Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 05:05
Behavioral task
behavioral1
Sample
efb4da44efd6f083271e2b508b10d37819b9cf57e19908f867f68fce3ab6d3a3.exe
Resource
win7-20240419-en
windows7-x64
6 signatures
150 seconds
General
-
Target
efb4da44efd6f083271e2b508b10d37819b9cf57e19908f867f68fce3ab6d3a3.exe
-
Size
82KB
-
MD5
c8a780a513ae3f307b849545e668bedb
-
SHA1
a212e13e412729b694a2c4e5bbffa0c1a193266a
-
SHA256
efb4da44efd6f083271e2b508b10d37819b9cf57e19908f867f68fce3ab6d3a3
-
SHA512
d47b8f2e30bd2a021459c6976f54e5e20239c9f0a7c96a756ad218579fa40b95f7d8d8ea2ef3c9aaa5406aef0097acc241dfa6c63e4703a38e45694e67daf9bd
-
SSDEEP
1536:CvQBeOGtrYS3srx93UBWfwC6Ggnouy8AelS7/7VIQHo:ChOmTsF93UYfwC6GIoutAe07zVIqo
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/816-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2596-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1268-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3336-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2112-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/884-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-321-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/324-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-349-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-377-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-414-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-435-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-456-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-458-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-474-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-479-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2112-504-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-516-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-543-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-577-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-603-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-675-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-682-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-726-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-728-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-826-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-854-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-877-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-890-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/816-0-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\006622.exe UPX behavioral2/memory/816-5-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5112-7-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5112-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\62604.exe UPX C:\020004.exe UPX behavioral2/memory/3984-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\2264440.exe UPX behavioral2/memory/1624-22-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\dvjdv.exe UPX behavioral2/memory/1652-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1416-31-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\84042.exe UPX C:\dppjv.exe UPX behavioral2/memory/2028-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\822660.exe UPX behavioral2/memory/3316-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\8402808.exe UPX