Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 00:33
Behavioral task
behavioral1
Sample
905b3babc5ce18022589a176b755cebf38703ec2e6806152b7067b81035827b7.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
905b3babc5ce18022589a176b755cebf38703ec2e6806152b7067b81035827b7.exe
-
Size
91KB
-
MD5
13234d9994d622604bae29d25d27606d
-
SHA1
f0d83241ee2f15cb47d4497ca7e43e7cb7dc615f
-
SHA256
905b3babc5ce18022589a176b755cebf38703ec2e6806152b7067b81035827b7
-
SHA512
bc37e4915f2febc512e2aa5d3282929e6269387529002a5481182a7020cd4937e816d7086db0dfe884ad640cc08ac2e6699aeb0b125832f8d254c4beb75d322d
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w801ouAsG9ZoPEudJGdXRKXR5Z/2K:xhOmTsF93UYfwC6GIout03Fv9KdJoQ3H
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1448-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1372-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1868-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2964-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/976-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2972-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3300-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3156-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2836-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3336-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1212-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/920-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1996-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3332-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1464-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3288-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1012-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2612-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/652-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4452-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2660-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2252-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/544-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1888-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1176-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1012-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1984-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2108-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2908-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-480-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1180-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2908-563-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-587-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1376-593-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-618-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4648-622-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-642-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3736-651-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4776-796-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/652-806-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-832-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4216-911-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3176-960-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1448-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1448-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3vpjj.exe