Analysis
-
max time kernel
150s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 18:42
Behavioral task
behavioral1
Sample
0cf6e06e09ff1c7990da1dcfacf8d2ec1d0e6f92dbc284165d24d58e6f61f6b4.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
-
Target
0cf6e06e09ff1c7990da1dcfacf8d2ec1d0e6f92dbc284165d24d58e6f61f6b4.exe
-
Size
58KB
-
MD5
10a9a6f41cc3b5e70acb6ca9a5ca4561
-
SHA1
ab0959f879972a4a75889c8e3912a1a73613a13a
-
SHA256
0cf6e06e09ff1c7990da1dcfacf8d2ec1d0e6f92dbc284165d24d58e6f61f6b4
-
SHA512
fb313cd0d8153b10355bb128c043c2867cd27866ea372d0e23f77559e58aafa3e390e728e47718cf6424cf59fcf47c1b642b56adab9abac5b3278845722f5c2c
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNG1mjtREVR:khOmTsF93UYfwC6GIoutpY918cn
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3420-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4140-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2964-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3316-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1300-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3520-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/64-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/64-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3068-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4340-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3104-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1960-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2680-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3340-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4100-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4532-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1988-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1632-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4116-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4408-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1600-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4248-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2772-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3764-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3912-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/560-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1124-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1936-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1416-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3492-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2512-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3852-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2136-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-511-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1416-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4840-549-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2924-560-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/520-578-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1936-612-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-646-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2224-681-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-710-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-724-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/460-1062-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3420-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ddvpp.exe