Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 18:57
Behavioral task
behavioral1
Sample
13a77b57ce03be997379a3431c8265a281dc17ed980fd60f429534d45935cffd.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
13a77b57ce03be997379a3431c8265a281dc17ed980fd60f429534d45935cffd.exe
-
Size
367KB
-
MD5
501d5849fa7ba7d41d918d528c33e814
-
SHA1
147b97aa80106dc645a0e3b3b6331a5bb85a27cc
-
SHA256
13a77b57ce03be997379a3431c8265a281dc17ed980fd60f429534d45935cffd
-
SHA512
e6ac78158061f7ddbd9974677f695fc9d006e3d31f261bcbae90c1f8b00358accc2f4d17a398acda8cd889374081b184722063e0f6bd43a8032a6d778a6af742
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOFltH4tiAlSpgFZAzwdjcIlSpgFZZr3GSM/xX:y4wFHoS3eFplAlSpgFZAKjcIlSpgFZZG
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
Processes:
resource yara_rule behavioral1/memory/3036-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/376-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2440-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-436-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2560-586-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1812-1095-0x0000000000260000-0x0000000000287000-memory.dmp family_blackmoon behavioral1/memory/1072-1212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-1082-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2856-1067-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/3044-809-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-657-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-509-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1616-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1500-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1056-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2440-199-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1228-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1616-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1052-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2072-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1464-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/3012-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\bththh.exe UPX behavioral1/memory/3036-12-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3012-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2548-21-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\ppdpp.exe UPX behavioral1/memory/2608-40-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\nbnbtb.exe UPX C:\rrlflrf.exe UPX behavioral1/memory/2484-67-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2508-76-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\hhtbht.exe UPX behavioral1/memory/2692-95-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\xrflxfr.exe UPX \??\c:\hbbnht.exe UPX \??\c:\3hbhnn.exe UPX \??\c:\dvdpd.exe UPX behavioral1/memory/376-145-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\jvdvv.exe UPX C:\llxrrrl.exe UPX C:\xlffffx.exe UPX behavioral1/memory/2440-191-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\5tnnbh.exe UPX \??\c:\vpjjv.exe UPX \??\c:\llllxlx.exe UPX C:\7ddvd.exe UPX C:\llxlfrx.exe UPX \??