Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 18:38
Behavioral task
behavioral1
Sample
0c3f207ab116e7cb9fcee39f195ae130d60166a146a23d1042ca3601123ab765.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
-
Target
0c3f207ab116e7cb9fcee39f195ae130d60166a146a23d1042ca3601123ab765.exe
-
Size
92KB
-
MD5
188b78c954aeb9aff615246709f49de7
-
SHA1
481563293cbcc35863de33e1b462ffa3dde4b822
-
SHA256
0c3f207ab116e7cb9fcee39f195ae130d60166a146a23d1042ca3601123ab765
-
SHA512
0d715d8cca29b1fbad54c11ce87b448899cf50d6a155e355947534184c95e8914ed65425d3b8e6146c6e6330d85c1525161552cab038cdeef72a6e40e8983bb4
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWpWGB:8hOmTsF93UYfwC6GIout0fmCiiiXA6mz
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3236-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1324-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4776-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2596-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1064-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2840-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3100-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1748-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2252-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1412-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4164-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3280-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3388-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1824-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2388-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3580-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4984-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1708-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3688-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4840-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2900-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/532-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3000-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4752-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4752-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4244-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3188-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4748-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2084-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2736-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1600-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3588-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1128-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2332-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-527-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-549-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3588-571-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2388-599-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1352-666-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3236-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3236-4-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xxrlrrx.exe UPX C:\hbtttt.exe UPX C:\jjjdp.exe