxfff.exehbtbbb.exe9vddv.exe7nbtbb.exepddvv.exexflflrr.exepvdvv.exerrrfxxl.exebtbttt.exevvjjj.exefxxlllf.exe9bnhnn.exejjvvd.exefrrxrxr.exetnbttt.exerlflfff.exehtbnht.exevpjdv.exexfrrlll.exettttnn.exennnnnn.exepvvpj.exerrllllr.exe3rxxxfl.exehhbttt.exepvdpj.exedvjdd.exelxffllr.exenhbtnb.exevvpvv.exejddvj.exelfffrxx.exe5bhhbb.exettnnnn.exe3jjvp.exefxrlfxx.exenhhhbb.exetbbnhn.exejpjdv.exelllfrrr.exenhhhbb.exebhbtbh.exe9jjjd.exe5rrllll.exe7lxxlxr.exebnntnb.exevppdp.exedjjdv.exerrxlrfl.exepid process 2196 nnnhbb.exe 5112 bbtnnh.exe 3020 vvpjj.exe 1484 frxxrrl.exe 4988 9tnhnh.exe 3988 frxxffr.exe 4812 hhhbbb.exe 4936 xfxrxxr.exe 3236 1hbnhn.exe 2204 jpvpp.exe 1824 xxlrxxf.exe 2816 hbthbb.exe 4828 vvvpd.exe 4636 lxlffrr.exe 368 pddvp.exe 2156 frxxfff.exe 1560 hbtbbb.exe 3080 9vddv.exe 2628 7nbtbb.exe 60 pddvv.exe 4328 xflflrr.exe 3872 pvdvv.exe 3208 rrrfxxl.exe 2456 btbttt.exe 3552 vvjjj.exe 5008 fxxlllf.exe 556 9bnhnn.exe 4684 jjvvd.exe 3240 frrxrxr.exe 3192 tnbttt.exe 3544 rlflfff.exe 1260 htbnht.exe 4976 vpjdv.exe 3912 xfrrlll.exe 2540 ttttnn.exe 2952 nnnnnn.exe 2896 pvvpj.exe 4556 rrllllr.exe 4596 3rxxxfl.exe 2980 hhbttt.exe 4432 pvdpj.exe 3960 dvjdd.exe 4540 lxffllr.exe 4880 nhbtnb.exe 2948 vvpvv.exe 4020 jddvj.exe 412 lfffrxx.exe 2800 5bhhbb.exe 2688 ttnnnn.exe 1092 3jjvp.exe 2612 fxrlfxx.exe 1284 nhhhbb.exe 4672 tbbnhn.exe 776 jpjdv.exe 1256 lllfrrr.exe 1148 nhhhbb.exe 3140 bhbtbh.exe 2076 9jjjd.exe 4756 5rrllll.exe 2100 7lxxlxr.exe 964 bnntnb.exe 2440 vppdp.exe 2856 djjdv.exe 1872 rrxlrfl.exe -
Processes:
resource yara_rule behavioral2/memory/3492-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnnhbb.exe upx behavioral2/memory/3492-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2196-8-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbtnnh.exe upx C:\vvpjj.exe upx C:\frxxrrl.exe upx behavioral2/memory/1484-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4988-30-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9tnhnh.exe upx behavioral2/memory/5112-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3020-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frxxffr.exe upx C:\hhhbbb.exe upx behavioral2/memory/3988-41-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xfxrxxr.exe upx behavioral2/memory/4812-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4936-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1hbnhn.exe upx C:\jpvpp.exe upx behavioral2/memory/3236-58-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxlrxxf.exe upx behavioral2/memory/2204-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1824-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbthbb.exe upx \??\c:\vvvpd.exe upx behavioral2/memory/4828-78-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxlffrr.exe upx behavioral2/memory/4636-84-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pddvp.exe upx behavioral2/memory/368-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frxxfff.exe upx behavioral2/memory/2156-96-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbtbbb.exe upx C:\9vddv.exe upx behavioral2/memory/1560-105-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7nbtbb.exe upx