\c:\1tntbh.exe UPX behavioral1/memory/2084-310-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2468-360-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1600-389-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2964-403-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2560-586-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2168-623-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2912-636-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/288-758-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2564-765-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1324-834-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2660-866-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2648-879-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2796-984-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2856-1059-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1448-1227-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1072-1212-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2456-1157-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2392-1074-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1924-1028-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/828-1003-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2732-947-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1880-928-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3044-809-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2012-778-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/380-743-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/560-706-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2000-663-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2148-657-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1600-649-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2120-549-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1528-542-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1720-535-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1268-522-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1708-509-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1244-454-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1616-441-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
bththh.exeppdpp.exe7xlxlrx.exenbnbtb.exepdpvj.exexxrfllx.exerrlflrf.exehhtbht.exehhhhbt.exe1pdvd.exexrflxfr.exehbbnht.exe3hbhnn.exedvdpd.exe9frxlxl.exe3nthtt.exejvdvv.exellxrrrl.exexlffffx.exe3bbhbn.exe7ddvv.exefxrfrrl.exe5tnnbh.exevpjjv.exellllxlx.exehnbbtn.exe1vvdj.exe7ddvd.exellxlfrx.exe1tntbh.exe9vddv.exe7xlrffl.exeffrlrfx.exebttnhh.exetthtth.exe3dppv.exe3rxflrf.exe5xfffll.exe3tnthn.exeddvjv.exe3pjjd.exelfxlllr.exefxrlfrl.exe5hbhhh.exevvpdv.exedppvd.exexrrlrfr.exe9tnnnt.exeddjdd.exevvvdd.exelxffxff.exenhntnh.exepjjjp.exevpddd.exerrlrrxf.exe7flrxfr.exehttbtt.exe9bnthn.exevpvvv.exellfxrlx.exerxffrfl.exehhbnbh.exenhbhbn.exejjvdp.exepid process 3036 bththh.exe 2548 ppdpp.exe 2660 7xlxlrx.exe 2608 nbnbtb.exe 2648 pdpvj.exe 2484 xxrfllx.exe 2676 rrlflrf.exe 2508 hhtbht.exe 2692 hhhhbt.exe 1464 1pdvd.exe 2816 xrflxfr.exe 2148 hbbnht.exe 2072 3hbhnn.exe 1076 dvdpd.exe 376 9frxlxl.exe 