UPX behavioral2/memory/1324-12-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4776-11-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2596-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\vvdvp.exe UPX behavioral2/memory/1064-22-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xrrrlll.exe UPX behavioral2/memory/2840-27-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xlrrlrr.exe UPX behavioral2/memory/3100-31-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vpppj.exe UPX behavioral2/memory/3100-37-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pjvpv.exe UPX behavioral2/memory/1748-42-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xlxrflf.exe UPX behavioral2/memory/5000-46-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tbtnnt.exe UPX behavioral2/memory/5000-50-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3712-52-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\thbhbn.exe UPX behavioral2/memory/3712-56-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\flxrllf.exe UPX behavioral2/memory/2376-62-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xrlfrrf.exe UPX behavioral2/memory/2876-66-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\httnhh.exe UPX C:\jdvpv.exe UPX behavioral2/memory/2252-76-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xrlrxfr.exe UPX behavioral2/memory/1412-80-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5076-82-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ttttnn.exe UPX C:\bbtnnn.exe UPX behavioral2/memory/4736-89-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4164-92-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4164-96-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jdjjd.exe UPX \??\c:\rfrlffx.exe UPX behavioral2/memory/4824-103-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hhbtnn.exe UPX behavioral2/memory/3280-107-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pjdvd.exe UPX behavioral2/memory/3280-112-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xrxxrrr.exe UPX behavioral2/memory/2552-117-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\fxlrlrx.exe UPX C:\tnhbnn.exe UPX C:\3nttnn.exe UPX \??\c:\dvpvj.exe UPX C:\frxxrrr.exe UPX behavioral2/memory/5052-139-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\fflrrrr.exe UPX C:\dpvpj.exe UPX C:\ddpdd.exe UPX C:\frfrfll.exe UPX behavioral2/memory/3388-156-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1784-158-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1784-161-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1824-163-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2388-167-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
xxrlrrx.exehbtttt.exejjjdp.exevvdvp.exexrrrlll.exexlrrlrr.exevpppj.exepjvpv.exexlxrflf.exetbtnnt.exethbhbn.exeflxrllf.exexrlfrrf.exehttnhh.exejdvpv.exexrlrxfr.exettttnn.exebbtnnn.exejdjjd.exerfrlffx.exehhbtnn.exepjdvd.exexrxxrrr.exefxlrlrx.exetnhbnn.exe3nttnn.exedvpvj.exefrxxrrr.exefflrrrr.exedpvpj.exeddpdd.exefrfrfll.exenntnnn.exenbnhhh.exejjpjj.exexrxrlll.exerflfxff.exehbbhnn.exebhhbbh.exedddjj.exexrrlfff.exebbhbbb.exethhnbb.exedddvv.exefrrlfll.exennhbnh.exehnntnt.exeppddj.exeppvvp.exerlllxff.exehbbbtb.exehhttnn.exedvvpp.exexllxxll.exefllrlfx.exehhtntt.exe7htnhh.exe1nbbtt.exenhhbtt.exebbntbh.exedddvv.exelxrlfxx.exeffxxxxx.exehhnhhh.exepid