Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 07:15
Behavioral task
behavioral1
Sample
c6d139a695d9529c634b1dbe018d0d29b87751a566e2b7f68c9acbc0f86e5a80.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
c6d139a695d9529c634b1dbe018d0d29b87751a566e2b7f68c9acbc0f86e5a80.exe
-
Size
440KB
-
MD5
8b53bc41a4643fe72619ddcb8f25ed9d
-
SHA1
efecc4025310aba83a59fe6ccc5494d400519429
-
SHA256
c6d139a695d9529c634b1dbe018d0d29b87751a566e2b7f68c9acbc0f86e5a80
-
SHA512
4d95ba4c7ba64aaef06104f8ce8b890f71b64af0c29d44585ad84a8596bea412491d77854564783c50ea58351b32010b110876aafab2781f1cf6d25bdb0616d7
-
SSDEEP
12288:w4wFHoS9KxbNnidEhjEJd1kNpeUgI95yRoZHVaoJMOxFXnRV4PiGO0hUmH91:kKxbNndhjEJd1kNpeUgI95yRoZHgoJMJ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1828-0-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1828-6-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4336-12-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2648-19-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4144-25-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4544-27-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/896-34-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5036-39-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3028-51-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5088-52-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1744-57-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3404-71-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3580-67-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2904-80-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4024-91-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4616-98-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1444-99-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/856-112-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/920-106-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/404-118-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2532-129-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2452-224-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2072-232-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4348-220-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4768-191-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2344-185-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3956-164-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3808-159-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4944-152-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3304-146-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/472-124-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4544-242-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1052-261-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1460-269-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5040-278-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2904-282-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4484-286-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4024-293-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2296-307-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2464-322-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5108-335-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3552-342-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2992-349-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3900-368-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4552-375-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/112-379-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/696-382-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4648-396-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2196-431-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1964-439-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2812-449-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2904-453-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2604-478-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