behavioral2/memory/3912-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\088260.exe UPX behavioral2/memory/2596-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1268-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\nbhtbn.exe UPX C:\llrrrxr.exe UPX behavioral2/memory/432-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\02060.exe UPX behavioral2/memory/4508-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\284882.exe UPX behavioral2/memory/2272-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\2800000.exe UPX C:\822266.exe UPX behavioral2/memory/3948-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\080482.exe UPX C:\xlllffx.exe UPX behavioral2/memory/2960-104-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\86882.exe UPX behavioral2/memory/2540-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4868-112-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\jpdvp.exe UPX behavioral2/memory/2032-123-0x0000000000400000-0x0000000000429000-memory.dmp UPX \??\c:\lrfrlfx.exe UPX C:\nhbnbt.exe UPX behavioral2/memory/3660-130-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\2066606.exe UPX behavioral2/memory/764-134-0x0000000000400000-0x0000000000429000-memory.dmp UPX \??\c:\0288826.exe UPX behavioral2/memory/3052-142-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\i088466.exe UPX C:\044028.exe UPX behavioral2/memory/1780-153-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\828200.exe UPX C:\jvdvp.exe UPX behavioral2/memory/3336-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\884866.exe UPX behavioral2/memory/4632-170-0x0000000000400000-0x0000000000429000-memory.dmp UPX C:\lxfxrrl.exe UPX \??\c:\062820.exe UPX C:\pjddv.exe UPX behavioral2/memory/4584-182-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2112-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4368-205-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2944-215-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3856-216-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
006622.exe62604.exe020004.exe2264440.exedvjdv.exe84042.exedppjv.exe822660.exe8402808.exe088260.exenbhtbn.exellrrrxr.exe02060.exe284882.exe2800000.exe822266.exe080482.exexlllffx.exe86882.exejpdvp.exelrfrlfx.exenhbnbt.exe2066606.exe0288826.exei088466.exe044028.exe828200.exejvdvp.exe884866.exelxfxrrl.exe062820.exepjddv.exe0400486.exerllxfxr.exe0208264.exe6848266.exe62882.exe288604.exe4626048.exe266048.exexlxxxxx.exe266464.exerlxrfxl.exe28444.exehhhbnn.exe048844.exefxxrxxr.exerrffxxx.exe7nnnnn.exe42286.exe1vdvj.exepdvpj.exe2060448.exerfrlffl.exe8824206.exe826604.exe6602028.exe264062.exeo282660.exepvvpd.exeg4004.exe488600.exe28404.exejpjdd.exepid process 5112 006622.exe 1624 62604.exe 3984 020004.exe 1416 2264440.exe 1652 dvjdv.exe 2028 84042.exe 3316 dppjv.exe 3912 822660.exe 2596 8402808.exe 1268 088260.exe 432 nbhtbn.exe 4508 llrrrxr.exe 2272 02060.exe 864 284882.exe 2152 2800000.exe 3948 822266.exe 2960 080482.exe 2540 xlllffx.exe 4868 86882.exe 2032 jpdvp.exe 3660 lrfrlfx.exe 4812 nhbnbt.exe 764 2066606.exe 3052 0288826.exe 1448 i088466.exe 1780 044028.exe 780 828200.exe 3336 jvdvp.exe 4632 884866.exe 4848 lxfxrrl.exe 4584 062820.exe 3732 pjddv.exe 4100 0400486.exe 3176 rllxfxr.exe 220 0208264.exe 2112 6848266.exe 4368 62882.exe 816 288604.exe 3552 4626048.exe 2944 266048.exe 3856 xlxxxxx.exe 1488 266464.exe 1416 rlxrfxl.exe 3384 28444.exe 3500 hhhbnn.exe 3588 048844.exe 2004 fxxrxxr.exe 4568 rrffxxx.exe 5060 7nnnnn.exe 1268 42286.exe 3456 1vdvj.exe 3904 pdvpj.exe 2272 2060448.exe 4448 rfrlffl.exe 2308 8824206.exe 884 826604.exe 3584 6602028.exe 4648 264062.exe 1824 o282660.exe 4868 pvvpd.exe 1932 g4004.exe 1832 488600.exe 4136 28404.exe 2160 jpjdd.exe -
