Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 19:20
Behavioral task
behavioral1
Sample
1cb0fadc62b32680b16d992bcff194da5dd1aaf45ef04ecfc102546bcb030914.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
1cb0fadc62b32680b16d992bcff194da5dd1aaf45ef04ecfc102546bcb030914.exe
-
Size
92KB
-
MD5
76dfe875c37259d2f5be45e326882769
-
SHA1
6e2488df917801d958d28180b75c96036f8adeca
-
SHA256
1cb0fadc62b32680b16d992bcff194da5dd1aaf45ef04ecfc102546bcb030914
-
SHA512
ba1b44502d6d8d823a9c3064d109def604522f8631086064eb27b3b72d11a3c56beddbbd86b89bd03539ef0bcec5a56f074b0b06d81a48298868ff7837bdfd61
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWpTe:8hOmTsF93UYfwC6GIout0fmCiiiXA6m0
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
Processes:
resource yara_rule behavioral2/memory/4508-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/564-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2228-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1540-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3760-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/860-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4844-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1284-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/912-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1520-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5088-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/960-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1976-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2084-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3756-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3668-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3296-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1896-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1064-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4916-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3136-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4448-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1616-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/860-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2112-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3488-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2852-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/740-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1624-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4684-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2512-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3100-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1304-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-508-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4044-519-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1004-602-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-645-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-806-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1760-1016-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4508-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4508-4-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lflfxxx.exe UPX C:\btttnn.exe