3460-491-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1140-498-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4016-536-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/896-557-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1844-609-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3900-646-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3224-653-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3404-712-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2624-725-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1736-778-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1732-836-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1828-0-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/1828-6-0x0000000000400000-0x0000000000434000-memory.dmp UPX \??\c:\2626222.exe UPX behavioral2/memory/4336-7-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\60882.exe UPX behavioral2/memory/2648-14-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\ttttnt.exe UPX behavioral2/memory/4336-12-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/2648-19-0x0000000000400000-0x0000000000434000-memory.dmp UPX \??\c:\88464.exe UPX behavioral2/memory/4144-25-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/4544-27-0x0000000000400000-0x0000000000434000-memory.dmp UPX \??\c:\fffxlfr.exe UPX behavioral2/memory/896-34-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\828602.exe UPX behavioral2/memory/5036-39-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\xrfxlxr.exe UPX behavioral2/memory/3028-51-0x0000000000400000-0x0000000000434000-memory.dmp UPX \??\c:\026660.exe UPX behavioral2/memory/5088-52-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\vvvpp.exe UPX behavioral2/memory/1744-57-0x0000000000400000-0x0000000000434000-memory.dmp UPX \??\c:\222204.exe UPX C:\7bbnhb.exe UPX behavioral2/memory/3404-71-0x0000000000400000-0x0000000000434000-memory.dmp UPX \??\c:\1ddpj.exe UPX behavioral2/memory/2904-75-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/3580-67-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\jvpjv.exe UPX behavioral2/memory/2904-80-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\w64866.exe UPX behavioral2/memory/4024-91-0x0000000000400000-0x0000000000434000-memory.dmp UPX \??\c:\8802064.exe UPX behavioral2/memory/4616-98-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/1444-99-0x0000000000400000-0x0000000000434000-memory.dmp UPX \??\c:\06222.exe UPX C:\0666004.exe UPX behavioral2/memory/856-112-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/920-106-0x0000000000400000-0x0000000000434000-memory.dmp UPX \??\c:\ffxrrrr.exe UPX \??\c:\djppv.exe UPX behavioral2/memory/404-118-0x0000000000400000-0x0000000000434000-memory.dmp UPX \??\c:\flfxlfx.exe UPX \??\c:\dddjd.exe UPX behavioral2/memory/2532-129-0x0000000000400000-0x0000000000434000-memory.dmp UPX C:\6000482.exe UPX \??\c:\2888626.exe UPX \??\c:\bhtthb.exe UPX \??\c:\5nhnht.exe UPX \??\c:\40608.exe UPX \??\c:\hnnnbt.exe UPX behavioral2/memory/2452-224-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/2072-232-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/4348-220-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/4768-191-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/2344-185-0x0000000000400000-0x0000000000434000-memory.dmp UPX \??\c:\ttttbt.exe UPX \??\c:\2060820.exe UPX \??\c:\8688406.exe UPX behavioral2/memory/3956-164-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/3808-159-0x0000000000400000-0x0000000000434000-memory.dmp UPX behavioral2/memory/4944-152-0x0000000000400000-0x0000000000434000-memory.dmp UPX \??\c:\086482.exe UPX behavioral2/memory/3304-146-0x0000000000400000-0x0000000000434000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