2752 3nthtt.exe 1052 jvdvv.exe 1616 llxrrrl.exe 1228 xlffffx.exe 2440 3bbhbn.exe 2844 7ddvv.exe 604 fxrfrrl.exe 1056 5tnnbh.exe 1500 vpjjv.exe 2428 llllxlx.exe 1644 hnbbtn.exe 1688 1vvdj.exe 904 7ddvd.exe 1768 llxlfrx.exe 2272 1tntbh.exe 2412 9vddv.exe 2740 7xlrffl.exe 1524 ffrlrfx.exe 2084 bttnhh.exe 1632 tthtth.exe 2548 3dppv.exe 2580 3rxflrf.exe 2464 5xfffll.exe 2800 3tnthn.exe 2628 ddvjv.exe 2468 3pjjd.exe 2920 lfxlllr.exe 2784 fxrlfrl.exe 2908 5hbhhh.exe 1600 vvpdv.exe 2148 dppvd.exe 2000 xrrlrfr.exe 2964 9tnnnt.exe 2624 ddjdd.exe 2700 vvvdd.exe 2524 lxffxff.exe 2260 nhntnh.exe 1748 pjjjp.exe 1616 vpddd.exe 3064 rrlrrxf.exe 1244 7flrxfr.exe 608 httbtt.exe 2612 9bnthn.exe 588 vpvvv.exe 1508 llfxrlx.exe 1160 rxffrfl.exe 860 hhbnbh.exe 2428 nhbhbn.exe 1708 jjvdp.exe -
Processes:
resource yara_rule behavioral1/memory/3012-0-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bththh.exe upx behavioral1/memory/3036-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2548-21-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ppdpp.exe upx behavioral1/memory/2608-40-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbnbtb.exe upx C:\rrlflrf.exe upx behavioral1/memory/2484-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2508-76-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hhtbht.exe upx behavioral1/memory/2692-95-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xrflxfr.exe upx \??\c:\hbbnht.exe upx \??\c:\3hbhnn.exe upx \??\c:\dvdpd.exe upx behavioral1/memory/376-145-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvdvv.exe upx C:\llxrrrl.exe upx C:\xlffffx.exe upx behavioral1/memory/2440-191-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5tnnbh.exe upx \??\c:\vpjjv.exe upx \??\c:\llllxlx.exe upx C:\7ddvd.exe upx C:\llxlfrx.exe upx \??\c:\1tntbh.exe upx behavioral1/memory/2084-310-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2468-360-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1600-389-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2964-403-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2560-586-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2168-623-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2912-636-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/288-758-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2564-765-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1324-834-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2660-866-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2648-879-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2796-984-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2856-1059-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1448-1227-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1072-1219-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1072-1212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2456-1157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2392-1074-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2856-1066-0x0000000000430000-0x0000000000457000-memory.dmp upx