behavioral2/memory/3080-111-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pddvv.exe upx behavioral2/memory/2628-117-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xflflrr.exe upx behavioral2/memory/60-123-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvdvv.exe upx behavioral2/memory/4328-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3872-131-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rrrfxxl.exe upx C:\btbttt.exe upx behavioral2/memory/2456-142-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vvjjj.exe upx C:\fxxlllf.exe upx C:\9bnhnn.exe upx behavioral2/memory/556-161-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jjvvd.exe upx behavioral2/memory/4684-165-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frrxrxr.exe upx C:\tnbttt.exe upx C:\rlflfff.exe upx behavioral2/memory/3192-178-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htbnht.exe upx behavioral2/memory/4976-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4976-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3912-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2540-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2952-205-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bb3af1059bcfc5cf4212d6510c4651e1fb4942d0d10383a11db45a7e79c31725.exennnhbb.exebbtnnh.exevvpjj.exefrxxrrl.exe9tnhnh.exefrxxffr.exehhhbbb.exexfxrxxr.exe1hbnhn.exejpvpp.exexxlrxxf.exehbthbb.exevvvpd.exelxlffrr.exepddvp.exefrxxfff.exehbtbbb.exe9vddv.exe7nbtbb.exepddvv.exexflflrr.exedescription pid process target process PID 3492 wrote to memory of 2196 3492 bb3af1059bcfc5cf4212d6510c4651e1fb4942d0d10383a11db45a7e79c31725.exe nnnhbb.exe PID 3492 wrote to memory of 2196 3492 bb3af1059bcfc5cf4212d6510c4651e1fb4942d0d10383a11db45a7e79c31725.exe nnnhbb.exe PID 3492 wrote to memory of 2196 3492 bb3af1059bcfc5cf4212d6510c4651e1fb4942d0d10383a11db45a7e79c31725.exe nnnhbb.exe PID 2196 wrote to memory of 5112 2196 nnnhbb.exe bbtnnh.exe PID 2196 wrote to memory of 5112 2196 nnnhbb.exe bbtnnh.exe PID 2196 wrote to memory of 5112 2196 nnnhbb.exe bbtnnh.exe PID 5112 wrote to memory of 3020 5112 bbtnnh.exe vvpjj.exe PID 5112 wrote to memory of 3020 5112 bbtnnh.exe vvpjj.exe PID 5112 wrote to memory of 3020 5112 bbtnnh.exe vvpjj.exe PID 3020 wrote to memory of 1484 3020 vvpjj.exe frxxrrl.exe PID 3020 wrote to memory of 1484 3020 vvpjj.exe frxxrrl.exe PID 3020 wrote to memory of 1484 3020 vvpjj.exe frxxrrl.exe PID 1484 wrote to memory of 4988 1484 frxxrrl.exe 9tnhnh.exe PID 1484 wrote to memory of 4988 1484 frxxrrl.exe 9tnhnh.exe PID 1484 wrote to memory of 4988 1484 frxxrrl.exe 9tnhnh.exe PID 4988 wrote to memory of 3988 4988 9tnhnh.exe frxxffr.exe PID 4988 wrote to memory of 3988 4988 9tnhnh.exe frxxffr.exe PID 4988 wrote to memory of 3988 4988 9tnhnh.exe frxxffr.exe PID 3988 wrote to memory of 4812 3988 frxxffr.exe hhhbbb.exe PID 3988 wrote to memory of 4812 3988 frxxffr.exe hhhbbb.exe PID 3988 wrote to memory of 4812 3988 frxxffr.exe hhhbbb.exe PID 4812 wrote to memory of 4936 4812 hhhbbb.exe xfxrxxr.exe PID 4812 wrote to memory of 4936 4812 hhhbbb.exe xfxrxxr.exe PID 4812 wrote to memory of 4936 4812 hhhbbb.exe xfxrxxr.exe PID 4936 wrote to memory of 3236 4936 xfxrxxr.exe 1hbnhn.exe PID 4936 wrote