2626222.exe60882.exettttnt.exe88464.exefffxlfr.exe828602.exexrfxlxr.exe026660.exevvvpp.exe222204.exe7bbnhb.exe1ddpj.exejvpjv.exew64866.exe8802064.exe06222.exeffxrrrr.exe0666004.exedjppv.exeflfxlfx.exedddjd.exe6000482.exetntnbt.exe2888626.exe086482.exebhtthb.exe5nhnht.exe8688406.exe2060820.exettttbt.exe40608.exehnnnbt.exe488862.exedvdjv.exe5jdpp.exe7djvp.exe86882.exe00282.exe3pjpd.exe8888268.exe2008688.exehntntn.exepddpj.exe4026266.exepjjdv.exe440482.exe40288.exevppjp.exe0422606.exerffxlfx.exerlfxrrl.exe668222.exe224226.exe282822.exepjvpj.exe9vdpj.exenbhbtn.exe822682.exebnhtth.exe468266.exevvpjp.exe484400.exei466004.exe62826.exepid process 4336 2626222.exe 2648 60882.exe 4144 ttttnt.exe 4544 88464.exe 896 fffxlfr.exe 5036 828602.exe 3028 xrfxlxr.exe 5088 026660.exe 1744 vvvpp.exe 3580 222204.exe 3404 7bbnhb.exe 2904 1ddpj.exe 2032 jvpjv.exe 4024 w64866.exe 4616 8802064.exe 1444 06222.exe 920 ffxrrrr.exe 856 0666004.exe 404 djppv.exe 472 flfxlfx.exe 2532 dddjd.exe 2088 6000482.exe 3304 tntnbt.exe 4944 2888626.exe 3808 086482.exe 3956 bhtthb.exe 4740 5nhnht.exe 1620 8688406.exe 4464 2060820.exe 2344 ttttbt.exe 4768 40608.exe 4688 hnnnbt.exe 5000 488862.exe 4580 dvdjv.exe 4880 5jdpp.exe 628 7djvp.exe 3224 86882.exe 2144 00282.exe 4344 3pjpd.exe 4348 8888268.exe 2452 2008688.exe 1752 hntntn.exe 4336 pddpj.exe 4428 4026266.exe 2072 pjjdv.exe 4848 440482.exe 4544 40288.exe 1072 vppjp.exe 4804 0422606.exe 5036 rffxlfx.exe 3940 rlfxrrl.exe 556 668222.exe 1052 224226.exe 3328 282822.exe 1460 pjvpj.exe 3580 9vdpj.exe 3404 nbhbtn.exe 5040 822682.exe 2904 bnhtth.exe 4484 468266.exe 4700 vvpjp.exe 4024 484400.exe 3860 i466004.exe 1444 62826.exe -
Processes:
resource yara_rule behavioral2/memory/1828-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1828-6-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\2626222.exe upx behavioral2/memory/4336-7-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\60882.exe upx behavioral2/memory/2648-14-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\ttttnt.exe upx behavioral2/memory/4336-12-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2648-19-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\88464.exe upx behavioral2/memory/4144-25-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4544-27-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\fffxlfr.exe upx behavioral2/memory/896-34-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\828602.exe upx behavioral2/memory/5036-39-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\xrfxlxr.exe upx behavioral2/memory/3028-51-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\026660.exe upx behavioral2/memory/5088-52-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\vvvpp.exe upx behavioral2/memory/1744-57-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\222204.exe upx C:\7bbnhb.exe upx behavioral2/memory/3404-71-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\1ddpj.exe upx behavioral2/memory/2904-75-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3580-67-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\jvpjv.exe upx behavioral2/memory/2904-80-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\w64866.exe upx behavioral2/memory/4024-91-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\8802064.exe upx behavioral2/memory/4616-98-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1444-99-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\06222.exe upx C:\0666004.exe upx behavioral2/memory/856-112-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/920-106-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\ffxrrrr.exe upx \??\c:\djppv.exe upx behavioral2/memory/404-118-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\flfxlfx.exe upx \??\c:\dddjd.exe upx behavioral2/memory/2532-129-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\6000482.exe upx \??\c:\2888626.exe upx \??\c:\bhtthb.exe upx \??\c:\5nhnht.exe upx \??\c:\40608.exe upx \??\c:\hnnnbt.exe upx behavioral2/memory/2452-224-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2072-232-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4348-220-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4768-191-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2344-185-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\ttttbt.exe upx \??