Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 18:25
Behavioral task
behavioral1
Sample
07ab195ff076b895801f25c4f374ce266a1eeb06247fd3cab1ac0c6e97295e84.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
07ab195ff076b895801f25c4f374ce266a1eeb06247fd3cab1ac0c6e97295e84.exe
-
Size
90KB
-
MD5
7a7bab780976bc9bbde8ab06c9e439d7
-
SHA1
a7bbf3acf43c378ca65b131f13bf710e14252928
-
SHA256
07ab195ff076b895801f25c4f374ce266a1eeb06247fd3cab1ac0c6e97295e84
-
SHA512
922e81aa31c84a28d6bed8f3874c7999cd06bbe518e3ba6b98f019d0657025aea534ca3fc757f82b0f92c994253b3d171f0878938f515e977eb164c56f2262b6
-
SSDEEP
1536:cvQBeOGtrYS3srx93UBWfwC6Ggnouy8mVeygryFU2li0gx4EBbhnyLFW+Y5:chOmTsF93UYfwC6GIoutieyhC2lbgGi/
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3884-5-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2540-14-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2500-16-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2928-20-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1160-36-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1752-35-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3208-25-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2568-45-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/868-50-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/468-56-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3556-63-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4880-72-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4944-75-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4520-90-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2536-93-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/896-103-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2960-118-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2628-111-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4656-125-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1460-133-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/636-139-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3680-154-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4336-166-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3304-183-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/736-189-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2288-205-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4752-212-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1748-216-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/116-223-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1248-234-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/8-240-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1956-242-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3152-251-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2076-255-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3256-270-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3676-277-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4492-292-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/404-302-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2768-303-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/544-310-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3412-315-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4632-343-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2416-352-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3704-366-