to memory of 3236 4936 xfxrxxr.exe 1hbnhn.exe PID 4936 wrote to memory of 3236 4936 xfxrxxr.exe 1hbnhn.exe PID 3236 wrote to memory of 2204 3236 1hbnhn.exe jpvpp.exe PID 3236 wrote to memory of 2204 3236 1hbnhn.exe jpvpp.exe PID 3236 wrote to memory of 2204 3236 1hbnhn.exe jpvpp.exe PID 2204 wrote to memory of 1824 2204 jpvpp.exe xxlrxxf.exe PID 2204 wrote to memory of 1824 2204 jpvpp.exe xxlrxxf.exe PID 2204 wrote to memory of 1824 2204 jpvpp.exe xxlrxxf.exe PID 1824 wrote to memory of 2816 1824 xxlrxxf.exe hbthbb.exe PID 1824 wrote to memory of 2816 1824 xxlrxxf.exe hbthbb.exe PID 1824 wrote to memory of 2816 1824 xxlrxxf.exe hbthbb.exe PID 2816 wrote to memory of 4828 2816 hbthbb.exe vvvpd.exe PID 2816 wrote to memory of 4828 2816 hbthbb.exe vvvpd.exe PID 2816 wrote to memory of 4828 2816 hbthbb.exe vvvpd.exe PID 4828 wrote to memory of 4636 4828 vvvpd.exe lxlffrr.exe PID 4828 wrote to memory of 4636 4828 vvvpd.exe lxlffrr.exe PID 4828 wrote to memory of 4636 4828 vvvpd.exe lxlffrr.exe PID 4636 wrote to memory of 368 4636 lxlffrr.exe pddvp.exe PID 4636 wrote to memory of 368 4636 lxlffrr.exe pddvp.exe PID 4636 wrote to memory of 368 4636 lxlffrr.exe pddvp.exe PID 368 wrote to memory of 2156 368 pddvp.exe frxxfff.exe PID 368 wrote to memory of 2156 368 pddvp.exe frxxfff.exe PID 368 wrote to memory of 2156 368 pddvp.exe frxxfff.exe PID 2156 wrote to memory of 1560 2156 frxxfff.exe hbtbbb.exe PID 2156 wrote to memory of 1560 2156 frxxfff.exe hbtbbb.exe PID 2156 wrote to memory of 1560 2156 frxxfff.exe hbtbbb.exe PID 1560 wrote to memory of 3080 1560 hbtbbb.exe 9vddv.exe PID 1560 wrote to memory of 3080 1560 hbtbbb.exe 9vddv.exe PID 1560 wrote to memory of 3080 1560 hbtbbb.exe 9vddv.exe PID 3080 wrote to memory of 2628 3080 9vddv.exe 7nbtbb.exe PID 3080 wrote to memory of 2628 3080 9vddv.exe 7nbtbb.exe PID 3080 wrote to memory of 2628 3080 9vddv.exe 7nbtbb.exe PID 2628 wrote to memory of 60 2628 7nbtbb.exe pddvv.exe PID 2628 wrote to memory of 60 2628 7nbtbb.exe pddvv.exe PID 2628 wrote to memory of 60 2628 7nbtbb.exe pddvv.exe PID 60 wrote to memory of 4328 60 pddvv.exe xflflrr.exe PID 60 wrote to memory of 4328 60 pddvv.exe xflflrr.exe PID 60 wrote to memory of 4328 60 pddvv.exe xflflrr.exe PID 4328 wrote to memory of 3872 4328 xflflrr.exe pvdvv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb3af1059bcfc5cf4212d6510c4651e1fb4942d0d10383a11db45a7e79c31725.exe"C:\Users\Admin\AppData\Local\Temp\bb3af1059bcfc5cf4212d6510c4651e1fb4942d0d10383a11db45a7e79c31725.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\nnnhbb.exec:\nnnhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\bbtnnh.exec:\bbtnnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\vvpjj.exec:\vvpjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\frxxrrl.exec:\frxxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\9tnhnh.exec:\9tnhnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\frxxffr.exec:\frxxffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\hhhbbb.exec:\hhhbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\xfxrxxr.exec:\xfxrxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\1hbnhn.exec:\1hbnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