process 1324 xxrlrrx.exe 4776 hbtttt.exe 2596 jjjdp.exe 1064 vvdvp.exe 2840 xrrrlll.exe 3100 xlrrlrr.exe 1748 vpppj.exe 3464 pjvpv.exe 5000 xlxrflf.exe 3712 tbtnnt.exe 2376 thbhbn.exe 2876 flxrllf.exe 2736 xrlfrrf.exe 2252 httnhh.exe 1412 jdvpv.exe 5076 xrlrxfr.exe 4736 ttttnn.exe 4164 bbtnnn.exe 316 jdjjd.exe 4824 rfrlffx.exe 3280 hhbtnn.exe 2552 pjdvd.exe 3396 xrxxrrr.exe 532 fxlrlrx.exe 3476 tnhbnn.exe 1244 3nttnn.exe 3984 dvpvj.exe 5052 frxxrrr.exe 1128 fflrrrr.exe 1160 dpvpj.exe 976 ddpdd.exe 3388 frfrfll.exe 1784 nntnnn.exe 1824 nbnhhh.exe 2388 jjpjj.exe 1400 xrxrlll.exe 4132 rflfxff.exe 2996 hbbhnn.exe 1176 bhhbbh.exe 3580 dddjj.exe 1044 xrrlfff.exe 1444 bbhbbb.exe 3744 thhnbb.exe 4432 dddvv.exe 4984 frrlfll.exe 3444 nnhbnh.exe 1708 hnntnt.exe 4436 ppddj.exe 2984 ppvvp.exe 3064 rlllxff.exe 1080 hbbbtb.exe 3380 hhttnn.exe 3100 dvvpp.exe 4764 xllxxll.exe 3688 fllrlfx.exe 4508 hhtntt.exe 2888 7htnhh.exe 1484 1nbbtt.exe 1504 nhhbtt.exe 2376 bbntbh.exe 848 dddvv.exe 2012 lxrlfxx.exe 5028 ffxxxxx.exe 2252 hhnhhh.exe -
Processes:
resource yara_rule behavioral2/memory/3236-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3236-4-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxrlrrx.exe upx C:\hbtttt.exe upx C:\jjjdp.exe upx behavioral2/memory/1324-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4776-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2596-17-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vvdvp.exe upx behavioral2/memory/1064-22-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrrrlll.exe upx behavioral2/memory/2840-27-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlrrlrr.exe upx behavioral2/memory/3100-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpppj.exe upx behavioral2/memory/3100-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjvpv.exe upx behavioral2/memory/1748-42-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlxrflf.exe upx behavioral2/memory/5000-46-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbtnnt.exe upx behavioral2/memory/5000-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3712-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thbhbn.exe upx behavioral2/memory/3712-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\flxrllf.exe upx behavioral2/memory/2376-62-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrlfrrf.exe upx behavioral2/memory/2876-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\httnhh.exe upx C:\jdvpv.exe upx behavioral2/memory/2252-76-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrlrxfr.exe upx behavioral2/memory/1412-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5076-82-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttttnn.exe upx C:\bbtnnn.exe upx behavioral2/memory/4736-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4164-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4164-96-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdjjd.exe upx \??