\c:\2060820.exe upx \??\c:\8688406.exe upx behavioral2/memory/3956-164-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3808-159-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4944-152-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\086482.exe upx behavioral2/memory/3304-146-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c6d139a695d9529c634b1dbe018d0d29b87751a566e2b7f68c9acbc0f86e5a80.exe2626222.exe60882.exettttnt.exe88464.exefffxlfr.exe828602.exexrfxlxr.exe026660.exevvvpp.exe222204.exe7bbnhb.exe1ddpj.exejvpjv.exew64866.exe8802064.exe06222.exeffxrrrr.exe0666004.exedjppv.exeflfxlfx.exedddjd.exedescription pid process target process PID 1828 wrote to memory of 4336 1828 c6d139a695d9529c634b1dbe018d0d29b87751a566e2b7f68c9acbc0f86e5a80.exe 2626222.exe PID 1828 wrote to memory of 4336 1828 c6d139a695d9529c634b1dbe018d0d29b87751a566e2b7f68c9acbc0f86e5a80.exe 2626222.exe PID 1828 wrote to memory of 4336 1828 c6d139a695d9529c634b1dbe018d0d29b87751a566e2b7f68c9acbc0f86e5a80.exe 2626222.exe PID 4336 wrote to memory of 2648 4336 2626222.exe 60882.exe PID 4336 wrote to memory of 2648 4336 2626222.exe 60882.exe PID 4336 wrote to memory of 2648 4336 2626222.exe 60882.exe PID 2648 wrote to memory of 4144 2648 60882.exe ttttnt.exe PID 2648 wrote to memory of 4144 2648 60882.exe ttttnt.exe PID 2648 wrote to memory of 4144 2648 60882.exe ttttnt.exe PID 4144 wrote to memory of 4544 4144 ttttnt.exe 88464.exe PID 4144 wrote to memory of 4544 4144 ttttnt.exe 88464.exe PID 4144 wrote to memory of 4544 4144 ttttnt.exe 88464.exe PID 4544 wrote to memory of 896 4544 88464.exe fffxlfr.exe PID 4544 wrote to memory of 896 4544 88464.exe fffxlfr.exe PID 4544 wrote to memory of 896 4544 88464.exe fffxlfr.exe PID 896 wrote to memory of 5036 896 fffxlfr.exe 828602.exe PID 896 wrote to memory of 5036 896 fffxlfr.exe 828602.exe PID 896 wrote to memory of 5036 896 fffxlfr.exe 828602.exe PID 5036 wrote to memory of 3028 5036 828602.exe xrfxlxr.exe PID 5036 wrote to memory of 3028 5036 828602.exe xrfxlxr.exe PID 5036 wrote to memory of 3028 5036 828602.exe xrfxlxr.exe PID 3028 wrote to memory of 5088 3028 xrfxlxr.exe 026660.exe PID 3028 wrote to memory of 5088 3028 xrfxlxr.exe 026660.exe PID 3028 wrote to memory of 5088 3028 xrfxlxr.exe 026660.exe PID 5088 wrote to memory of 1744 5088 026660.exe vvvpp.exe PID 5088 wrote to memory of 1744 5088 026660.exe vvvpp.exe PID 5088 wrote to memory of 1744 5088 026660.exe vvvpp.exe PID 1744 wrote to memory of 3580 1744 vvvpp.exe 222204.exe PID 1744 wrote to memory of 3580 1744 vvvpp.exe 222204.exe PID 1744 wrote to memory of 3580 1744 vvvpp.exe 222204.exe PID 3580 wrote to memory of 3404 3580 222204.exe 7bbnhb.exe PID 3580 wrote to memory of 3404 3580 222204.exe 7bbnhb.exe PID 3580 wrote to memory of 3404 3580 222204.exe 7bbnhb.exe PID 3404 wrote to memory of 2904 3404 7bbnhb.exe 1ddpj.exe PID 3404 wrote to memory of 2904 3404 7bbnhb.exe 1ddpj.exe PID 3404 wrote to memory of 2904 3404 7bbnhb.exe 1ddpj.exe PID 2904 wrote to memory of 2032 2904 1ddpj.exe jvpjv.exe PID 2904 wrote to memory of 2032 2904 1ddpj.exe jvpjv.exe PID 2904 wrote to memory of 2032 2904 1ddpj.exe jvpjv.exe PID 2032 wrote to memory of 4024 2032 jvpjv.exe w64866.exe PID 2032 wrote to memory of 4024 2032 jvpjv.exe w64866.exe PID 2032 wrote to memory of 4024 2032 jvpjv.exe w64866.exe PID 4024 wrote to memory of 4616 4024 w64866.exe 8802064.exe PID 4024 wrote to memory of 4616 4024 w64866.exe 8802064.exe PID 4024 wrote to memory of 4616 4024 w64866.exe 8802064.exe PID 4616 wrote to memory of 1444 4616 8802064.exe 06222.exe PID 4616 wrote to memory of 1444 4616 8802064.exe 06222.exe PID 4616 wrote to memory of 1444 4616 8802064.exe 06222.exe PID 1444 wrote to memory of 920 1444 06222.exe ffxrrrr.exe PID 1444 wrote to memory of 920 1444 06222.exe ffxrrrr.exe PID 1444 wrote to memory of 920 1444 06222.exe ffxrrrr.exe PID 920 wrote to memory of 856 920 ffxrrrr.exe 