Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 22:32
Behavioral task
behavioral1
Sample
65de78171842124c60dbdba4261b2ce38d92f096a89eba304797c397c1b8f5eb.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
General
-
Target
65de78171842124c60dbdba4261b2ce38d92f096a89eba304797c397c1b8f5eb.exe
-
Size
169KB
-
MD5
09e4dd7c605fa0a0b8a563889a5cf82e
-
SHA1
9716b39b53490beb7f5b1b8a91f6ee0068408bf9
-
SHA256
65de78171842124c60dbdba4261b2ce38d92f096a89eba304797c397c1b8f5eb
-
SHA512
4b5d40fcf3b37f8b458983695c2bc44ee64faf7de6378f8d65fb7440fbaef79c64fb6d5f21d7fded41cd2d6cf664de68fb97ae82a5685406e7c287d0b3a8e59d
-
SSDEEP
1536:HvQBeOGtrYS3srx93UBWfwC6Ggnouy8CUYj7FK4O8A1o4XEc3YtxD8/Ai2N:HhOmTsF93UYfwC6GIoutX8Ki3c3YT8VM
Malware Config
Signatures
-
Detect Blackmoon payload 62 IoCs
Processes:
resource yara_rule behavioral2/memory/3784-8-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1280-13-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3948-6-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/920-25-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1560-31-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3748-34-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/392-41-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3944-44-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3004-48-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4436-59-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1080-68-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4432-74-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3444-78-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4064-99-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4848-97-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2828-123-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2596-115-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2760-118-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4076-133-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4216-144-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1508-146-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4328-156-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2740-165-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4732-177-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2152-180-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4712-193-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3364-198-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4864-205-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1612-234-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2728-238-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/5040-253-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4124-258-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2888-271-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1648-275-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1344-285-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2176-290-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1168-300-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1932-302-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1920-309-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4316-336-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4472-346-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4688-350-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3372-364-