Processes:
resource yara_rule behavioral2/memory/816-0-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\006622.exe upx behavioral2/memory/816-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-11-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\62604.exe upx C:\020004.exe upx behavioral2/memory/3984-19-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\2264440.exe upx behavioral2/memory/1624-22-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\dvjdv.exe upx behavioral2/memory/1652-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-31-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\84042.exe upx C:\dppjv.exe upx behavioral2/memory/2028-43-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\822660.exe upx behavioral2/memory/3316-48-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\8402808.exe upx behavioral2/memory/3912-55-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\088260.exe upx behavioral2/memory/2596-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-64-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\nbhtbn.exe upx C:\llrrrxr.exe upx behavioral2/memory/432-71-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\02060.exe upx behavioral2/memory/4508-78-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\284882.exe upx behavioral2/memory/2272-83-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\2800000.exe upx C:\822266.exe upx behavioral2/memory/3948-96-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\080482.exe upx C:\xlllffx.exe upx behavioral2/memory/2960-104-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\86882.exe upx behavioral2/memory/2540-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-112-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\jpdvp.exe upx behavioral2/memory/2032-123-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\lrfrlfx.exe upx C:\nhbnbt.exe upx behavioral2/memory/3660-130-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\2066606.exe upx behavioral2/memory/764-134-0x0000000000400000-0x0000000000429000-memory.dmp upx \??\c:\0288826.exe upx behavioral2/memory/3052-142-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\i088466.exe upx C:\044028.exe upx behavioral2/memory/1780-153-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\828200.exe upx C:\jvdvp.exe upx behavioral2/memory/3336-163-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\884866.exe upx behavioral2/memory/4632-170-0x0000000000400000-0x0000000000429000-memory.dmp upx C:\lxfxrrl.exe upx \??\c:\062820.exe upx C:\pjddv.exe upx behavioral2/memory/4584-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2112-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3856-216-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