UPX behavioral2/memory/2228-11-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vdpjj.exe UPX behavioral2/memory/564-10-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2228-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1540-16-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\lrrlxxx.exe UPX behavioral2/memory/1540-22-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tbhbtt.exe UPX behavioral2/memory/4520-26-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4596-31-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jvjdd.exe UPX C:\fxfxrrl.exe UPX behavioral2/memory/1852-36-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1768-38-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rfllfxx.exe UPX behavioral2/memory/1768-42-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1328-47-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\thnttt.exe UPX \??\c:\djvjp.exe UPX behavioral2/memory/3760-53-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/860-57-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lffrlxx.exe UPX C:\bthnht.exe UPX behavioral2/memory/4072-63-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vpdpp.exe UPX behavioral2/memory/1548-67-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\jjdvp.exe UPX behavioral2/memory/4844-72-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\frffllf.exe UPX behavioral2/memory/1284-79-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bnhntt.exe UPX C:\tthtbt.exe UPX C:\vjvpj.exe UPX behavioral2/memory/4700-92-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\fxlflfl.exe UPX behavioral2/memory/912-96-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lfxrlxx.exe UPX behavioral2/memory/912-100-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\httthn.exe UPX behavioral2/memory/1520-106-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vdpvv.exe UPX C:\pvvvp.exe UPX behavioral2/memory/5088-113-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\llfxxxr.exe UPX behavioral2/memory/4976-118-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4604-122-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\ttnnnt.exe UPX behavioral2/memory/960-129-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ppvpj.exe UPX behavioral2/memory/4284-133-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\flrlllf.exe UPX C:\btttnn.exe UPX C:\nbnnnb.exe UPX behavioral2/memory/1976-144-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\jjpdv.exe UPX behavioral2/memory/2084-154-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lflllrl.exe UPX behavioral2/memory/3756-156-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\llrlxlf.exe UPX behavioral2/memory/3668-161-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