0666004.exe PID 920 wrote to memory of 856 920 ffxrrrr.exe 0666004.exe PID 920 wrote to memory of 856 920 ffxrrrr.exe 0666004.exe PID 856 wrote to memory of 404 856 0666004.exe djppv.exe PID 856 wrote to memory of 404 856 0666004.exe djppv.exe PID 856 wrote to memory of 404 856 0666004.exe djppv.exe PID 404 wrote to memory of 472 404 djppv.exe flfxlfx.exe PID 404 wrote to memory of 472 404 djppv.exe flfxlfx.exe PID 404 wrote to memory of 472 404 djppv.exe flfxlfx.exe PID 472 wrote to memory of 2532 472 flfxlfx.exe dddjd.exe PID 472 wrote to memory of 2532 472 flfxlfx.exe dddjd.exe PID 472 wrote to memory of 2532 472 flfxlfx.exe dddjd.exe PID 2532 wrote to memory of 2088 2532 dddjd.exe 6000482.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6d139a695d9529c634b1dbe018d0d29b87751a566e2b7f68c9acbc0f86e5a80.exe"C:\Users\Admin\AppData\Local\Temp\c6d139a695d9529c634b1dbe018d0d29b87751a566e2b7f68c9acbc0f86e5a80.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\2626222.exec:\2626222.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\60882.exec:\60882.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\ttttnt.exec:\ttttnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\88464.exec:\88464.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\fffxlfr.exec:\fffxlfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\828602.exec:\828602.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\xrfxlxr.exec:\xrfxlxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\026660.exec:\026660.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\vvvpp.exec:\vvvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\222204.exec:\222204.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\7bbnhb.exec:\7bbnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\1ddpj.exec:\1ddpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\jvpjv.exec:\jvpjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\w64866.exec:\w64866.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\8802064.exec:\8802064.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\06222.exec:\06222.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\ffxrrrr.exec:\ffxrrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\0666004.exec:\0666004.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\djppv.exec:\djppv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\flfxlfx.exec:\flfxlfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
\??\c:\dddjd.exec:\dddjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\6000482.exec:\6000482.exe23⤵
- Executes dropped EXE
PID:2088 -
\??\c:\tntnbt.exec:\tntnbt.exe24⤵
- Executes dropped EXE
PID:3304 -
\??\c:\2888626.exec:\2888626.exe25⤵
- Executes dropped EXE
PID:4944 -
\??\c:\086482.exec:\086482.exe26⤵
- Executes dropped EXE
PID:3808 -
\??\c:\bhtthb.exec:\bhtthb.exe27⤵
- Executes dropped EXE
PID:3956 -
\??\c:\5nhnht.exec:\5nhnht.exe28⤵
- Executes dropped EXE
PID:4740 -
\??\c:\8688406.exec:\8688406.exe29⤵
- Executes dropped EXE
PID:1620 -
\??\c:\2060820.exec:\2060820.exe30⤵
- Executes dropped EXE
PID:4464 -
\??\c:\ttttbt.exec:\ttttbt.exe31⤵
- Executes dropped EXE
PID:2344 -
\??\c:\40608.exec:\40608.exe32⤵
- Executes dropped EXE
PID:4768 -
\??\c:\hnnnbt.exec:\hnnnbt.exe33⤵
- Executes dropped EXE
PID:4688 -
\??\c:\488862.exec:\488862.exe34⤵
- Executes dropped EXE
PID:5000 -
\??\c:\dvdjv.exec:\dvdjv.exe35⤵
- Executes dropped EXE
PID:4580 -
\??\c:\5jdpp.exec:\5jdpp.exe36⤵
- Executes dropped EXE
PID:4880 -
\??\c:\7djvp.exec:\7djvp.exe37⤵
- Executes dropped EXE
PID:628 -
\??\c:\86882.exec:\86882.exe38⤵
- Executes dropped EXE
PID:3224 -
\??\c:\00282.exec:\00282.exe39⤵
- Executes dropped EXE
PID:2144 -
\??\c:\3pjpd.exec:\3pjpd.exe40⤵
- Executes dropped EXE
PID:4344 -
\??\c:\8888268.exec:\8888268.exe41⤵
- Executes dropped EXE
PID:4348 -
\??\c:\2008688.exec:\2008688.exe42⤵
- Executes dropped EXE
PID:2452 -
\??\c:\hntntn.exec:\hntntn.exe43⤵
- Executes dropped EXE
PID:1752 -
\??\c:\pddpj.exec:\pddpj.exe44⤵
- Executes dropped EXE
PID:4336 -