efb4da44efd6f083271e2b508b10d37819b9cf57e19908f867f68fce3ab6d3a3.exe006622.exe62604.exe020004.exe2264440.exedvjdv.exe84042.exedppjv.exe822660.exe8402808.exe088260.exenbhtbn.exellrrrxr.exe02060.exe284882.exe2800000.exe822266.exe080482.exexlllffx.exe86882.exejpdvp.exelrfrlfx.exedescription pid process target process PID 816 wrote to memory of 5112 816 efb4da44efd6f083271e2b508b10d37819b9cf57e19908f867f68fce3ab6d3a3.exe 006622.exe PID 816 wrote to memory of 5112 816 efb4da44efd6f083271e2b508b10d37819b9cf57e19908f867f68fce3ab6d3a3.exe 006622.exe PID 816 wrote to memory of 5112 816 efb4da44efd6f083271e2b508b10d37819b9cf57e19908f867f68fce3ab6d3a3.exe 006622.exe PID 5112 wrote to memory of 1624 5112 006622.exe 62604.exe PID 5112 wrote to memory of 1624 5112 006622.exe 62604.exe PID 5112 wrote to memory of 1624 5112 006622.exe 62604.exe PID 1624 wrote to memory of 3984 1624 62604.exe 020004.exe PID 1624 wrote to memory of 3984 1624 62604.exe 020004.exe PID 1624 wrote to memory of 3984 1624 62604.exe 020004.exe PID 3984 wrote to memory of 1416 3984 020004.exe 2264440.exe PID 3984 wrote to memory of 1416 3984 020004.exe 2264440.exe PID 3984 wrote to memory of 1416 3984 020004.exe 2264440.exe PID 1416 wrote to memory of 1652 1416 2264440.exe dvjdv.exe PID 1416 wrote to memory of 1652 1416 2264440.exe dvjdv.exe PID 1416 wrote to memory of 1652 1416 2264440.exe dvjdv.exe PID 1652 wrote to memory of 2028 1652 dvjdv.exe 84042.exe PID 1652 wrote to memory of 2028 1652 dvjdv.exe 84042.exe PID 1652 wrote to memory of 2028 1652 dvjdv.exe 84042.exe PID 2028 wrote to memory of 3316 2028 84042.exe dppjv.exe PID 2028 wrote to memory of 3316 2028 84042.exe dppjv.exe PID 2028 wrote to memory of 3316 2028 84042.exe dppjv.exe PID 3316 wrote to memory of 3912 3316 dppjv.exe 822660.exe PID 3316 wrote to memory of 3912 3316 dppjv.exe 822660.exe PID 3316 wrote to memory of 3912 3316 dppjv.exe 822660.exe PID 3912 wrote to memory of 2596 3912 822660.exe 8402808.exe PID 3912 wrote to memory of 2596 3912 822660.exe 8402808.exe PID 3912 wrote to memory of 2596 3912 822660.exe 8402808.exe PID 2596 wrote to memory of 1268 2596 8402808.exe 088260.exe PID 2596 wrote to memory of 1268 2596 8402808.exe 088260.exe PID 2596 wrote to memory of 1268 2596 8402808.exe 088260.exe PID 1268 wrote to memory of 432 1268 088260.exe nbhtbn.exe PID 1268 wrote to memory of 432 1268 088260.exe nbhtbn.exe PID 1268 wrote to memory of 432 1268 088260.exe nbhtbn.exe PID 432 wrote to memory of 4508 432 nbhtbn.exe llrrrxr.exe PID 432 wrote to memory of 4508 432 nbhtbn.exe llrrrxr.exe PID 432 wrote to memory of 4508 432 nbhtbn.exe llrrrxr.exe PID 4508 wrote to memory of 2272 4508 llrrrxr.exe 02060.exe PID 4508 wrote to memory of 2272 4508 llrrrxr.exe 02060.exe PID 4508 wrote to memory of 2272 4508 llrrrxr.exe 02060.exe PID 2272 wrote to memory of 864 2272 02060.exe 284882.exe PID 2272 wrote to memory of 864 2272 02060.exe 284882.exe PID 2272 wrote to memory of 864 2272 02060.exe 284882.exe PID 864 wrote to memory of 2152 864 284882.exe 2800000.exe PID 864 wrote to memory of 2152 864 284882.exe 2800000.exe PID 864 wrote to memory of 2152 864 284882.exe 2800000.exe PID 2152 wrote to memory of 3948 2152 2800000.exe 822266.exe PID 2152 wrote to memory of 3948 2152 2800000.exe 822266.exe PID 2152 wrote to memory of 3948 2152 2800000.exe 822266.exe PID 3948 wrote to memory of 2960 3948 822266.exe 080482.exe PID 3948 wrote to memory of 2960 3948 822266.exe 080482.exe PID 3948 wrote to memory of 2960 3948 822266.exe 080482.exe PID 2960 wrote to memory of 2540 2960 080482.exe xlllffx.exe PID 2960 wrote to memory of 