UPX behavioral2/memory/1372-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\xxlxrlf.exe UPX C:\bnbnhb.exe UPX behavioral2/memory/2016-14-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1868-22-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pdvpj.exe UPX behavioral2/memory/2964-26-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\lflfxxr.exe UPX behavioral2/memory/2972-30-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\nhttnn.exe UPX behavioral2/memory/976-39-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2972-38-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\1vvvj.exe UPX behavioral2/memory/3300-44-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\fxfxrxr.exe UPX behavioral2/memory/1508-50-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lffxrll.exe UPX C:\1hhbtt.exe UPX behavioral2/memory/3156-61-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2836-62-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\1pdvp.exe UPX behavioral2/memory/2836-68-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3336-70-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jdpjp.exe UPX C:\rlxrrrx.exe UPX C:\ttntnn.exe UPX behavioral2/memory/1212-85-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4640-87-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\pvvjd.exe UPX behavioral2/memory/4656-93-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\frxlrrr.exe UPX C:\lxxfrxf.exe UPX behavioral2/memory/920-101-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9btnhh.exe UPX C:\vdvpp.exe UPX C:\fxxllfx.exe UPX behavioral2/memory/4520-117-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3572-120-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\xxxfffx.exe UPX C:\5hhbhn.exe UPX behavioral2/memory/2756-129-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1996-136-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\pjjpj.exe UPX behavioral2/memory/4376-138-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pppdv.exe UPX behavioral2/memory/3332-144-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xrrlfxr.exe UPX behavioral2/memory/1464-151-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hthnth.exe UPX C:\thbhbn.exe UPX behavioral2/memory/3288-159-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ddddv.exe UPX behavioral2/memory/1012-170-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\9rxllxr.exe UPX behavioral2/memory/2612-173-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5xxfxxr.exe UPX behavioral2/memory/4712-178-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7htnhh.exe UPX C:\pvpvp.exe UPX behavioral2/memory/4484-188-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3628-190-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