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4976-379-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4336-411-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3188-415-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1412-420-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1000-479-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4556-503-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1788-513-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2924-568-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1876-593-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3292-638-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3732-648-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2628-677-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3152-681-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1080-690-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4348-721-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1304-756-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/212-778-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2572-931-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/888-942-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3732-968-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3884-0-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\5thhhh.exe UPX behavioral2/memory/3884-5-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\vpjdv.exe UPX behavioral2/memory/2540-14-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/2500-16-0x0000000000400000-0x0000000000436000-memory.dmp UPX \??\c:\djjdv.exe UPX behavioral2/memory/2928-20-0x0000000000400000-0x0000000000436000-memory.dmp UPX \??\c:\7xxrlll.exe UPX \??\c:\llffllx.exe UPX \??\c:\5nbbtb.exe UPX behavioral2/memory/1160-36-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/1752-35-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\9dddd.exe UPX behavioral2/memory/3208-25-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/2568-45-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\frffflf.exe UPX behavioral2/memory/868-50-0x0000000000400000-0x0000000000436000-memory.dmp UPX \??\c:\xfxxxxx.exe UPX behavioral2/memory/468-56-0x0000000000400000-0x0000000000436000-memory.dmp UPX \??\c:\tnttnh.exe UPX behavioral2/memory/3556-63-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\vpppp.exe UPX behavioral2/memory/4880-67-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4880-72-0x0000000000400000-0x0000000000436000-memory.dmp UPX \??\c:\fxxrrrr.exe UPX behavioral2/memory/4944-75-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\3nbbtt.exe UPX C:\nntbht.exe UPX behavioral2/memory/4520-85-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\vpppj.exe UPX behavioral2/memory/4520-90-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/2536-93-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\fxrfrll.exe UPX C:\nbhbtn.exe UPX behavioral2/memory/896-103-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\5hhbnh.exe UPX C:\pdjpj.exe UPX behavioral2/memory/2960-118-0x0000000000400000-0x0000000000436000-memory.dmp UPX \??\c:\9rxrffl.exe UPX behavioral2/memory/2628-111-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\tttntn.exe UPX behavioral2/memory/4656-125-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\vdjvj.exe UPX behavioral2/memory/1460-133-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\pvddd.exe UPX behavioral2/memory/636-139-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\xlrrfff.exe UPX C:\9ttnbh.exe UPX \??