\c:\rfrlffx.exe upx behavioral2/memory/4824-103-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhbtnn.exe upx behavioral2/memory/3280-107-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjdvd.exe upx behavioral2/memory/3280-112-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrxxrrr.exe upx behavioral2/memory/2552-117-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxlrlrx.exe upx C:\tnhbnn.exe upx C:\3nttnn.exe upx \??\c:\dvpvj.exe upx C:\frxxrrr.exe upx behavioral2/memory/5052-139-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fflrrrr.exe upx C:\dpvpj.exe upx C:\ddpdd.exe upx C:\frfrfll.exe upx behavioral2/memory/3388-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1784-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1784-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1824-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2388-167-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0c3f207ab116e7cb9fcee39f195ae130d60166a146a23d1042ca3601123ab765.exexxrlrrx.exehbtttt.exejjjdp.exevvdvp.exexrrrlll.exexlrrlrr.exevpppj.exepjvpv.exexlxrflf.exetbtnnt.exethbhbn.exeflxrllf.exexrlfrrf.exehttnhh.exejdvpv.exexrlrxfr.exettttnn.exebbtnnn.exejdjjd.exerfrlffx.exehhbtnn.exedescription pid process target process PID 3236 wrote to memory of 1324 3236 0c3f207ab116e7cb9fcee39f195ae130d60166a146a23d1042ca3601123ab765.exe xxrlrrx.exe PID 3236 wrote to memory of 1324 3236 0c3f207ab116e7cb9fcee39f195ae130d60166a146a23d1042ca3601123ab765.exe xxrlrrx.exe PID 3236 wrote to memory of 1324 3236 0c3f207ab116e7cb9fcee39f195ae130d60166a146a23d1042ca3601123ab765.exe xxrlrrx.exe PID 1324 wrote to memory of 4776 1324 xxrlrrx.exe hbtttt.exe PID 1324 wrote to memory of 4776 1324 xxrlrrx.exe hbtttt.exe PID 1324 wrote to memory of 4776 1324 xxrlrrx.exe hbtttt.exe PID 4776 wrote to memory of 2596 4776 hbtttt.exe jjjdp.exe PID 4776 wrote to memory of 2596 4776 hbtttt.exe jjjdp.exe PID 4776 wrote to memory of 2596 4776 hbtttt.exe jjjdp.exe PID 2596 wrote to memory of 1064 2596 jjjdp.exe vvdvp.exe PID 2596 wrote to memory of 1064 2596 jjjdp.exe vvdvp.exe PID 2596 wrote to memory of 1064 2596 jjjdp.exe vvdvp.exe PID 1064 wrote to memory of 2840 1064 vvdvp.exe xrrrlll.exe PID 1064 wrote to memory of 2840 1064 vvdvp.exe xrrrlll.exe PID 1064 wrote to memory of 2840 1064 vvdvp.exe xrrrlll.exe PID 2840 wrote to memory of 3100 2840 xrrrlll.exe xlrrlrr.exe PID 2840 wrote to memory of 3100 2840 xrrrlll.exe xlrrlrr.exe PID 2840 wrote to memory of 3100 2840 xrrrlll.exe xlrrlrr.exe PID 3100 wrote to memory of 1748 3100 xlrrlrr.exe vpppj.exe PID 3100 wrote to memory of 1748 3100 xlrrlrr.exe vpppj.exe PID 3100 wrote to memory of 1748 3100 xlrrlrr.exe vpppj.exe PID 1748 wrote to memory of 3464 1748 vpppj.exe pjvpv.exe PID 1748 wrote to memory of 3464 1748 vpppj.exe pjvpv.exe PID 1748 wrote to memory of 3464 1748 vpppj.exe pjvpv.exe PID 3464 wrote to memory of 5000 3464 pjvpv.exe xlxrflf.exe PID 3464 wrote to memory of 5000 3464 pjvpv.exe xlxrflf.exe PID 3464 wrote to memory of 5000 3464 pjvpv.exe xlxrflf.exe PID 5000 wrote to memory of 3712 5000 xlxrflf.exe tbtnnt.exe PID 5000 wrote to memory of 3712 5000 xlxrflf.exe tbtnnt.exe PID 5000 wrote to memory of 3712 5000 xlxrflf.exe tbtnnt.exe PID 3712 wrote to memory