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4388-375-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3196-391-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4848-452-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4968-462-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1276-472-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3588-489-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3364-507-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2824-533-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2824-536-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3004-553-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3620-637-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1780-659-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4208-664-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4520-674-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3944-690-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/4432-708-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/3500-870-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/1560-910-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral2/memory/2176-964-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3948-0-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\tbbnbt.exe UPX behavioral2/memory/3784-8-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\ppvpj.exe UPX behavioral2/memory/920-17-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/1280-13-0x0000000000400000-0x0000000000446000-memory.dmp UPX \??\c:\thbtnb.exe UPX behavioral2/memory/3948-6-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\fxrrfff.exe UPX behavioral2/memory/920-25-0x0000000000400000-0x0000000000446000-memory.dmp UPX \??\c:\hnnhtt.exe UPX behavioral2/memory/1560-31-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\fxxrllf.exe UPX behavioral2/memory/3748-34-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\thbbtn.exe UPX behavioral2/memory/392-41-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/3944-44-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\1pjdv.exe UPX behavioral2/memory/3004-48-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\llfrffl.exe UPX \??\c:\bhbtbn.exe UPX behavioral2/memory/4436-59-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\jdddv.exe UPX behavioral2/memory/1080-68-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\fxxlffx.exe UPX C:\dpvpp.exe UPX behavioral2/memory/4432-74-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\9xfxxxf.exe UPX \??\c:\5xrllrx.exe UPX behavioral2/memory/3444-78-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\bnhhbh.exe UPX \??\c:\frxrrlr.exe UPX behavioral2/memory/4064-99-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\1frllrl.exe UPX behavioral2/memory/4848-97-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\hbttnn.exe UPX behavioral2/memory/2760-108-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\rlxrlfr.exe UPX behavioral2/memory/2828-123-0x0000000000400000-0x0000000000446000-memory.dmp UPX \??\c:\btnhhh.exe UPX behavioral2/memory/2596-115-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/2760-118-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\9nnhbb.exe UPX C:\xxrrlrf.exe UPX behavioral2/memory/4076-133-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\1nnhbh.exe UPX behavioral2/memory/4216-144-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/1508-146-0x0000000000400000-0x0000000000446000-memory.dmp UPX \??