lflfxxx.exebtttnn.exevdpjj.exelrrlxxx.exetbhbtt.exejvjdd.exefxfxrrl.exerfllfxx.exethnttt.exedjvjp.exelffrlxx.exebthnht.exevpdpp.exejjdvp.exefrffllf.exebnhntt.exetthtbt.exevjvpj.exefxlflfl.exelfxrlxx.exehttthn.exevdpvv.exepvvvp.exellfxxxr.exettnnnt.exeppvpj.exeflrlllf.exebtttnn.exenbnnnb.exejjpdv.exellrlxlf.exelflllrl.exehhbbbb.exejjdjd.exe5jpdd.exexllfxff.exefxlllrl.exetnnnhh.exe9jjvv.exe5pvpj.exedvpjv.exe7llxrrl.exenntttt.exe3bnhhb.exevdppv.exe1rxrrll.exelffxrrr.exennnhhh.exebnnnhh.exejdjdv.exe5jjjv.exexrrrrxx.exelflrlff.exebthhbh.exe7dvvj.exejvppp.exerlxxrrr.exerxxxrrf.exethhbbb.exe5nnnhn.exetnbttt.exepjjdj.exevvdpj.exexxxxlll.exepid process 564 lflfxxx.exe 2228 btttnn.exe 1540 vdpjj.exe 4520 lrrlxxx.exe 4596 tbhbtt.exe 1852 jvjdd.exe 1768 fxfxrrl.exe 1328 rfllfxx.exe 3760 thnttt.exe 860 djvjp.exe 4072 lffrlxx.exe 1548 bthnht.exe 4844 vpdpp.exe 756 jjdvp.exe 1284 frffllf.exe 4648 bnhntt.exe 5028 tthtbt.exe 4700 vjvpj.exe 912 fxlflfl.exe 1520 lfxrlxx.exe 4468 httthn.exe 5088 vdpvv.exe 4976 pvvvp.exe 4604 llfxxxr.exe 960 ttnnnt.exe 4284 ppvpj.exe 1544 flrlllf.exe 1424 btttnn.exe 1976 nbnnnb.exe 3756 jjpdv.exe 2084 llrlxlf.exe 3052 lflllrl.exe 3668 hhbbbb.exe 3172 jjdjd.exe 4148 5jpdd.exe 3744 xllfxff.exe 3296 fxlllrl.exe 1896 tnnnhh.exe 4088 9jjvv.exe 516 5pvpj.exe 1064 dvpjv.exe 4412 7llxrrl.exe 4916 nntttt.exe 2776 3bnhhb.exe 4644 vdppv.exe 2420 1rxrrll.exe 4140 lffxrrr.exe 3136 nnnhhh.exe 3288 bnnnhh.exe 4008 jdjdv.exe 4520 5jjjv.exe 3268 xrrrrxx.exe 4992 lflrlff.exe 996 bthhbh.exe 2980 7dvvj.exe 4448 jvppp.exe 3748 rlxxrrr.exe 1616 rxxxrrf.exe 860 thhbbb.exe 2112 5nnnhn.exe 4436 tnbttt.exe 1536 pjjdj.exe 4844 vvdpj.exe 1996 xxxxlll.exe -
Processes:
resource yara_rule behavioral2/memory/4508-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4508-4-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lflfxxx.exe upx C:\btttnn.exe upx behavioral2/memory/2228-11-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vdpjj.exe upx behavioral2/memory/564-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2228-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1540-16-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lrrlxxx.exe upx behavioral2/memory/1540-22-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbhbtt.exe upx behavioral2/memory/4520-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4596-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvjdd.exe upx C:\fxfxrrl.exe upx behavioral2/memory/1852-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1768-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rfllfxx.exe upx behavioral2/memory/1768-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1328-47-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thnttt.exe upx \??\c:\djvjp.exe upx behavioral2/memory/3760-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/860-57-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lffrlxx.exe upx C:\bthnht.exe upx behavioral2/memory/4072-63-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpdpp.exe upx behavioral2/memory/1548-67-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jjdvp.exe upx behavioral2/memory/4844-72-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frffllf.exe upx behavioral2/memory/1284-79-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnhntt.exe upx C:\tthtbt.exe upx C:\vjvpj.exe upx behavioral2/memory/4700-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxlflfl.exe upx behavioral2/memory/912-96-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfxrlxx.exe upx behavioral2/memory/912-100-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\httthn.exe upx