Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 23:56
Behavioral task
behavioral1
Sample
8424a8353d9b37f9eae15126d7655b83fac03edff9901f1a393e38606d341ed6.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
8424a8353d9b37f9eae15126d7655b83fac03edff9901f1a393e38606d341ed6.exe
-
Size
107KB
-
MD5
3eabac60a09288a4f8b350bc3a5e60e5
-
SHA1
097ea75438d0ddb42fc82bc18941b1ee0a213ab0
-
SHA256
8424a8353d9b37f9eae15126d7655b83fac03edff9901f1a393e38606d341ed6
-
SHA512
004612a5e788f992f1eedfd376ec01d4626a83bfb654d037519d8a3b6fd88fb5cde67be56cb8e0a961581d2967aded43504636f660eb6ee8c0391899a7db4a5c
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66krop7Bcgg:kcm4FmowdHoSphraHcp7yv
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3056-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4464-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3644-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1276-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4268-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3940-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4348-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4064-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3684-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3928-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2304-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3256-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2176-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3944-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3376-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4276-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2924-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2748-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2248-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3684-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2176-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3648-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/912-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/536-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2908-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3772-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2500-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1320-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2256-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4184-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3676-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-496-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-539-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1276-603-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1404-620-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/656-657-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-678-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2788-798-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-896-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-906-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-1013-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-1252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-1280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4464-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vvddd.exe