\??\c:\4026266.exec:\4026266.exe45⤵
- Executes dropped EXE
PID:4428 -
\??\c:\pjjdv.exec:\pjjdv.exe46⤵
- Executes dropped EXE
PID:2072 -
\??\c:\440482.exec:\440482.exe47⤵
- Executes dropped EXE
PID:4848 -
\??\c:\40288.exec:\40288.exe48⤵
- Executes dropped EXE
PID:4544 -
\??\c:\vppjp.exec:\vppjp.exe49⤵
- Executes dropped EXE
PID:1072 -
\??\c:\0422606.exec:\0422606.exe50⤵
- Executes dropped EXE
PID:4804 -
\??\c:\rffxlfx.exec:\rffxlfx.exe51⤵
- Executes dropped EXE
PID:5036 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe52⤵
- Executes dropped EXE
PID:3940 -
\??\c:\668222.exec:\668222.exe53⤵
- Executes dropped EXE
PID:556 -
\??\c:\224226.exec:\224226.exe54⤵
- Executes dropped EXE
PID:1052 -
\??\c:\282822.exec:\282822.exe55⤵
- Executes dropped EXE
PID:3328 -
\??\c:\pjvpj.exec:\pjvpj.exe56⤵
- Executes dropped EXE
PID:1460 -
\??\c:\9vdpj.exec:\9vdpj.exe57⤵
- Executes dropped EXE
PID:3580 -
\??\c:\nbhbtn.exec:\nbhbtn.exe58⤵
- Executes dropped EXE
PID:3404 -
\??\c:\822682.exec:\822682.exe59⤵
- Executes dropped EXE
PID:5040 -
\??\c:\bnhtth.exec:\bnhtth.exe60⤵
- Executes dropped EXE
PID:2904 -
\??\c:\468266.exec:\468266.exe61⤵
- Executes dropped EXE
PID:4484 -
\??\c:\vvpjp.exec:\vvpjp.exe62⤵
- Executes dropped EXE
PID:4700 -
\??\c:\484400.exec:\484400.exe63⤵
- Executes dropped EXE
PID:4024 -
\??\c:\i466004.exec:\i466004.exe64⤵
- Executes dropped EXE
PID:3860 -
\??\c:\62826.exec:\62826.exe65⤵
- Executes dropped EXE
PID:1444 -
\??\c:\28448.exec:\28448.exe66⤵PID:2624
-
\??\c:\884480.exec:\884480.exe67⤵PID:4272
-
\??\c:\hbbbtt.exec:\hbbbtt.exe68⤵PID:2296
-
\??\c:\rrfxxxf.exec:\rrfxxxf.exe69⤵PID:404
-
\??\c:\xlxrxxf.exec:\xlxrxxf.exe70⤵PID:2752
-
\??\c:\i404888.exec:\i404888.exe71⤵PID:2532
-
\??\c:\fflfxxr.exec:\fflfxxr.exe72⤵PID:1416
-
\??\c:\406044.exec:\406044.exe73⤵PID:2464
-
\??\c:\6842660.exec:\6842660.exe74⤵PID:5084
-
\??\c:\fflffff.exec:\fflffff.exe75⤵PID:3972
-
\??\c:\884084.exec:\884084.exe76⤵PID:5108
-
\??\c:\dvdvp.exec:\dvdvp.exe77⤵PID:1092
-
\??\c:\62848.exec:\62848.exe78⤵PID:3552
-
\??\c:\006008.exec:\006008.exe79⤵PID:2992
-
\??\c:\pdjdd.exec:\pdjdd.exe80⤵PID:4472
-
\??\c:\lflfffx.exec:\lflfffx.exe81⤵PID:3444
-
\??\c:\1nttnn.exec:\1nttnn.exe82⤵PID:2688
-
\??\c:\rfxlflf.exec:\rfxlflf.exe83⤵PID:1436
-
\??\c:\a6826.exec:\a6826.exe84⤵PID:4636
-
\??\c:\66226.exec:\66226.exe85⤵PID:4784
-
\??\c:\tttbht.exec:\tttbht.exe86⤵PID:3900
-
\??\c:\2004888.exec:\2004888.exe87⤵PID:2168
-
\??\c:\660000.exec:\660000.exe88⤵PID:4552
-
\??\c:\jjvdd.exec:\jjvdd.exe89⤵PID:112
-
\??\c:\bttnhh.exec:\bttnhh.exe90⤵PID:696
-
\??\c:\488822.exec:\488822.exe91⤵PID:1440
-
\??\c:\864006.exec:\864006.exe92⤵PID:4016
-
\??\c:\82822.exec:\82822.exe93⤵PID:1388
-
\??\c:\tbbtnh.exec:\tbbtnh.exe94⤵PID:4648
-
\??\c:\i026666.exec:\i026666.exe95⤵PID:2408
-
\??\c:\82226.exec:\82226.exe96⤵PID:4984
-
\??\c:\6662626.exec:\6662626.exe97⤵PID:3680
-
\??\c:\u446026.exec:\u446026.exe98⤵PID:4796
-
\??\c:\082268.exec:\082268.exe99⤵PID:4496
-
\??\c:\8288222.exec:\8288222.exe100⤵PID:636
-
\??\c:\q64044.exec:\q64044.exe101⤵PID:2980
-
\??\c:\284488.exec:\284488.exe102⤵PID:4132
-
\??\c:\frllfxx.exec:\frllfxx.exe103⤵PID:4508
-
\??\c:\tnnhbn.exec:\tnnhbn.exe104⤵PID:556
-
\??\c:\htbtnt.exec:\htbtnt.exe105⤵PID:1052
-
\??\c:\btbthh.exec:\btbthh.exe106⤵PID:2196
-
\??\c:\02400.exec:\02400.exe107⤵PID:1964
-
\??\c:\82006.exec:\82006.exe108⤵PID:4288
-
\??\c:\42848.exec:\42848.exe109⤵PID:2748
-
\??\c:\2684686.exec:\2684686.exe110⤵PID:2812
-
\??\c:\pdjdd.exec:\pdjdd.exe111⤵PID:2904
-
\??\c:\5lxxflf.exec:\5lxxflf.exe112⤵PID:1060
-
\??\c:\llxrrfl.exec:\llxrrfl.exe113⤵PID:3928
-
\??\c:\04040.exec:\04040.exe114⤵PID:1444
-
\??\c:\044246.exec:\044246.exe115⤵PID:1788
-
\??\c:\htbhbh.exec:\htbhbh.exe116⤵PID:2296
-
\??\c:\62448.exec:\62448.exe117⤵PID:3312
-
\??\c:\204882.exec:\204882.exe118⤵PID:5012
-
\??\c:\bhhbtn.exec:\bhhbtn.exe119⤵PID:3508
-
\??\c:\840486.exec:\840486.exe120⤵PID:2604
-
\??\c:\pjvjd.exec:\pjvjd.exe121⤵PID:2136
-
\??\c:\ttbbtb.exec:\ttbbtb.exe122⤵PID:1620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-