behavioral2/memory/1520-106-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vdpvv.exe upx C:\pvvvp.exe upx behavioral2/memory/5088-113-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llfxxxr.exe upx behavioral2/memory/4976-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4604-122-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ttnnnt.exe upx behavioral2/memory/960-129-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppvpj.exe upx behavioral2/memory/4284-133-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\flrlllf.exe upx C:\btttnn.exe upx C:\nbnnnb.exe upx behavioral2/memory/1976-144-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jjpdv.exe upx behavioral2/memory/2084-154-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lflllrl.exe upx behavioral2/memory/3756-156-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\llrlxlf.exe upx behavioral2/memory/3668-161-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1cb0fadc62b32680b16d992bcff194da5dd1aaf45ef04ecfc102546bcb030914.exelflfxxx.exebtttnn.exevdpjj.exelrrlxxx.exetbhbtt.exejvjdd.exefxfxrrl.exerfllfxx.exethnttt.exedjvjp.exelffrlxx.exebthnht.exevpdpp.exejjdvp.exefrffllf.exebnhntt.exetthtbt.exevjvpj.exefxlflfl.exelfxrlxx.exehttthn.exedescription pid process target process PID 4508 wrote to memory of 564 4508 1cb0fadc62b32680b16d992bcff194da5dd1aaf45ef04ecfc102546bcb030914.exe lflfxxx.exe PID 4508 wrote to memory of 564 4508 1cb0fadc62b32680b16d992bcff194da5dd1aaf45ef04ecfc102546bcb030914.exe lflfxxx.exe PID 4508 wrote to memory of 564 4508 1cb0fadc62b32680b16d992bcff194da5dd1aaf45ef04ecfc102546bcb030914.exe lflfxxx.exe PID 564 wrote to memory of 2228 564 lflfxxx.exe btttnn.exe PID 564 wrote to memory of 2228 564 lflfxxx.exe btttnn.exe PID 564 wrote to memory of 2228 564 lflfxxx.exe btttnn.exe PID 2228 wrote to memory of 1540 2228 btttnn.exe vdpjj.exe PID 2228 wrote to memory of 1540 2228 btttnn.exe vdpjj.exe PID 2228 wrote to memory of 1540 2228 btttnn.exe vdpjj.exe PID 1540 wrote to memory of 4520 1540 vdpjj.exe lrrlxxx.exe PID 1540 wrote to memory of 4520 1540 vdpjj.exe lrrlxxx.exe PID 1540 wrote to memory of 4520 1540 vdpjj.exe lrrlxxx.exe PID 4520 wrote to memory of 4596 4520 lrrlxxx.exe tbhbtt.exe PID 4520 wrote to memory of 4596 4520 lrrlxxx.exe tbhbtt.exe PID 4520 wrote to memory of 4596 4520 lrrlxxx.exe tbhbtt.exe PID 4596 wrote to memory of 1852 4596 tbhbtt.exe jvjdd.exe PID 4596 wrote to memory of 1852 4596 tbhbtt.exe jvjdd.exe PID 4596 wrote to memory of 1852 4596 tbhbtt.exe jvjdd.exe PID 1852 wrote to memory of 1768 1852 jvjdd.exe fxfxrrl.exe PID 1852 wrote to memory of 1768 1852 jvjdd.exe fxfxrrl.exe PID 1852 wrote to memory of 1768 1852 jvjdd.exe fxfxrrl.exe PID 1768 wrote to memory of 1328 1768 fxfxrrl.exe rfllfxx.exe PID 1768 wrote to memory of 1328 1768 fxfxrrl.exe rfllfxx.exe PID 1768 wrote to memory of 1328 1768 fxfxrrl.exe rfllfxx.exe PID 1328 wrote to memory of 3760 1328 rfllfxx.exe thnttt.exe PID 1328 wrote to memory of 3760 1328 rfllfxx.exe thnttt.exe PID 1328 wrote to memory of 3760 1328 rfllfxx.exe thnttt.exe PID 3760 wrote to memory of 860 3760 thnttt.exe djvjp.exe PID 3760 wrote to memory of 860 3760 thnttt.exe djvjp.exe PID 3760 wrote to memory