3vpjj.exexxlxrlf.exebnbnhb.exepdvpj.exelflfxxr.exenhttnn.exe1vvvj.exefxfxrxr.exelffxrll.exe1hhbtt.exe1pdvp.exejdpjp.exerlxrrrx.exettntnn.exepvvjd.exefrxlrrr.exelxxfrxf.exe9btnhh.exevdvpp.exefxxllfx.exexxxfffx.exe5hhbhn.exepjjpj.exepppdv.exexrrlfxr.exehthnth.exethbhbn.exeddddv.exe9rxllxr.exe5xxfxxr.exe7htnhh.exepvpvp.exejvvvv.exebttntt.exetbhhbh.exeflflfff.exetnhthb.exehnhhnn.exe7pvdp.exepjppv.exe3lfxllx.exe3rxxxff.exehnnhbh.exedjvvv.exexrrlllf.exerrxrlfx.exe1nnhhh.exejvvpj.exepvvvv.exefrffffx.exebhtttt.exevdjvd.exejvvpj.exerlrrlrl.exefffffxx.exebbbtnh.exebntnth.exedvddj.exepvvvj.exefffxrrl.exefxffxfl.exe7hhbth.exehbhhtt.exettbbtt.exepid process 1372 3vpjj.exe 2016 xxlxrlf.exe 1868 bnbnhb.exe 2964 pdvpj.exe 2972 lflfxxr.exe 976 nhttnn.exe 3300 1vvvj.exe 1508 fxfxrxr.exe 3156 lffxrll.exe 2836 1hhbtt.exe 3336 1pdvp.exe 216 jdpjp.exe 1212 rlxrrrx.exe 4640 ttntnn.exe 4656 pvvjd.exe 920 frxlrrr.exe 1800 lxxfrxf.exe 2736 9btnhh.exe 4520 vdvpp.exe 3572 fxxllfx.exe 2756 xxxfffx.exe 1996 5hhbhn.exe 4376 pjjpj.exe 3332 pppdv.exe 1464 xrrlfxr.exe 3288 hthnth.exe 3536 thbhbn.exe 1012 ddddv.exe 2612 9rxllxr.exe 4712 5xxfxxr.exe 4484 7htnhh.exe 3628 pvpvp.exe 3868 jvvvv.exe 652 bttntt.exe 4452 tbhhbh.exe 884 flflfff.exe 2660 tnhthb.exe 3032 hnhhnn.exe 4292 7pvdp.exe 1944 pjppv.exe 4336 3lfxllx.exe 2252 3rxxxff.exe 2120 hnnhbh.exe 3276 djvvv.exe 544 xrrlllf.exe 4872 rrxrlfx.exe 976 1nnhhh.exe 1888 jvvpj.exe 1236 pvvvv.exe 1392 frffffx.exe 4008 bhtttt.exe 3616 vdjvd.exe 5052 jvvpj.exe 1872 rlrrlrl.exe 1988 fffffxx.exe 624 bbbtnh.exe 4064 bntnth.exe 4836 dvddj.exe 4928 pvvvj.exe 4780 fffxrrl.exe 4656 fxffxfl.exe 920 7hhbth.exe 1176 hbhhtt.exe 3708 ttbbtt.exe -
Processes:
resource yara_rule behavioral2/memory/1448-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1448-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3vpjj.exe upx behavioral2/memory/1372-8-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xxlxrlf.exe upx C:\bnbnhb.exe upx behavioral2/memory/2016-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1868-22-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdvpj.exe upx behavioral2/memory/2964-26-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lflfxxr.exe upx behavioral2/memory/2972-30-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhttnn.exe upx behavioral2/memory/976-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2972-38-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1vvvj.exe upx behavioral2/memory/3300-44-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxfxrxr.exe upx behavioral2/memory/1508-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lffxrll.exe upx C:\1hhbtt.exe upx behavioral2/memory/3156-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2836-62-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1pdvp.exe upx behavioral2/memory/2836-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3336-70-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdpjp.exe upx C:\rlxrrrx.exe upx C:\ttntnn.exe upx behavioral2/memory/1212-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4640-87-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pvvjd.exe upx behavioral2/memory/4656-93-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\frxlrrr.exe upx C:\lxxfrxf.exe upx behavioral2/memory/920-101-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9btnhh.exe upx C:\vdvpp.exe upx C:\fxxllfx.exe upx behavioral2/memory/4520-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3572-120-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xxxfffx.exe