\c:\jvpjd.exe UPX C:\llfxlrf.exe UPX C:\htbbbh.exe UPX behavioral2/memory/4328-156-0x0000000000400000-0x0000000000446000-memory.dmp UPX \??\c:\bntbbh.exe UPX C:\1dddv.exe UPX behavioral2/memory/2740-165-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/4072-168-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\thtnhh.exe UPX C:\7pvvp.exe UPX behavioral2/memory/4732-177-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/2152-180-0x0000000000400000-0x0000000000446000-memory.dmp UPX C:\9xxrllx.exe UPX behavioral2/memory/4476-186-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/4712-193-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/3364-194-0x0000000000400000-0x0000000000446000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
tbbnbt.exethbtnb.exeppvpj.exefxrrfff.exehnnhtt.exefxxrllf.exethbbtn.exe1pjdv.exellfrffl.exebhbtbn.exejdddv.exefxxlffx.exedpvpp.exe9xfxxxf.exe5xrllrx.exebnhhbh.exefrxrrlr.exe1frllrl.exehbttnn.exerlxrlfr.exebtnhhh.exe9nnhbb.exexxrrlrf.exe1nnhbh.exejvpjd.exellfxlrf.exehtbbbh.exebntbbh.exe1dddv.exethtnhh.exe7pvvp.exe9xxrllx.exedppjj.exe1rrrllf.exehbhhhn.exedvjdd.exelrrlxrf.exelrfxffr.exehhbhhh.exejjdpp.exejjjjd.exe7xlllrr.exebtbthh.exebttttt.exevppjj.exevjppj.exeffrrflf.exehbhbbb.exejvddd.exeddjjj.exefrxxxxx.exe3ffxxff.exennnnbh.exejvvvp.exelrrrlff.exerfllfll.exettbtnh.exejdddd.exejddpp.exelfxllrr.exellrfffr.exenntnbb.exejvjdd.exexlfxfxl.exepid process 3784 tbbnbt.exe 1280 thbtnb.exe 920 ppvpj.exe 1560 fxrrfff.exe 3748 hnnhtt.exe 392 fxxrllf.exe 3944 thbbtn.exe 3004 1pjdv.exe 1796 llfrffl.exe 4436 bhbtbn.exe 1080 jdddv.exe 4432 fxxlffx.exe 3444 dpvpp.exe 4656 9xfxxxf.exe 2696 5xrllrx.exe 4064 bnhhbh.exe 4848 frxrrlr.exe 4944 1frllrl.exe 2760 hbttnn.exe 2596 rlxrlfr.exe 2828 btnhhh.exe 4076 9nnhbb.exe 1276 xxrrlrf.exe 4216 1nnhbh.exe 1508 jvpjd.exe 4328 llfxlrf.exe 3124 htbbbh.exe 2740 bntbbh.exe 4072 1dddv.exe 4732 thtnhh.exe 2152 7pvvp.exe 4476 9xxrllx.exe 4712 dppjj.exe 3364 1rrrllf.exe 232 hbhhhn.exe 4864 dvjdd.exe 4204 lrrlxrf.exe 3876 lrfxffr.exe 4376 hhbhhh.exe 3608 jjdpp.exe 5056 jjjjd.exe 4348 7xlllrr.exe 768 btbthh.exe 2036 bttttt.exe 3880 vppjj.exe 1612 vjppj.exe 2728 ffrrflf.exe 4104 hbhbbb.exe 2380 jvddd.exe 2532 ddjjj.exe 5040 frxxxxx.exe 1996 3ffxxff.exe 4124 nnnnbh.exe 452 jvvvp.exe 1376 lrrrlff.exe 2888 rfllfll.exe 1648 ttbtnh.exe 1864 jdddd.exe 2368 jddpp.exe 1344 lfxllrr.exe 1804 llrfffr.exe 2176 nntnbb.exe 2020 jvjdd.exe 1168 xlfxfxl.exe -
Processes:
resource yara_rule behavioral2/memory/3948-0-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\tbbnbt.exe upx behavioral2/memory/3784-8-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\ppvpj.exe upx behavioral2/memory/920-17-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/1280-13-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\thbtnb.exe upx behavioral2/memory/3948-6-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\fxrrfff.exe upx behavioral2/memory/920-25-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\hnnhtt.exe upx behavioral2/memory/1560-31-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\fxxrllf.exe upx behavioral2/memory/3748-34-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\thbbtn.exe upx behavioral2/memory/392-41-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3944-44-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\1pjdv.exe upx behavioral2/memory/3004-48-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\llfrffl.exe upx \??