\jpvpp.exec:\jpvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\xxlrxxf.exec:\xxlrxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\hbthbb.exec:\hbthbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\vvvpd.exec:\vvvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\lxlffrr.exec:\lxlffrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\pddvp.exec:\pddvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\frxxfff.exec:\frxxfff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\hbtbbb.exec:\hbtbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\9vddv.exec:\9vddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\7nbtbb.exec:\7nbtbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\pddvv.exec:\pddvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\xflflrr.exec:\xflflrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\pvdvv.exec:\pvdvv.exe23⤵
- Executes dropped EXE
PID:3872 -
\??\c:\rrrfxxl.exec:\rrrfxxl.exe24⤵
- Executes dropped EXE
PID:3208 -
\??\c:\btbttt.exec:\btbttt.exe25⤵
- Executes dropped EXE
PID:2456 -
\??\c:\vvjjj.exec:\vvjjj.exe26⤵
- Executes dropped EXE
PID:3552 -
\??\c:\fxxlllf.exec:\fxxlllf.exe27⤵
- Executes dropped EXE
PID:5008 -
\??\c:\9bnhnn.exec:\9bnhnn.exe28⤵
- Executes dropped EXE
PID:556 -
\??\c:\jjvvd.exec:\jjvvd.exe29⤵
- Executes dropped EXE
PID:4684 -
\??\c:\frrxrxr.exec:\frrxrxr.exe30⤵
- Executes dropped EXE
PID:3240 -
\??\c:\tnbttt.exec:\tnbttt.exe31⤵
- Executes dropped EXE
PID:3192 -
\??\c:\rlflfff.exec:\rlflfff.exe32⤵
- Executes dropped EXE
PID:3544 -
\??\c:\htbnht.exec:\htbnht.exe33⤵
- Executes dropped EXE
PID:1260 -
\??\c:\vpjdv.exec:\vpjdv.exe34⤵
- Executes dropped EXE
PID:4976 -
\??\c:\xfrrlll.exec:\xfrrlll.exe35⤵
- Executes dropped EXE
PID:3912 -
\??\c:\ttttnn.exec:\ttttnn.exe36⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nnnnnn.exec:\nnnnnn.exe37⤵
- Executes dropped EXE
PID:2952 -
\??\c:\pvvpj.exec:\pvvpj.exe38⤵
- Executes dropped EXE
PID:2896 -
\??\c:\rrllllr.exec:\rrllllr.exe39⤵
- Executes dropped EXE
PID:4556 -
\??\c:\3rxxxfl.exec:\3rxxxfl.exe40⤵
- Executes dropped EXE
PID:4596 -
\??\c:\hhbttt.exec:\hhbttt.exe41⤵
- Executes dropped EXE
PID:2980 -
\??\c:\pvdpj.exec:\pvdpj.exe42⤵
- Executes dropped EXE
PID:4432 -
\??\c:\dvjdd.exec:\dvjdd.exe43⤵
- Executes dropped EXE
PID:3960 -
\??\c:\lxffllr.exec:\lxffllr.exe44⤵
- Executes dropped EXE
PID:4540 -
\??\c:\nhbtnb.exec:\nhbtnb.exe45⤵
- Executes dropped EXE
PID:4880 -
\??\c:\vvpvv.exec:\vvpvv.exe46⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jddvj.exec:\jddvj.exe47⤵
- Executes dropped EXE
PID:4020 -
\??\c:\lfffrxx.exec:\lfffrxx.exe48⤵
- Executes dropped EXE
PID:412 -
\??\c:\5bhhbb.exec:\5bhhbb.exe49⤵
- Executes dropped EXE
PID:2800 -
\??\c:\ttnnnn.exec:\ttnnnn.exe50⤵
- Executes dropped EXE
PID:2688 -
\??\c:\3jjvp.exec:\3jjvp.exe51⤵
- Executes dropped EXE
PID:1092 -
\??\c:\fxrlfxx.exec:\fxrlfxx.exe52⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nhhhbb.exec:\nhhhbb.exe53⤵
- Executes dropped EXE
PID:1284 -
\??\c:\tbbnhn.exec:\tbbnhn.exe54⤵
- Executes dropped EXE
PID:4672 -
\??\c:\jpjdv.exec:\jpjdv.exe55⤵
- Executes dropped EXE
PID:776 -
\??\c:\lllfrrr.exec:\lllfrrr.exe56⤵
- Executes dropped EXE
PID:1256 -