UPX behavioral2/memory/3056-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4464-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vjdvp.exe UPX C:\1lrfrrx.exe UPX behavioral2/memory/3644-15-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hnnnhh.exe UPX behavioral2/memory/2276-25-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1276-32-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\pjdvv.exe UPX \??\c:\1vvpj.exe UPX C:\lffxrlf.exe UPX behavioral2/memory/4268-39-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3940-46-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\3bnnhn.exe UPX behavioral2/memory/4348-52-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ppddd.exe UPX C:\xrxrrxr.exe UPX behavioral2/memory/4064-57-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3684-59-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nbhhbt.exe UPX behavioral2/memory/3684-65-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ddjjp.exe UPX \??\c:\xfllfxr.exe UPX C:\rrxrlff.exe UPX behavioral2/memory/5052-80-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\ttthbt.exe UPX behavioral2/memory/3928-86-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rxrxlfx.exe UPX behavioral2/memory/2304-92-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hnbtnb.exe UPX behavioral2/memory/3256-98-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9hbnhh.exe UPX C:\9djjd.exe UPX behavioral2/memory/4804-109-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xlxrrxr.exe UPX behavioral2/memory/2176-114-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\htnhhb.exe UPX C:\pjvpj.exe UPX behavioral2/memory/5064-125-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/656-127-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\rrxxrlx.exe UPX C:\1fllfll.exe UPX behavioral2/memory/4436-138-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tttntn.exe UPX behavioral2/memory/3944-144-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3376-146-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jjjvj.exe UPX behavioral2/memory/2204-151-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vjppj.exe UPX \??\c:\nttttt.exe UPX \??\c:\xfllxfl.exe UPX behavioral2/memory/4276-161-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2924-168-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ddddp.exe UPX \??\c:\lxxxrxr.exe UPX behavioral2/memory/4568-182-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bthhhh.exe UPX behavioral2/memory/4860-191-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2748-198-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5028-203-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2248-215-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3684-219-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