\c:\bhbtbn.exe upx behavioral2/memory/4436-59-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\jdddv.exe upx behavioral2/memory/1080-68-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\fxxlffx.exe upx C:\dpvpp.exe upx behavioral2/memory/4432-74-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\9xfxxxf.exe upx \??\c:\5xrllrx.exe upx behavioral2/memory/3444-78-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\bnhhbh.exe upx \??\c:\frxrrlr.exe upx behavioral2/memory/4064-99-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\1frllrl.exe upx behavioral2/memory/4848-97-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\hbttnn.exe upx behavioral2/memory/2760-108-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\rlxrlfr.exe upx behavioral2/memory/2828-123-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\btnhhh.exe upx behavioral2/memory/2596-115-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2760-118-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\9nnhbb.exe upx C:\xxrrlrf.exe upx behavioral2/memory/4076-133-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\1nnhbh.exe upx behavioral2/memory/4216-144-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/1508-146-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\jvpjd.exe upx C:\llfxlrf.exe upx C:\htbbbh.exe upx behavioral2/memory/4328-156-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\bntbbh.exe upx C:\1dddv.exe upx behavioral2/memory/2740-165-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4072-168-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\thtnhh.exe upx C:\7pvvp.exe upx behavioral2/memory/4732-177-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/2152-180-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\9xxrllx.exe upx behavioral2/memory/4476-186-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4712-193-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/3364-194-0x0000000000400000-0x0000000000446000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
65de78171842124c60dbdba4261b2ce38d92f096a89eba304797c397c1b8f5eb.exetbbnbt.exethbtnb.exeppvpj.exefxrrfff.exehnnhtt.exefxxrllf.exethbbtn.exe1pjdv.exellfrffl.exebhbtbn.exejdddv.exefxxlffx.exedpvpp.exe9xfxxxf.exe5xrllrx.exebnhhbh.exefrxrrlr.exe1frllrl.exehbttnn.exerlxrlfr.exebtnhhh.exedescription pid process target process PID 3948 wrote to memory of 3784 3948 65de78171842124c60dbdba4261b2ce38d92f096a89eba304797c397c1b8f5eb.exe tbbnbt.exe PID 3948 wrote to memory of 3784 3948 65de78171842124c60dbdba4261b2ce38d92f096a89eba304797c397c1b8f5eb.exe tbbnbt.exe PID 3948 wrote to memory of 3784 3948 65de78171842124c60dbdba4261b2ce38d92f096a89eba304797c397c1b8f5eb.exe tbbnbt.exe PID 3784 wrote to memory of 1280 3784 tbbnbt.exe thbtnb.exe PID 3784 wrote to memory of 1280 3784 tbbnbt.exe thbtnb.exe PID 3784 wrote to memory of 1280 3784 tbbnbt.exe thbtnb.exe PID 1280 wrote to memory of 920 1280 thbtnb.exe ppvpj.exe PID 1280 wrote to memory of 920 1280 thbtnb.exe ppvpj.exe PID 1280 wrote to memory of 920 1280 thbtnb.exe ppvpj.exe PID 920 wrote to memory of 1560 920 ppvpj.exe fxrrfff.exe PID 920 wrote to memory of 1560 920 ppvpj.exe fxrrfff.exe PID 920 wrote to memory of 1560 920 ppvpj.exe fxrrfff.exe PID 1560 wrote to memory of 3748 1560 fxrrfff.exe hnnhtt.exe PID 1560 wrote to memory of 3748 1560 fxrrfff.exe hnnhtt.exe PID 1560 wrote to memory of 3748 1560 fxrrfff.exe hnnhtt.exe