\c:\jpppp.exe UPX behavioral2/memory/3680-154-0x0000000000400000-0x0000000000436000-memory.dmp UPX \??\c:\ppdvv.exe UPX \??\c:\xxrxrrl.exe UPX behavioral2/memory/4336-166-0x0000000000400000-0x0000000000436000-memory.dmp UPX C:\fxlfxxr.exe UPX C:\tbbbbt.exe UPX C:\pjdpv.exe UPX \??\c:\rlrlxxx.exe UPX behavioral2/memory/3304-183-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/736-189-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4652-200-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/2288-205-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4752-208-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4752-212-0x0000000000400000-0x0000000000436000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
5thhhh.exevpjdv.exedjjdv.exe7xxrlll.exellffllx.exe5nbbtb.exe9dddd.exefrffflf.exexfxxxxx.exetnttnh.exevpppp.exefxxrrrr.exe3nbbtt.exenntbht.exevpppj.exefxrfrll.exenbhbtn.exe5hhbnh.exepdjpj.exe9rxrffl.exetttntn.exevdjvj.exepvddd.exexlrrfff.exe9ttnbh.exejpppp.exeppdvv.exexxrxrrl.exefxlfxxr.exetbbbbt.exepjdpv.exerlrlxxx.exehbhntt.exehnnnnn.exe7jvvv.exedjjdv.exe9fffxxr.exefrrrrrl.exevpdvv.exedvpvp.exelxfxrxx.exexrxxrxx.exebttttn.exebtnnnb.exevpjdd.exepvvvp.exelxxxrrr.exelxrlfxf.exenhbbht.exejdjpj.exexxrrffx.exe3llrllr.exenbnhbb.exe7tbhbb.exejvvpj.exedvvjd.exexfrlrrx.exenhbbbt.exennhbnn.exevpvvv.exeppvjj.exerfflxrl.exe9tnhhn.exe9bhbbb.exepid process 2540 5thhhh.exe 2500 vpjdv.exe 2928 djjdv.exe 3208 7xxrlll.exe 1752 llffllx.exe 1160 5nbbtb.exe 2568 9dddd.exe 868 frffflf.exe 468 xfxxxxx.exe 3556 tnttnh.exe 4880 vpppp.exe 4944 fxxrrrr.exe 1544 3nbbtt.exe 4520 nntbht.exe 2536 vpppj.exe 896 fxrfrll.exe 4848 nbhbtn.exe 2628 5hhbnh.exe 2960 pdjpj.exe 4656 9rxrffl.exe 4528 tttntn.exe 1460 vdjvj.exe 636 pvddd.exe 3676 xlrrfff.exe 3680 9ttnbh.exe 2744 jpppp.exe 3228 ppdvv.exe 4336 xxrxrrl.exe 3188 fxlfxxr.exe 1468 tbbbbt.exe 3304 pjdpv.exe 736 rlrlxxx.exe 4928 hbhntt.exe 3316 hnnnnn.exe 980 7jvvv.exe 4652 djjdv.exe 2288 9fffxxr.exe 4752 frrrrrl.exe 1748 vpdvv.exe 4416 dvpvp.exe 116 lxfxrxx.exe 4632 xrxxrxx.exe 3972 bttttn.exe 1728 btnnnb.exe 1248 vpjdd.exe 8 pvvvp.exe 1956 lxxxrrr.exe 4676 lxrlfxf.exe 3152 nhbbht.exe 2076 jdjpj.exe 1792 xxrrffx.exe 4656 3llrllr.exe 2948 nbnhbb.exe 3624 7tbhbb.exe 3256 jvvpj.exe 2932 dvvjd.exe 3676 xfrlrrx.exe 212 nhbbbt.exe 1172 nnhbnn.exe 4512 vpvvv.exe 4492 ppvjj.exe 3884 rfflxrl.exe 864 9tnhhn.exe 404 9bhbbb.exe -
Processes:
resource yara_rule behavioral2/memory/3884-0-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\5thhhh.exe upx behavioral2/memory/3884-5-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\vpjdv.exe upx behavioral2/memory/2540-14-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2500-16-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\djjdv.exe upx behavioral2/memory/2928-20-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\7xxrlll.exe upx \??\c:\llffllx.exe upx \??