UPX behavioral2/memory/3420-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5044-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\1frlfxx.exe UPX C:\hnhbbh.exe UPX behavioral2/memory/4140-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5dpjv.exe UPX behavioral2/memory/2964-28-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ppppp.exe UPX behavioral2/memory/4284-32-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3ffrxlr.exe UPX \??\c:\hhttnn.exe UPX behavioral2/memory/3316-40-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bhhnhh.exe UPX C:\ppjjj.exe UPX behavioral2/memory/1300-54-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lrrlllf.exe UPX C:\llrrlfx.exe UPX behavioral2/memory/3520-60-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1872-66-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\5bbbbn.exe UPX behavioral2/memory/64-68-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7djjj.exe UPX behavioral2/memory/64-72-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\9xxxffl.exe UPX C:\llllfff.exe UPX behavioral2/memory/3068-82-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nhbbbh.exe UPX behavioral2/memory/4340-88-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3104-90-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\djpdj.exe UPX behavioral2/memory/3104-96-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4832-99-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pdppp.exe UPX behavioral2/memory/1960-103-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\fffxrlf.exe UPX behavioral2/memory/2680-110-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bthntb.exe UPX C:\vdddj.exe UPX behavioral2/memory/3340-128-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\pdvpj.exe UPX behavioral2/memory/4100-123-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1696-117-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xrllfll.exe UPX C:\3xflrrr.exe UPX C:\bhhhbb.exe UPX behavioral2/memory/4728-144-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\7jjjd.exe UPX C:\pjjjj.exe UPX behavioral2/memory/3672-155-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3576-154-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lrfffff.exe UPX behavioral2/memory/3672-160-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4532-166-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\1lrrflr.exe UPX C:\tnbttb.exe UPX behavioral2/memory/1988-172-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5000-175-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ppvjp.exe UPX \??\c:\flffrxx.exe UPX behavioral2/memory/1632-190-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3172-194-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4116-195-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