2540 2960 080482.exe xlllffx.exe PID 2960 wrote to memory of 2540 2960 080482.exe xlllffx.exe PID 2540 wrote to memory of 4868 2540 xlllffx.exe 86882.exe PID 2540 wrote to memory of 4868 2540 xlllffx.exe 86882.exe PID 2540 wrote to memory of 4868 2540 xlllffx.exe 86882.exe PID 4868 wrote to memory of 2032 4868 86882.exe jpdvp.exe PID 4868 wrote to memory of 2032 4868 86882.exe jpdvp.exe PID 4868 wrote to memory of 2032 4868 86882.exe jpdvp.exe PID 2032 wrote to memory of 3660 2032 jpdvp.exe lrfrlfx.exe PID 2032 wrote to memory of 3660 2032 jpdvp.exe lrfrlfx.exe PID 2032 wrote to memory of 3660 2032 jpdvp.exe lrfrlfx.exe PID 3660 wrote to memory of 4812 3660 lrfrlfx.exe nhbnbt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efb4da44efd6f083271e2b508b10d37819b9cf57e19908f867f68fce3ab6d3a3.exe"C:\Users\Admin\AppData\Local\Temp\efb4da44efd6f083271e2b508b10d37819b9cf57e19908f867f68fce3ab6d3a3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\006622.exec:\006622.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\62604.exec:\62604.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\020004.exec:\020004.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\2264440.exec:\2264440.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\dvjdv.exec:\dvjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\84042.exec:\84042.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\dppjv.exec:\dppjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\822660.exec:\822660.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\8402808.exec:\8402808.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\088260.exec:\088260.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\nbhtbn.exec:\nbhtbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\llrrrxr.exec:\llrrrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\02060.exec:\02060.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\284882.exec:\284882.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\2800000.exec:\2800000.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\822266.exec:\822266.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\080482.exec:\080482.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\xlllffx.exec:\xlllffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\86882.exec:\86882.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\jpdvp.exec:\jpdvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\lrfrlfx.exec:\lrfrlfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\nhbnbt.exec:\nhbnbt.exe23⤵
- Executes dropped EXE
PID:4812 -
\??\c:\2066606.exec:\2066606.exe24⤵
- Executes dropped EXE
PID:764 -
\??\c:\0288826.exec:\0288826.exe25⤵
- Executes dropped EXE
PID:3052 -
\??\c:\i088466.exec:\i088466.exe26⤵
- Executes dropped EXE
PID:1448 -
\??\c:\044028.exec:\044028.exe27⤵
- Executes dropped EXE
PID:1780 -
\??\c:\828200.exec:\828200.exe28⤵
- Executes dropped EXE
PID:780 -
\??\c:\jvdvp.exec:\jvdvp.exe29⤵
- Executes dropped EXE
PID:3336 -
\??\c:\884866.exec:\884866.exe30⤵
- Executes dropped EXE
PID:4632 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe31⤵
- Executes dropped EXE
PID:4848 -
\??\c:\062820.exec:\062820.exe32⤵
- Executes dropped EXE
PID:4584 -
\??\c:\pjddv.exec:\pjddv.exe33⤵
- Executes dropped EXE
PID:3732 -
\??\c:\0400486.exec:\0400486.exe34⤵
- Executes dropped EXE
PID:4100 -
\??\c:\rllxfxr.exec:\rllxfxr.exe35⤵