\c:\5nbbtb.exe upx behavioral2/memory/1160-36-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1752-35-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\9dddd.exe upx behavioral2/memory/3208-25-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2568-45-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\frffflf.exe upx behavioral2/memory/868-50-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\xfxxxxx.exe upx behavioral2/memory/468-56-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\tnttnh.exe upx behavioral2/memory/3556-63-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\vpppp.exe upx behavioral2/memory/4880-67-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4880-72-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\fxxrrrr.exe upx behavioral2/memory/4944-75-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\3nbbtt.exe upx C:\nntbht.exe upx behavioral2/memory/4520-85-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\vpppj.exe upx behavioral2/memory/4520-90-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2536-93-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\fxrfrll.exe upx C:\nbhbtn.exe upx behavioral2/memory/896-103-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\5hhbnh.exe upx C:\pdjpj.exe upx behavioral2/memory/2960-118-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\9rxrffl.exe upx behavioral2/memory/2628-111-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\tttntn.exe upx behavioral2/memory/4656-125-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\vdjvj.exe upx behavioral2/memory/1460-133-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pvddd.exe upx behavioral2/memory/636-139-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\xlrrfff.exe upx C:\9ttnbh.exe upx \??\c:\jpppp.exe upx behavioral2/memory/3680-154-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\ppdvv.exe upx \??\c:\xxrxrrl.exe upx behavioral2/memory/4336-166-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\fxlfxxr.exe upx C:\tbbbbt.exe upx C:\pjdpv.exe upx \??\c:\rlrlxxx.exe upx behavioral2/memory/3304-183-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/736-189-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4652-200-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2288-205-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4752-208-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4752-212-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
07ab195ff076b895801f25c4f374ce266a1eeb06247fd3cab1ac0c6e97295e84.exe5thhhh.exevpjdv.exedjjdv.exe7xxrlll.exellffllx.exe5nbbtb.exe9dddd.exefrffflf.exexfxxxxx.exetnttnh.exevpppp.exefxxrrrr.exe3nbbtt.exenntbht.exevpppj.exefxrfrll.exenbhbtn.exe5hhbnh.exepdjpj.exe9rxrffl.exetttntn.exedescription pid process target process PID 3884 wrote to memory of 2540 3884 07ab195ff076b895801f25c4f374ce266a1eeb06247fd3cab1ac0c6e97295e84.exe 5thhhh.exe PID 3884 wrote to memory of 2540 3884 07ab195ff076b895801f25c4f374ce266a1eeb06247fd3cab1ac0c6e97295e84.exe 5thhhh.exe PID 3884 wrote to memory of 2540 3884 07ab195ff076b895801f25c4f374ce266a1eeb06247fd3cab1ac0c6e97295e84.exe 5thhhh.exe PID 2540 wrote to memory of 2500 2540 5thhhh.exe vpjdv.exe PID 2540 wrote to memory of 2500 2540 5thhhh.exe vpjdv.exe PID 2540 wrote to memory of 2500 2540 5thhhh.exe vpjdv.exe PID 2500 wrote to memory of 2928 2500 vpjdv.exe djjdv.exe PID 2500 wrote to memory of 2928 2500 vpjdv.exe djjdv.exe PID 2500 wrote to memory of 2928 2500 vpjdv.exe djjdv.exe PID 2928 wrote to memory of 3208 2928 djjdv.exe 7xxrlll.exe PID 2928 wrote to memory of 3208 2928 djjdv.exe 7xxrlll.exe PID 2928 wrote to memory of 3208 2928 djjdv.exe 7xxrlll.exe PID 3208 wrote to memory of 1752 3208 7xxrlll.exe llffllx.exe PID 3208 wrote to memory of 1752 3208 7xxrlll.exe llffllx.exe PID 3208 wrote to memory of 