vvddd.exevjdvp.exe1lrfrrx.exehnnnhh.exe1vvpj.exepjdvv.exelffxrlf.exe3bnnhn.exeppddd.exexrxrrxr.exenbhhbt.exeddjjp.exexfllfxr.exerrxrlff.exettthbt.exerxrxlfx.exehnbtnb.exe9hbnhh.exe9djjd.exexlxrrxr.exehtnhhb.exepjvpj.exerrxxrlx.exe1fllfll.exetttntn.exejjjvj.exevjppj.exexfllxfl.exenttttt.exeddddp.exelxxxrxr.exebthhhh.exedpjvj.exepjpvj.exentbbhh.exe5nbbth.exeppjvp.exerlrlxxx.exerfllxfx.exebbbtnn.exedvvpd.exejjvpj.exelrxrllf.exe5thbnh.exe5hbttb.exevpvvj.exe9rxxrrr.exelffxrff.exettttnh.exetbtnhb.exe5pvpp.exerllfxfx.exe7hbttb.exebthhtt.exejdpjd.exelxxrrxx.exerrfxxlr.exebbhbnn.exevdjpj.exexflffxr.exe3xffxxr.exehbtnhb.exejvjdd.exe5vjdd.exepid process 3056 vvddd.exe 3644 vjdvp.exe 4752 1lrfrrx.exe 2276 hnnnhh.exe 1276 1vvpj.exe 4268 pjdvv.exe 3940 lffxrlf.exe 4348 3bnnhn.exe 4064 ppddd.exe 3684 xrxrrxr.exe 3064 nbhhbt.exe 4548 ddjjp.exe 5052 xfllfxr.exe 3928 rrxrlff.exe 2304 ttthbt.exe 3256 rxrxlfx.exe 4480 hnbtnb.exe 4804 9hbnhh.exe 2176 9djjd.exe 852 xlxrrxr.exe 5064 htnhhb.exe 656 pjvpj.exe 4436 rrxxrlx.exe 3944 1fllfll.exe 3376 tttntn.exe 2204 jjjvj.exe 4276 vjppj.exe 2868 xfllxfl.exe 2924 nttttt.exe 2908 ddddp.exe 4568 lxxxrxr.exe 3020 bthhhh.exe 4860 dpjvj.exe 3920 pjpvj.exe 2748 ntbbhh.exe 2184 5nbbth.exe 5028 ppjvp.exe 4432 rlrlxxx.exe 4980 rfllxfx.exe 2248 bbbtnn.exe 3684 dvvpd.exe 1644 jjvpj.exe 428 lrxrllf.exe 988 5thbnh.exe 3460 5hbttb.exe 4184 vpvvj.exe 1876 9rxxrrr.exe 4972 lffxrff.exe 4132 ttttnh.exe 220 tbtnhb.exe 2176 5pvpp.exe 4188 rllfxfx.exe 3112 7hbttb.exe 4892 bthhtt.exe 388 jdpjd.exe 3648 lxxrrxx.exe 912 rrfxxlr.exe 2644 bbhbnn.exe 2044 vdjpj.exe 3412 xflffxr.exe 4332 3xffxxr.exe 4276 hbtnhb.exe 536 jvjdd.exe 3600 5vjdd.exe -
Processes:
resource yara_rule behavioral2/memory/4464-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvddd.exe upx behavioral2/memory/3056-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4464-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjdvp.exe upx C:\1lrfrrx.exe upx behavioral2/memory/3644-15-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hnnnhh.exe upx behavioral2/memory/2276-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1276-32-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjdvv.exe upx \??\c:\1vvpj.exe upx C:\lffxrlf.exe upx behavioral2/memory/4268-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3940-46-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3bnnhn.exe upx behavioral2/memory/4348-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppddd.exe upx C:\xrxrrxr.exe upx behavioral2/memory/4064-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3684-59-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbhhbt.exe upx behavioral2/memory/3684-65-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddjjp.exe upx \??\c:\xfllfxr.exe upx C:\rrxrlff.exe upx behavioral2/memory/5052-80-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ttthbt.exe upx behavioral2/memory/3928-86-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxrxlfx.exe upx behavioral2/memory/2304-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hnbtnb.exe upx behavioral2/memory/3256-98-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9hbnhh.exe upx C:\9djjd.exe upx behavioral2/memory/4804-109-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlxrrxr.exe upx behavioral2/memory/2176-114-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htnhhb.exe upx C:\pjvpj.exe upx behavioral2/memory/5064-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/656-127-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rrxxrlx.exe upx C:\1fllfll.exe upx behavioral2/memory/4436-138-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tttntn.exe upx behavioral2/memory/3944-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3376-146-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjjvj.exe upx behavioral2/memory/2204-151-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjppj.exe upx \??