- Executes dropped EXE
PID:3176 -
\??\c:\0208264.exec:\0208264.exe36⤵
- Executes dropped EXE
PID:220 -
\??\c:\6848266.exec:\6848266.exe37⤵
- Executes dropped EXE
PID:2112 -
\??\c:\62882.exec:\62882.exe38⤵
- Executes dropped EXE
PID:4368 -
\??\c:\288604.exec:\288604.exe39⤵
- Executes dropped EXE
PID:816 -
\??\c:\4626048.exec:\4626048.exe40⤵
- Executes dropped EXE
PID:3552 -
\??\c:\266048.exec:\266048.exe41⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xlxxxxx.exec:\xlxxxxx.exe42⤵
- Executes dropped EXE
PID:3856 -
\??\c:\266464.exec:\266464.exe43⤵
- Executes dropped EXE
PID:1488 -
\??\c:\rlxrfxl.exec:\rlxrfxl.exe44⤵
- Executes dropped EXE
PID:1416 -
\??\c:\28444.exec:\28444.exe45⤵
- Executes dropped EXE
PID:3384 -
\??\c:\hhhbnn.exec:\hhhbnn.exe46⤵
- Executes dropped EXE
PID:3500 -
\??\c:\048844.exec:\048844.exe47⤵
- Executes dropped EXE
PID:3588 -
\??\c:\fxxrxxr.exec:\fxxrxxr.exe48⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rrffxxx.exec:\rrffxxx.exe49⤵
- Executes dropped EXE
PID:4568 -
\??\c:\7nnnnn.exec:\7nnnnn.exe50⤵
- Executes dropped EXE
PID:5060 -
\??\c:\42286.exec:\42286.exe51⤵
- Executes dropped EXE
PID:1268 -
\??\c:\1vdvj.exec:\1vdvj.exe52⤵
- Executes dropped EXE
PID:3456 -
\??\c:\pdvpj.exec:\pdvpj.exe53⤵
- Executes dropped EXE
PID:3904 -
\??\c:\2060448.exec:\2060448.exe54⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rfrlffl.exec:\rfrlffl.exe55⤵
- Executes dropped EXE
PID:4448 -
\??\c:\8824206.exec:\8824206.exe56⤵
- Executes dropped EXE
PID:2308 -
\??\c:\826604.exec:\826604.exe57⤵
- Executes dropped EXE
PID:884 -
\??\c:\6602028.exec:\6602028.exe58⤵
- Executes dropped EXE
PID:3584 -
\??\c:\264062.exec:\264062.exe59⤵
- Executes dropped EXE
PID:4648 -
\??\c:\o282660.exec:\o282660.exe60⤵
- Executes dropped EXE
PID:1824 -
\??\c:\pvvpd.exec:\pvvpd.exe61⤵
- Executes dropped EXE
PID:4868 -
\??\c:\g4004.exec:\g4004.exe62⤵
- Executes dropped EXE
PID:1932 -
\??\c:\488600.exec:\488600.exe63⤵
- Executes dropped EXE
PID:1832 -
\??\c:\28404.exec:\28404.exe64⤵
- Executes dropped EXE
PID:4136 -
\??\c:\jpjdd.exec:\jpjdd.exe65⤵
- Executes dropped EXE
PID:2160 -
\??\c:\m0606.exec:\m0606.exe66⤵PID:4444
-
\??\c:\xfffxff.exec:\xfffxff.exe67⤵PID:3276
-
\??\c:\86460.exec:\86460.exe68⤵PID:4176
-
\??\c:\tnnnhb.exec:\tnnnhb.exe69⤵PID:2412
-
\??\c:\pvdvp.exec:\pvdvp.exe70⤵PID:4252
-
\??\c:\xlfrrlr.exec:\xlfrrlr.exe71⤵PID:4504
-
\??\c:\68444.exec:\68444.exe72⤵PID:4196
-
\??\c:\flrlfrl.exec:\flrlfrl.exe73⤵PID:4800
-
\??\c:\206824.exec:\206824.exe74⤵PID:4632
-
\??\c:\nhhbtt.exec:\nhhbtt.exe75⤵PID:1224
-
\??\c:\jvvvp.exec:\jvvvp.exe76⤵PID:1752
-
\??\c:\bntntb.exec:\bntntb.exe77⤵PID:4584
-
\??\c:\rfrlrlr.exec:\rfrlrlr.exe78⤵PID:324
-
\??\c:\xrrxrrr.exec:\xrrxrrr.exe79⤵PID:112
-
\??\c:\tbbtnn.exec:\tbbtnn.exe80⤵PID:2284
-
\??\c:\q80444.exec:\q80444.exe81⤵PID:2324
-
\??\c:\2266048.exec:\2266048.exe82⤵PID:4484
-
\??\c:\5ntnhh.exec:\5ntnhh.exe83⤵PID:1900
-
\??\c:\864406.exec:\864406.exe84⤵PID:2920
-
\??\c:\e22600.exec:\e22600.exe85⤵PID:1000
-
\??\c:\xrlfffr.exec:\xrlfffr.exe86⤵PID:1624
-
\??\c:\046000.exec:\046000.exe87⤵PID:1312
-
\??\c:\1nttnn.exec:\1nttnn.exe88⤵PID:3400
-
\??\c:\vvvjp.exec:\vvvjp.exe89⤵PID:1416
-
\??\c:\2602260.exec:\2602260.exe90⤵PID:3384
-
\??\c:\flfxxxx.exec:\flfxxxx.exe91⤵PID:4532
-
\??\c:\648820.exec:\648820.exe92⤵PID:696
-
\??\c:\tnhhhh.exec:\tnhhhh.exe93⤵PID:2468