1752 3208 7xxrlll.exe llffllx.exe PID 1752 wrote to memory of 1160 1752 llffllx.exe 5nbbtb.exe PID 1752 wrote to memory of 1160 1752 llffllx.exe 5nbbtb.exe PID 1752 wrote to memory of 1160 1752 llffllx.exe 5nbbtb.exe PID 1160 wrote to memory of 2568 1160 5nbbtb.exe 9dddd.exe PID 1160 wrote to memory of 2568 1160 5nbbtb.exe 9dddd.exe PID 1160 wrote to memory of 2568 1160 5nbbtb.exe 9dddd.exe PID 2568 wrote to memory of 868 2568 9dddd.exe frffflf.exe PID 2568 wrote to memory of 868 2568 9dddd.exe frffflf.exe PID 2568 wrote to memory of 868 2568 9dddd.exe frffflf.exe PID 868 wrote to memory of 468 868 frffflf.exe xfxxxxx.exe PID 868 wrote to memory of 468 868 frffflf.exe xfxxxxx.exe PID 868 wrote to memory of 468 868 frffflf.exe xfxxxxx.exe PID 468 wrote to memory of 3556 468 xfxxxxx.exe tnttnh.exe PID 468 wrote to memory of 3556 468 xfxxxxx.exe tnttnh.exe PID 468 wrote to memory of 3556 468 xfxxxxx.exe tnttnh.exe PID 3556 wrote to memory of 4880 3556 tnttnh.exe vpppp.exe PID 3556 wrote to memory of 4880 3556 tnttnh.exe vpppp.exe PID 3556 wrote to memory of 4880 3556 tnttnh.exe vpppp.exe PID 4880 wrote to memory of 4944 4880 vpppp.exe fxxrrrr.exe PID 4880 wrote to memory of 4944 4880 vpppp.exe fxxrrrr.exe PID 4880 wrote to memory of 4944 4880 vpppp.exe fxxrrrr.exe PID 4944 wrote to memory of 1544 4944 fxxrrrr.exe 3nbbtt.exe PID 4944 wrote to memory of 1544 4944 fxxrrrr.exe 3nbbtt.exe PID 4944 wrote to memory of 1544 4944 fxxrrrr.exe 3nbbtt.exe PID 1544 wrote to memory of 4520 1544 3nbbtt.exe nntbht.exe PID 1544 wrote to memory of 4520 1544 3nbbtt.exe nntbht.exe PID 1544 wrote to memory of 4520 1544 3nbbtt.exe nntbht.exe PID 4520 wrote to memory of 2536 4520 nntbht.exe vpppj.exe PID 4520 wrote to memory of 2536 4520 nntbht.exe vpppj.exe PID 4520 wrote to memory of 2536 4520 nntbht.exe vpppj.exe PID 2536 wrote to memory of 896 2536 vpppj.exe fxrfrll.exe PID 2536 wrote to memory of 896 2536 vpppj.exe fxrfrll.exe PID 2536 wrote to memory of 896 2536 vpppj.exe fxrfrll.exe PID 896 wrote to memory of 4848 896 fxrfrll.exe nbhbtn.exe PID 896 wrote to memory of 4848 896 fxrfrll.exe nbhbtn.exe PID 896 wrote to memory of 4848 896 fxrfrll.exe nbhbtn.exe PID 4848 wrote to memory of 2628 4848 nbhbtn.exe 5hhbnh.exe PID 4848 wrote to memory of 2628 4848 nbhbtn.exe 5hhbnh.exe PID 4848 wrote to memory of 2628 4848 nbhbtn.exe 5hhbnh.exe PID 2628 wrote to memory of 2960 2628 5hhbnh.exe pdjpj.exe PID 2628 wrote to memory of 2960 2628 5hhbnh.exe pdjpj.exe PID 2628 wrote to memory of 2960 2628 5hhbnh.exe pdjpj.exe PID 2960 wrote to memory of 4656 2960 pdjpj.exe 3llrllr.exe PID 2960 wrote to memory of 4656 2960 pdjpj.exe 3llrllr.exe PID 2960 wrote to memory of 4656 2960 pdjpj.exe 3llrllr.exe PID 4656 wrote to memory of 4528 4656 9rxrffl.exe tttntn.exe PID 4656 wrote to memory of 4528 4656 9rxrffl.exe tttntn.exe PID 4656 wrote to memory of 4528 4656 9rxrffl.exe tttntn.exe PID 4528 wrote to memory of 1460 4528 tttntn.exe vdjvj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07ab195ff076b895801f25c4f374ce266a1eeb06247fd3cab1ac0c6e97295e84.exe"C:\Users\Admin\AppData\Local\Temp\07ab195ff076b895801f25c4f374ce266a1eeb06247fd3cab1ac0c6e97295e84.