\c:\nttttt.exe upx \??\c:\xfllxfl.exe upx behavioral2/memory/4276-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2924-168-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddddp.exe upx \??\c:\lxxxrxr.exe upx behavioral2/memory/4568-182-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bthhhh.exe upx behavioral2/memory/4860-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2748-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5028-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2248-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3684-219-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8424a8353d9b37f9eae15126d7655b83fac03edff9901f1a393e38606d341ed6.exevvddd.exevjdvp.exe1lrfrrx.exehnnnhh.exe1vvpj.exepjdvv.exelffxrlf.exe3bnnhn.exeppddd.exexrxrrxr.exenbhhbt.exeddjjp.exexfllfxr.exerrxrlff.exettthbt.exerxrxlfx.exehnbtnb.exe9hbnhh.exe9djjd.exexlxrrxr.exehtnhhb.exedescription pid process target process PID 4464 wrote to memory of 3056 4464 8424a8353d9b37f9eae15126d7655b83fac03edff9901f1a393e38606d341ed6.exe vvddd.exe PID 4464 wrote to memory of 3056 4464 8424a8353d9b37f9eae15126d7655b83fac03edff9901f1a393e38606d341ed6.exe vvddd.exe PID 4464 wrote to memory of 3056 4464 8424a8353d9b37f9eae15126d7655b83fac03edff9901f1a393e38606d341ed6.exe vvddd.exe PID 3056 wrote to memory of 3644 3056 vvddd.exe vjdvp.exe PID 3056 wrote to memory of 3644 3056 vvddd.exe vjdvp.exe PID 3056 wrote to memory of 3644 3056 vvddd.exe vjdvp.exe PID 3644 wrote to memory of 4752 3644 vjdvp.exe 1lrfrrx.exe PID 3644 wrote to memory of 4752 3644 vjdvp.exe 1lrfrrx.exe PID 3644 wrote to memory of 4752 3644 vjdvp.exe 1lrfrrx.exe PID 4752 wrote to memory of 2276 4752 1lrfrrx.exe hnnnhh.exe PID 4752 wrote to memory of 2276 4752 1lrfrrx.exe hnnnhh.exe PID 4752 wrote to memory of 2276 4752 1lrfrrx.exe hnnnhh.exe PID 2276 wrote to memory of 1276 2276 hnnnhh.exe 1vvpj.exe PID 2276 wrote to memory of 1276 2276 hnnnhh.exe 1vvpj.exe PID 2276 wrote to memory of 1276 2276 hnnnhh.exe 1vvpj.exe PID 1276 wrote to memory of 4268 1276 1vvpj.exe pjdvv.exe PID 1276 wrote to memory of 4268 1276 1vvpj.exe pjdvv.exe PID 1276 wrote to memory of 4268 1276 1vvpj.exe pjdvv.exe PID 4268 wrote to memory of 3940 4268 pjdvv.exe lffxrlf.exe PID 4268 wrote to memory of 3940 4268 pjdvv.exe lffxrlf.exe PID 4268 wrote to memory of 3940 4268 pjdvv.exe lffxrlf.exe PID 3940 wrote to memory of 4348 3940 lffxrlf.exe 3bnnhn.exe PID 3940 wrote to memory of 4348 3940 lffxrlf.exe 3bnnhn.exe PID 3940 wrote to memory of 4348 3940 lffxrlf.exe 3bnnhn.exe PID 4348 wrote to memory of 4064 4348 3bnnhn.exe ppddd.exe PID 4348 wrote to memory of 4064 4348 3bnnhn.exe ppddd.exe PID 4348 wrote to memory of 4064 4348 3bnnhn.exe ppddd.exe PID 4064 wrote to memory of 3684 4064 ppddd.exe xrxrrxr.exe PID 4064 wrote to memory of 3684 4064 ppddd.exe xrxrrxr.exe PID 4064 wrote to memory of 3684 4064 ppddd.exe xrxrrxr.exe PID 3684 wrote to memory of 3064 