of 860 3760 thnttt.exe djvjp.exe PID 860 wrote to memory of 4072 860 djvjp.exe lffrlxx.exe PID 860 wrote to memory of 4072 860 djvjp.exe lffrlxx.exe PID 860 wrote to memory of 4072 860 djvjp.exe lffrlxx.exe PID 4072 wrote to memory of 1548 4072 lffrlxx.exe bthnht.exe PID 4072 wrote to memory of 1548 4072 lffrlxx.exe bthnht.exe PID 4072 wrote to memory of 1548 4072 lffrlxx.exe bthnht.exe PID 1548 wrote to memory of 4844 1548 bthnht.exe vpdpp.exe PID 1548 wrote to memory of 4844 1548 bthnht.exe vpdpp.exe PID 1548 wrote to memory of 4844 1548 bthnht.exe vpdpp.exe PID 4844 wrote to memory of 756 4844 vpdpp.exe jjdvp.exe PID 4844 wrote to memory of 756 4844 vpdpp.exe jjdvp.exe PID 4844 wrote to memory of 756 4844 vpdpp.exe jjdvp.exe PID 756 wrote to memory of 1284 756 jjdvp.exe frffllf.exe PID 756 wrote to memory of 1284 756 jjdvp.exe frffllf.exe PID 756 wrote to memory of 1284 756 jjdvp.exe frffllf.exe PID 1284 wrote to memory of 4648 1284 frffllf.exe bnhntt.exe PID 1284 wrote to memory of 4648 1284 frffllf.exe bnhntt.exe PID 1284 wrote to memory of 4648 1284 frffllf.exe bnhntt.exe PID 4648 wrote to memory of 5028 4648 bnhntt.exe tthtbt.exe PID 4648 wrote to memory of 5028 4648 bnhntt.exe tthtbt.exe PID 4648 wrote to memory of 5028 4648 bnhntt.exe tthtbt.exe PID 5028 wrote to memory of 4700 5028 tthtbt.exe vjvpj.exe PID 5028 wrote to memory of 4700 5028 tthtbt.exe vjvpj.exe PID 5028 wrote to memory of 4700 5028 tthtbt.exe vjvpj.exe PID 4700 wrote to memory of 912 4700 vjvpj.exe fxlflfl.exe PID 4700 wrote to memory of 912 4700 vjvpj.exe fxlflfl.exe PID 4700 wrote to memory of 912 4700 vjvpj.exe fxlflfl.exe PID 912 wrote to memory of 1520 912 fxlflfl.exe lfxrlxx.exe PID 912 wrote to memory of 1520 912 fxlflfl.exe lfxrlxx.exe PID 912 wrote to memory of 1520 912 fxlflfl.exe lfxrlxx.exe PID 1520 wrote to memory of 4468 1520 lfxrlxx.exe httthn.exe PID 1520 wrote to memory of 4468 1520 lfxrlxx.exe httthn.exe PID 1520 wrote to memory of 4468 1520 lfxrlxx.exe httthn.exe PID 4468 wrote to memory of 5088 4468 httthn.exe vdpvv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cb0fadc62b32680b16d992bcff194da5dd1aaf45ef04ecfc102546bcb030914.exe"C:\Users\Admin\AppData\Local\Temp\1cb0fadc62b32680b16d992bcff194da5dd1aaf45ef04ecfc102546bcb030914.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\lflfxxx.exec:\lflfxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btttnn.exec:\btttnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdpjj.exec:\vdpjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrrlxxx.exec:\lrrlxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbhbtt.exec:\tbhbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvjdd.exec:\jvjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfllfxx.exec:\rfllfxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thnttt.exec:\thnttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djvjp.exec:\djvjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lffrlxx.exec:\lffrlxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bthnht.exec:\bthnht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpdpp.exec:\vpdpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjdvp.exec:\jjdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