-
\??\c:\fxxrrlf.exec:\fxxrrlf.exe94⤵PID:3912
-
\??\c:\jdjpj.exec:\jdjpj.exe95⤵PID:4568
-
\??\c:\i204484.exec:\i204484.exe96⤵PID:1376
-
\??\c:\dvpjd.exec:\dvpjd.exe97⤵PID:432
-
\??\c:\vppjj.exec:\vppjj.exe98⤵PID:4932
-
\??\c:\6448826.exec:\6448826.exe99⤵PID:5052
-
\??\c:\1xxfxfx.exec:\1xxfxfx.exe100⤵PID:4960
-
\??\c:\0082828.exec:\0082828.exe101⤵PID:1828
-
\??\c:\xxfxrlr.exec:\xxfxrlr.exe102⤵PID:3016
-
\??\c:\vvppj.exec:\vvppj.exe103⤵PID:2308
-
\??\c:\4286048.exec:\4286048.exe104⤵PID:884
-
\??\c:\6244488.exec:\6244488.exe105⤵PID:1656
-
\??\c:\08448.exec:\08448.exe106⤵PID:4648
-
\??\c:\268426.exec:\268426.exe107⤵PID:5080
-
\??\c:\ffxrllf.exec:\ffxrllf.exe108⤵PID:4400
-
\??\c:\5dddp.exec:\5dddp.exe109⤵PID:3660
-
\??\c:\lfllxfx.exec:\lfllxfx.exe110⤵PID:4812
-
\??\c:\0626626.exec:\0626626.exe111⤵PID:5036
-
\??\c:\20086.exec:\20086.exe112⤵PID:2312
-
\??\c:\ppjdv.exec:\ppjdv.exe113⤵PID:3420
-
\??\c:\8006482.exec:\8006482.exe114⤵PID:4260
-
\??\c:\ttnbbh.exec:\ttnbbh.exe115⤵PID:4436
-
\??\c:\dvjjd.exec:\dvjjd.exe116⤵PID:4928
-
\??\c:\64422.exec:\64422.exe117⤵PID:2628
-
\??\c:\2022888.exec:\2022888.exe118⤵PID:756
-
\??\c:\424806.exec:\424806.exe119⤵PID:1768
-
\??\c:\pdjdv.exec:\pdjdv.exe120⤵PID:4632
-
\??\c:\rrfxrrl.exec:\rrfxrrl.exe121⤵PID:4476
-
\??\c:\4806004.exec:\4806004.exe122⤵PID:2376
-
\??\c:\tthbbt.exec:\tthbbt.exe123⤵PID:3256
-
\??\c:\ffxxrll.exec:\ffxxrll.exe124⤵PID:220
-
\??\c:\vjdvp.exec:\vjdvp.exe125⤵PID:4924
-
\??\c:\0006404.exec:\0006404.exe126⤵PID:4364
-
\??\c:\rxrxfrf.exec:\rxrxfrf.exe127⤵PID:2112
-
\??\c:\tnhbtt.exec:\tnhbtt.exe128⤵PID:4484
-
\??\c:\bnhbnn.exec:\bnhbnn.exe129⤵PID:1900
-
\??\c:\a4444.exec:\a4444.exe130⤵PID:2920
-
\??\c:\thnbbh.exec:\thnbbh.exe131⤵PID:2944
-
\??\c:\0200822.exec:\0200822.exe132⤵PID:5048
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe133⤵PID:3992
-
\??\c:\1nbtbb.exec:\1nbtbb.exe134⤵PID:2260
-
\??\c:\pvpvd.exec:\pvpvd.exe135⤵PID:4844
-
\??\c:\pdppj.exec:\pdppj.exe136⤵PID:3588
-
\??\c:\20060.exec:\20060.exe137⤵PID:4236
-
\??\c:\vpjvj.exec:\vpjvj.exe138⤵PID:2596
-
\??\c:\6860448.exec:\6860448.exe139⤵PID:1048
-
\??\c:\lfflfrl.exec:\lfflfrl.exe140⤵PID:956
-
\??\c:\42226.exec:\42226.exe141⤵PID:4856
-
\??\c:\826600.exec:\826600.exe142⤵PID:4508
-
\??\c:\rfxxflr.exec:\rfxxflr.exe143⤵PID:2988
-
\??\c:\26226.exec:\26226.exe144⤵PID:4944
-
\??\c:\vjppv.exec:\vjppv.exe145⤵PID:744
-
\??\c:\bnttnt.exec:\bnttnt.exe146⤵PID:3692
-
\??\c:\ntbtnn.exec:\ntbtnn.exe147⤵PID:3048
-
\??\c:\24666.exec:\24666.exe148⤵PID:3584
-
\??\c:\2888826.exec:\2888826.exe149⤵PID:2540
-
\??\c:\00048.exec:\00048.exe150⤵PID:2032
-
\??\c:\68680.exec:\68680.exe151⤵PID:2384
-
\??\c:\dpvjj.exec:\dpvjj.exe152⤵PID:4560
-
\??\c:\tnnnhh.exec:\tnnnhh.exe153⤵PID:3660
-
\??\c:\624444.exec:\624444.exe154⤵PID:4480
-
\??\c:\u626000.exec:\u626000.exe155⤵PID:5036
-
\??\c:\q46600.exec:\q46600.exe156⤵PID:2856
-
\??\c:\80026.exec:\80026.exe157⤵PID:1992
-
\??\c:\nbbttt.exec:\nbbttt.exe158⤵PID:2736
-
\??\c:\484448.exec:\484448.exe159⤵PID:780
-
\??\c:\064000.exec:\064000.exe160⤵PID:4308
-
\??\c:\4844440.exec:\4844440.exe161⤵PID:4428
-
\??\c:\btbbhh.exec:\btbbhh.exe162⤵PID:2772
-
\??\c:\vjjdv.exec:\vjjdv.exe163⤵PID:4588
-
\??\c:\406228.exec:\406228.exe164⤵PID:4516
-
\??\c:\3vvpd.exec:\3vvpd.exe165⤵PID:2876
-
\??\c:\vdjdv.exec:\vdjdv.exe166⤵PID:2820
-
\??\c:\042688.exec:\042688.exe167⤵PID:1152