3684 xrxrrxr.exe nbhhbt.exe PID 3684 wrote to memory of 3064 3684 xrxrrxr.exe nbhhbt.exe PID 3684 wrote to memory of 3064 3684 xrxrrxr.exe nbhhbt.exe PID 3064 wrote to memory of 4548 3064 nbhhbt.exe ddjjp.exe PID 3064 wrote to memory of 4548 3064 nbhhbt.exe ddjjp.exe PID 3064 wrote to memory of 4548 3064 nbhhbt.exe ddjjp.exe PID 4548 wrote to memory of 5052 4548 ddjjp.exe xfllfxr.exe PID 4548 wrote to memory of 5052 4548 ddjjp.exe xfllfxr.exe PID 4548 wrote to memory of 5052 4548 ddjjp.exe xfllfxr.exe PID 5052 wrote to memory of 3928 5052 xfllfxr.exe rrxrlff.exe PID 5052 wrote to memory of 3928 5052 xfllfxr.exe rrxrlff.exe PID 5052 wrote to memory of 3928 5052 xfllfxr.exe rrxrlff.exe PID 3928 wrote to memory of 2304 3928 rrxrlff.exe ttthbt.exe PID 3928 wrote to memory of 2304 3928 rrxrlff.exe ttthbt.exe PID 3928 wrote to memory of 2304 3928 rrxrlff.exe ttthbt.exe PID 2304 wrote to memory of 3256 2304 ttthbt.exe rxrxlfx.exe PID 2304 wrote to memory of 3256 2304 ttthbt.exe rxrxlfx.exe PID 2304 wrote to memory of 3256 2304 ttthbt.exe rxrxlfx.exe PID 3256 wrote to memory of 4480 3256 rxrxlfx.exe hnbtnb.exe PID 3256 wrote to memory of 4480 3256 rxrxlfx.exe hnbtnb.exe PID 3256 wrote to memory of 4480 3256 rxrxlfx.exe hnbtnb.exe PID 4480 wrote to memory of 4804 4480 hnbtnb.exe 9hbnhh.exe PID 4480 wrote to memory of 4804 4480 hnbtnb.exe 9hbnhh.exe PID 4480 wrote to memory of 4804 4480 hnbtnb.exe 9hbnhh.exe PID 4804 wrote to memory of 2176 4804 9hbnhh.exe 9djjd.exe PID 4804 wrote to memory of 2176 4804 9hbnhh.exe 9djjd.exe PID 4804 wrote to memory of 2176 4804 9hbnhh.exe 9djjd.exe PID 2176 wrote to memory of 852 2176 9djjd.exe xlxrrxr.exe PID 2176 wrote to memory of 852 2176 9djjd.exe xlxrrxr.exe PID 2176 wrote to memory of 852 2176 9djjd.exe xlxrrxr.exe PID 852 wrote to memory of 5064 852 xlxrrxr.exe htnhhb.exe PID 852 wrote to memory of 5064 852 xlxrrxr.exe htnhhb.exe PID 852 wrote to memory of 5064 852 xlxrrxr.exe htnhhb.exe PID 5064 wrote to memory of 656 5064 htnhhb.exe pjvpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8424a8353d9b37f9eae15126d7655b83fac03edff9901f1a393e38606d341ed6.exe"C:\Users\Admin\AppData\Local\Temp\8424a8353d9b37f9eae15126d7655b83fac03edff9901f1a393e38606d341ed6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vvddd.exec:\vvddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjdvp.exec:\vjdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1lrfrrx.exec:\1lrfrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnnnhh.exec:\hnnnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1vvpj.exec:\1vvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjdvv.exec:\pjdvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lffxrlf.exec:\lffxrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3bnnhn.exec:\3bnnhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppddd.exec:\ppddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrxrrxr.exec:\xrxrrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbhhbt.exec:\nbhhbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddjjp.exec:\ddjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xfllfxr.exec:\xfllfxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrxrlff.exec:\rrxrlff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttthbt.exec:\ttthbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxrxlfx.exec:\rxrxlfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnbtnb.exec:\hnbtnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9hbnhh.exec:\9hbnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9djjd.exec:\9djjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlxrrxr.exec:\xlxrrxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htnhhb.exec:\htnhhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvpj.exec:\pjvpj.exe23⤵
- Executes dropped EXE
-
\??\c:\rrxxrlx.exec:\rrxxrlx.exe24⤵
- Executes dropped EXE
-
\??\c:\1fllfll.exec:\1fllfll.exe25⤵
- Executes dropped EXE
-
\??\c:\tttntn.exec:\tttntn.exe26⤵
- Executes dropped EXE
-
\??\c:\jjjvj.exec:\jjjvj.exe27⤵
- Executes dropped EXE
-
\??\c:\vjppj.exec:\vjppj.exe28⤵
- Executes dropped EXE
-
\??\c:\xfllxfl.exec:\xfllxfl.exe29⤵
- Executes dropped EXE
-
\??\c:\nttttt.exec:\nttttt.exe30⤵
- Executes dropped EXE
-
\??\c:\ddddp.exec:\ddddp.exe31⤵
- Executes dropped EXE
-
\??\c:\lxxxrxr.exec:\lxxxrxr.exe32⤵
- Executes dropped EXE
-
\??\c:\bthhhh.exec:\bthhhh.exe33⤵
- Executes dropped EXE
-
\??\c:\dpjvj.exec:\dpjvj.exe34⤵
- Executes dropped EXE
-
\??\c:\pjpvj.exec:\pjpvj.exe35⤵
- Executes dropped EXE
-
\??\c:\ntbbhh.exec:\ntbbhh.exe36⤵
- Executes dropped EXE
-
\??\c:\5nbbth.exec:\5nbbth.exe37⤵
- Executes dropped EXE
-
\??\c:\ppjvp.exec:\ppjvp.exe38⤵
- Executes dropped EXE
-
\??\c:\rlrlxxx.exec:\rlrlxxx.exe39⤵
- Executes dropped EXE
-
\??\c:\rfllxfx.exec:\rfllxfx.exe40⤵
- Executes dropped EXE
-
\??\c:\bbbtnn.exec:\bbbtnn.exe41⤵
- Executes dropped EXE
-
\??\c:\dvvpd.exec:\dvvpd.exe42⤵
- Executes dropped EXE
-
\??\c:\jjvpj.exec:\jjvpj.exe43⤵
- Executes dropped EXE
-
\??\c:\lrxrllf.exec:\lrxrllf.exe44⤵
- Executes dropped EXE
-
\??\c:\5thbnh.exec:\5thbnh.exe45⤵
- Executes dropped EXE
-
\??\c:\5hbttb.exec:\5hbttb.exe46⤵
- Executes dropped EXE
-
\??\c:\vpvvj.exec:\vpvvj.exe47⤵
- Executes dropped EXE
-
\??\c:\9rxxrrr.exec:\9rxxrrr.exe48⤵
- Executes dropped EXE
-
\??\c:\lffxrff.exec:\lffxrff.exe49⤵
- Executes dropped EXE
-
\??\c:\ttttnh.exec:\ttttnh.exe50⤵
- Executes dropped EXE
-
\??\c:\tbtnhb.exec:\tbtnhb.exe51⤵
- Executes dropped EXE
-
\??\c:\5pvpp.exec:\5pvpp.exe52⤵
- Executes dropped EXE
-
\??\c:\rllfxfx.exec:\rllfxfx.exe53⤵
- Executes dropped EXE
-
\??\c:\7hbttb.exec:\7hbttb.exe54⤵
- Executes dropped EXE
-
\??\c:\bthhtt.exec:\bthhtt.exe55⤵
- Executes dropped EXE
-
\??\c:\jdpjd.exec:\jdpjd.exe56⤵
- Executes dropped EXE
-
\??\c:\lxxrrxx.exec:\lxxrrxx.exe57⤵
- Executes dropped EXE
-
\??\c:\rrfxxlr.exec:\rrfxxlr.exe58⤵
- Executes dropped EXE
-
\??\c:\bbhbnn.exec:\bbhbnn.exe59⤵
- Executes dropped EXE
-
\??\c:\vdjpj.exec:\vdjpj.exe60⤵
- Executes dropped EXE
-
\??\c:\xflffxr.exec:\xflffxr.exe61⤵
- Executes dropped EXE
-
\??\c:\3xffxxr.exec:\3xffxxr.exe62⤵
- Executes dropped EXE
-
\??\c:\hbtnhb.exec:\hbtnhb.exe63⤵
- Executes dropped EXE
-
\??\c:\jvjdd.exec:\jvjdd.exe64⤵
- Executes dropped EXE
-
\??\c:\5vjdd.exec:\5vjdd.exe65⤵
- Executes dropped EXE
-
\??\c:\tttntb.exec:\tttntb.exe66⤵
-
\??\c:\nhhhbt.exec:\nhhhbt.exe67⤵
-
\??\c:\pddvp.exec:\pddvp.exe68⤵
-
\??\c:\9xrlllr.exec:\9xrlllr.exe69⤵
-
\??\c:\rxxfxxx.exec:\rxxfxxx.exe70⤵
-
\??\c:\nhhbhb.exec:\nhhbhb.exe71⤵