ddvpp.exe1frlfxx.exehnhbbh.exe5dpjv.exeppppp.exe3ffrxlr.exehhttnn.exebhhnhh.exeppjjj.exelrrlllf.exellrrlfx.exe5bbbbn.exe7djjj.exe9xxxffl.exellllfff.exenhbbbh.exedjpdj.exepdppp.exefffxrlf.exebthntb.exepdvpj.exevdddj.exexrllfll.exe3xflrrr.exebhhhbb.exe7jjjd.exepjjjj.exelrfffff.exe1lrrflr.exetnbttb.exeppvjp.exeflffrxx.exelrffxxr.exe3bhhhh.exevdjjj.exedvpvd.exelxlrxxf.exe1bnttt.exeddvvv.exe1frrrrr.exethnhhh.exedpvdp.exedjpdv.exerfxrrrf.exe7lfflff.exenbbhnn.exejpvvv.exe3ppjp.exeflxfffl.exenntnbb.exevdppp.exedppjv.exeffffflf.exe1xlrfrl.exebhtbbb.exejjppj.exefrxxxff.exexrfflfx.exehnhhhh.exe3bhbth.exejdjpd.exevvjjv.exefxlllrr.exerflrxxr.exepid process 5044 ddvpp.exe 4140 1frlfxx.exe 3764 hnhbbh.exe 2964 5dpjv.exe 4284 ppppp.exe 4840 3ffrxlr.exe 3316 hhttnn.exe 3600 bhhnhh.exe 1300 ppjjj.exe 3520 lrrlllf.exe 1872 llrrlfx.exe 64 5bbbbn.exe 4176 7djjj.exe 3068 9xxxffl.exe 4340 llllfff.exe 3104 nhbbbh.exe 4832 djpdj.exe 1960 pdppp.exe 2680 fffxrlf.exe 1696 bthntb.exe 4100 pdvpj.exe 3340 vdddj.exe 884 xrllfll.exe 1936 3xflrrr.exe 4728 bhhhbb.exe 3576 7jjjd.exe 3672 pjjjj.exe 4532 lrfffff.exe 1988 1lrrflr.exe 5000 tnbttb.exe 4980 ppvjp.exe 1692 flffrxx.exe 1632 lrffxxr.exe 3172 3bhhhh.exe 4116 vdjjj.exe 5032 dvpvd.exe 4408 lxlrxxf.exe 2192 1bnttt.exe 1672 ddvvv.exe 1600 1frrrrr.exe 4248 thnhhh.exe 4324 dpvdp.exe 2772 djpdv.exe 840 rfxrrrf.exe 3764 7lfflff.exe 3200 nbbhnn.exe 4284 jpvvv.exe 4840 3ppjp.exe 4528 flxfffl.exe 3372 nntnbb.exe 3864 vdppp.exe 3364 dppjv.exe 1904 ffffflf.exe 3728 1xlrfrl.exe 932 bhtbbb.exe 2584 jjppj.exe 4004 frxxxff.exe 3912 xrfflfx.exe 4984 hnhhhh.exe 3560 3bhbth.exe 560 jdjpd.exe 3636 vvjjv.exe 1740 fxlllrr.exe 4392 rflrxxr.exe -
Processes:
resource yara_rule behavioral2/memory/3420-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddvpp.exe upx behavioral2/memory/3420-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5044-8-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1frlfxx.exe upx C:\hnhbbh.exe upx behavioral2/memory/4140-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5dpjv.exe upx behavioral2/memory/2964-28-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppppp.exe upx behavioral2/memory/4284-32-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3ffrxlr.exe upx \??\c:\hhttnn.exe upx behavioral2/memory/3316-40-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bhhnhh.exe upx C:\ppjjj.exe upx behavioral2/memory/1300-54-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrrlllf.exe upx C:\llrrlfx.exe upx behavioral2/memory/3520-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1872-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5bbbbn.exe upx behavioral2/memory/64-68-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7djjj.exe upx behavioral2/memory/64-72-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9xxxffl.exe upx C:\llllfff.exe upx behavioral2/memory/3068-82-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhbbbh.exe upx behavioral2/memory/4340-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3104-90-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djpdj.exe upx behavioral2/memory/3104-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4832-99-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdppp.exe upx behavioral2/memory/1960-103-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fffxrlf.exe upx behavioral2/memory/2680-110-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bthntb.exe upx C:\vdddj.exe upx behavioral2/memory/3340-128-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pdvpj.exe