upx C:\5hhbhn.exe upx behavioral2/memory/2756-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1996-136-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjjpj.exe upx behavioral2/memory/4376-138-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pppdv.exe upx behavioral2/memory/3332-144-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrrlfxr.exe upx behavioral2/memory/1464-151-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hthnth.exe upx C:\thbhbn.exe upx behavioral2/memory/3288-159-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddddv.exe upx behavioral2/memory/1012-170-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9rxllxr.exe upx behavioral2/memory/2612-173-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5xxfxxr.exe upx behavioral2/memory/4712-178-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7htnhh.exe upx C:\pvpvp.exe upx behavioral2/memory/4484-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3628-190-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
905b3babc5ce18022589a176b755cebf38703ec2e6806152b7067b81035827b7.exe3vpjj.exexxlxrlf.exebnbnhb.exepdvpj.exelflfxxr.exenhttnn.exe1vvvj.exefxfxrxr.exelffxrll.exe1hhbtt.exe1pdvp.exejdpjp.exerlxrrrx.exettntnn.exepvvjd.exefrxlrrr.exelxxfrxf.exe9btnhh.exevdvpp.exefxxllfx.exexxxfffx.exedescription pid process target process PID 1448 wrote to memory of 1372 1448 905b3babc5ce18022589a176b755cebf38703ec2e6806152b7067b81035827b7.exe 3vpjj.exe PID 1448 wrote to memory of 1372 1448 905b3babc5ce18022589a176b755cebf38703ec2e6806152b7067b81035827b7.exe 3vpjj.exe PID 1448 wrote to memory of 1372 1448 905b3babc5ce18022589a176b755cebf38703ec2e6806152b7067b81035827b7.exe 3vpjj.exe PID 1372 wrote to memory of 2016 1372 3vpjj.exe xxlxrlf.exe PID 1372 wrote to memory of 2016 1372 3vpjj.exe xxlxrlf.exe PID 1372 wrote to memory of 2016 1372 3vpjj.exe xxlxrlf.exe PID 2016 wrote to memory of 1868 2016 xxlxrlf.exe bnbnhb.exe PID 2016 wrote to memory of 1868 2016 xxlxrlf.exe bnbnhb.exe PID 2016 wrote to memory of 1868 2016 xxlxrlf.exe bnbnhb.exe PID 1868 wrote to memory of 2964 1868 bnbnhb.exe pdvpj.exe PID 1868 wrote to memory of 2964 1868 bnbnhb.exe pdvpj.exe PID 1868 wrote to memory of 2964 1868 bnbnhb.exe pdvpj.exe PID 2964 wrote to memory of 2972 2964 pdvpj.exe lflfxxr.exe PID 2964 wrote to memory of 2972 2964 pdvpj.exe lflfxxr.exe PID 2964 wrote to memory of 2972 2964 pdvpj.exe lflfxxr.exe PID 2972 wrote to memory of 976 2972 lflfxxr.exe nhttnn.exe PID 2972 wrote to memory of 976 2972 lflfxxr.exe nhttnn.exe PID 2972 wrote to memory of 976 2972 lflfxxr.exe nhttnn.exe PID 976 wrote to memory of 3300 976 nhttnn.exe 1vvvj.exe PID 976 wrote to memory of 3300 976 nhttnn.exe 1vvvj.exe PID 976 wrote to memory of 3300 976 nhttnn.exe 1vvvj.exe PID 3300 wrote to memory of 1508 3300 1vvvj.exe fxfxrxr.exe PID 3300 wrote to memory of 1508 3300 1vvvj.exe fxfxrxr.exe PID 3300 wrote to memory of 1508 3300 1vvvj.exe fxfxrxr.exe PID 1508 wrote to memory of 3156 1508 fxfxrxr.exe lffxrll.exe PID 1508 wrote to memory of 3156 1508 fxfxrxr.exe lffxrll.exe PID 1508 wrote to memory of 3156 1508 fxfxrxr.exe lffxrll.exe PID 3156 wrote to memory of 2836 3156 lffxrll.exe 1hhbtt.exe PID 3156 wrote to