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\5thhhh.exec:\5thhhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjdv.exec:\vpjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djjdv.exec:\djjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7xxrlll.exec:\7xxrlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llffllx.exec:\llffllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5nbbtb.exec:\5nbbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9dddd.exec:\9dddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frffflf.exec:\frffflf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xfxxxxx.exec:\xfxxxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnttnh.exec:\tnttnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpppp.exec:\vpppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3nbbtt.exec:\3nbbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nntbht.exec:\nntbht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpppj.exec:\vpppj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxrfrll.exec:\fxrfrll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbhbtn.exec:\nbhbtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5hhbnh.exec:\5hhbnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdjpj.exec:\pdjpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9rxrffl.exec:\9rxrffl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tttntn.exec:\tttntn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdjvj.exec:\vdjvj.exe23⤵
- Executes dropped EXE
-
\??\c:\pvddd.exec:\pvddd.exe24⤵
- Executes dropped EXE
-
\??\c:\xlrrfff.exec:\xlrrfff.exe25⤵
- Executes dropped EXE
-
\??\c:\9ttnbh.exec:\9ttnbh.exe26⤵
- Executes dropped EXE
-
\??\c:\jpppp.exec:\jpppp.exe27⤵
- Executes dropped EXE
-
\??\c:\ppdvv.exec:\ppdvv.exe28⤵
- Executes dropped EXE
-
\??\c:\xxrxrrl.exec:\xxrxrrl.exe29⤵
- Executes dropped EXE
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe30⤵
- Executes dropped EXE
-
\??\c:\tbbbbt.exec:\tbbbbt.exe31⤵
- Executes dropped EXE
-
\??\c:\pjdpv.exec:\pjdpv.exe32⤵
- Executes dropped EXE
-
\??\c:\rlrlxxx.exec:\rlrlxxx.exe33⤵
- Executes dropped EXE
-
\??\c:\hbhntt.exec:\hbhntt.exe34⤵
- Executes dropped EXE
-
\??\c:\hnnnnn.exec:\hnnnnn.exe35⤵
- Executes dropped EXE
-
\??\c:\7jvvv.exec:\7jvvv.exe36⤵
- Executes dropped EXE
-
\??\c:\djjdv.exec:\djjdv.exe37⤵
- Executes dropped EXE
-
\??\c:\9fffxxr.exec:\9fffxxr.exe38⤵
- Executes dropped EXE
-
\??\c:\frrrrrl.exec:\frrrrrl.exe39⤵
- Executes dropped EXE
-
\??\c:\vpdvv.exec:\vpdvv.exe40⤵
- Executes dropped EXE
-
\??\c:\dvpvp.exec:\dvpvp.exe41⤵
- Executes dropped EXE
-
\??\c:\lxfxrxx.exec:\lxfxrxx.exe42⤵
- Executes dropped EXE
-
\??\c:\xrxxrxx.exec:\xrxxrxx.exe43⤵
- Executes dropped EXE
-
\??\c:\bttttn.exec:\bttttn.exe44⤵
- Executes dropped EXE
-
\??\c:\btnnnb.exec:\btnnnb.exe45⤵
- Executes dropped EXE
-
\??\c:\vpjdd.exec:\vpjdd.exe46⤵
- Executes dropped EXE
-
\??\c:\pvvvp.exec:\pvvvp.exe47⤵
- Executes dropped EXE
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe48⤵
- Executes dropped EXE
-
\??\c:\lxrlfxf.exec:\lxrlfxf.exe49⤵
- Executes dropped EXE
-
\??\c:\nhbbht.exec:\nhbbht.exe50⤵
- Executes dropped EXE
-
\??\c:\jdjpj.exec:\jdjpj.exe51⤵
- Executes dropped EXE
-
\??\c:\xxrrffx.exec:\xxrrffx.exe52⤵
- Executes dropped EXE
-
\??\c:\3llrllr.exec:\3llrllr.exe53⤵
- Executes dropped EXE
-
\??\c:\nbnhbb.exec:\nbnhbb.exe54⤵
- Executes dropped EXE
-
\??\c:\7tbhbb.exec:\7tbhbb.exe55⤵
- Executes dropped EXE
-
\??\c:\jvvpj.exec:\jvvpj.exe56⤵
- Executes dropped EXE
-
\??\c:\dvvjd.exec:\dvvjd.exe57⤵
- Executes dropped EXE
-
\??\c:\xfrlrrx.exec:\xfrlrrx.exe58⤵
- Executes dropped EXE
-
\??\c:\nhbbbt.exec:\nhbbbt.exe59⤵
- Executes dropped EXE