\??\c:\nhhhbb.exec:\nhhhbb.exe57⤵
- Executes dropped EXE
PID:1148 -
\??\c:\bhbtbh.exec:\bhbtbh.exe58⤵
- Executes dropped EXE
PID:3140 -
\??\c:\9jjjd.exec:\9jjjd.exe59⤵
- Executes dropped EXE
PID:2076 -
\??\c:\5rrllll.exec:\5rrllll.exe60⤵
- Executes dropped EXE
PID:4756 -
\??\c:\7lxxlxr.exec:\7lxxlxr.exe61⤵
- Executes dropped EXE
PID:2100 -
\??\c:\bnntnb.exec:\bnntnb.exe62⤵
- Executes dropped EXE
PID:964 -
\??\c:\vppdp.exec:\vppdp.exe63⤵
- Executes dropped EXE
PID:2440 -
\??\c:\djjdv.exec:\djjdv.exe64⤵
- Executes dropped EXE
PID:2856 -
\??\c:\rrxlrfl.exec:\rrxlrfl.exe65⤵
- Executes dropped EXE
PID:1872 -
\??\c:\tthtnt.exec:\tthtnt.exe66⤵PID:3148
-
\??\c:\nhhbtt.exec:\nhhbtt.exe67⤵PID:4548
-
\??\c:\dppjp.exec:\dppjp.exe68⤵PID:5064
-
\??\c:\3frxxrl.exec:\3frxxrl.exe69⤵PID:468
-
\??\c:\7rxxfll.exec:\7rxxfll.exe70⤵PID:1888
-
\??\c:\ththnb.exec:\ththnb.exe71⤵PID:4684
-
\??\c:\7xxxxxr.exec:\7xxxxxr.exe72⤵PID:2528
-
\??\c:\rrrlffx.exec:\rrrlffx.exe73⤵PID:2328
-
\??\c:\hhbtbb.exec:\hhbtbb.exe74⤵PID:4156
-
\??\c:\5dvdd.exec:\5dvdd.exe75⤵PID:2392
-
\??\c:\ffllrrl.exec:\ffllrrl.exe76⤵PID:4632
-
\??\c:\fxllxfr.exec:\fxllxfr.exe77⤵PID:3352
-
\??\c:\1hbttt.exec:\1hbttt.exe78⤵PID:2924
-
\??\c:\nhhbbt.exec:\nhhbbt.exe79⤵PID:4272
-
\??\c:\3vppj.exec:\3vppj.exe80⤵PID:1492
-
\??\c:\jddjv.exec:\jddjv.exe81⤵PID:2952
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe82⤵PID:4056
-
\??\c:\hbbtnt.exec:\hbbtnt.exe83⤵PID:4556
-
\??\c:\pjpjv.exec:\pjpjv.exe84⤵PID:2432
-
\??\c:\lffxllf.exec:\lffxllf.exe85⤵PID:3572
-
\??\c:\ntnhtb.exec:\ntnhtb.exe86⤵PID:1280
-
\??\c:\thbhnt.exec:\thbhnt.exe87⤵PID:3136
-
\??\c:\pdvvp.exec:\pdvvp.exe88⤵PID:2160
-
\??\c:\xlrfxlf.exec:\xlrfxlf.exe89⤵PID:4108
-
\??\c:\bbttnt.exec:\bbttnt.exe90⤵PID:3476
-
\??\c:\dpvvd.exec:\dpvvd.exe91⤵PID:4020
-
\??\c:\vjppp.exec:\vjppp.exe92⤵PID:2816
-
\??\c:\xxxrllf.exec:\xxxrllf.exe93⤵PID:2688
-
\??\c:\tnnhbb.exec:\tnnhbb.exe94⤵PID:4848
-
\??\c:\9bnnht.exec:\9bnnht.exe95⤵PID:368
-
\??\c:\ddpjd.exec:\ddpjd.exe96⤵PID:4840
-
\??\c:\9jppp.exec:\9jppp.exe97⤵PID:4564
-
\??\c:\3rrlffx.exec:\3rrlffx.exe98⤵PID:2248
-
\??\c:\5rxrxxx.exec:\5rxrxxx.exe99⤵PID:1516
-
\??\c:\5ntnhh.exec:\5ntnhh.exe100⤵PID:632
-
\??\c:\3pjdp.exec:\3pjdp.exe101⤵PID:2628
-
\??\c:\ddvpp.exec:\ddvpp.exe102⤵PID:2068
-
\??\c:\rlxxllf.exec:\rlxxllf.exe103⤵PID:5080
-
\??\c:\fffxrrr.exec:\fffxrrr.exe104⤵PID:552
-
\??\c:\bbtnnn.exec:\bbtnnn.exe105⤵PID:3452
-
\??\c:\jddjj.exec:\jddjj.exe106⤵PID:4064
-
\??\c:\vjppp.exec:\vjppp.exe107⤵PID:2172
-
\??\c:\fllrxlr.exec:\fllrxlr.exe108⤵PID:3708
-
\??\c:\5rllllf.exec:\5rllllf.exe109⤵PID:3220
-
\??\c:\btttnn.exec:\btttnn.exe110⤵PID:4400
-
\??\c:\jdvpj.exec:\jdvpj.exe111⤵PID:888
-
\??\c:\pjvpd.exec:\pjvpd.exe112⤵PID:1900
-
\??\c:\xlffxrr.exec:\xlffxrr.exe113⤵PID:3360
-
\??\c:\1nbnhn.exec:\1nbnhn.exe114⤵PID:2580
-
\??\c:\hbbtnn.exec:\hbbtnn.exe115⤵PID:3996
-
\??\c:\pvpvv.exec:\pvpvv.exe116⤵PID:336
-
\??\c:\9vvpj.exec:\9vvpj.exe117⤵PID:1868
-
\??\c:\frfffxr.exec:\frfffxr.exe118⤵PID:1852
-
\??\c:\tbhbtn.exec:\tbhbtn.exe119⤵PID:5016
-
\??\c:\9nnhbb.exec:\9nnhbb.exe120⤵PID:2540
-
\??\c:\vpppj.exec:\vpppj.exe121⤵PID:3812
-
\??\c:\rrxxrrf.exec:\rrxxrrf.exe122⤵PID:1820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-