frffllf.exec:\frffllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnhntt.exec:\bnhntt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tthtbt.exec:\tthtbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjvpj.exec:\vjvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxlflfl.exec:\fxlflfl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxrlxx.exec:\lfxrlxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\httthn.exec:\httthn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdpvv.exec:\vdpvv.exe23⤵
- Executes dropped EXE
-
\??\c:\pvvvp.exec:\pvvvp.exe24⤵
- Executes dropped EXE
-
\??\c:\llfxxxr.exec:\llfxxxr.exe25⤵
- Executes dropped EXE
-
\??\c:\ttnnnt.exec:\ttnnnt.exe26⤵
- Executes dropped EXE
-
\??\c:\ppvpj.exec:\ppvpj.exe27⤵
- Executes dropped EXE
-
\??\c:\flrlllf.exec:\flrlllf.exe28⤵
- Executes dropped EXE
-
\??\c:\btttnn.exec:\btttnn.exe29⤵
- Executes dropped EXE
-
\??\c:\nbnnnb.exec:\nbnnnb.exe30⤵
- Executes dropped EXE
-
\??\c:\jjpdv.exec:\jjpdv.exe31⤵
- Executes dropped EXE
-
\??\c:\llrlxlf.exec:\llrlxlf.exe32⤵
- Executes dropped EXE
-
\??\c:\lflllrl.exec:\lflllrl.exe33⤵
- Executes dropped EXE
-
\??\c:\hhbbbb.exec:\hhbbbb.exe34⤵
- Executes dropped EXE
-
\??\c:\jjdjd.exec:\jjdjd.exe35⤵
- Executes dropped EXE
-
\??\c:\5jpdd.exec:\5jpdd.exe36⤵
- Executes dropped EXE
-
\??\c:\xllfxff.exec:\xllfxff.exe37⤵
- Executes dropped EXE
-
\??\c:\fxlllrl.exec:\fxlllrl.exe38⤵
- Executes dropped EXE
-
\??\c:\tnnnhh.exec:\tnnnhh.exe39⤵
- Executes dropped EXE
-
\??\c:\9jjvv.exec:\9jjvv.exe40⤵
- Executes dropped EXE
-
\??\c:\5pvpj.exec:\5pvpj.exe41⤵
- Executes dropped EXE
-
\??\c:\dvpjv.exec:\dvpjv.exe42⤵
- Executes dropped EXE
-
\??\c:\7llxrrl.exec:\7llxrrl.exe43⤵
- Executes dropped EXE
-
\??\c:\nntttt.exec:\nntttt.exe44⤵
- Executes dropped EXE
-
\??\c:\3bnhhb.exec:\3bnhhb.exe45⤵
- Executes dropped EXE
-
\??\c:\vdppv.exec:\vdppv.exe46⤵
- Executes dropped EXE
-
\??\c:\1rxrrll.exec:\1rxrrll.exe47⤵
- Executes dropped EXE
-
\??\c:\lffxrrr.exec:\lffxrrr.exe48⤵
- Executes dropped EXE
-
\??\c:\nnnhhh.exec:\nnnhhh.exe49⤵
- Executes dropped EXE
-
\??\c:\bnnnhh.exec:\bnnnhh.exe50⤵
- Executes dropped EXE
-
\??\c:\jdjdv.exec:\jdjdv.exe51⤵
- Executes dropped EXE
-
\??\c:\5jjjv.exec:\5jjjv.exe52⤵
- Executes dropped EXE
-
\??\c:\xrrrrxx.exec:\xrrrrxx.exe53⤵
- Executes dropped EXE
-
\??\c:\lflrlff.exec:\lflrlff.exe54⤵
- Executes dropped EXE
-
\??\c:\bthhbh.exec:\bthhbh.exe55⤵
- Executes dropped EXE
-
\??\c:\7dvvj.exec:\7dvvj.exe56⤵
- Executes dropped EXE
-
\??\c:\jvppp.exec:\jvppp.exe57⤵
- Executes dropped EXE
-
\??\c:\rlxxrrr.exec:\rlxxrrr.exe58⤵
- Executes dropped EXE
-
\??\c:\rxxxrrf.exec:\rxxxrrf.exe59⤵
- Executes dropped EXE
-
\??\c:\thhbbb.exec:\thhbbb.exe60⤵
- Executes dropped EXE
-
\??\c:\5nnnhn.exec:\5nnnhn.exe61⤵
- Executes dropped EXE
-
\??\c:\tnbttt.exec:\tnbttt.exe62⤵
- Executes dropped EXE
-
\??\c:\pjjdj.exec:\pjjdj.exe63⤵
- Executes dropped EXE
-
\??\c:\vvdpj.exec:\vvdpj.exe64⤵
- Executes dropped EXE
-
\??\c:\xxxxlll.exec:\xxxxlll.exe65⤵
- Executes dropped EXE
-
\??\c:\ffffffx.exec:\ffffffx.exe66⤵
-
\??\c:\bttttb.exec:\bttttb.exe67⤵
-
\??\c:\pjjdj.exec:\pjjdj.exe68⤵
-
\??\c:\dvjdd.exec:\dvjdd.exe69⤵
-