-
\??\c:\nnhbnn.exec:\nnhbnn.exe60⤵
- Executes dropped EXE
-
\??\c:\vpvvv.exec:\vpvvv.exe61⤵
- Executes dropped EXE
-
\??\c:\ppvjj.exec:\ppvjj.exe62⤵
- Executes dropped EXE
-
\??\c:\rfflxrl.exec:\rfflxrl.exe63⤵
- Executes dropped EXE
-
\??\c:\9tnhhn.exec:\9tnhhn.exe64⤵
- Executes dropped EXE
-
\??\c:\9bhbbb.exec:\9bhbbb.exe65⤵
- Executes dropped EXE
-
\??\c:\tnbthb.exec:\tnbthb.exe66⤵
-
\??\c:\3dpjj.exec:\3dpjj.exe67⤵
-
\??\c:\fxxrxrx.exec:\fxxrxrx.exe68⤵
-
\??\c:\rxfxxrl.exec:\rxfxxrl.exe69⤵
-
\??\c:\xlrfrlf.exec:\xlrfrlf.exe70⤵
-
\??\c:\nnnbhh.exec:\nnnbhh.exe71⤵
-
\??\c:\3bhtnn.exec:\3bhtnn.exe72⤵
-
\??\c:\jvjdd.exec:\jvjdd.exe73⤵
-
\??\c:\djpjd.exec:\djpjd.exe74⤵
-
\??\c:\7rxrxxr.exec:\7rxrxxr.exe75⤵
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe76⤵
-
\??\c:\9nthbb.exec:\9nthbb.exe77⤵
-
\??\c:\hbttnn.exec:\hbttnn.exe78⤵
-
\??\c:\1dddp.exec:\1dddp.exe79⤵
-
\??\c:\pddjv.exec:\pddjv.exe80⤵
-
\??\c:\fxfrlfx.exec:\fxfrlfx.exe81⤵
-
\??\c:\rlrxfxf.exec:\rlrxfxf.exe82⤵
-
\??\c:\nbhhhh.exec:\nbhhhh.exe83⤵
-
\??\c:\hnbbtn.exec:\hnbbtn.exe84⤵
-
\??\c:\3dvpd.exec:\3dvpd.exe85⤵
-
\??\c:\dpdjj.exec:\dpdjj.exe86⤵
-
\??\c:\flrlxrl.exec:\flrlxrl.exe87⤵
-
\??\c:\9lrlrrl.exec:\9lrlrrl.exe88⤵
-
\??\c:\3xxxrrr.exec:\3xxxrrr.exe89⤵
-
\??\c:\nhtttt.exec:\nhtttt.exe90⤵
-
\??\c:\jdjvd.exec:\jdjvd.exe91⤵
-
\??\c:\dpjvj.exec:\dpjvj.exe92⤵
-
\??\c:\rlfrfrr.exec:\rlfrfrr.exe93⤵
-
\??\c:\xxlxlfr.exec:\xxlxlfr.exe94⤵
-
\??\c:\bbhbtt.exec:\bbhbtt.exe95⤵
-
\??\c:\ppvpj.exec:\ppvpj.exe96⤵
-
\??\c:\3jdvp.exec:\3jdvp.exe97⤵
-
\??\c:\rlrfffx.exec:\rlrfffx.exe98⤵
-
\??\c:\btntbh.exec:\btntbh.exe99⤵
-
\??\c:\hnbnnh.exec:\hnbnnh.exe100⤵
-
\??\c:\vpjdp.exec:\vpjdp.exe101⤵
-
\??\c:\vjjdv.exec:\vjjdv.exe102⤵
-
\??\c:\9llfrrl.exec:\9llfrrl.exe103⤵
-
\??\c:\rrxrlll.exec:\rrxrlll.exe104⤵
-
\??\c:\nhhhbb.exec:\nhhhbb.exe105⤵
-
\??\c:\jvvpj.exec:\jvvpj.exe106⤵
-
\??\c:\vdjdp.exec:\vdjdp.exe107⤵
-
\??\c:\rllxrrr.exec:\rllxrrr.exe108⤵
-
\??\c:\xrxxrlf.exec:\xrxxrlf.exe109⤵
-
\??\c:\nnttbh.exec:\nnttbh.exe110⤵
-
\??\c:\1hbttn.exec:\1hbttn.exe111⤵
-
\??\c:\pdvpj.exec:\pdvpj.exe112⤵
-
\??\c:\fffxlff.exec:\fffxlff.exe113⤵
-
\??\c:\1fxfrrf.exec:\1fxfrrf.exe114⤵
-
\??\c:\bttbnb.exec:\bttbnb.exe115⤵
-
\??\c:\vvvvj.exec:\vvvvj.exe116⤵
-
\??\c:\vpjdp.exec:\vpjdp.exe117⤵
-
\??\c:\vdjjd.exec:\vdjjd.exe118⤵
-
\??\c:\rllxllf.exec:\rllxllf.exe119⤵
-
\??\c:\bthbbb.exec:\bthbbb.exe120⤵
-
\??\c:\ntbtnn.exec:\ntbtnn.exe121⤵
-
\??\c:\9bhbnn.exec:\9bhbnn.exe122⤵
-
\??\c:\ppvvp.exec:\ppvvp.exe123⤵
-
\??\c:\5jpjj.exec:\5jpjj.exe124⤵
-
\??\c:\rrlfxxl.exec:\rrlfxxl.exe125⤵
-
\??\c:\fffxrrl.exec:\fffxrrl.exe126⤵
-
\??\c:\9nnnhh.exec:\9nnnhh.exe127⤵
-
\??\c:\nhtntt.exec:\nhtntt.exe128⤵
-
\??\c:\djjjj.exec:\djjjj.exe129⤵
-
\??\c:\pvvjj.exec:\pvvjj.exe130⤵
-
\??\c:\5lrllrr.exec:\5lrllrr.exe131⤵
-
\??\c:\llffxfx.exec:\llffxfx.exe132⤵
-
\??\c:\7nnhbb.exec:\7nnhbb.exe133⤵
-
\??\c:\nnnntt.exec:\nnnntt.exe134⤵
-
\??\c:\nbttbh.exec:\nbttbh.exe135⤵
-
\??\c:\dppvp.exec:\dppvp.exe136⤵
-
\??\c:\vjppj.exec:\vjppj.exe137⤵
-
\??\c:\rrxxffl.exec:\rrxxffl.exe138⤵
-
\??\c:\xrflllf.exec:\xrflllf.exe139⤵
-
\??\c:\1flfxxf.exec:\1flfxxf.exe140⤵
-
\??\c:\hnnnhh.exec:\hnnnhh.exe141⤵
-
\??\c:\nhhbnn.exec:\nhhbnn.exe142⤵
-
\??\c:\jddjd.exec:\jddjd.exe143⤵
-
\??\c:\djpdv.exec:\djpdv.exe144⤵
-
\??\c:\pjjdd.exec:\pjjdd.exe145⤵
-
\??\c:\ffxrfff.exec:\ffxrfff.exe146⤵
-
\??\c:\bbbbbb.exec:\bbbbbb.exe147⤵
-
\??\c:\bhhbht.exec:\bhhbht.exe148⤵
-