memory of 2836 3156 lffxrll.exe 1hhbtt.exe PID 3156 wrote to memory of 2836 3156 lffxrll.exe 1hhbtt.exe PID 2836 wrote to memory of 3336 2836 1hhbtt.exe 1pdvp.exe PID 2836 wrote to memory of 3336 2836 1hhbtt.exe 1pdvp.exe PID 2836 wrote to memory of 3336 2836 1hhbtt.exe 1pdvp.exe PID 3336 wrote to memory of 216 3336 1pdvp.exe jdpjp.exe PID 3336 wrote to memory of 216 3336 1pdvp.exe jdpjp.exe PID 3336 wrote to memory of 216 3336 1pdvp.exe jdpjp.exe PID 216 wrote to memory of 1212 216 jdpjp.exe rlxrrrx.exe PID 216 wrote to memory of 1212 216 jdpjp.exe rlxrrrx.exe PID 216 wrote to memory of 1212 216 jdpjp.exe rlxrrrx.exe PID 1212 wrote to memory of 4640 1212 rlxrrrx.exe ttntnn.exe PID 1212 wrote to memory of 4640 1212 rlxrrrx.exe ttntnn.exe PID 1212 wrote to memory of 4640 1212 rlxrrrx.exe ttntnn.exe PID 4640 wrote to memory of 4656 4640 ttntnn.exe pvvjd.exe PID 4640 wrote to memory of 4656 4640 ttntnn.exe pvvjd.exe PID 4640 wrote to memory of 4656 4640 ttntnn.exe pvvjd.exe PID 4656 wrote to memory of 920 4656 pvvjd.exe frxlrrr.exe PID 4656 wrote to memory of 920 4656 pvvjd.exe frxlrrr.exe PID 4656 wrote to memory of 920 4656 pvvjd.exe frxlrrr.exe PID 920 wrote to memory of 1800 920 frxlrrr.exe lxxfrxf.exe PID 920 wrote to memory of 1800 920 frxlrrr.exe lxxfrxf.exe PID 920 wrote to memory of 1800 920 frxlrrr.exe lxxfrxf.exe PID 1800 wrote to memory of 2736 1800 lxxfrxf.exe 9btnhh.exe PID 1800 wrote to memory of 2736 1800 lxxfrxf.exe 9btnhh.exe PID 1800 wrote to memory of 2736 1800 lxxfrxf.exe 9btnhh.exe PID 2736 wrote to memory of 4520 2736 9btnhh.exe vdvpp.exe PID 2736 wrote to memory of 4520 2736 9btnhh.exe vdvpp.exe PID 2736 wrote to memory of 4520 2736 9btnhh.exe vdvpp.exe PID 4520 wrote to memory of 3572 4520 vdvpp.exe fxxllfx.exe PID 4520 wrote to memory of 3572 4520 vdvpp.exe fxxllfx.exe PID 4520 wrote to memory of 3572 4520 vdvpp.exe fxxllfx.exe PID 3572 wrote to memory of 2756 3572 fxxllfx.exe xxxfffx.exe PID 3572 wrote to memory of 2756 3572 fxxllfx.exe xxxfffx.exe PID 3572 wrote to memory of 2756 3572 fxxllfx.exe xxxfffx.exe PID 2756 wrote to memory of 1996 2756 xxxfffx.exe 5hhbhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\905b3babc5ce18022589a176b755cebf38703ec2e6806152b7067b81035827b7.exe"C:\Users\Admin\AppData\Local\Temp\905b3babc5ce18022589a176b755cebf38703ec2e6806152b7067b81035827b7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\3vpjj.exec:\3vpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxlxrlf.exec:\xxlxrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnbnhb.exec:\bnbnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdvpj.exec:\pdvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lflfxxr.exec:\lflfxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhttnn.exec:\nhttnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1vvvj.exec:\1vvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxfxrxr.exec:\fxfxrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lffxrll.exec:\lffxrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1hhbtt.exec:\1hhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1pdvp.exec:\1pdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdpjp.exec:\jdpjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttntnn.exec:\ttntnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvvjd.exec:\pvvjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frxlrrr.exec:\frxlrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxxfrxf.exec:\lxxfrxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9btnhh.exec:\9btnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdvpp.exec:\vdvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxxllfx.exec:\fxxllfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxxfffx.exec:\xxxfffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5hhbhn.exec:\5hhbhn.exe23⤵
- Executes dropped EXE
-
\??\c:\pjjpj.exec:\pjjpj.exe24⤵
- Executes dropped EXE
-
\??\c:\pppdv.exec:\pppdv.exe25⤵
- Executes dropped EXE
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe26⤵
- Executes dropped EXE
-
\??\c:\hthnth.exec:\hthnth.exe27⤵
- Executes dropped EXE
-
\??\c:\thbhbn.exec:\thbhbn.exe28⤵
- Executes dropped EXE
-
\??\c:\ddddv.exec:\ddddv.exe29⤵
- Executes dropped EXE
-
\??\c:\9rxllxr.exec:\9rxllxr.exe30⤵
- Executes dropped EXE
-
\??\c:\5xxfxxr.exec:\5xxfxxr.exe31⤵
- Executes dropped EXE
-
\??\c:\7htnhh.exec:\7htnhh.exe32⤵
- Executes dropped EXE
-
\??\c:\pvpvp.exec:\pvpvp.exe33⤵
- Executes dropped EXE
-
\??\c:\jvvvv.exec:\jvvvv.exe34⤵
- Executes dropped EXE
-
\??\c:\bttntt.exec:\bttntt.exe35⤵
- Executes dropped EXE
-
\??\c:\tbhhbh.exec:\tbhhbh.exe36⤵
- Executes dropped EXE
-
\??\c:\flflfff.exec:\flflfff.exe37⤵
- Executes dropped EXE
-
\??\c:\tnhthb.exec:\tnhthb.exe38⤵
- Executes dropped EXE
-
\??\c:\hnhhnn.exec:\hnhhnn.exe39⤵
- Executes dropped EXE
-
\??\c:\7pvdp.exec:\7pvdp.exe40⤵
- Executes dropped EXE
-
\??\c:\pjppv.exec:\pjppv.exe41⤵
- Executes dropped EXE
-
\??\c:\3lfxllx.exec:\3lfxllx.exe42⤵
- Executes dropped EXE
-
\??\c:\3rxxxff.exec:\3rxxxff.exe43⤵
- Executes dropped EXE
-
\??\c:\hnnhbh.exec:\hnnhbh.exe44⤵
- Executes dropped EXE
-
\??\c:\djvvv.exec:\djvvv.exe45⤵
- Executes dropped EXE
-
\??\c:\xrrlllf.exec:\xrrlllf.exe46⤵
- Executes dropped EXE
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe47⤵
- Executes dropped EXE
-
\??\c:\1nnhhh.exec:\1nnhhh.exe48⤵
- Executes dropped EXE
-
\??\c:\jvvpj.exec:\jvvpj.exe49⤵
- Executes dropped EXE
-
\??\c:\pvvvv.exec:\pvvvv.exe50⤵
- Executes dropped EXE
-
\??\c:\frffffx.exec:\frffffx.exe51⤵
- Executes dropped EXE
-
\??\c:\bhtttt.exec:\bhtttt.exe52⤵
- Executes dropped EXE
-
\??\c:\vdjvd.exec:\vdjvd.exe53⤵
- Executes dropped EXE
-
\??\c:\jvvpj.exec:\jvvpj.exe54⤵
- Executes dropped EXE
-
\??\c:\rlrrlrl.exec:\rlrrlrl.exe55⤵
- Executes dropped EXE
-
\??\c:\fffffxx.exec:\fffffxx.exe56⤵
- Executes dropped EXE
-
\??\c:\bbbtnh.exec:\bbbtnh.exe57⤵
- Executes dropped EXE
-
\??\c:\bntnth.exec:\bntnth.exe58⤵
- Executes dropped EXE
-
\??\c:\dvddj.exec:\dvddj.exe59⤵
- Executes dropped EXE
-
\??\c:\pvvvj.exec:\pvvvj.exe60⤵
- Executes dropped EXE
-
\??\c:\fffxrrl.exec:\fffxrrl.exe61⤵
- Executes dropped EXE
-
\??\c:\fxffxfl.exec:\fxffxfl.exe62⤵
- Executes dropped EXE
-
\??\c:\7hhbth.exec:\7hhbth.exe63⤵
- Executes dropped EXE
-
\??\c:\hbhhtt.exec:\hbhhtt.exe64⤵
- Executes dropped EXE
-
\??\c:\ttbbtt.exec:\ttbbtt.exe65⤵
- Executes dropped EXE
-
\??\c:\dvjpp.exec:\dvjpp.exe66⤵
-
\??\c:\7dvvp.exec:\7dvvp.exe67⤵
-
\??\c:\xffrffx.exec:\xffrffx.exe68⤵
-