PID 3748 wrote to memory of 392 3748 hnnhtt.exe fxxrllf.exe PID 3748 wrote to memory of 392 3748 hnnhtt.exe fxxrllf.exe PID 3748 wrote to memory of 392 3748 hnnhtt.exe fxxrllf.exe PID 392 wrote to memory of 3944 392 fxxrllf.exe thbbtn.exe PID 392 wrote to memory of 3944 392 fxxrllf.exe thbbtn.exe PID 392 wrote to memory of 3944 392 fxxrllf.exe thbbtn.exe PID 3944 wrote to memory of 3004 3944 thbbtn.exe 1pjdv.exe PID 3944 wrote to memory of 3004 3944 thbbtn.exe 1pjdv.exe PID 3944 wrote to memory of 3004 3944 thbbtn.exe 1pjdv.exe PID 3004 wrote to memory of 1796 3004 1pjdv.exe llfrffl.exe PID 3004 wrote to memory of 1796 3004 1pjdv.exe llfrffl.exe PID 3004 wrote to memory of 1796 3004 1pjdv.exe llfrffl.exe PID 1796 wrote to memory of 4436 1796 llfrffl.exe bhbtbn.exe PID 1796 wrote to memory of 4436 1796 llfrffl.exe bhbtbn.exe PID 1796 wrote to memory of 4436 1796 llfrffl.exe bhbtbn.exe PID 4436 wrote to memory of 1080 4436 bhbtbn.exe jdddv.exe PID 4436 wrote to memory of 1080 4436 bhbtbn.exe jdddv.exe PID 4436 wrote to memory of 1080 4436 bhbtbn.exe jdddv.exe PID 1080 wrote to memory of 4432 1080 jdddv.exe fxxlffx.exe PID 1080 wrote to memory of 4432 1080 jdddv.exe fxxlffx.exe PID 1080 wrote to memory of 4432 1080 jdddv.exe fxxlffx.exe PID 4432 wrote to memory of 3444 4432 fxxlffx.exe dpvpp.exe PID 4432 wrote to memory of 3444 4432 fxxlffx.exe dpvpp.exe PID 4432 wrote to memory of 3444 4432 fxxlffx.exe dpvpp.exe PID 3444 wrote to memory of 4656 3444 dpvpp.exe 9xfxxxf.exe PID 3444 wrote to memory of 4656 3444 dpvpp.exe 9xfxxxf.exe PID 3444 wrote to memory of 4656 3444 dpvpp.exe 9xfxxxf.exe PID 4656 wrote to memory of 2696 4656 9xfxxxf.exe 5xrllrx.exe PID 4656 wrote to memory of 2696 4656 9xfxxxf.exe 5xrllrx.exe PID 4656 wrote to memory of 2696 4656 9xfxxxf.exe 5xrllrx.exe PID 2696 wrote to memory of 4064 2696 5xrllrx.exe bnhhbh.exe PID 2696 wrote to memory of 4064 2696 5xrllrx.exe bnhhbh.exe PID 2696 wrote to memory of 4064 2696 5xrllrx.exe bnhhbh.exe PID 4064 wrote to memory of 4848 4064 bnhhbh.exe frxrrlr.exe PID 4064 wrote to memory of 4848 4064 bnhhbh.exe frxrrlr.exe PID 4064 wrote to memory of 4848 4064 bnhhbh.exe frxrrlr.exe PID 4848 wrote to memory of 4944 4848 frxrrlr.exe 1frllrl.exe PID 4848 wrote to memory of 4944 4848 frxrrlr.exe 1frllrl.exe PID 4848 wrote to memory of 4944 4848 frxrrlr.exe 1frllrl.exe PID 4944 wrote to memory of 2760 4944 1frllrl.exe hbttnn.exe PID 4944 wrote to memory of 2760 4944 1frllrl.exe hbttnn.exe PID 4944 wrote to memory of 2760 4944 1frllrl.exe hbttnn.exe PID 2760 wrote to memory of 2596 2760 hbttnn.exe rlxrlfr.exe PID 2760 wrote to memory of 2596 2760 hbttnn.exe rlxrlfr.exe PID 2760 wrote to memory of 2596 2760 hbttnn.exe rlxrlfr.exe PID 2596 wrote to memory of 2828 2596 rlxrlfr.exe btnhhh.exe PID 2596 wrote to memory of 2828 2596 rlxrlfr.exe btnhhh.exe PID 2596 wrote to memory of 2828 2596 rlxrlfr.exe btnhhh.exe PID 2828 wrote to memory of 4076 2828 btnhhh.exe 9nnhbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65de78171842124c60dbdba4261b2ce38d92f096a89eba304797c397c1b8f5eb.exe"C:\Users\Admin\AppData\Local\Temp\65de78171842124c60dbdba4261b2ce38d92f096a89eba304797c397c1b8f5eb.