of 2376 3712 tbtnnt.exe thbhbn.exe PID 3712 wrote to memory of 2376 3712 tbtnnt.exe thbhbn.exe PID 3712 wrote to memory of 2376 3712 tbtnnt.exe thbhbn.exe PID 2376 wrote to memory of 2876 2376 thbhbn.exe flxrllf.exe PID 2376 wrote to memory of 2876 2376 thbhbn.exe flxrllf.exe PID 2376 wrote to memory of 2876 2376 thbhbn.exe flxrllf.exe PID 2876 wrote to memory of 2736 2876 flxrllf.exe xrlfrrf.exe PID 2876 wrote to memory of 2736 2876 flxrllf.exe xrlfrrf.exe PID 2876 wrote to memory of 2736 2876 flxrllf.exe xrlfrrf.exe PID 2736 wrote to memory of 2252 2736 xrlfrrf.exe httnhh.exe PID 2736 wrote to memory of 2252 2736 xrlfrrf.exe httnhh.exe PID 2736 wrote to memory of 2252 2736 xrlfrrf.exe httnhh.exe PID 2252 wrote to memory of 1412 2252 httnhh.exe jdvpv.exe PID 2252 wrote to memory of 1412 2252 httnhh.exe jdvpv.exe PID 2252 wrote to memory of 1412 2252 httnhh.exe jdvpv.exe PID 1412 wrote to memory of 5076 1412 jdvpv.exe xrlrxfr.exe PID 1412 wrote to memory of 5076 1412 jdvpv.exe xrlrxfr.exe PID 1412 wrote to memory of 5076 1412 jdvpv.exe xrlrxfr.exe PID 5076 wrote to memory of 4736 5076 xrlrxfr.exe ttttnn.exe PID 5076 wrote to memory of 4736 5076 xrlrxfr.exe ttttnn.exe PID 5076 wrote to memory of 4736 5076 xrlrxfr.exe ttttnn.exe PID 4736 wrote to memory of 4164 4736 ttttnn.exe bbtnnn.exe PID 4736 wrote to memory of 4164 4736 ttttnn.exe bbtnnn.exe PID 4736 wrote to memory of 4164 4736 ttttnn.exe bbtnnn.exe PID 4164 wrote to memory of 316 4164 bbtnnn.exe jdjjd.exe PID 4164 wrote to memory of 316 4164 bbtnnn.exe jdjjd.exe PID 4164 wrote to memory of 316 4164 bbtnnn.exe jdjjd.exe PID 316 wrote to memory of 4824 316 jdjjd.exe rfrlffx.exe PID 316 wrote to memory of 4824 316 jdjjd.exe rfrlffx.exe PID 316 wrote to memory of 4824 316 jdjjd.exe rfrlffx.exe PID 4824 wrote to memory of 3280 4824 rfrlffx.exe hhbtnn.exe PID 4824 wrote to memory of 3280 4824 rfrlffx.exe hhbtnn.exe PID 4824 wrote to memory of 3280 4824 rfrlffx.exe hhbtnn.exe PID 3280 wrote to memory of 2552 3280 hhbtnn.exe pjdvd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c3f207ab116e7cb9fcee39f195ae130d60166a146a23d1042ca3601123ab765.exe"C:\Users\Admin\AppData\Local\Temp\0c3f207ab116e7cb9fcee39f195ae130d60166a146a23d1042ca3601123ab765.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbtttt.exec:\hbtttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjjdp.exec:\jjjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvdvp.exec:\vvdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrrrlll.exec:\xrrrlll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlrrlrr.exec:\xlrrlrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpppj.exec:\vpppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvpv.exec:\pjvpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlxrflf.exec:\xlxrflf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbtnnt.exec:\tbtnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thbhbn.exec:\thbhbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flxrllf.exec:\flxrllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrlfrrf.exec:\xrlfrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\httnhh.exec:\httnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdvpv.exec:\jdvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttttnn.exec:\ttttnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbtnnn.exec:\bbtnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdjjd.exec:\jdjjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfrlffx.exec:\rfrlffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhbtnn.exec:\hhbtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjdvd.exec:\pjdvd.exe23⤵