upx behavioral2/memory/4100-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1696-117-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrllfll.exe upx C:\3xflrrr.exe upx C:\bhhhbb.exe upx behavioral2/memory/4728-144-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7jjjd.exe upx C:\pjjjj.exe upx behavioral2/memory/3672-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3576-154-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrfffff.exe upx behavioral2/memory/3672-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4532-166-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1lrrflr.exe upx C:\tnbttb.exe upx behavioral2/memory/1988-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5000-175-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppvjp.exe upx \??\c:\flffrxx.exe upx behavioral2/memory/1632-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3172-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4116-195-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0cf6e06e09ff1c7990da1dcfacf8d2ec1d0e6f92dbc284165d24d58e6f61f6b4.exeddvpp.exe1frlfxx.exehnhbbh.exe5dpjv.exeppppp.exe3ffrxlr.exehhttnn.exebhhnhh.exeppjjj.exelrrlllf.exellrrlfx.exe5bbbbn.exe7djjj.exe9xxxffl.exellllfff.exenhbbbh.exedjpdj.exepdppp.exefffxrlf.exebthntb.exepdvpj.exedescription pid process target process PID 3420 wrote to memory of 5044 3420 0cf6e06e09ff1c7990da1dcfacf8d2ec1d0e6f92dbc284165d24d58e6f61f6b4.exe ddvpp.exe PID 3420 wrote to memory of 5044 3420 0cf6e06e09ff1c7990da1dcfacf8d2ec1d0e6f92dbc284165d24d58e6f61f6b4.exe ddvpp.exe PID 3420 wrote to memory of 5044 3420 0cf6e06e09ff1c7990da1dcfacf8d2ec1d0e6f92dbc284165d24d58e6f61f6b4.exe ddvpp.exe PID 5044 wrote to memory of 4140 5044 ddvpp.exe 1frlfxx.exe PID 5044 wrote to memory of 4140 5044 ddvpp.exe 1frlfxx.exe PID 5044 wrote to memory of 4140 5044 ddvpp.exe 1frlfxx.exe PID 4140 wrote to memory of 3764 4140 1frlfxx.exe hnhbbh.exe PID 4140 wrote to memory of 3764 4140 1frlfxx.exe hnhbbh.exe PID 4140 wrote to memory of 3764 4140 1frlfxx.exe hnhbbh.exe PID 3764 wrote to memory of 2964 3764 hnhbbh.exe 5dpjv.exe PID 3764 wrote to memory of 2964 3764 hnhbbh.exe 5dpjv.exe PID 3764 wrote to memory of 2964 3764 hnhbbh.exe 5dpjv.exe PID 2964 wrote to memory of 4284 2964 5dpjv.exe ppppp.exe PID 2964 wrote to memory of 4284 2964 5dpjv.exe ppppp.exe PID 2964 wrote to memory of 4284 2964 5dpjv.exe ppppp.exe PID 4284 wrote to memory of 4840 4284 ppppp.exe 3ffrxlr.exe PID 4284 wrote to memory of 4840 4284 ppppp.exe 3ffrxlr.exe PID 4284 wrote to memory of 4840 4284 ppppp.exe 3ffrxlr.exe PID 4840 wrote to memory of 3316 4840 3ffrxlr.exe hhttnn.exe PID 4840 wrote to memory of 3316 4840 3ffrxlr.exe hhttnn.exe PID 4840 wrote to memory of 3316 4840 3ffrxlr.exe hhttnn.exe PID 3316 wrote to memory of 3600 3316 hhttnn.exe bhhnhh.exe PID 3316 wrote to memory of 3600 3316 hhttnn.exe bhhnhh.exe PID 3316 wrote to memory of 3600 3316 hhttnn.exe bhhnhh.exe PID 3600 wrote to memory of 1300 3600 bhhnhh.exe ppjjj.exe PID 3600 wrote to memory of 1300 3600 bhhnhh.exe ppjjj.exe PID 3600 wrote to memory of 1300 3600 bhhnhh.exe ppjjj.exe PID 1300 wrote to memory of 3520 1300 ppjjj.exe lrrlllf.exe PID 1300 wrote to memory of 3520 1300 