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\tbbnbt.exec:\tbbnbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thbtnb.exec:\thbtnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppvpj.exec:\ppvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxrrfff.exec:\fxrrfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnnhtt.exec:\hnnhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxxrllf.exec:\fxxrllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thbbtn.exec:\thbbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1pjdv.exec:\1pjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llfrffl.exec:\llfrffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhbtbn.exec:\bhbtbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdddv.exec:\jdddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxxlffx.exec:\fxxlffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpvpp.exec:\dpvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9xfxxxf.exec:\9xfxxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5xrllrx.exec:\5xrllrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnhhbh.exec:\bnhhbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frxrrlr.exec:\frxrrlr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1frllrl.exec:\1frllrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbttnn.exec:\hbttnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxrlfr.exec:\rlxrlfr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btnhhh.exec:\btnhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9nnhbb.exec:\9nnhbb.exe23⤵
- Executes dropped EXE
-
\??\c:\xxrrlrf.exec:\xxrrlrf.exe24⤵
- Executes dropped EXE
-
\??\c:\1nnhbh.exec:\1nnhbh.exe25⤵
- Executes dropped EXE
-
\??\c:\jvpjd.exec:\jvpjd.exe26⤵
- Executes dropped EXE
-
\??\c:\llfxlrf.exec:\llfxlrf.exe27⤵
- Executes dropped EXE
-
\??\c:\htbbbh.exec:\htbbbh.exe28⤵
- Executes dropped EXE
-
\??\c:\bntbbh.exec:\bntbbh.exe29⤵
- Executes dropped EXE
-
\??\c:\1dddv.exec:\1dddv.exe30⤵
- Executes dropped EXE
-
\??\c:\thtnhh.exec:\thtnhh.exe31⤵
- Executes dropped EXE
-
\??\c:\7pvvp.exec:\7pvvp.exe32⤵
- Executes dropped EXE
-
\??\c:\9xxrllx.exec:\9xxrllx.exe33⤵
- Executes dropped EXE
-
\??\c:\dppjj.exec:\dppjj.exe34⤵
- Executes dropped EXE
-
\??\c:\1rrrllf.exec:\1rrrllf.exe35⤵
- Executes dropped EXE
-
\??\c:\hbhhhn.exec:\hbhhhn.exe36⤵
- Executes dropped EXE
-
\??\c:\dvjdd.exec:\dvjdd.exe37⤵
- Executes dropped EXE
-
\??\c:\lrrlxrf.exec:\lrrlxrf.exe38⤵
- Executes dropped EXE
-
\??\c:\lrfxffr.exec:\lrfxffr.exe39⤵
- Executes dropped EXE
-
\??\c:\hhbhhh.exec:\hhbhhh.exe40⤵
- Executes dropped EXE
-
\??\c:\jjdpp.exec:\jjdpp.exe41⤵
- Executes dropped EXE
-
\??\c:\jjjjd.exec:\jjjjd.exe42⤵
- Executes dropped EXE
-
\??\c:\7xlllrr.exec:\7xlllrr.exe43⤵
- Executes dropped EXE
-
\??\c:\btbthh.exec:\btbthh.exe44⤵
- Executes dropped EXE
-
\??\c:\bttttt.exec:\bttttt.exe45⤵
- Executes dropped EXE
-
\??\c:\vppjj.exec:\vppjj.exe46⤵
- Executes dropped EXE
-
\??\c:\vjppj.exec:\vjppj.exe47⤵
- Executes dropped EXE
-
\??\c:\ffrrflf.exec:\ffrrflf.exe48⤵
- Executes dropped EXE
-
\??\c:\hbhbbb.exec:\hbhbbb.exe49⤵
- Executes dropped EXE
-
\??\c:\jvddd.exec:\jvddd.exe50⤵
- Executes dropped EXE
-
\??\c:\ddjjj.exec:\ddjjj.exe51⤵
- Executes dropped EXE
-
\??\c:\frxxxxx.exec:\frxxxxx.exe52⤵
- Executes dropped EXE
-
\??\c:\3ffxxff.exec:\3ffxxff.exe53⤵
- Executes dropped EXE
-
\??\c:\nnnnbh.exec:\nnnnbh.exe54⤵
- Executes dropped EXE
-
\??\c:\jvvvp.exec:\jvvvp.exe55⤵
- Executes dropped EXE
-
\??\c:\lrrrlff.exec:\lrrrlff.exe56⤵
- Executes dropped EXE
-
\??\c:\rfllfll.exec:\rfllfll.exe57⤵
- Executes dropped EXE
-
\??\c:\ttbtnh.exec:\ttbtnh.exe58⤵
- Executes dropped EXE
-
\??\c:\jdddd.exec:\jdddd.exe59⤵
- Executes dropped EXE
-