- Executes dropped EXE
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe24⤵
- Executes dropped EXE
-
\??\c:\fxlrlrx.exec:\fxlrlrx.exe25⤵
- Executes dropped EXE
-
\??\c:\tnhbnn.exec:\tnhbnn.exe26⤵
- Executes dropped EXE
-
\??\c:\3nttnn.exec:\3nttnn.exe27⤵
- Executes dropped EXE
-
\??\c:\dvpvj.exec:\dvpvj.exe28⤵
- Executes dropped EXE
-
\??\c:\frxxrrr.exec:\frxxrrr.exe29⤵
- Executes dropped EXE
-
\??\c:\fflrrrr.exec:\fflrrrr.exe30⤵
- Executes dropped EXE
-
\??\c:\dpvpj.exec:\dpvpj.exe31⤵
- Executes dropped EXE
-
\??\c:\ddpdd.exec:\ddpdd.exe32⤵
- Executes dropped EXE
-
\??\c:\frfrfll.exec:\frfrfll.exe33⤵
- Executes dropped EXE
-
\??\c:\nntnnn.exec:\nntnnn.exe34⤵
- Executes dropped EXE
-
\??\c:\nbnhhh.exec:\nbnhhh.exe35⤵
- Executes dropped EXE
-
\??\c:\jjpjj.exec:\jjpjj.exe36⤵
- Executes dropped EXE
-
\??\c:\xrxrlll.exec:\xrxrlll.exe37⤵
- Executes dropped EXE
-
\??\c:\rflfxff.exec:\rflfxff.exe38⤵
- Executes dropped EXE
-
\??\c:\hbbhnn.exec:\hbbhnn.exe39⤵
- Executes dropped EXE
-
\??\c:\bhhbbh.exec:\bhhbbh.exe40⤵
- Executes dropped EXE
-
\??\c:\dddjj.exec:\dddjj.exe41⤵
- Executes dropped EXE
-
\??\c:\xrrlfff.exec:\xrrlfff.exe42⤵
- Executes dropped EXE
-
\??\c:\bbhbbb.exec:\bbhbbb.exe43⤵
- Executes dropped EXE
-
\??\c:\thhnbb.exec:\thhnbb.exe44⤵
- Executes dropped EXE
-
\??\c:\dddvv.exec:\dddvv.exe45⤵
- Executes dropped EXE
-
\??\c:\frrlfll.exec:\frrlfll.exe46⤵
- Executes dropped EXE
-
\??\c:\nnhbnh.exec:\nnhbnh.exe47⤵
- Executes dropped EXE
-
\??\c:\hnntnt.exec:\hnntnt.exe48⤵
- Executes dropped EXE
-
\??\c:\ppddj.exec:\ppddj.exe49⤵
- Executes dropped EXE
-
\??\c:\ppvvp.exec:\ppvvp.exe50⤵
- Executes dropped EXE
-
\??\c:\rlllxff.exec:\rlllxff.exe51⤵
- Executes dropped EXE
-
\??\c:\hbbbtb.exec:\hbbbtb.exe52⤵
- Executes dropped EXE
-
\??\c:\hhttnn.exec:\hhttnn.exe53⤵
- Executes dropped EXE
-
\??\c:\dvvpp.exec:\dvvpp.exe54⤵
- Executes dropped EXE
-
\??\c:\xllxxll.exec:\xllxxll.exe55⤵
- Executes dropped EXE
-
\??\c:\fllrlfx.exec:\fllrlfx.exe56⤵
- Executes dropped EXE
-
\??\c:\hhtntt.exec:\hhtntt.exe57⤵
- Executes dropped EXE
-
\??\c:\7htnhh.exec:\7htnhh.exe58⤵
- Executes dropped EXE
-
\??\c:\1nbbtt.exec:\1nbbtt.exe59⤵
- Executes dropped EXE
-
\??\c:\nhhbtt.exec:\nhhbtt.exe60⤵
- Executes dropped EXE
-
\??\c:\bbntbh.exec:\bbntbh.exe61⤵
- Executes dropped EXE
-
\??\c:\dddvv.exec:\dddvv.exe62⤵
- Executes dropped EXE
-
\??\c:\lxrlfxx.exec:\lxrlfxx.exe63⤵
- Executes dropped EXE
-
\??\c:\ffxxxxx.exec:\ffxxxxx.exe64⤵
- Executes dropped EXE
-
\??\c:\hhnhhh.exec:\hhnhhh.exe65⤵
- Executes dropped EXE
-
\??\c:\5htbtt.exec:\5htbtt.exe66⤵
-
\??\c:\dpvdd.exec:\dpvdd.exe67⤵
-
\??\c:\lxfxlrl.exec:\lxfxlrl.exe68⤵
-
\??\c:\lfllllx.exec:\lfllllx.exe69⤵
-
\??\c:\bbhbhb.exec:\bbhbhb.exe70⤵
-
\??\c:\pjdjv.exec:\pjdjv.exe71⤵