ppjjj.exe lrrlllf.exe PID 1300 wrote to memory of 3520 1300 ppjjj.exe lrrlllf.exe PID 3520 wrote to memory of 1872 3520 lrrlllf.exe llrrlfx.exe PID 3520 wrote to memory of 1872 3520 lrrlllf.exe llrrlfx.exe PID 3520 wrote to memory of 1872 3520 lrrlllf.exe llrrlfx.exe PID 1872 wrote to memory of 64 1872 llrrlfx.exe 5bbbbn.exe PID 1872 wrote to memory of 64 1872 llrrlfx.exe 5bbbbn.exe PID 1872 wrote to memory of 64 1872 llrrlfx.exe 5bbbbn.exe PID 64 wrote to memory of 4176 64 5bbbbn.exe 7djjj.exe PID 64 wrote to memory of 4176 64 5bbbbn.exe 7djjj.exe PID 64 wrote to memory of 4176 64 5bbbbn.exe 7djjj.exe PID 4176 wrote to memory of 3068 4176 7djjj.exe 9xxxffl.exe PID 4176 wrote to memory of 3068 4176 7djjj.exe 9xxxffl.exe PID 4176 wrote to memory of 3068 4176 7djjj.exe 9xxxffl.exe PID 3068 wrote to memory of 4340 3068 9xxxffl.exe llllfff.exe PID 3068 wrote to memory of 4340 3068 9xxxffl.exe llllfff.exe PID 3068 wrote to memory of 4340 3068 9xxxffl.exe llllfff.exe PID 4340 wrote to memory of 3104 4340 llllfff.exe nhbbbh.exe PID 4340 wrote to memory of 3104 4340 llllfff.exe nhbbbh.exe PID 4340 wrote to memory of 3104 4340 llllfff.exe nhbbbh.exe PID 3104 wrote to memory of 4832 3104 nhbbbh.exe djpdj.exe PID 3104 wrote to memory of 4832 3104 nhbbbh.exe djpdj.exe PID 3104 wrote to memory of 4832 3104 nhbbbh.exe djpdj.exe PID 4832 wrote to memory of 1960 4832 djpdj.exe pdppp.exe PID 4832 wrote to memory of 1960 4832 djpdj.exe pdppp.exe PID 4832 wrote to memory of 1960 4832 djpdj.exe pdppp.exe PID 1960 wrote to memory of 2680 1960 pdppp.exe fffxrlf.exe PID 1960 wrote to memory of 2680 1960 pdppp.exe fffxrlf.exe PID 1960 wrote to memory of 2680 1960 pdppp.exe fffxrlf.exe PID 2680 wrote to memory of 1696 2680 fffxrlf.exe bthntb.exe PID 2680 wrote to memory of 1696 2680 fffxrlf.exe bthntb.exe PID 2680 wrote to memory of 1696 2680 fffxrlf.exe bthntb.exe PID 1696 wrote to memory of 4100 1696 bthntb.exe pdvpj.exe PID 1696 wrote to memory of 4100 1696 bthntb.exe pdvpj.exe PID 1696 wrote to memory of 4100 1696 bthntb.exe pdvpj.exe PID 4100 wrote to memory of 3340 4100 pdvpj.exe vdddj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cf6e06e09ff1c7990da1dcfacf8d2ec1d0e6f92dbc284165d24d58e6f61f6b4.exe"C:\Users\Admin\AppData\Local\Temp\0cf6e06e09ff1c7990da1dcfacf8d2ec1d0e6f92dbc284165d24d58e6f61f6b4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\ddvpp.exec:\ddvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1frlfxx.exec:\1frlfxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnhbbh.exec:\hnhbbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5dpjv.exec:\5dpjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppppp.exec:\ppppp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3ffrxlr.exec:\3ffrxlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhttnn.exec:\hhttnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhhnhh.exec:\bhhnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppjjj.exec:\ppjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrrlllf.exec:\lrrlllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llrrlfx.exec:\llrrlfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5bbbbn.exec:\5bbbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7djjj.exec:\7djjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9xxxffl.exec:\9xxxffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llllfff.exec:\llllfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbbbh.exec:\nhbbbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djpdj.exec:\djpdj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdppp.exec:\pdppp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fffxrlf.exec:\fffxrlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bthntb.exec:\bthntb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdvpj.exec:\pdvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdddj.exec:\vdddj.exe23⤵
- Executes dropped EXE
-
\??\c:\xrllfll.exec:\xrllfll.exe24⤵
- Executes dropped EXE
-
\??\c:\3xflrrr.exec:\3xflrrr.exe25⤵
- Executes dropped EXE
-
\??\c:\bhhhbb.exec:\bhhhbb.exe26⤵
- Executes dropped EXE
-
\??\c:\7jjjd.exec:\7jjjd.exe27⤵
- Executes dropped EXE
-
\??\c:\pjjjj.exec:\pjjjj.exe28⤵
- Executes dropped EXE
-
\??\c:\lrfffff.exec:\lrfffff.exe29⤵
- Executes dropped EXE
-
\??\c:\1lrrflr.exec:\1lrrflr.exe30⤵
- Executes dropped EXE
-
\??\c:\tnbttb.exec:\tnbttb.exe31⤵
- Executes dropped EXE
-
\??\c:\ppvjp.exec:\ppvjp.exe32⤵
- Executes dropped EXE
-
\??\c:\flffrxx.exec:\flffrxx.exe33⤵
- Executes dropped EXE
-
\??\c:\lrffxxr.exec:\lrffxxr.exe34⤵
- Executes dropped EXE
-
\??\c:\3bhhhh.exec:\3bhhhh.exe35⤵
- Executes dropped EXE
-
\??\c:\vdjjj.exec:\vdjjj.exe36⤵
- Executes dropped EXE
-
\??\c:\dvpvd.exec:\dvpvd.exe37⤵
- Executes dropped EXE
-
\??\c:\lxlrxxf.exec:\lxlrxxf.exe38⤵
- Executes dropped EXE
-
\??\c:\1bnttt.exec:\1bnttt.exe39⤵
- Executes dropped EXE
-
\??\c:\ddvvv.exec:\ddvvv.exe40⤵
- Executes dropped EXE
-
\??\c:\1frrrrr.exec:\1frrrrr.exe41⤵
- Executes dropped EXE
-
\??\c:\thnhhh.exec:\thnhhh.exe42⤵
- Executes dropped EXE
-
\??\c:\dpvdp.exec:\dpvdp.exe43⤵
- Executes dropped EXE
-
\??\c:\djpdv.exec:\djpdv.exe44⤵
- Executes dropped EXE
-
\??\c:\rfxrrrf.exec:\rfxrrrf.exe45⤵
- Executes dropped EXE
-
\??\c:\7lfflff.exec:\7lfflff.exe46⤵
- Executes dropped EXE
-
\??\c:\nbbhnn.exec:\nbbhnn.exe47⤵
- Executes dropped EXE
-
\??\c:\jpvvv.exec:\jpvvv.exe48⤵
- Executes dropped EXE
-
\??\c:\3ppjp.exec:\3ppjp.exe49⤵
- Executes dropped EXE
-
\??\c:\flxfffl.exec:\flxfffl.exe50⤵
- Executes dropped EXE
-
\??\c:\nntnbb.exec:\nntnbb.exe51⤵
- Executes dropped EXE
-
\??\c:\vdppp.exec:\vdppp.exe52⤵
- Executes dropped EXE
-
\??\c:\dppjv.exec:\dppjv.exe53⤵
- Executes dropped EXE
-
\??\c:\ffffflf.exec:\ffffflf.exe54⤵
- Executes dropped EXE
-
\??\c:\1xlrfrl.exec:\1xlrfrl.exe55⤵
- Executes dropped EXE
-
\??\c:\bhtbbb.exec:\bhtbbb.exe56⤵
- Executes dropped EXE
-
\??\c:\jjppj.exec:\jjppj.exe57⤵
- Executes dropped EXE
-
\??\c:\frxxxff.exec:\frxxxff.exe58⤵
- Executes dropped EXE
-
\??\c:\xrfflfx.exec:\xrfflfx.exe59⤵
- Executes dropped EXE
-
\??\c:\hnhhhh.exec:\hnhhhh.exe60⤵
- Executes dropped EXE
-
\??\c:\3bhbth.exec:\3bhbth.exe61⤵
- Executes dropped EXE
-
\??\c:\jdjpd.exec:\jdjpd.exe62⤵
- Executes dropped EXE
-
\??\c:\vvjjv.exec:\vvjjv.exe63⤵
- Executes dropped EXE
-
\??\c:\fxlllrr.exec:\fxlllrr.exe64⤵
- Executes dropped EXE
-
\??\c:\rflrxxr.exec:\rflrxxr.exe65⤵
- Executes dropped EXE
-
\??\c:\7hhnnn.exec:\7hhnnn.exe66⤵
-
\??\c:\thnhhb.exec:\thnhhb.exe67⤵
-
\??\c:\dvjpp.exec:\dvjpp.exe68⤵
-
\??\c:\jjppp.exec:\jjppp.exe69⤵
-
\??\c:\fxrlxxf.exec:\fxrlxxf.exe70⤵
-
\??\c:\fxfxxrr.exec:\fxfxxrr.exe71⤵
-
\??\c:\nthttt.exec:\nthttt.exe72⤵
-
\??\c:\thnnnn.exec:\thnnnn.exe73⤵
-
\??\c:\pjjdd.exec:\pjjdd.exe74⤵
-
\??\c:\djddj.exec:\djddj.exe75⤵
-
\??\c:\1frrrll.exec:\1frrrll.exe76⤵
-
\??\c:\7fffxfx.exec:\7fffxfx.exe77⤵
-
\??\c:\hhnthn.exec:\hhnthn.exe78⤵
-
\??\c:\btnnnn.exec:\btnnnn.exe79⤵
-
\??\c:\djvvp.exec:\djvvp.exe80⤵
-
\??\c:\vdjjd.exec:\vdjjd.exe81⤵
-
\??\c:\lflflff.exec:\lflflff.exe82⤵
-
\??\c:\xfxrrrr.exec:\xfxrrrr.exe83⤵
-
\??\c:\btbhht.exec:\btbhht.exe84⤵
-
\??\c:\thnttn.exec:\thnttn.exe85⤵
-
\??\c:\pvjjj.exec:\pvjjj.exe86⤵
-
\??\c:\hhhhnn.exec:\hhhhnn.exe87⤵
-
\??\c:\btbbbt.exec:\btbbbt.exe88⤵
-
\??\c:\dpppp.exec:\dpppp.exe89⤵
-
\??\c:\lrrlffx.exec:\lrrlffx.exe90⤵
-
\??\c:\rflfrll.exec:\rflfrll.exe91⤵
-
\??\c:\3nbnhb.exec:\3nbnhb.exe92⤵
-
\??\c:\9ntbtt.exec:\9ntbtt.exe93⤵
-
\??\c:\7dpjp.exec:\7dpjp.exe94⤵
-
\??\c:\xrrrrxx.exec:\xrrrrxx.exe95⤵
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe96⤵
-
\??\c:\thbbtt.exec:\thbbtt.exe97⤵
-
\??\c:\9hnhhn.exec:\9hnhhn.exe98⤵
-
\??\c:\djpvp.exec:\djpvp.exe99⤵
-
\??\c:\dppjd.exec:\dppjd.exe100⤵
-
\??\c:\xfrlllf.exec:\xfrlllf.exe101⤵
-
\??\c:\hbntth.exec:\hbntth.exe102⤵
-
\??\c:\nhbbth.exec:\nhbbth.exe103⤵
-
\??\c:\nhhbth.exec:\nhhbth.exe104⤵
-
\??\c:\5dpvp.exec:\5dpvp.exe105⤵
-
\??\c:\vjddd.exec:\vjddd.exe106⤵
-
\??\c:\flrrlll.exec:\flrrlll.exe107⤵
-
\??\c:\1lrrrrr.exec:\1lrrrrr.exe108⤵
-
\??\c:\tttttt.exec:\tttttt.exe109⤵
-
\??\c:\nhhbtb.exec:\nhhbtb.exe110⤵
-
\??\c:\dvvvj.exec:\dvvvj.exe111⤵
-
\??\c:\pjppv.exec:\pjppv.exe112⤵
-
\??\c:\flflrxx.exec:\flflrxx.exe113⤵
-
\??\c:\5rllxfl.exec:\5rllxfl.exe114⤵
-
\??\c:\hbhhbb.exec:\hbhhbb.exe115⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe116⤵
-
\??\c:\jpvvp.exec:\jpvvp.exe117⤵
-
\??\c:\lffxrrr.exec:\lffxrrr.exe118⤵
-
\??\c:\ffflxxx.exec:\ffflxxx.exe119⤵
-
\??\c:\btbttt.exec:\btbttt.exe120⤵
-
\??\c:\bbnnnn.exec:\bbnnnn.exe121⤵
-
\??\c:\7ppvp.exec:\7ppvp.exe122⤵
-
\??\c:\vpvdv.exec:\vpvdv.exe123⤵
-
\??\c:\flrrlll.exec:\flrrlll.exe124⤵
-
\??\c:\3xrxxfr.exec:\3xrxxfr.exe125⤵
-
\??\c:\3hhttt.exec:\3hhttt.exe126⤵
-
\??\c:\tnhbhh.exec:\tnhbhh.exe127⤵
-
\??\c:\jddjj.exec:\jddjj.exe128⤵
-
\??\c:\ppppj.exec:\ppppj.exe129⤵
-
\??\c:\lrxrrrr.exec:\lrxrrrr.exe130⤵
-
\??\c:\rxxxxxr.exec:\rxxxxxr.exe131⤵
-
\??\c:\1httbb.exec:\1httbb.exe132⤵
-
\??\c:\1bhhbh.exec:\1bhhbh.exe133⤵
-
\??\c:\1djjj.exec:\1djjj.exe134⤵
-
\??\c:\pdppd.exec:\pdppd.exe135⤵
-
\??\c:\pjdpv.exec:\pjdpv.exe136⤵
-
\??\c:\rllrrrr.exec:\rllrrrr.exe137⤵
-
\??\c:\lxxfxxx.exec:\lxxfxxx.exe138⤵
-
\??\c:\1nhhtt.exec:\1nhhtt.exe139⤵
-
\??\c:\lxllfff.exec:\lxllfff.exe140⤵
-
\??\c:\lllfxff.exec:\lllfxff.exe141⤵
-
\??\c:\bbhbnt.exec:\bbhbnt.exe142⤵
-
\??\c:\vjjdv.exec:\vjjdv.exe143⤵
-
\??\c:\3jvvv.exec:\3jvvv.exe144⤵
-
\??\c:\xrllxxx.exec:\xrllxxx.exe145⤵
-
\??\c:\xxfrrxx.exec:\xxfrrxx.exe146⤵
-
\??\c:\hbbbtt.exec:\hbbbtt.exe147⤵
-
\??\c:\ppdpd.exec:\ppdpd.exe148⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe149⤵
-
\??\c:\pjdpp.exec:\pjdpp.exe150⤵
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe151⤵
-
\??\c:\1lxxrrf.exec:\1lxxrrf.exe152⤵
-
\??\c:\nnhnnn.exec:\nnhnnn.exe153⤵
-
\??\c:\ddjdv.exec:\ddjdv.exe154⤵
-
\??\c:\pdppj.exec:\pdppj.exe155⤵