\??\c:\lrlfrrf.exec:\lrlfrrf.exe69⤵
-
\??\c:\nhhtnn.exec:\nhhtnn.exe70⤵
-
\??\c:\bhnhhh.exec:\bhnhhh.exe71⤵
-
\??\c:\vvddv.exec:\vvddv.exe72⤵
-
\??\c:\vjpdv.exec:\vjpdv.exe73⤵
-
\??\c:\llllfxx.exec:\llllfxx.exe74⤵
-
\??\c:\lrllxxx.exec:\lrllxxx.exe75⤵
-
\??\c:\btnhnh.exec:\btnhnh.exe76⤵
-
\??\c:\ntttth.exec:\ntttth.exe77⤵
-
\??\c:\5hhbnn.exec:\5hhbnn.exe78⤵
-
\??\c:\vpddv.exec:\vpddv.exe79⤵
-
\??\c:\5pppj.exec:\5pppj.exe80⤵
-
\??\c:\rlrlffx.exec:\rlrlffx.exe81⤵
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe82⤵
-
\??\c:\9bhhhn.exec:\9bhhhn.exe83⤵
-
\??\c:\vdjdd.exec:\vdjdd.exe84⤵
-
\??\c:\jjvdp.exec:\jjvdp.exe85⤵
-
\??\c:\xxxfffr.exec:\xxxfffr.exe86⤵
-
\??\c:\xxffllf.exec:\xxffllf.exe87⤵
-
\??\c:\bthbhh.exec:\bthbhh.exe88⤵
-
\??\c:\htnhbb.exec:\htnhbb.exe89⤵
-
\??\c:\vvvpj.exec:\vvvpj.exe90⤵
-
\??\c:\fxxrfxr.exec:\fxxrfxr.exe91⤵
-
\??\c:\1ttnhh.exec:\1ttnhh.exe92⤵
-
\??\c:\jdddv.exec:\jdddv.exe93⤵
-
\??\c:\ddjdj.exec:\ddjdj.exe94⤵
-
\??\c:\lflxlff.exec:\lflxlff.exe95⤵
-
\??\c:\5rlfrlf.exec:\5rlfrlf.exe96⤵
-
\??\c:\9nbnnt.exec:\9nbnnt.exe97⤵
-
\??\c:\jddvv.exec:\jddvv.exe98⤵
-
\??\c:\rffxxrl.exec:\rffxxrl.exe99⤵
-
\??\c:\9fffxfr.exec:\9fffxfr.exe100⤵
-
\??\c:\nbbbnh.exec:\nbbbnh.exe101⤵
-
\??\c:\hbhhbh.exec:\hbhhbh.exe102⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe103⤵
-
\??\c:\ppppp.exec:\ppppp.exe104⤵
-
\??\c:\fxlfrrr.exec:\fxlfrrr.exe105⤵
-
\??\c:\7xlxfxl.exec:\7xlxfxl.exe106⤵
-
\??\c:\nbbbtt.exec:\nbbbtt.exe107⤵
-
\??\c:\thntbt.exec:\thntbt.exe108⤵
-
\??\c:\vdjvj.exec:\vdjvj.exe109⤵
-
\??\c:\vvjjd.exec:\vvjjd.exe110⤵
-
\??\c:\fxrlrrx.exec:\fxrlrrx.exe111⤵
-
\??\c:\lxlxfll.exec:\lxlxfll.exe112⤵
-
\??\c:\tttnbt.exec:\tttnbt.exe113⤵
-
\??\c:\hhbttt.exec:\hhbttt.exe114⤵
-
\??\c:\jdjpv.exec:\jdjpv.exe115⤵
-
\??\c:\dvdpd.exec:\dvdpd.exe116⤵
-
\??\c:\xlrlffx.exec:\xlrlffx.exe117⤵
-
\??\c:\rrrrlll.exec:\rrrrlll.exe118⤵
-
\??\c:\hntbtb.exec:\hntbtb.exe119⤵
-
\??\c:\tnnnhb.exec:\tnnnhb.exe120⤵
-
\??\c:\7bhbnn.exec:\7bhbnn.exe121⤵
-
\??\c:\vvvvj.exec:\vvvvj.exe122⤵
-
\??\c:\lfffxxr.exec:\lfffxxr.exe123⤵
-
\??\c:\bhhhhh.exec:\bhhhhh.exe124⤵
-
\??\c:\nttbtt.exec:\nttbtt.exe125⤵
-
\??\c:\pppvp.exec:\pppvp.exe126⤵
-
\??\c:\ppvpd.exec:\ppvpd.exe127⤵
-
\??\c:\frrfxrr.exec:\frrfxrr.exe128⤵
-
\??\c:\xrxrxxl.exec:\xrxrxxl.exe129⤵
-
\??\c:\rxxlffx.exec:\rxxlffx.exe130⤵
-
\??\c:\tnhhbt.exec:\tnhhbt.exe131⤵
-
\??\c:\hnnhtt.exec:\hnnhtt.exe132⤵
-
\??\c:\ppjdv.exec:\ppjdv.exe133⤵
-
\??\c:\dppjv.exec:\dppjv.exe134⤵
-
\??\c:\rffxrfx.exec:\rffxrfx.exe135⤵
-
\??\c:\xfxxllx.exec:\xfxxllx.exe136⤵
-
\??\c:\7ttnhh.exec:\7ttnhh.exe137⤵
-
\??\c:\5nnnnn.exec:\5nnnnn.exe138⤵
-
\??\c:\vjvvj.exec:\vjvvj.exe139⤵
-
\??\c:\jpvvv.exec:\jpvvv.exe140⤵
-
\??\c:\3btnhb.exec:\3btnhb.exe141⤵
-
\??\c:\hnbbnn.exec:\hnbbnn.exe142⤵
-
\??\c:\nbnhbt.exec:\nbnhbt.exe143⤵
-
\??\c:\dvdvp.exec:\dvdvp.exe144⤵
-
\??\c:\lxflffx.exec:\lxflffx.exe145⤵
-
\??\c:\frfxrxx.exec:\frfxrxx.exe146⤵
-
\??\c:\7htnnh.exec:\7htnnh.exe147⤵
-
\??\c:\bhnhbt.exec:\bhnhbt.exe148⤵
-
\??\c:\ppdvd.exec:\ppdvd.exe149⤵
-
\??\c:\5vjdp.exec:\5vjdp.exe150⤵
-
\??\c:\rxxxxxl.exec:\rxxxxxl.exe151⤵
-
\??\c:\fxfrxrx.exec:\fxfrxrx.exe152⤵
-
\??\c:\rxxlfrf.exec:\rxxlfrf.exe153⤵
-
\??\c:\bbhhbh.exec:\bbhhbh.exe154⤵
-
\??\c:\9hhbbb.exec:\9hhbbb.exe155⤵
-