\??\c:\fffxrrl.exec:\fffxrrl.exe70⤵
-
\??\c:\xrffflf.exec:\xrffflf.exe71⤵
-
\??\c:\htbtnn.exec:\htbtnn.exe72⤵
-
\??\c:\hbnnnn.exec:\hbnnnn.exe73⤵
-
\??\c:\dvdvp.exec:\dvdvp.exe74⤵
-
\??\c:\pjpjd.exec:\pjpjd.exe75⤵
-
\??\c:\rllfflf.exec:\rllfflf.exe76⤵
-
\??\c:\tnhntb.exec:\tnhntb.exe77⤵
-
\??\c:\bhtnhh.exec:\bhtnhh.exe78⤵
-
\??\c:\pddvp.exec:\pddvp.exe79⤵
-
\??\c:\ddpdv.exec:\ddpdv.exe80⤵
-
\??\c:\fffrllf.exec:\fffrllf.exe81⤵
-
\??\c:\rlrlfxf.exec:\rlrlfxf.exe82⤵
-
\??\c:\hbhhhh.exec:\hbhhhh.exe83⤵
-
\??\c:\ttbbtt.exec:\ttbbtt.exe84⤵
-
\??\c:\3vdpj.exec:\3vdpj.exe85⤵
-
\??\c:\3jdpd.exec:\3jdpd.exe86⤵
-
\??\c:\xfxxfff.exec:\xfxxfff.exe87⤵
-
\??\c:\thnnhn.exec:\thnnhn.exe88⤵
-
\??\c:\hnnbnt.exec:\hnnbnt.exe89⤵
-
\??\c:\djpvp.exec:\djpvp.exe90⤵
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe91⤵
-
\??\c:\lrxfxxx.exec:\lrxfxxx.exe92⤵
-
\??\c:\hhhbtb.exec:\hhhbtb.exe93⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe94⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe95⤵
-
\??\c:\lflffxx.exec:\lflffxx.exe96⤵
-
\??\c:\5nnhbt.exec:\5nnhbt.exe97⤵
-
\??\c:\thhbtb.exec:\thhbtb.exe98⤵
-
\??\c:\vpdvp.exec:\vpdvp.exe99⤵
-
\??\c:\flffxxr.exec:\flffxxr.exe100⤵
-
\??\c:\flfllff.exec:\flfllff.exe101⤵
-
\??\c:\tnnbtt.exec:\tnnbtt.exe102⤵
-
\??\c:\pjpjj.exec:\pjpjj.exe103⤵
-
\??\c:\vvvdv.exec:\vvvdv.exe104⤵
-
\??\c:\vvjjj.exec:\vvjjj.exe105⤵
-
\??\c:\xrlfrrr.exec:\xrlfrrr.exe106⤵
-
\??\c:\ffxxrrx.exec:\ffxxrrx.exe107⤵
-
\??\c:\bhnnnt.exec:\bhnnnt.exe108⤵
-
\??\c:\ttnhhh.exec:\ttnhhh.exe109⤵
-
\??\c:\pvjvj.exec:\pvjvj.exe110⤵
-
\??\c:\xrrlffx.exec:\xrrlffx.exe111⤵
-
\??\c:\rxlrrll.exec:\rxlrrll.exe112⤵
-
\??\c:\bthhnt.exec:\bthhnt.exe113⤵
-
\??\c:\hnnbnn.exec:\hnnbnn.exe114⤵
-
\??\c:\3jjdv.exec:\3jjdv.exe115⤵
-
\??\c:\djjdv.exec:\djjdv.exe116⤵
-
\??\c:\lflfxxr.exec:\lflfxxr.exe117⤵
-
\??\c:\xrxrlxr.exec:\xrxrlxr.exe118⤵
-
\??\c:\tththh.exec:\tththh.exe119⤵
-
\??\c:\bttnnn.exec:\bttnnn.exe120⤵
-
\??\c:\vdddv.exec:\vdddv.exe121⤵
-
\??\c:\pdjdd.exec:\pdjdd.exe122⤵
-
\??\c:\xllfrrl.exec:\xllfrrl.exe123⤵
-
\??\c:\fflfllf.exec:\fflfllf.exe124⤵
-
\??\c:\xxrlffl.exec:\xxrlffl.exe125⤵
-
\??\c:\btbttt.exec:\btbttt.exe126⤵
-
\??\c:\thnhhn.exec:\thnhhn.exe127⤵
-
\??\c:\pjpjp.exec:\pjpjp.exe128⤵
-
\??\c:\jpppp.exec:\jpppp.exe129⤵
-
\??\c:\xfxrfxr.exec:\xfxrfxr.exe130⤵
-
\??\c:\xrfxrlf.exec:\xrfxrlf.exe131⤵
-
\??\c:\3tbtbt.exec:\3tbtbt.exe132⤵
-
\??\c:\htttbt.exec:\htttbt.exe133⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe134⤵
-
\??\c:\vpvpd.exec:\vpvpd.exe135⤵
-
\??\c:\rxffxrl.exec:\rxffxrl.exe136⤵
-
\??\c:\tbthtn.exec:\tbthtn.exe137⤵
-
\??\c:\htthhb.exec:\htthhb.exe138⤵
-
\??\c:\vvpjv.exec:\vvpjv.exe139⤵
-
\??\c:\3vdvv.exec:\3vdvv.exe140⤵
-
\??\c:\rxxrlll.exec:\rxxrlll.exe141⤵
-
\??\c:\nnbbhh.exec:\nnbbhh.exe142⤵
-
\??\c:\5vppd.exec:\5vppd.exe143⤵
-
\??\c:\jvpjv.exec:\jvpjv.exe144⤵
-
\??\c:\fxlfllx.exec:\fxlfllx.exe145⤵
-
\??\c:\rflrlfl.exec:\rflrlfl.exe146⤵
-
\??\c:\thbtnh.exec:\thbtnh.exe147⤵
-
\??\c:\nbtnnh.exec:\nbtnnh.exe148⤵
-
\??\c:\vvpjp.exec:\vvpjp.exe149⤵
-
\??\c:\dppdd.exec:\dppdd.exe150⤵
-
\??\c:\xlxllff.exec:\xlxllff.exe151⤵
-
\??\c:\nbtnbt.exec:\nbtnbt.exe152⤵
-
\??\c:\nhnhhh.exec:\nhnhhh.exe153⤵
-
\??\c:\3dvpv.exec:\3dvpv.exe154⤵
-
\??\c:\pdpjd.exec:\pdpjd.exe155⤵