-
\??\c:\9pvvv.exec:\9pvvv.exe156⤵
-
\??\c:\rrrrlrx.exec:\rrrrlrx.exe157⤵
-
\??\c:\xflfxxx.exec:\xflfxxx.exe158⤵
-
\??\c:\nttbbb.exec:\nttbbb.exe159⤵
-
\??\c:\bbbtnn.exec:\bbbtnn.exe160⤵
-
\??\c:\jjvpv.exec:\jjvpv.exe161⤵
-
\??\c:\3pddv.exec:\3pddv.exe162⤵
-
\??\c:\llllrxl.exec:\llllrxl.exe163⤵
-
\??\c:\hbbtnt.exec:\hbbtnt.exe164⤵
-
\??\c:\hnnbht.exec:\hnnbht.exe165⤵
-
\??\c:\9djjv.exec:\9djjv.exe166⤵
-
\??\c:\jvdvv.exec:\jvdvv.exe167⤵
-
\??\c:\llrllll.exec:\llrllll.exe168⤵
-
\??\c:\lrxlflf.exec:\lrxlflf.exe169⤵
-
\??\c:\1nnntt.exec:\1nnntt.exe170⤵
-
\??\c:\pvddv.exec:\pvddv.exe171⤵
-
\??\c:\dddvd.exec:\dddvd.exe172⤵
-
\??\c:\xrrrxxx.exec:\xrrrxxx.exe173⤵
-
\??\c:\rrlxrxx.exec:\rrlxrxx.exe174⤵
-
\??\c:\nhbbth.exec:\nhbbth.exe175⤵
-
\??\c:\tbbhbh.exec:\tbbhbh.exe176⤵
-
\??\c:\7jpjj.exec:\7jpjj.exe177⤵
-
\??\c:\xrxxllr.exec:\xrxxllr.exe178⤵
-
\??\c:\9lrxxfl.exec:\9lrxxfl.exe179⤵
-
\??\c:\bthtnb.exec:\bthtnb.exe180⤵
-
\??\c:\vvddj.exec:\vvddj.exe181⤵
-
\??\c:\bthhhn.exec:\bthhhn.exe182⤵
-
\??\c:\rrlfrrf.exec:\rrlfrrf.exe183⤵
-
\??\c:\llffxfl.exec:\llffxfl.exe184⤵
-
\??\c:\9htbhh.exec:\9htbhh.exe185⤵
-
\??\c:\bhbtnn.exec:\bhbtnn.exe186⤵
-
\??\c:\3vppp.exec:\3vppp.exe187⤵
-
\??\c:\ffffxxf.exec:\ffffxxf.exe188⤵
-
\??\c:\ttbbbb.exec:\ttbbbb.exe189⤵
-
\??\c:\thtnhh.exec:\thtnhh.exe190⤵
-
\??\c:\ppddv.exec:\ppddv.exe191⤵
-
\??\c:\ddvvv.exec:\ddvvv.exe192⤵
-
\??\c:\9fxrrrl.exec:\9fxrrrl.exe193⤵
-
\??\c:\rrflllf.exec:\rrflllf.exe194⤵
-
\??\c:\lflfxxx.exec:\lflfxxx.exe195⤵
-
\??\c:\hhhhnt.exec:\hhhhnt.exe196⤵
-
\??\c:\ppvvv.exec:\ppvvv.exe197⤵
-
\??\c:\jpdvp.exec:\jpdvp.exe198⤵
-
\??\c:\lffxrrl.exec:\lffxrrl.exe199⤵
-
\??\c:\3flrlll.exec:\3flrlll.exe200⤵
-
\??\c:\ttnnnn.exec:\ttnnnn.exe201⤵
-
\??\c:\tnbtbb.exec:\tnbtbb.exe202⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe203⤵
-
\??\c:\dddvp.exec:\dddvp.exe204⤵
-
\??\c:\rflfrlx.exec:\rflfrlx.exe205⤵
-
\??\c:\xflllll.exec:\xflllll.exe206⤵
-
\??\c:\hnthnb.exec:\hnthnb.exe207⤵
-
\??\c:\1hntnn.exec:\1hntnn.exe208⤵
-
\??\c:\ddjpv.exec:\ddjpv.exe209⤵
-
\??\c:\3jjjd.exec:\3jjjd.exe210⤵
-
\??\c:\9jppj.exec:\9jppj.exe211⤵
-
\??\c:\lxfffll.exec:\lxfffll.exe212⤵
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe213⤵
-
\??\c:\tntttt.exec:\tntttt.exe214⤵
-
\??\c:\1bttnn.exec:\1bttnn.exe215⤵
-
\??\c:\hbhbbb.exec:\hbhbbb.exe216⤵
-
\??\c:\5vppj.exec:\5vppj.exe217⤵
-
\??\c:\rrllxxl.exec:\rrllxxl.exe218⤵
-
\??\c:\frlrfrf.exec:\frlrfrf.exe219⤵
-
\??\c:\tbtttb.exec:\tbtttb.exe220⤵
-
\??\c:\nhhbtb.exec:\nhhbtb.exe221⤵
-
\??\c:\jpddd.exec:\jpddd.exe222⤵
-
\??\c:\pddpv.exec:\pddpv.exe223⤵
-
\??\c:\ffxxrrl.exec:\ffxxrrl.exe224⤵
-
\??\c:\5xrxxll.exec:\5xrxxll.exe225⤵
-
\??\c:\7bnnnt.exec:\7bnnnt.exe226⤵
-
\??\c:\btbnbn.exec:\btbnbn.exe227⤵
-
\??\c:\vvdjj.exec:\vvdjj.exe228⤵
-
\??\c:\rxffrrl.exec:\rxffrrl.exe229⤵
-
\??\c:\bnhnnt.exec:\bnhnnt.exe230⤵
-
\??\c:\nbtbnb.exec:\nbtbnb.exe231⤵
-
\??\c:\jdvdd.exec:\jdvdd.exe232⤵
-
\??\c:\fxrlfll.exec:\fxrlfll.exe233⤵
-
\??\c:\frlflfr.exec:\frlflfr.exe234⤵
-
\??\c:\5djjd.exec:\5djjd.exe235⤵
-
\??\c:\rrrlfff.exec:\rrrlfff.exe236⤵
-
\??\c:\tthhnt.exec:\tthhnt.exe237⤵
-
\??\c:\hnbtnn.exec:\hnbtnn.exe238⤵
-
\??\c:\ppppp.exec:\ppppp.exe239⤵
-
\??\c:\xxxfrff.exec:\xxxfrff.exe240⤵
-
\??\c:\ffxlflf.exec:\ffxlflf.exe241⤵