-
\??\c:\tnnnnt.exec:\tnnnnt.exe72⤵
-
\??\c:\7dvjv.exec:\7dvjv.exe73⤵
-
\??\c:\dvddd.exec:\dvddd.exe74⤵
-
\??\c:\rflfxxf.exec:\rflfxxf.exe75⤵
-
\??\c:\tbbbhh.exec:\tbbbhh.exe76⤵
-
\??\c:\nhbbtt.exec:\nhbbtt.exe77⤵
-
\??\c:\jjpjj.exec:\jjpjj.exe78⤵
-
\??\c:\dvppj.exec:\dvppj.exe79⤵
-
\??\c:\rrlfxxx.exec:\rrlfxxx.exe80⤵
-
\??\c:\tnbbhh.exec:\tnbbhh.exe81⤵
-
\??\c:\9vjjv.exec:\9vjjv.exe82⤵
-
\??\c:\jjjdd.exec:\jjjdd.exe83⤵
-
\??\c:\xrxxrxx.exec:\xrxxrxx.exe84⤵
-
\??\c:\1ttnnt.exec:\1ttnnt.exe85⤵
-
\??\c:\htbbtt.exec:\htbbtt.exe86⤵
-
\??\c:\9djpj.exec:\9djpj.exe87⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe88⤵
-
\??\c:\hhtnbt.exec:\hhtnbt.exe89⤵
-
\??\c:\hbhnnb.exec:\hbhnnb.exe90⤵
-
\??\c:\dppjd.exec:\dppjd.exe91⤵
-
\??\c:\flxxflf.exec:\flxxflf.exe92⤵
-
\??\c:\nnbbnh.exec:\nnbbnh.exe93⤵
-
\??\c:\hnhbbt.exec:\hnhbbt.exe94⤵
-
\??\c:\jdvjd.exec:\jdvjd.exe95⤵
-
\??\c:\ppvpj.exec:\ppvpj.exe96⤵
-
\??\c:\rrrffxx.exec:\rrrffxx.exe97⤵
-
\??\c:\xlrrlll.exec:\xlrrlll.exe98⤵
-
\??\c:\btbbbn.exec:\btbbbn.exe99⤵
-
\??\c:\hnttnh.exec:\hnttnh.exe100⤵
-
\??\c:\3ddvv.exec:\3ddvv.exe101⤵
-
\??\c:\dpvvp.exec:\dpvvp.exe102⤵
-
\??\c:\xlrxrlf.exec:\xlrxrlf.exe103⤵
-
\??\c:\llrrffr.exec:\llrrffr.exe104⤵
-
\??\c:\bttttn.exec:\bttttn.exe105⤵
-
\??\c:\bbnhhh.exec:\bbnhhh.exe106⤵
-
\??\c:\7vpvv.exec:\7vpvv.exe107⤵
-
\??\c:\jddvp.exec:\jddvp.exe108⤵
-
\??\c:\9lrlrrr.exec:\9lrlrrr.exe109⤵
-
\??\c:\5lrrrff.exec:\5lrrrff.exe110⤵
-
\??\c:\5bbtnt.exec:\5bbtnt.exe111⤵
-
\??\c:\ttbtnn.exec:\ttbtnn.exe112⤵
-
\??\c:\pdddd.exec:\pdddd.exe113⤵
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe114⤵
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe115⤵
-
\??\c:\xrxxllr.exec:\xrxxllr.exe116⤵
-
\??\c:\3bbbbb.exec:\3bbbbb.exe117⤵
-
\??\c:\nbhhht.exec:\nbhhht.exe118⤵
-
\??\c:\7vpvp.exec:\7vpvp.exe119⤵
-
\??\c:\9dvvv.exec:\9dvvv.exe120⤵
-
\??\c:\xrlfrxx.exec:\xrlfrxx.exe121⤵
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe122⤵
-
\??\c:\thtbbb.exec:\thtbbb.exe123⤵
-
\??\c:\nbnhbt.exec:\nbnhbt.exe124⤵
-
\??\c:\pjjjv.exec:\pjjjv.exe125⤵
-
\??\c:\lflxrxx.exec:\lflxrxx.exe126⤵
-
\??\c:\nhbbbb.exec:\nhbbbb.exe127⤵
-
\??\c:\1hnhtt.exec:\1hnhtt.exe128⤵
-
\??\c:\jjpjv.exec:\jjpjv.exe129⤵
-
\??\c:\vpvvd.exec:\vpvvd.exe130⤵
-
\??\c:\ffflfff.exec:\ffflfff.exe131⤵
-
\??\c:\tnnttt.exec:\tnnttt.exe132⤵
-
\??\c:\nnhhhh.exec:\nnhhhh.exe133⤵
-
\??\c:\9jjjv.exec:\9jjjv.exe134⤵
-
\??\c:\vdddv.exec:\vdddv.exe135⤵
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe136⤵
-
\??\c:\thhbtt.exec:\thhbtt.exe137⤵
-
\??\c:\9tbttt.exec:\9tbttt.exe138⤵
-
\??\c:\9vvvp.exec:\9vvvp.exe139⤵
-
\??\c:\1jvpd.exec:\1jvpd.exe140⤵
-
\??\c:\xxxlffx.exec:\xxxlffx.exe141⤵
-
\??\c:\9thbbb.exec:\9thbbb.exe142⤵
-
\??\c:\bthnnb.exec:\bthnnb.exe143⤵
-
\??\c:\5pjdv.exec:\5pjdv.exe144⤵
-
\??\c:\vppjd.exec:\vppjd.exe145⤵
-
\??\c:\lrxfffx.exec:\lrxfffx.exe146⤵
-
\??\c:\lrffxxr.exec:\lrffxxr.exe147⤵
-
\??\c:\htbntt.exec:\htbntt.exe148⤵
-
\??\c:\vdjvp.exec:\vdjvp.exe149⤵
-
\??\c:\jvvvd.exec:\jvvvd.exe150⤵
-
\??\c:\1lrlxxr.exec:\1lrlxxr.exe151⤵
-
\??\c:\xlxllxx.exec:\xlxllxx.exe152⤵
-
\??\c:\nnhbtt.exec:\nnhbtt.exe153⤵
-
\??\c:\3djjp.exec:\3djjp.exe154⤵
-
\??\c:\pdjdp.exec:\pdjdp.exe155⤵
-
\??\c:\lfxrlll.exec:\lfxrlll.exe156⤵
-
\??\c:\rlrffrl.exec:\rlrffrl.exe157⤵