\??\c:\9pdpj.exec:\9pdpj.exe149⤵
-
\??\c:\ddppv.exec:\ddppv.exe150⤵
-
\??\c:\9fffrrr.exec:\9fffrrr.exe151⤵
-
\??\c:\1rfxxrl.exec:\1rfxxrl.exe152⤵
-
\??\c:\tnbhhn.exec:\tnbhhn.exe153⤵
-
\??\c:\btttnn.exec:\btttnn.exe154⤵
-
\??\c:\pvdpp.exec:\pvdpp.exe155⤵
-
\??\c:\xfllfff.exec:\xfllfff.exe156⤵
-
\??\c:\7fxllrr.exec:\7fxllrr.exe157⤵
-
\??\c:\3tbbbb.exec:\3tbbbb.exe158⤵
-
\??\c:\bnnhbb.exec:\bnnhbb.exe159⤵
-
\??\c:\pdjjd.exec:\pdjjd.exe160⤵
-
\??\c:\5pjdd.exec:\5pjdd.exe161⤵
-
\??\c:\rlllxxr.exec:\rlllxxr.exe162⤵
-
\??\c:\3xrxrlf.exec:\3xrxrlf.exe163⤵
-
\??\c:\ntbhhn.exec:\ntbhhn.exe164⤵
-
\??\c:\nnnhhb.exec:\nnnhhb.exe165⤵
-
\??\c:\djdvv.exec:\djdvv.exe166⤵
-
\??\c:\ppdvp.exec:\ppdvp.exe167⤵
-
\??\c:\1dpjj.exec:\1dpjj.exe168⤵
-
\??\c:\xrlffff.exec:\xrlffff.exe169⤵
-
\??\c:\fllrxfl.exec:\fllrxfl.exe170⤵
-
\??\c:\btbbhh.exec:\btbbhh.exe171⤵
-
\??\c:\5nttnt.exec:\5nttnt.exe172⤵
-
\??\c:\3vdjj.exec:\3vdjj.exe173⤵
-
\??\c:\3ddvp.exec:\3ddvp.exe174⤵
-
\??\c:\rllfxxr.exec:\rllfxxr.exe175⤵
-
\??\c:\frrlfff.exec:\frrlfff.exe176⤵
-
\??\c:\tttttn.exec:\tttttn.exe177⤵
-
\??\c:\tbnhnn.exec:\tbnhnn.exe178⤵
-
\??\c:\3ddjd.exec:\3ddjd.exe179⤵
-
\??\c:\5xfllll.exec:\5xfllll.exe180⤵
-
\??\c:\rxffxff.exec:\rxffxff.exe181⤵
-
\??\c:\9btttt.exec:\9btttt.exe182⤵
-
\??\c:\bnnttb.exec:\bnnttb.exe183⤵
-
\??\c:\vdddj.exec:\vdddj.exe184⤵
-
\??\c:\pdjjd.exec:\pdjjd.exe185⤵
-
\??\c:\xrfxrlf.exec:\xrfxrlf.exe186⤵
-
\??\c:\9ffffff.exec:\9ffffff.exe187⤵
-
\??\c:\3bhhhh.exec:\3bhhhh.exe188⤵
-
\??\c:\tnhbbt.exec:\tnhbbt.exe189⤵
-
\??\c:\7jpjj.exec:\7jpjj.exe190⤵
-
\??\c:\jpdvj.exec:\jpdvj.exe191⤵
-
\??\c:\xffxrxr.exec:\xffxrxr.exe192⤵
-
\??\c:\ttbhbb.exec:\ttbhbb.exe193⤵
-
\??\c:\7pvdp.exec:\7pvdp.exe194⤵
-
\??\c:\dvpjj.exec:\dvpjj.exe195⤵
-
\??\c:\5flllfl.exec:\5flllfl.exe196⤵
-
\??\c:\nbhbbb.exec:\nbhbbb.exe197⤵
-
\??\c:\bnttnn.exec:\bnttnn.exe198⤵
-
\??\c:\xrllfll.exec:\xrllfll.exe199⤵
-
\??\c:\ntbnbb.exec:\ntbnbb.exe200⤵
-
\??\c:\hntbnt.exec:\hntbnt.exe201⤵
-
\??\c:\7ppjp.exec:\7ppjp.exe202⤵
-
\??\c:\1xxrllf.exec:\1xxrllf.exe203⤵
-
\??\c:\bbttnn.exec:\bbttnn.exe204⤵
-
\??\c:\3tbttt.exec:\3tbttt.exe205⤵
-
\??\c:\pvdjj.exec:\pvdjj.exe206⤵
-
\??\c:\xrrfxrl.exec:\xrrfxrl.exe207⤵
-
\??\c:\hbbbbb.exec:\hbbbbb.exe208⤵
-
\??\c:\bhnhbb.exec:\bhnhbb.exe209⤵
-
\??\c:\5pjjj.exec:\5pjjj.exe210⤵
-
\??\c:\lllfflf.exec:\lllfflf.exe211⤵
-
\??\c:\nbbttt.exec:\nbbttt.exe212⤵
-
\??\c:\bbhhnt.exec:\bbhhnt.exe213⤵
-
\??\c:\pppjv.exec:\pppjv.exe214⤵
-
\??\c:\ppjvp.exec:\ppjvp.exe215⤵
-
\??\c:\1lfxrrl.exec:\1lfxrrl.exe216⤵
-
\??\c:\tbbtth.exec:\tbbtth.exe217⤵
-
\??\c:\hbhhbb.exec:\hbhhbb.exe218⤵
-
\??\c:\1jpjj.exec:\1jpjj.exe219⤵
-
\??\c:\vppjv.exec:\vppjv.exe220⤵
-
\??\c:\3ffxrrr.exec:\3ffxrrr.exe221⤵
-
\??\c:\9thhhh.exec:\9thhhh.exe222⤵
-
\??\c:\1hhnbb.exec:\1hhnbb.exe223⤵
-
\??\c:\jvvdp.exec:\jvvdp.exe224⤵
-
\??\c:\ppppj.exec:\ppppj.exe225⤵
-
\??\c:\dvddv.exec:\dvddv.exe226⤵
-
\??\c:\xlfxxxf.exec:\xlfxxxf.exe227⤵
-
\??\c:\btnhnh.exec:\btnhnh.exe228⤵
-
\??\c:\pjjdd.exec:\pjjdd.exe229⤵
-
\??\c:\1pdpd.exec:\1pdpd.exe230⤵
-
\??\c:\1xlxxrx.exec:\1xlxxrx.exe231⤵
-
\??\c:\xrrlxrr.exec:\xrrlxrr.exe232⤵
-
\??\c:\tbhhhb.exec:\tbhhhb.exe233⤵
-
\??\c:\tbbbbt.exec:\tbbbbt.exe234⤵
-
\??\c:\jjvvj.exec:\jjvvj.exe235⤵
-
\??\c:\vdpdj.exec:\vdpdj.exe236⤵
-
\??\c:\lxlxxxr.exec:\lxlxxxr.exe237⤵
-
\??\c:\fffxxxx.exec:\fffxxxx.exe238⤵
-
\??\c:\hbbttn.exec:\hbbttn.exe239⤵
-
\??\c:\jjddp.exec:\jjddp.exe240⤵
-
\??\c:\vppjd.exec:\vppjd.exe241⤵