-
\??\c:\flrlfff.exec:\flrlfff.exe72⤵
-
\??\c:\hthtnh.exec:\hthtnh.exe73⤵
-
\??\c:\bnnbnn.exec:\bnnbnn.exe74⤵
-
\??\c:\vvjjd.exec:\vvjjd.exe75⤵
-
\??\c:\rfxfflx.exec:\rfxfflx.exe76⤵
-
\??\c:\1flflfx.exec:\1flflfx.exe77⤵
-
\??\c:\hnbbnh.exec:\hnbbnh.exe78⤵
-
\??\c:\djvpv.exec:\djvpv.exe79⤵
-
\??\c:\llxrllr.exec:\llxrllr.exe80⤵
-
\??\c:\9rlrfff.exec:\9rlrfff.exe81⤵
-
\??\c:\hbtbtn.exec:\hbtbtn.exe82⤵
-
\??\c:\1vdvp.exec:\1vdvp.exe83⤵
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe84⤵
-
\??\c:\nthhbt.exec:\nthhbt.exe85⤵
-
\??\c:\7bbbtt.exec:\7bbbtt.exe86⤵
-
\??\c:\dpppp.exec:\dpppp.exe87⤵
-
\??\c:\jpddv.exec:\jpddv.exe88⤵
-
\??\c:\1rrffff.exec:\1rrffff.exe89⤵
-
\??\c:\lflfxxf.exec:\lflfxxf.exe90⤵
-
\??\c:\nbbbtt.exec:\nbbbtt.exe91⤵
-
\??\c:\9pvdp.exec:\9pvdp.exe92⤵
-
\??\c:\vjjdv.exec:\vjjdv.exe93⤵
-
\??\c:\lrffxxr.exec:\lrffxxr.exe94⤵
-
\??\c:\7fllfff.exec:\7fllfff.exe95⤵
-
\??\c:\tttttb.exec:\tttttb.exe96⤵
-
\??\c:\bbbbbh.exec:\bbbbbh.exe97⤵
-
\??\c:\vpddv.exec:\vpddv.exe98⤵
-
\??\c:\ppjjj.exec:\ppjjj.exe99⤵
-
\??\c:\fffrrff.exec:\fffrrff.exe100⤵
-
\??\c:\tnbnbh.exec:\tnbnbh.exe101⤵
-
\??\c:\ppvvv.exec:\ppvvv.exe102⤵
-
\??\c:\llxrrrl.exec:\llxrrrl.exe103⤵
-
\??\c:\frllfff.exec:\frllfff.exe104⤵
-
\??\c:\bbhntn.exec:\bbhntn.exe105⤵
-
\??\c:\ntbtnn.exec:\ntbtnn.exe106⤵
-
\??\c:\7pvvv.exec:\7pvvv.exe107⤵
-
\??\c:\vvvvv.exec:\vvvvv.exe108⤵
-
\??\c:\3lrlxxf.exec:\3lrlxxf.exe109⤵
-
\??\c:\thnnhn.exec:\thnnhn.exe110⤵
-
\??\c:\tnhbbh.exec:\tnhbbh.exe111⤵
-
\??\c:\pjjjj.exec:\pjjjj.exe112⤵
-
\??\c:\5dddj.exec:\5dddj.exe113⤵
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe114⤵
-
\??\c:\bbtttt.exec:\bbtttt.exe115⤵
-
\??\c:\nntnhh.exec:\nntnhh.exe116⤵
-
\??\c:\vvdjv.exec:\vvdjv.exe117⤵
-
\??\c:\9ddvj.exec:\9ddvj.exe118⤵
-
\??\c:\rxfxlll.exec:\rxfxlll.exe119⤵
-
\??\c:\xfxrfff.exec:\xfxrfff.exe120⤵
-
\??\c:\bbhbhb.exec:\bbhbhb.exe121⤵
-
\??\c:\xxxfxfx.exec:\xxxfxfx.exe122⤵
-
\??\c:\fxlfxfx.exec:\fxlfxfx.exe123⤵
-
\??\c:\httttt.exec:\httttt.exe124⤵
-
\??\c:\dvvvp.exec:\dvvvp.exe125⤵
-
\??\c:\pjdvp.exec:\pjdvp.exe126⤵
-
\??\c:\1hntnn.exec:\1hntnn.exe127⤵
-
\??\c:\pjddv.exec:\pjddv.exe128⤵
-
\??\c:\pjddd.exec:\pjddd.exe129⤵
-
\??\c:\fxrllxx.exec:\fxrllxx.exe130⤵
-
\??\c:\tnttnn.exec:\tnttnn.exe131⤵
-
\??\c:\7thbhh.exec:\7thbhh.exe132⤵
-
\??\c:\jdjvv.exec:\jdjvv.exe133⤵
-
\??\c:\fxxrlll.exec:\fxxrlll.exe134⤵
-
\??\c:\rlfxxxx.exec:\rlfxxxx.exe135⤵
-
\??\c:\nhhhhh.exec:\nhhhhh.exe136⤵
-
\??\c:\hhnthn.exec:\hhnthn.exe137⤵
-
\??\c:\vdjjd.exec:\vdjjd.exe138⤵
-
\??\c:\frrllfr.exec:\frrllfr.exe139⤵
-
\??\c:\xxrrrrl.exec:\xxrrrrl.exe140⤵
-
\??\c:\htnhnn.exec:\htnhnn.exe141⤵
-
\??\c:\bhthbh.exec:\bhthbh.exe142⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe143⤵
-
\??\c:\7jjdp.exec:\7jjdp.exe144⤵
-
\??\c:\xxrlfrr.exec:\xxrlfrr.exe145⤵
-
\??\c:\rlfxrxx.exec:\rlfxrxx.exe146⤵
-
\??\c:\ttnnht.exec:\ttnnht.exe147⤵
-
\??\c:\djvvv.exec:\djvvv.exe148⤵
-
\??\c:\fxffflf.exec:\fxffflf.exe149⤵
-
\??\c:\pjjvj.exec:\pjjvj.exe150⤵
-
\??\c:\nhnhbb.exec:\nhnhbb.exe151⤵
-
\??\c:\nbttnh.exec:\nbttnh.exe152⤵
-
\??\c:\7pvpv.exec:\7pvpv.exe153⤵
-
\??\c:\vpppv.exec:\vpppv.exe154⤵
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe155⤵
-