behavioral1/memory/1924-1028-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/828-1003-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2732-947-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1880-928-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3044-809-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2012-778-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/380-743-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/560-706-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2000-663-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2148-657-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1600-649-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2120-549-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1528-542-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1720-535-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1268-522-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1708-509-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
13a77b57ce03be997379a3431c8265a281dc17ed980fd60f429534d45935cffd.exebththh.exeppdpp.exe7xlxlrx.exenbnbtb.exepdpvj.exexxrfllx.exerrlflrf.exehhtbht.exehhhhbt.exe1pdvd.exexrflxfr.exehbbnht.exe3hbhnn.exedvdpd.exe9frxlxl.exedescription pid process target process PID 3012 wrote to memory of 3036 3012 13a77b57ce03be997379a3431c8265a281dc17ed980fd60f429534d45935cffd.exe bththh.exe PID 3012 wrote to memory of 3036 3012 13a77b57ce03be997379a3431c8265a281dc17ed980fd60f429534d45935cffd.exe bththh.exe PID 3012 wrote to memory of 3036 3012 13a77b57ce03be997379a3431c8265a281dc17ed980fd60f429534d45935cffd.exe bththh.exe PID 3012 wrote to memory of 3036 3012 13a77b57ce03be997379a3431c8265a281dc17ed980fd60f429534d45935cffd.exe bththh.exe PID 3036 wrote to memory of 2548 3036 bththh.exe ppdpp.exe PID 3036 wrote to memory of 2548 3036 bththh.exe ppdpp.exe PID 3036 wrote to memory of 2548 3036 bththh.exe ppdpp.exe PID 3036 wrote to memory of 2548 3036 bththh.exe ppdpp.exe PID 2548 wrote to memory of 2660 2548 ppdpp.exe 3dppv.exe PID 2548 wrote to memory of 2660 2548 ppdpp.exe 3dppv.exe PID 2548 wrote to memory of 2660 2548 ppdpp.exe 3dppv.exe PID 2548 wrote to memory of 2660 2548 ppdpp.exe 3dppv.exe PID 2660 wrote to memory of 2608 2660 7xlxlrx.exe nbnbtb.exe PID 2660 wrote to memory of 2608 2660 7xlxlrx.exe nbnbtb.exe PID 2660 wrote to memory of 2608 2660 7xlxlrx.exe nbnbtb.exe PID 2660 wrote to memory of 2608 2660 7xlxlrx.exe nbnbtb.exe PID 2608 wrote to memory of 2648 2608 nbnbtb.exe pdpvj.exe PID 2608 wrote to memory of 2648 2608 nbnbtb.exe pdpvj.exe PID 2608 wrote to memory of 2648 2608 nbnbtb.exe pdpvj.exe PID 2608 wrote to memory of 2648 2608 nbnbtb.exe pdpvj.exe PID 2648 wrote to memory of 2484 2648 pdpvj.exe xxrfllx.exe PID 2648 wrote to memory of 2484 2648 pdpvj.exe xxrfllx.exe PID 2648 wrote to memory of 2484 2648 pdpvj.exe xxrfllx.exe PID 2648 wrote to memory of 2484 2648 pdpvj.exe xxrfllx.exe PID 2484 wrote to memory of 2676 2484 xxrfllx.exe rrlflrf.exe PID 2484 wrote to memory of 2676 2484 xxrfllx.exe rrlflrf.exe PID 2484 wrote to memory of 2676 2484 xxrfllx.exe rrlflrf.exe PID 2484 wrote to memory of 2676 2484 xxrfllx.exe rrlflrf.exe PID 2676 wrote to memory of 2508 2676 