-
\??\c:\nhtnnn.exec:\nhtnnn.exe158⤵
-
\??\c:\bhhntt.exec:\bhhntt.exe159⤵
-
\??\c:\jvvdv.exec:\jvvdv.exe160⤵
-
\??\c:\llxllxf.exec:\llxllxf.exe161⤵
-
\??\c:\5rlllfl.exec:\5rlllfl.exe162⤵
-
\??\c:\hnbbhn.exec:\hnbbhn.exe163⤵
-
\??\c:\5nttnb.exec:\5nttnb.exe164⤵
-
\??\c:\vvddj.exec:\vvddj.exe165⤵
-
\??\c:\pjvjj.exec:\pjvjj.exe166⤵
-
\??\c:\flrlllf.exec:\flrlllf.exe167⤵
-
\??\c:\xfflflf.exec:\xfflflf.exe168⤵
-
\??\c:\htnnnn.exec:\htnnnn.exe169⤵
-
\??\c:\tnbhtn.exec:\tnbhtn.exe170⤵
-
\??\c:\1jdvv.exec:\1jdvv.exe171⤵
-
\??\c:\xrrxrff.exec:\xrrxrff.exe172⤵
-
\??\c:\7xllfff.exec:\7xllfff.exe173⤵
-
\??\c:\btbbhh.exec:\btbbhh.exe174⤵
-
\??\c:\nnhhhn.exec:\nnhhhn.exe175⤵
-
\??\c:\ppjjd.exec:\ppjjd.exe176⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe177⤵
-
\??\c:\9rllffx.exec:\9rllffx.exe178⤵
-
\??\c:\tnhbhh.exec:\tnhbhh.exe179⤵
-
\??\c:\tnnnnn.exec:\tnnnnn.exe180⤵
-
\??\c:\bbbnhn.exec:\bbbnhn.exe181⤵
-
\??\c:\5pppj.exec:\5pppj.exe182⤵
-
\??\c:\3xxxllf.exec:\3xxxllf.exe183⤵
-
\??\c:\rlllxfl.exec:\rlllxfl.exe184⤵
-
\??\c:\nnttbb.exec:\nnttbb.exe185⤵
-
\??\c:\dppvj.exec:\dppvj.exe186⤵
-
\??\c:\1pjjd.exec:\1pjjd.exe187⤵
-
\??\c:\1xfxrrl.exec:\1xfxrrl.exe188⤵
-
\??\c:\rlrlllf.exec:\rlrlllf.exe189⤵
-
\??\c:\3httbt.exec:\3httbt.exe190⤵
-
\??\c:\3ttnhn.exec:\3ttnhn.exe191⤵
-
\??\c:\ppdjd.exec:\ppdjd.exe192⤵
-
\??\c:\rflfxxr.exec:\rflfxxr.exe193⤵
-
\??\c:\fxxrfff.exec:\fxxrfff.exe194⤵
-
\??\c:\nhnnnn.exec:\nhnnnn.exe195⤵
-
\??\c:\nbnnhh.exec:\nbnnhh.exe196⤵
-
\??\c:\dvpjj.exec:\dvpjj.exe197⤵
-
\??\c:\hhbbbt.exec:\hhbbbt.exe198⤵
-
\??\c:\djdpp.exec:\djdpp.exe199⤵
-
\??\c:\lxlrlll.exec:\lxlrlll.exe200⤵
-
\??\c:\tnhbtt.exec:\tnhbtt.exe201⤵
-
\??\c:\1dpdj.exec:\1dpdj.exe202⤵
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe203⤵
-
\??\c:\nhhthh.exec:\nhhthh.exe204⤵
-
\??\c:\ttbhnt.exec:\ttbhnt.exe205⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe206⤵
-
\??\c:\dvdvj.exec:\dvdvj.exe207⤵
-
\??\c:\ffxxfxf.exec:\ffxxfxf.exe208⤵
-
\??\c:\3xlffff.exec:\3xlffff.exe209⤵
-
\??\c:\tnnhbb.exec:\tnnhbb.exe210⤵
-
\??\c:\1bhhbb.exec:\1bhhbb.exe211⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe212⤵
-
\??\c:\dpppp.exec:\dpppp.exe213⤵
-
\??\c:\9rlfxff.exec:\9rlfxff.exe214⤵
-
\??\c:\rfflxlx.exec:\rfflxlx.exe215⤵
-
\??\c:\bbtttt.exec:\bbtttt.exe216⤵
-
\??\c:\bhbhbb.exec:\bhbhbb.exe217⤵
-
\??\c:\jjpjj.exec:\jjpjj.exe218⤵
-
\??\c:\pdjjd.exec:\pdjjd.exe219⤵
-
\??\c:\xrrfxxr.exec:\xrrfxxr.exe220⤵
-
\??\c:\7ffrlll.exec:\7ffrlll.exe221⤵
-
\??\c:\tbhttt.exec:\tbhttt.exe222⤵
-
\??\c:\bbnhhn.exec:\bbnhhn.exe223⤵
-
\??\c:\5vvvp.exec:\5vvvp.exe224⤵
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe225⤵
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe226⤵
-
\??\c:\btbttt.exec:\btbttt.exe227⤵
-
\??\c:\bbhbnn.exec:\bbhbnn.exe228⤵
-
\??\c:\9jppd.exec:\9jppd.exe229⤵
-
\??\c:\7vjjd.exec:\7vjjd.exe230⤵
-
\??\c:\lxxrlfl.exec:\lxxrlfl.exe231⤵
-
\??\c:\xlllrrl.exec:\xlllrrl.exe232⤵
-
\??\c:\bhhthh.exec:\bhhthh.exe233⤵
-
\??\c:\dpppp.exec:\dpppp.exe234⤵
-
\??\c:\1pvvv.exec:\1pvvv.exe235⤵
-
\??\c:\lflfxff.exec:\lflfxff.exe236⤵
-
\??\c:\hnnhnh.exec:\hnnhnh.exe237⤵
-
\??\c:\httbnn.exec:\httbnn.exe238⤵
-
\??\c:\pdvvj.exec:\pdvvj.exe239⤵
-
\??\c:\dvjjd.exec:\dvjjd.exe240⤵
-
\??\c:\lxlxfxr.exec:\lxlxfxr.exe241⤵