\??\c:\hbntnn.exec:\hbntnn.exe156⤵
-
\??\c:\dvjdj.exec:\dvjdj.exe157⤵
-
\??\c:\xrffxxx.exec:\xrffxxx.exe158⤵
-
\??\c:\xffflrf.exec:\xffflrf.exe159⤵
-
\??\c:\nttthn.exec:\nttthn.exe160⤵
-
\??\c:\pdjdv.exec:\pdjdv.exe161⤵
-
\??\c:\xrxrrlf.exec:\xrxrrlf.exe162⤵
-
\??\c:\bhnnhh.exec:\bhnnhh.exe163⤵
-
\??\c:\jjpjj.exec:\jjpjj.exe164⤵
-
\??\c:\djpvp.exec:\djpvp.exe165⤵
-
\??\c:\ddpjp.exec:\ddpjp.exe166⤵
-
\??\c:\rflffxr.exec:\rflffxr.exe167⤵
-
\??\c:\lfrrlll.exec:\lfrrlll.exe168⤵
-
\??\c:\nhtnnn.exec:\nhtnnn.exe169⤵
-
\??\c:\hthhbh.exec:\hthhbh.exe170⤵
-
\??\c:\vvpjp.exec:\vvpjp.exe171⤵
-
\??\c:\dpjpv.exec:\dpjpv.exe172⤵
-
\??\c:\ffxflrf.exec:\ffxflrf.exe173⤵
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe174⤵
-
\??\c:\3nhnnt.exec:\3nhnnt.exe175⤵
-
\??\c:\hhntnn.exec:\hhntnn.exe176⤵
-
\??\c:\7jjjd.exec:\7jjjd.exe177⤵
-
\??\c:\vjjdp.exec:\vjjdp.exe178⤵
-
\??\c:\rlllfff.exec:\rlllfff.exe179⤵
-
\??\c:\xxfxffr.exec:\xxfxffr.exe180⤵
-
\??\c:\nnbbbb.exec:\nnbbbb.exe181⤵
-
\??\c:\5htnhh.exec:\5htnhh.exe182⤵
-
\??\c:\5dppj.exec:\5dppj.exe183⤵
-
\??\c:\xfllffr.exec:\xfllffr.exe184⤵
-
\??\c:\lfxxxxx.exec:\lfxxxxx.exe185⤵
-
\??\c:\tbhhbb.exec:\tbhhbb.exe186⤵
-
\??\c:\bththh.exec:\bththh.exe187⤵
-
\??\c:\vpddv.exec:\vpddv.exe188⤵
-
\??\c:\rllfffx.exec:\rllfffx.exe189⤵
-
\??\c:\7xfxrrr.exec:\7xfxrrr.exe190⤵
-
\??\c:\nhtntt.exec:\nhtntt.exe191⤵
-
\??\c:\hnbbtb.exec:\hnbbtb.exe192⤵
-
\??\c:\3jpjd.exec:\3jpjd.exe193⤵
-
\??\c:\pjpjj.exec:\pjpjj.exe194⤵
-
\??\c:\rxrrxff.exec:\rxrrxff.exe195⤵
-
\??\c:\3xrrlrl.exec:\3xrrlrl.exe196⤵
-
\??\c:\nbbtnt.exec:\nbbtnt.exe197⤵
-
\??\c:\pppjv.exec:\pppjv.exe198⤵
-
\??\c:\vvjvv.exec:\vvjvv.exe199⤵
-
\??\c:\rxxfflf.exec:\rxxfflf.exe200⤵
-
\??\c:\3ntnnn.exec:\3ntnnn.exe201⤵
-
\??\c:\ntbtbb.exec:\ntbtbb.exe202⤵
-
\??\c:\pdpjj.exec:\pdpjj.exe203⤵
-
\??\c:\pdjjd.exec:\pdjjd.exe204⤵
-
\??\c:\xffffll.exec:\xffffll.exe205⤵
-
\??\c:\5ntttb.exec:\5ntttb.exe206⤵
-
\??\c:\nbbbtb.exec:\nbbbtb.exe207⤵
-
\??\c:\jjpjd.exec:\jjpjd.exe208⤵
-
\??\c:\7pdvp.exec:\7pdvp.exe209⤵
-
\??\c:\7xrlfxf.exec:\7xrlfxf.exe210⤵
-
\??\c:\lxlrrrf.exec:\lxlrrrf.exe211⤵
-
\??\c:\rfllfxr.exec:\rfllfxr.exe212⤵
-
\??\c:\btbbbt.exec:\btbbbt.exe213⤵
-
\??\c:\pvjjd.exec:\pvjjd.exe214⤵
-
\??\c:\3vvvd.exec:\3vvvd.exe215⤵
-
\??\c:\ffrrfll.exec:\ffrrfll.exe216⤵
-
\??\c:\fffxffl.exec:\fffxffl.exe217⤵
-
\??\c:\btbttn.exec:\btbttn.exe218⤵
-
\??\c:\btthtt.exec:\btthtt.exe219⤵
-
\??\c:\jpjvp.exec:\jpjvp.exe220⤵
-
\??\c:\vvdvv.exec:\vvdvv.exe221⤵
-
\??\c:\fxfxlff.exec:\fxfxlff.exe222⤵
-
\??\c:\llxrxrf.exec:\llxrxrf.exe223⤵
-
\??\c:\hnbbnt.exec:\hnbbnt.exe224⤵
-
\??\c:\1nhbhn.exec:\1nhbhn.exe225⤵
-
\??\c:\nbhhbh.exec:\nbhhbh.exe226⤵
-
\??\c:\dvvpp.exec:\dvvpp.exe227⤵
-
\??\c:\1dddv.exec:\1dddv.exe228⤵
-
\??\c:\rfxrlll.exec:\rfxrlll.exe229⤵
-
\??\c:\llrlxfr.exec:\llrlxfr.exe230⤵
-
\??\c:\ntbnhn.exec:\ntbnhn.exe231⤵
-
\??\c:\htbtbb.exec:\htbtbb.exe232⤵
-
\??\c:\vdvjj.exec:\vdvjj.exe233⤵
-
\??\c:\vpvvp.exec:\vpvvp.exe234⤵
-
\??\c:\frrrrxr.exec:\frrrrxr.exe235⤵
-
\??\c:\fllfxxx.exec:\fllfxxx.exe236⤵
-
\??\c:\bhnnnn.exec:\bhnnnn.exe237⤵
-
\??\c:\9vjjd.exec:\9vjjd.exe238⤵
-
\??\c:\3djjv.exec:\3djjv.exe239⤵
-
\??\c:\lxllflf.exec:\lxllflf.exe240⤵
-
\??\c:\xlffxxx.exec:\xlffxxx.exe241⤵