rrlflrf.exe hhtbht.exe PID 2676 wrote to memory of 2508 2676 rrlflrf.exe hhtbht.exe PID 2676 wrote to memory of 2508 2676 rrlflrf.exe hhtbht.exe PID 2676 wrote to memory of 2508 2676 rrlflrf.exe hhtbht.exe PID 2508 wrote to memory of 2692 2508 hhtbht.exe hhhhbt.exe PID 2508 wrote to memory of 2692 2508 hhtbht.exe hhhhbt.exe PID 2508 wrote to memory of 2692 2508 hhtbht.exe hhhhbt.exe PID 2508 wrote to memory of 2692 2508 hhtbht.exe hhhhbt.exe PID 2692 wrote to memory of 1464 2692 hhhhbt.exe 1pdvd.exe PID 2692 wrote to memory of 1464 2692 hhhhbt.exe 1pdvd.exe PID 2692 wrote to memory of 1464 2692 hhhhbt.exe 1pdvd.exe PID 2692 wrote to memory of 1464 2692 hhhhbt.exe 1pdvd.exe PID 1464 wrote to memory of 2816 1464 1pdvd.exe xrflxfr.exe PID 1464 wrote to memory of 2816 1464 1pdvd.exe xrflxfr.exe PID 1464 wrote to memory of 2816 1464 1pdvd.exe xrflxfr.exe PID 1464 wrote to memory of 2816 1464 1pdvd.exe xrflxfr.exe PID 2816 wrote to memory of 2148 2816 xrflxfr.exe hbbnht.exe PID 2816 wrote to memory of 2148 2816 xrflxfr.exe hbbnht.exe PID 2816 wrote to memory of 2148 2816 xrflxfr.exe hbbnht.exe PID 2816 wrote to memory of 2148 2816 xrflxfr.exe hbbnht.exe PID 2148 wrote to memory of 2072 2148 hbbnht.exe 3hbhnn.exe PID 2148 wrote to memory of 2072 2148 hbbnht.exe 3hbhnn.exe PID 2148 wrote to memory of 2072 2148 hbbnht.exe 3hbhnn.exe PID 2148 wrote to memory of 2072 2148 hbbnht.exe 3hbhnn.exe PID 2072 wrote to memory of 1076 2072 3hbhnn.exe dvdpd.exe PID 2072 wrote to memory of 1076 2072 3hbhnn.exe dvdpd.exe PID 2072 wrote to memory of 1076 2072 3hbhnn.exe dvdpd.exe PID 2072 wrote to memory of 1076 2072 3hbhnn.exe dvdpd.exe PID 1076 wrote to memory of 376 1076 dvdpd.exe 9frxlxl.exe PID 1076 wrote to memory of 376 1076 dvdpd.exe 9frxlxl.exe PID 1076 wrote to memory of 376 1076 dvdpd.exe 9frxlxl.exe PID 1076 wrote to memory of 376 1076 dvdpd.exe 9frxlxl.exe PID 376 wrote to memory of 2752 376 9frxlxl.exe 3nthtt.exe PID 376 wrote to memory of 2752 376 9frxlxl.exe 3nthtt.exe PID 376 wrote to memory of 2752 376 9frxlxl.exe 3nthtt.exe PID 376 wrote to memory of 2752 376 9frxlxl.exe 3nthtt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\13a77b57ce03be997379a3431c8265a281dc17ed980fd60f429534d45935cffd.exe"C:\Users\Admin\AppData\Local\Temp\13a77b57ce03be997379a3431c8265a281dc17ed980fd60f429534d45935cffd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\bththh.exec:\bththh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppdpp.exec:\ppdpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7xlxlrx.exec:\7xlxlrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbnbtb.exec:\nbnbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdpvj.exec:\pdpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxrfllx.exec:\xxrfllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrlflrf.exec:\rrlflrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhtbht.exec:\hhtbht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhhbt.exec:\hhhhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1pdvd.exec:\1pdvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrflxfr.exec:\xrflxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbbnht.exec:\hbbnht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3hbhnn.exec:\3hbhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvdpd.exec:\dvdpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9frxlxl.exec:\9frxlxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3nthtt.exec:\3nthtt.exe17⤵