-
\??\c:\7xfxllx.exec:\7xfxllx.exe156⤵
-
\??\c:\5hnbtn.exec:\5hnbtn.exe157⤵
-
\??\c:\hthbtt.exec:\hthbtt.exe158⤵
-
\??\c:\vvdpd.exec:\vvdpd.exe159⤵
-
\??\c:\lrfxlfr.exec:\lrfxlfr.exe160⤵
-
\??\c:\bnnbnh.exec:\bnnbnh.exe161⤵
-
\??\c:\3bbbnh.exec:\3bbbnh.exe162⤵
-
\??\c:\vvjdd.exec:\vvjdd.exe163⤵
-
\??\c:\vpdvd.exec:\vpdvd.exe164⤵
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe165⤵
-
\??\c:\hnnhtt.exec:\hnnhtt.exe166⤵
-
\??\c:\9pjdp.exec:\9pjdp.exe167⤵
-
\??\c:\vppjd.exec:\vppjd.exe168⤵
-
\??\c:\fffxlfr.exec:\fffxlfr.exe169⤵
-
\??\c:\xllxrfx.exec:\xllxrfx.exe170⤵
-
\??\c:\htnnhn.exec:\htnnhn.exe171⤵
-
\??\c:\vvjjd.exec:\vvjjd.exe172⤵
-
\??\c:\pddpd.exec:\pddpd.exe173⤵
-
\??\c:\1ffxllx.exec:\1ffxllx.exe174⤵
-
\??\c:\rxffxrx.exec:\rxffxrx.exe175⤵
-
\??\c:\pdpjp.exec:\pdpjp.exe176⤵
-
\??\c:\5xffxrl.exec:\5xffxrl.exe177⤵
-
\??\c:\nntntn.exec:\nntntn.exe178⤵
-
\??\c:\xlrlffx.exec:\xlrlffx.exe179⤵
-
\??\c:\thhbtt.exec:\thhbtt.exe180⤵
-
\??\c:\djppj.exec:\djppj.exe181⤵
-
\??\c:\9dvjv.exec:\9dvjv.exe182⤵
-
\??\c:\7ffxlfx.exec:\7ffxlfx.exe183⤵
-
\??\c:\fxxrffx.exec:\fxxrffx.exe184⤵
-
\??\c:\tnnbbt.exec:\tnnbbt.exe185⤵
-
\??\c:\jpvjv.exec:\jpvjv.exe186⤵
-
\??\c:\pvvpd.exec:\pvvpd.exe187⤵
-
\??\c:\lrlfxxr.exec:\lrlfxxr.exe188⤵
-
\??\c:\htnhbt.exec:\htnhbt.exe189⤵
-
\??\c:\nbnhtn.exec:\nbnhtn.exe190⤵
-
\??\c:\vjvvv.exec:\vjvvv.exe191⤵
-
\??\c:\jdpdd.exec:\jdpdd.exe192⤵
-
\??\c:\lxlfrrf.exec:\lxlfrrf.exe193⤵
-
\??\c:\fxlrrrx.exec:\fxlrrrx.exe194⤵
-
\??\c:\bhnthb.exec:\bhnthb.exe195⤵
-
\??\c:\bhhbnn.exec:\bhhbnn.exe196⤵
-
\??\c:\tntnhh.exec:\tntnhh.exe197⤵
-
\??\c:\jpddp.exec:\jpddp.exe198⤵
-
\??\c:\jdpjv.exec:\jdpjv.exe199⤵
-
\??\c:\llrlxrl.exec:\llrlxrl.exe200⤵
-
\??\c:\1lfxrlf.exec:\1lfxrlf.exe201⤵
-
\??\c:\7bbthn.exec:\7bbthn.exe202⤵
-
\??\c:\5nhbnh.exec:\5nhbnh.exe203⤵
-
\??\c:\pvvjv.exec:\pvvjv.exe204⤵
-
\??\c:\pjjdp.exec:\pjjdp.exe205⤵
-
\??\c:\lxxlrrf.exec:\lxxlrrf.exe206⤵
-
\??\c:\xxfxrlf.exec:\xxfxrlf.exe207⤵
-
\??\c:\7nnbtn.exec:\7nnbtn.exe208⤵
-
\??\c:\nbthtt.exec:\nbthtt.exe209⤵
-
\??\c:\1dvjd.exec:\1dvjd.exe210⤵
-
\??\c:\dvpdv.exec:\dvpdv.exe211⤵
-
\??\c:\vvpvd.exec:\vvpvd.exe212⤵
-
\??\c:\frfxlrl.exec:\frfxlrl.exe213⤵
-
\??\c:\1bbtbt.exec:\1bbtbt.exe214⤵
-
\??\c:\hbbbth.exec:\hbbbth.exe215⤵
-
\??\c:\jpjdp.exec:\jpjdp.exe216⤵
-
\??\c:\jjdvp.exec:\jjdvp.exe217⤵
-
\??\c:\lxfxffl.exec:\lxfxffl.exe218⤵
-
\??\c:\lfffrrr.exec:\lfffrrr.exe219⤵
-
\??\c:\nhnnnn.exec:\nhnnnn.exe220⤵
-
\??\c:\bbbthb.exec:\bbbthb.exe221⤵
-
\??\c:\dvvvj.exec:\dvvvj.exe222⤵
-
\??\c:\7pjdp.exec:\7pjdp.exe223⤵
-
\??\c:\9jjvp.exec:\9jjvp.exe224⤵
-
\??\c:\5frllll.exec:\5frllll.exe225⤵
-
\??\c:\frllllf.exec:\frllllf.exe226⤵
-
\??\c:\7hhbnn.exec:\7hhbnn.exe227⤵
-
\??\c:\3bhbhb.exec:\3bhbhb.exe228⤵
-
\??\c:\vpvpj.exec:\vpvpj.exe229⤵
-
\??\c:\dddvd.exec:\dddvd.exe230⤵
-
\??\c:\frlxllx.exec:\frlxllx.exe231⤵
-
\??\c:\lffxrrr.exec:\lffxrrr.exe232⤵
-
\??\c:\btbttn.exec:\btbttn.exe233⤵
-
\??\c:\tbhnbt.exec:\tbhnbt.exe234⤵
-
\??\c:\vpjdp.exec:\vpjdp.exe235⤵
-
\??\c:\dpvdp.exec:\dpvdp.exe236⤵
-
\??\c:\xrrlrrx.exec:\xrrlrrx.exe237⤵
-
\??\c:\llfxrlx.exec:\llfxrlx.exe238⤵
-
\??\c:\tbtnnb.exec:\tbtnnb.exe239⤵
-
\??\c:\7bnhbt.exec:\7bnhbt.exe240⤵
-
\??\c:\vjvpj.exec:\vjvpj.exe241⤵