\??\c:\jddpp.exec:\jddpp.exe60⤵
- Executes dropped EXE
-
\??\c:\lfxllrr.exec:\lfxllrr.exe61⤵
- Executes dropped EXE
-
\??\c:\llrfffr.exec:\llrfffr.exe62⤵
- Executes dropped EXE
-
\??\c:\nntnbb.exec:\nntnbb.exe63⤵
- Executes dropped EXE
-
\??\c:\jvjdd.exec:\jvjdd.exe64⤵
- Executes dropped EXE
-
\??\c:\xlfxfxl.exec:\xlfxfxl.exe65⤵
- Executes dropped EXE
-
\??\c:\thbbbh.exec:\thbbbh.exe66⤵
-
\??\c:\bttnhb.exec:\bttnhb.exe67⤵
-
\??\c:\9vdpp.exec:\9vdpp.exe68⤵
-
\??\c:\rrrrrlr.exec:\rrrrrlr.exe69⤵
-
\??\c:\rxlrlrx.exec:\rxlrlrx.exe70⤵
-
\??\c:\9bnnhn.exec:\9bnnhn.exe71⤵
-
\??\c:\vjdjp.exec:\vjdjp.exe72⤵
-
\??\c:\3rxxrrr.exec:\3rxxrrr.exe73⤵
-
\??\c:\3ttntn.exec:\3ttntn.exe74⤵
-
\??\c:\thnntb.exec:\thnntb.exe75⤵
-
\??\c:\jdddp.exec:\jdddp.exe76⤵
-
\??\c:\rrxxffl.exec:\rrxxffl.exe77⤵
-
\??\c:\bnbbbh.exec:\bnbbbh.exe78⤵
-
\??\c:\bnhbbb.exec:\bnhbbb.exe79⤵
-
\??\c:\pvdvv.exec:\pvdvv.exe80⤵
-
\??\c:\lllrlll.exec:\lllrlll.exe81⤵
-
\??\c:\thtnnt.exec:\thtnnt.exe82⤵
-
\??\c:\jpvpj.exec:\jpvpj.exe83⤵
-
\??\c:\1dvpp.exec:\1dvpp.exe84⤵
-
\??\c:\xrlllll.exec:\xrlllll.exe85⤵
-
\??\c:\tnbtbb.exec:\tnbtbb.exe86⤵
-
\??\c:\dvvvv.exec:\dvvvv.exe87⤵
-
\??\c:\5vppv.exec:\5vppv.exe88⤵
-
\??\c:\fxfrrrr.exec:\fxfrrrr.exe89⤵
-
\??\c:\ntnhhb.exec:\ntnhhb.exe90⤵
-
\??\c:\btbttt.exec:\btbttt.exe91⤵
-
\??\c:\jjvvv.exec:\jjvvv.exe92⤵
-
\??\c:\xrlxrxf.exec:\xrlxrxf.exe93⤵
-
\??\c:\lfxfxfl.exec:\lfxfxfl.exe94⤵
-
\??\c:\hbhnbb.exec:\hbhnbb.exe95⤵
-
\??\c:\dvvdv.exec:\dvvdv.exe96⤵
-
\??\c:\lrrxxxl.exec:\lrrxxxl.exe97⤵
-
\??\c:\xfflfrf.exec:\xfflfrf.exe98⤵
-
\??\c:\vjpjj.exec:\vjpjj.exe99⤵
-
\??\c:\frlfxlr.exec:\frlfxlr.exe100⤵
-
\??\c:\nnnbbt.exec:\nnnbbt.exe101⤵
-
\??\c:\dvpjd.exec:\dvpjd.exe102⤵
-
\??\c:\jjppj.exec:\jjppj.exe103⤵
-
\??\c:\ffxxxxr.exec:\ffxxxxr.exe104⤵
-
\??\c:\bhnbnh.exec:\bhnbnh.exe105⤵
-
\??\c:\vjppp.exec:\vjppp.exe106⤵
-
\??\c:\dvvvv.exec:\dvvvv.exe107⤵
-
\??\c:\xxffflr.exec:\xxffflr.exe108⤵
-
\??\c:\lflllrr.exec:\lflllrr.exe109⤵
-
\??\c:\thnhnn.exec:\thnhnn.exe110⤵
-
\??\c:\1hnhbt.exec:\1hnhbt.exe111⤵
-
\??\c:\vvjdp.exec:\vvjdp.exe112⤵
-
\??\c:\9lrrrxf.exec:\9lrrrxf.exe113⤵
-
\??\c:\hbhhtb.exec:\hbhhtb.exe114⤵
-
\??\c:\thbtnt.exec:\thbtnt.exe115⤵
-
\??\c:\5pddd.exec:\5pddd.exe116⤵
-
\??\c:\vvvdd.exec:\vvvdd.exe117⤵
-
\??\c:\xxlflfl.exec:\xxlflfl.exe118⤵
-
\??\c:\fllrrlx.exec:\fllrrlx.exe119⤵
-
\??\c:\tthbnh.exec:\tthbnh.exe120⤵
-
\??\c:\thtnhb.exec:\thtnhb.exe121⤵
-
\??\c:\jjppj.exec:\jjppj.exe122⤵
-
\??\c:\5jdvv.exec:\5jdvv.exe123⤵
-
\??\c:\rxllxxr.exec:\rxllxxr.exe124⤵
-
\??\c:\llrrllx.exec:\llrrllx.exe125⤵
-
\??\c:\bnnnnh.exec:\bnnnnh.exe126⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe127⤵
-
\??\c:\jjpvv.exec:\jjpvv.exe128⤵
-
\??\c:\fxxxxff.exec:\fxxxxff.exe129⤵
-
\??\c:\hnttnn.exec:\hnttnn.exe130⤵
-
\??\c:\pdppp.exec:\pdppp.exe131⤵
-
\??\c:\vvvpp.exec:\vvvpp.exe132⤵
-
\??\c:\fffxfrr.exec:\fffxfrr.exe133⤵
-
\??\c:\flxxxff.exec:\flxxxff.exe134⤵
-
\??\c:\nbtnhh.exec:\nbtnhh.exe135⤵
-
\??\c:\nhnhbb.exec:\nhnhbb.exe136⤵
-
\??\c:\7ppjj.exec:\7ppjj.exe137⤵
-
\??\c:\lrlfxxx.exec:\lrlfxxx.exe138⤵
-
\??\c:\bbbbth.exec:\bbbbth.exe139⤵
-
\??\c:\dvjjj.exec:\dvjjj.exe140⤵
-
\??\c:\3jvvp.exec:\3jvvp.exe141⤵
-
\??\c:\xfrrrxx.exec:\xfrrrxx.exe142⤵
-
\??\c:\1flllrr.exec:\1flllrr.exe143⤵
-
\??\c:\nbbnbh.exec:\nbbnbh.exe144⤵
-
\??\c:\fxllxfx.exec:\fxllxfx.exe145⤵
-
\??\c:\pvddd.exec:\pvddd.exe146⤵
-
\??\c:\7xfffrl.exec:\7xfffrl.exe147⤵
-
\??\c:\ntbhhh.exec:\ntbhhh.exe148⤵
-
\??\c:\5nbbbb.exec:\5nbbbb.exe149⤵
-