- Executes dropped EXE
-
\??\c:\jvdvv.exec:\jvdvv.exe18⤵
- Executes dropped EXE
-
\??\c:\llxrrrl.exec:\llxrrrl.exe19⤵
- Executes dropped EXE
-
\??\c:\xlffffx.exec:\xlffffx.exe20⤵
- Executes dropped EXE
-
\??\c:\3bbhbn.exec:\3bbhbn.exe21⤵
- Executes dropped EXE
-
\??\c:\7ddvv.exec:\7ddvv.exe22⤵
- Executes dropped EXE
-
\??\c:\fxrfrrl.exec:\fxrfrrl.exe23⤵
- Executes dropped EXE
-
\??\c:\5tnnbh.exec:\5tnnbh.exe24⤵
- Executes dropped EXE
-
\??\c:\vpjjv.exec:\vpjjv.exe25⤵
- Executes dropped EXE
-
\??\c:\llllxlx.exec:\llllxlx.exe26⤵
- Executes dropped EXE
-
\??\c:\hnbbtn.exec:\hnbbtn.exe27⤵
- Executes dropped EXE
-
\??\c:\1vvdj.exec:\1vvdj.exe28⤵
- Executes dropped EXE
-
\??\c:\7ddvd.exec:\7ddvd.exe29⤵
- Executes dropped EXE
-
\??\c:\llxlfrx.exec:\llxlfrx.exe30⤵
- Executes dropped EXE
-
\??\c:\1tntbh.exec:\1tntbh.exe31⤵
- Executes dropped EXE
-
\??\c:\9vddv.exec:\9vddv.exe32⤵
- Executes dropped EXE
-
\??\c:\7xlrffl.exec:\7xlrffl.exe33⤵
- Executes dropped EXE
-
\??\c:\ffrlrfx.exec:\ffrlrfx.exe34⤵
- Executes dropped EXE
-
\??\c:\bttnhh.exec:\bttnhh.exe35⤵
- Executes dropped EXE
-
\??\c:\tthtth.exec:\tthtth.exe36⤵
- Executes dropped EXE
-
\??\c:\3dppv.exec:\3dppv.exe37⤵
- Executes dropped EXE
-
\??\c:\3rxflrf.exec:\3rxflrf.exe38⤵
- Executes dropped EXE
-
\??\c:\5xfffll.exec:\5xfffll.exe39⤵
- Executes dropped EXE
-
\??\c:\3tnthn.exec:\3tnthn.exe40⤵
- Executes dropped EXE
-
\??\c:\ddvjv.exec:\ddvjv.exe41⤵
- Executes dropped EXE
-
\??\c:\3pjjd.exec:\3pjjd.exe42⤵
- Executes dropped EXE
-
\??\c:\lfxlllr.exec:\lfxlllr.exe43⤵
- Executes dropped EXE
-
\??\c:\fxrlfrl.exec:\fxrlfrl.exe44⤵
- Executes dropped EXE
-
\??\c:\5hbhhh.exec:\5hbhhh.exe45⤵
- Executes dropped EXE
-
\??\c:\vvpdv.exec:\vvpdv.exe46⤵
- Executes dropped EXE
-
\??\c:\dppvd.exec:\dppvd.exe47⤵
- Executes dropped EXE
-
\??\c:\xrrlrfr.exec:\xrrlrfr.exe48⤵
- Executes dropped EXE
-
\??\c:\9tnnnt.exec:\9tnnnt.exe49⤵
- Executes dropped EXE
-
\??\c:\ddjdd.exec:\ddjdd.exe50⤵
- Executes dropped EXE
-
\??\c:\vvvdd.exec:\vvvdd.exe51⤵
- Executes dropped EXE
-
\??\c:\lxffxff.exec:\lxffxff.exe52⤵
- Executes dropped EXE
-
\??\c:\nhntnh.exec:\nhntnh.exe53⤵
- Executes dropped EXE
-
\??\c:\pjjjp.exec:\pjjjp.exe54⤵
- Executes dropped EXE
-
\??\c:\vpddd.exec:\vpddd.exe55⤵
- Executes dropped EXE
-
\??\c:\rrlrrxf.exec:\rrlrrxf.exe56⤵
- Executes dropped EXE
-
\??\c:\7flrxfr.exec:\7flrxfr.exe57⤵
- Executes dropped EXE
-
\??\c:\httbtt.exec:\httbtt.exe58⤵
- Executes dropped EXE
-
\??\c:\9bnthn.exec:\9bnthn.exe59⤵
- Executes dropped EXE
-
\??\c:\vpvvv.exec:\vpvvv.exe60⤵
- Executes dropped EXE
-
\??\c:\llfxrlx.exec:\llfxrlx.exe61⤵
- Executes dropped EXE
-
\??\c:\rxffrfl.exec:\rxffrfl.exe62⤵
- Executes dropped EXE
-
\??\c:\hhbnbh.exec:\hhbnbh.exe63⤵
- Executes dropped EXE
-
\??\c:\nhbhbn.exec:\nhbhbn.exe64⤵
- Executes dropped EXE
-
\??\c:\jjvdp.exec:\jjvdp.exe65⤵