-
\??\c:\24406.exec:\24406.exe168⤵PID:336
-
\??\c:\djppd.exec:\djppd.exe169⤵PID:2284
-
\??\c:\4004882.exec:\4004882.exe170⤵PID:1812
-
\??\c:\vpjdp.exec:\vpjdp.exe171⤵PID:1936
-
\??\c:\266066.exec:\266066.exe172⤵PID:1208
-
\??\c:\26886.exec:\26886.exe173⤵PID:4500
-
\??\c:\622688.exec:\622688.exe174⤵PID:2944
-
\??\c:\tnbnbt.exec:\tnbnbt.exe175⤵PID:3852
-
\??\c:\9bnnnt.exec:\9bnnnt.exe176⤵PID:5048
-
\??\c:\pdpdp.exec:\pdpdp.exe177⤵PID:3992
-
\??\c:\0282644.exec:\0282644.exe178⤵PID:3472
-
\??\c:\fxxllll.exec:\fxxllll.exe179⤵PID:5084
-
\??\c:\bttnnh.exec:\bttnnh.exe180⤵PID:2928
-
\??\c:\2626600.exec:\2626600.exe181⤵PID:2004
-
\??\c:\4204228.exec:\4204228.exe182⤵PID:1048
-
\??\c:\4884888.exec:\4884888.exe183⤵PID:5100
-
\??\c:\0240200.exec:\0240200.exe184⤵PID:384
-
\??\c:\0280246.exec:\0280246.exe185⤵PID:2152
-
\??\c:\e48266.exec:\e48266.exe186⤵PID:2568
-
\??\c:\bthbhb.exec:\bthbhb.exe187⤵PID:1404
-
\??\c:\88444.exec:\88444.exe188⤵PID:884
-
\??\c:\jdjdv.exec:\jdjdv.exe189⤵PID:4596
-
\??\c:\60440.exec:\60440.exe190⤵PID:4048
-
\??\c:\xflllrl.exec:\xflllrl.exe191⤵PID:2100
-
\??\c:\242682.exec:\242682.exe192⤵PID:4812
-
\??\c:\frfxrrr.exec:\frfxrrr.exe193⤵PID:888
-
\??\c:\btbtnt.exec:\btbtnt.exe194⤵PID:512
-
\??\c:\8882406.exec:\8882406.exe195⤵PID:4260
-
\??\c:\66882.exec:\66882.exe196⤵PID:4252
-
\??\c:\4688882.exec:\4688882.exe197⤵PID:4928
-
\??\c:\htbbtt.exec:\htbbtt.exe198⤵PID:4308
-
\??\c:\ffffxxx.exec:\ffffxxx.exe199⤵PID:4848
-
\??\c:\dvppj.exec:\dvppj.exe200⤵PID:1072
-
\??\c:\884484.exec:\884484.exe201⤵PID:3732
-
\??\c:\g4466.exec:\g4466.exe202⤵PID:4516
-
\??\c:\m4008.exec:\m4008.exe203⤵PID:2876
-
\??\c:\bntnbn.exec:\bntnbn.exe204⤵PID:3176
-
\??\c:\ttbbbb.exec:\ttbbbb.exe205⤵PID:4348
-
\??\c:\044822.exec:\044822.exe206⤵PID:336
-
\??\c:\pdjdv.exec:\pdjdv.exe207⤵PID:2284
-
\??\c:\284040.exec:\284040.exe208⤵PID:816
-
\??\c:\06268.exec:\06268.exe209⤵PID:1900
-
\??\c:\2644404.exec:\2644404.exe210⤵PID:3312
-
\??\c:\w66622.exec:\w66622.exe211⤵PID:1444
-
\??\c:\k62248.exec:\k62248.exe212⤵PID:4488
-
\??\c:\840044.exec:\840044.exe213⤵PID:4716
-
\??\c:\062222.exec:\062222.exe214⤵PID:2112
-
\??\c:\4846448.exec:\4846448.exe215⤵PID:3412
-
\??\c:\pvjpj.exec:\pvjpj.exe216⤵PID:5048
-
\??\c:\rxxxrxr.exec:\rxxxrxr.exe217⤵PID:3384
-
\??\c:\rlllfff.exec:\rlllfff.exe218⤵PID:4844
-
\??\c:\84446.exec:\84446.exe219⤵PID:5104
-
\??\c:\68488.exec:\68488.exe220⤵PID:3884
-
\??\c:\rlxxlll.exec:\rlxxlll.exe221⤵PID:2136
-
\??\c:\44664.exec:\44664.exe222⤵PID:1048
-
\??\c:\2026004.exec:\2026004.exe223⤵PID:1688
-
\??\c:\9rxrffx.exec:\9rxrffx.exe224⤵PID:384
-
\??\c:\thhbbh.exec:\thhbbh.exe225⤵PID:3084
-
\??\c:\llrffxr.exec:\llrffxr.exe226⤵PID:2568
-
\??\c:\m8042.exec:\m8042.exe227⤵PID:2704
-
\??\c:\o804040.exec:\o804040.exe228⤵PID:3548
-
\??\c:\jvvvv.exec:\jvvvv.exe229⤵PID:4596
-
\??\c:\m6664.exec:\m6664.exe230⤵PID:4048
-
\??\c:\rllfrrr.exec:\rllfrrr.exe231⤵PID:3328
-
\??\c:\280040.exec:\280040.exe232⤵PID:5036
-
\??\c:\88048.exec:\88048.exe233⤵PID:888
-
\??\c:\ddvpj.exec:\ddvpj.exe234⤵PID:2648
-
\??\c:\nttbbb.exec:\nttbbb.exe235⤵PID:972
-
\??\c:\242260.exec:\242260.exe236⤵PID:4728
-
\??\c:\nnnhnt.exec:\nnnhnt.exe237⤵PID:4928
-
\??\c:\448268.exec:\448268.exe238⤵PID:1408
-
\??\c:\0286604.exec:\0286604.exe239⤵PID:2948
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe240⤵PID:4708
-
\??\c:\68044.exec:\68044.exe241⤵PID:4888
-