\??\c:\lfllfll.exec:\lfllfll.exe150⤵
-
\??\c:\httbbb.exec:\httbbb.exe151⤵
-
\??\c:\vpppj.exec:\vpppj.exe152⤵
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe153⤵
-
\??\c:\7nttbh.exec:\7nttbh.exe154⤵
-
\??\c:\lfllfll.exec:\lfllfll.exe155⤵
-
\??\c:\rrfrrlx.exec:\rrfrrlx.exe156⤵
-
\??\c:\bttnnt.exec:\bttnnt.exe157⤵
-
\??\c:\9vdpp.exec:\9vdpp.exe158⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe159⤵
-
\??\c:\rxlrfrf.exec:\rxlrfrf.exe160⤵
-
\??\c:\hhbbtb.exec:\hhbbtb.exe161⤵
-
\??\c:\bthttb.exec:\bthttb.exe162⤵
-
\??\c:\jvjjp.exec:\jvjjp.exe163⤵
-
\??\c:\xlrrlll.exec:\xlrrlll.exe164⤵
-
\??\c:\lxxfxff.exec:\lxxfxff.exe165⤵
-
\??\c:\bthnnt.exec:\bthnnt.exe166⤵
-
\??\c:\hhhhhn.exec:\hhhhhn.exe167⤵
-
\??\c:\jdvvv.exec:\jdvvv.exe168⤵
-
\??\c:\ddvvp.exec:\ddvvp.exe169⤵
-
\??\c:\rllllrr.exec:\rllllrr.exe170⤵
-
\??\c:\tnbbnn.exec:\tnbbnn.exe171⤵
-
\??\c:\tthttb.exec:\tthttb.exe172⤵
-
\??\c:\ddvvv.exec:\ddvvv.exe173⤵
-
\??\c:\xxxrxxx.exec:\xxxrxxx.exe174⤵
-
\??\c:\xffffll.exec:\xffffll.exe175⤵
-
\??\c:\btnnbb.exec:\btnnbb.exe176⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe177⤵
-
\??\c:\dppjp.exec:\dppjp.exe178⤵
-
\??\c:\5fffflr.exec:\5fffflr.exe179⤵
-
\??\c:\htbhhb.exec:\htbhhb.exe180⤵
-
\??\c:\3vdvv.exec:\3vdvv.exe181⤵
-
\??\c:\pdjjj.exec:\pdjjj.exe182⤵
-
\??\c:\7frlfff.exec:\7frlfff.exe183⤵
-
\??\c:\xxlrrxf.exec:\xxlrrxf.exe184⤵
-
\??\c:\nnnnhn.exec:\nnnnhn.exe185⤵
-
\??\c:\7pppj.exec:\7pppj.exe186⤵
-
\??\c:\dddvp.exec:\dddvp.exe187⤵
-
\??\c:\xxfffll.exec:\xxfffll.exe188⤵
-
\??\c:\3rrlfll.exec:\3rrlfll.exe189⤵
-
\??\c:\7tnnnt.exec:\7tnnnt.exe190⤵
-
\??\c:\tthnht.exec:\tthnht.exe191⤵
-
\??\c:\vjvvv.exec:\vjvvv.exe192⤵
-
\??\c:\lfffxff.exec:\lfffxff.exe193⤵
-
\??\c:\9nttnn.exec:\9nttnn.exe194⤵
-
\??\c:\htnhnn.exec:\htnhnn.exe195⤵
-
\??\c:\jdjdj.exec:\jdjdj.exe196⤵
-
\??\c:\jpddv.exec:\jpddv.exe197⤵
-
\??\c:\rlffxxx.exec:\rlffxxx.exe198⤵
-
\??\c:\ttnbht.exec:\ttnbht.exe199⤵
-
\??\c:\1vdvv.exec:\1vdvv.exe200⤵
-
\??\c:\pvvdj.exec:\pvvdj.exe201⤵
-
\??\c:\lxrfflr.exec:\lxrfflr.exe202⤵
-
\??\c:\nbbnnt.exec:\nbbnnt.exe203⤵
-
\??\c:\9htttt.exec:\9htttt.exe204⤵
-
\??\c:\djjpp.exec:\djjpp.exe205⤵
-
\??\c:\9lxxrxx.exec:\9lxxrxx.exe206⤵
-
\??\c:\ttbbtb.exec:\ttbbtb.exe207⤵
-
\??\c:\nntthn.exec:\nntthn.exe208⤵
-
\??\c:\rllfflf.exec:\rllfflf.exe209⤵
-
\??\c:\xrxxlrf.exec:\xrxxlrf.exe210⤵
-
\??\c:\nbhhbh.exec:\nbhhbh.exe211⤵
-
\??\c:\1jppp.exec:\1jppp.exe212⤵
-
\??\c:\hbhtnt.exec:\hbhtnt.exe213⤵
-
\??\c:\vjvpv.exec:\vjvpv.exe214⤵
-
\??\c:\jpddp.exec:\jpddp.exe215⤵
-
\??\c:\rfrrrrf.exec:\rfrrrrf.exe216⤵
-
\??\c:\hnbbbb.exec:\hnbbbb.exe217⤵
-
\??\c:\nnbhtt.exec:\nnbhtt.exe218⤵
-
\??\c:\jdvpv.exec:\jdvpv.exe219⤵
-
\??\c:\fllfxff.exec:\fllfxff.exe220⤵
-
\??\c:\xrxrxff.exec:\xrxrxff.exe221⤵
-
\??\c:\5pddd.exec:\5pddd.exe222⤵
-
\??\c:\3pddv.exec:\3pddv.exe223⤵
-
\??\c:\nntttb.exec:\nntttb.exe224⤵
-
\??\c:\htnhhn.exec:\htnhhn.exe225⤵
-
\??\c:\ppvvv.exec:\ppvvv.exe226⤵
-
\??\c:\jpvdv.exec:\jpvdv.exe227⤵
-
\??\c:\fflffff.exec:\fflffff.exe228⤵
-
\??\c:\bnhbbh.exec:\bnhbbh.exe229⤵
-
\??\c:\nhnhbb.exec:\nhnhbb.exe230⤵
-
\??\c:\pvdvv.exec:\pvdvv.exe231⤵
-
\??\c:\9jvvp.exec:\9jvvp.exe232⤵
-
\??\c:\xrxllrx.exec:\xrxllrx.exe233⤵
-
\??\c:\ttbtbb.exec:\ttbtbb.exe234⤵
-
\??\c:\ttttbh.exec:\ttttbh.exe235⤵
-
\??\c:\jjppv.exec:\jjppv.exe236⤵
-
\??\c:\9djjd.exec:\9djjd.exe237⤵
-
\??\c:\xrllllr.exec:\xrllllr.exe238⤵
-
\??\c:\5xllrxl.exec:\5xllrxl.exe239⤵
-
\??\c:\bbbbbh.exec:\bbbbbh.exe240⤵
-
\??\c:\ppjpj.exec:\ppjpj.exe241⤵