\??\c:\9pddj.exec:\9pddj.exe156⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe157⤵
-
\??\c:\dvjpv.exec:\dvjpv.exe158⤵
-
\??\c:\rfrlffx.exec:\rfrlffx.exe159⤵
-
\??\c:\5lffxrr.exec:\5lffxrr.exe160⤵
-
\??\c:\btbtnn.exec:\btbtnn.exe161⤵
-
\??\c:\tbhbnn.exec:\tbhbnn.exe162⤵
-
\??\c:\jdddp.exec:\jdddp.exe163⤵
-
\??\c:\5vdvv.exec:\5vdvv.exe164⤵
-
\??\c:\xxfxlff.exec:\xxfxlff.exe165⤵
-
\??\c:\flxflll.exec:\flxflll.exe166⤵
-
\??\c:\hbhhhb.exec:\hbhhhb.exe167⤵
-
\??\c:\hhnnhh.exec:\hhnnhh.exe168⤵
-
\??\c:\1vdvj.exec:\1vdvj.exe169⤵
-
\??\c:\vdjjd.exec:\vdjjd.exe170⤵
-
\??\c:\lxffxfx.exec:\lxffxfx.exe171⤵
-
\??\c:\xxfxllr.exec:\xxfxllr.exe172⤵
-
\??\c:\5hnnhh.exec:\5hnnhh.exe173⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe174⤵
-
\??\c:\pddvp.exec:\pddvp.exe175⤵
-
\??\c:\5lxrlfx.exec:\5lxrlfx.exe176⤵
-
\??\c:\frffxfx.exec:\frffxfx.exe177⤵
-
\??\c:\nnhbtt.exec:\nnhbtt.exe178⤵
-
\??\c:\5hbtnh.exec:\5hbtnh.exe179⤵
-
\??\c:\jdddv.exec:\jdddv.exe180⤵
-
\??\c:\jpdvj.exec:\jpdvj.exe181⤵
-
\??\c:\9fxrfff.exec:\9fxrfff.exe182⤵
-
\??\c:\ttnnnn.exec:\ttnnnn.exe183⤵
-
\??\c:\nnhbbb.exec:\nnhbbb.exe184⤵
-
\??\c:\bhhbtb.exec:\bhhbtb.exe185⤵
-
\??\c:\jpvvp.exec:\jpvvp.exe186⤵
-
\??\c:\vpppd.exec:\vpppd.exe187⤵
-
\??\c:\rlfxllf.exec:\rlfxllf.exe188⤵
-
\??\c:\bnbtnn.exec:\bnbtnn.exe189⤵
-
\??\c:\7pvpd.exec:\7pvpd.exe190⤵
-
\??\c:\bhthnb.exec:\bhthnb.exe191⤵
-
\??\c:\nnnhtb.exec:\nnnhtb.exe192⤵
-
\??\c:\ddvjv.exec:\ddvjv.exe193⤵
-
\??\c:\dpppd.exec:\dpppd.exe194⤵
-
\??\c:\frrllff.exec:\frrllff.exe195⤵
-
\??\c:\9htnnt.exec:\9htnnt.exe196⤵
-
\??\c:\jppjp.exec:\jppjp.exe197⤵
-
\??\c:\7dppj.exec:\7dppj.exe198⤵
-
\??\c:\5xrlfxr.exec:\5xrlfxr.exe199⤵
-
\??\c:\lxxfrxx.exec:\lxxfrxx.exe200⤵
-
\??\c:\btbtnh.exec:\btbtnh.exe201⤵
-
\??\c:\ntbtnn.exec:\ntbtnn.exe202⤵
-
\??\c:\vvddj.exec:\vvddj.exe203⤵
-
\??\c:\dvpvv.exec:\dvpvv.exe204⤵
-
\??\c:\xrxrrrx.exec:\xrxrrrx.exe205⤵
-
\??\c:\rlxrlxr.exec:\rlxrlxr.exe206⤵
-
\??\c:\bttnnh.exec:\bttnnh.exe207⤵
-
\??\c:\httnbt.exec:\httnbt.exe208⤵
-
\??\c:\3vpdp.exec:\3vpdp.exe209⤵
-
\??\c:\dpdvp.exec:\dpdvp.exe210⤵
-
\??\c:\1rrrllr.exec:\1rrrllr.exe211⤵
-
\??\c:\fxrrfxl.exec:\fxrrfxl.exe212⤵
-
\??\c:\lxfrrll.exec:\lxfrrll.exe213⤵
-
\??\c:\bnhhbb.exec:\bnhhbb.exe214⤵
-
\??\c:\bhnhnn.exec:\bhnhnn.exe215⤵
-
\??\c:\1vpvp.exec:\1vpvp.exe216⤵
-
\??\c:\dvdvj.exec:\dvdvj.exe217⤵
-
\??\c:\frrflfl.exec:\frrflfl.exe218⤵
-
\??\c:\xflllrf.exec:\xflllrf.exe219⤵
-
\??\c:\bhnnnn.exec:\bhnnnn.exe220⤵
-
\??\c:\bhhhbt.exec:\bhhhbt.exe221⤵
-
\??\c:\djjdv.exec:\djjdv.exe222⤵
-
\??\c:\pdjpp.exec:\pdjpp.exe223⤵
-
\??\c:\thtnnt.exec:\thtnnt.exe224⤵
-
\??\c:\tnbtnb.exec:\tnbtnb.exe225⤵
-
\??\c:\pvvvp.exec:\pvvvp.exe226⤵
-
\??\c:\9lrrrxx.exec:\9lrrrxx.exe227⤵
-
\??\c:\xrxxllf.exec:\xrxxllf.exe228⤵
-
\??\c:\hhnbtt.exec:\hhnbtt.exe229⤵
-
\??\c:\nnttnt.exec:\nnttnt.exe230⤵
-
\??\c:\ddppj.exec:\ddppj.exe231⤵
-
\??\c:\rxlrllf.exec:\rxlrllf.exe232⤵
-
\??\c:\rrffrrf.exec:\rrffrrf.exe233⤵
-
\??\c:\nhnhbb.exec:\nhnhbb.exe234⤵
-
\??\c:\htbbtt.exec:\htbbtt.exe235⤵
-
\??\c:\9vdvp.exec:\9vdvp.exe236⤵
-
\??\c:\rxxlllr.exec:\rxxlllr.exe237⤵
-
\??\c:\htnnhh.exec:\htnnhh.exe238⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe239⤵
-
\??\c:\rrfflfx.exec:\rrfflfx.exe240⤵
-
\??\c:\rxrlflx.exec:\rxrlflx.exe241⤵