- Executes dropped EXE
-
\??\c:\xlxxfxf.exec:\xlxxfxf.exe66⤵
-
\??\c:\llflxfx.exec:\llflxfx.exe67⤵
-
\??\c:\tnbtbn.exec:\tnbtbn.exe68⤵
-
\??\c:\ttntnn.exec:\ttntnn.exe69⤵
-
\??\c:\pvdvv.exec:\pvdvv.exe70⤵
-
\??\c:\3vvpd.exec:\3vvpd.exe71⤵
-
\??\c:\ffxxxfl.exec:\ffxxxfl.exe72⤵
-
\??\c:\1ntbnb.exec:\1ntbnb.exe73⤵
-
\??\c:\bttbtb.exec:\bttbtb.exe74⤵
-
\??\c:\vpdjd.exec:\vpdjd.exe75⤵
-
\??\c:\pjvvv.exec:\pjvvv.exe76⤵
-
\??\c:\rlxllxl.exec:\rlxllxl.exe77⤵
-
\??\c:\xlrxxlx.exec:\xlrxxlx.exe78⤵
-
\??\c:\bththn.exec:\bththn.exe79⤵
-
\??\c:\hhbbnb.exec:\hhbbnb.exe80⤵
-
\??\c:\vvppv.exec:\vvppv.exe81⤵
-
\??\c:\dvjvp.exec:\dvjvp.exe82⤵
-
\??\c:\ffxrfrx.exec:\ffxrfrx.exe83⤵
-
\??\c:\frfxfrf.exec:\frfxfrf.exe84⤵
-
\??\c:\tntbhn.exec:\tntbhn.exe85⤵
-
\??\c:\jpvdv.exec:\jpvdv.exe86⤵
-
\??\c:\vdjvj.exec:\vdjvj.exe87⤵
-
\??\c:\ffxlrxf.exec:\ffxlrxf.exe88⤵
-
\??\c:\fxrfrxf.exec:\fxrfrxf.exe89⤵
-
\??\c:\bbtbhh.exec:\bbtbhh.exe90⤵
-
\??\c:\nnhntn.exec:\nnhntn.exe91⤵
-
\??\c:\pdpdp.exec:\pdpdp.exe92⤵
-
\??\c:\vdpdp.exec:\vdpdp.exe93⤵
-
\??\c:\5fxrflx.exec:\5fxrflx.exe94⤵
-
\??\c:\rlflffl.exec:\rlflffl.exe95⤵
-
\??\c:\ntnbtn.exec:\ntnbtn.exe96⤵
-
\??\c:\bthnbh.exec:\bthnbh.exe97⤵
-
\??\c:\jdvvp.exec:\jdvvp.exe98⤵
-
\??\c:\vvvvj.exec:\vvvvj.exe99⤵
-
\??\c:\xxxxxfx.exec:\xxxxxfx.exe100⤵
-
\??\c:\lfrxlrl.exec:\lfrxlrl.exe101⤵
-
\??\c:\hbhnnb.exec:\hbhnnb.exe102⤵
-
\??\c:\5tttbb.exec:\5tttbb.exe103⤵
-
\??\c:\dvddj.exec:\dvddj.exe104⤵
-
\??\c:\7jddj.exec:\7jddj.exe105⤵
-
\??\c:\3xrfrxl.exec:\3xrfrxl.exe106⤵
-
\??\c:\bthhtn.exec:\bthhtn.exe107⤵
-
\??\c:\hhbtbn.exec:\hhbtbn.exe108⤵
-
\??\c:\ddvdd.exec:\ddvdd.exe109⤵
-
\??\c:\vvvdv.exec:\vvvdv.exe110⤵
-
\??\c:\vvpvd.exec:\vvpvd.exe111⤵
-
\??\c:\ffxrxxf.exec:\ffxrxxf.exe112⤵
-
\??\c:\9llrxrl.exec:\9llrxrl.exe113⤵
-
\??\c:\nhnnbb.exec:\nhnnbb.exe114⤵
-
\??\c:\5nhhht.exec:\5nhhht.exe115⤵
-
\??\c:\jdjjv.exec:\jdjjv.exe116⤵
-
\??\c:\rlflrfx.exec:\rlflrfx.exe117⤵
-
\??\c:\xrflxlf.exec:\xrflxlf.exe118⤵
-
\??\c:\tbthbn.exec:\tbthbn.exe119⤵
-
\??\c:\hbbntt.exec:\hbbntt.exe120⤵
-
\??\c:\pjvdp.exec:\pjvdp.exe121⤵
-
\??\c:\3dppv.exec:\3dppv.exe122⤵
-
\??\c:\xxrlflx.exec:\xxrlflx.exe123⤵
-
\??\c:\9fxfrlx.exec:\9fxfrlx.exe124⤵
-
\??\c:\btbnbt.exec:\btbnbt.exe125⤵
-
\??\c:\7hbbhn.exec:\7hbbhn.exe126⤵
-
\??\c:\dvjpd.exec:\dvjpd.exe127⤵
-
\??\c:\3ppjp.exec:\3ppjp.exe128⤵
-
\??\c:\ffxlxlr.exec:\ffxlxlr.exe129⤵
-
\??\c:\xrffllf.exec:\xrffllf.exe130⤵
-
\??\c:\nhttbh.exec:\nhttbh.exe131⤵
-
\??\c:\htnnhn.exec:\htnnhn.exe132⤵
-
\??\c:\1vvdp.exec:\1vvdp.exe133⤵
-
\??\c:\1pjpv.exec:\1pjpv.exe134⤵
-
\??\c:\xxllrlx.exec:\xxllrlx.exe135⤵
-
\??\c:\flrrfxx.exec:\flrrfxx.exe136⤵
-
\??\c:\htbbhn.exec:\htbbhn.exe137⤵
-
\??\c:\tbthtb.exec:\tbthtb.exe138⤵
-
\??\c:\jvjjp.exec:\jvjjp.exe139⤵
-
\??\c:\9pjvv.exec:\9pjvv.exe140⤵
-
\??\c:\rfflxfx.exec:\rfflxfx.exe141⤵
-
\??\c:\7flffrf.exec:\7flffrf.exe142⤵
-
\??\c:\3ttthn.exec:\3ttthn.exe143⤵
-
\??\c:\nhbbhh.exec:\nhbbhh.exe144⤵
-
\??\c:\vppdp.exec:\vppdp.exe145⤵
-
\??\c:\vvjpv.exec:\vvjpv.exe146⤵
-
\??\c:\ffrxfxf.exec:\ffrxfxf.exe147⤵
-
\??\c:\hnnbnh.exec:\hnnbnh.exe148⤵
-
\??\c:\pjvpv.exec:\pjvpv.exe149⤵
-
\??\c:\5pvjp.exec:\5pvjp.exe150⤵
-
\??\c:\rrflrxl.exec:\rrflrxl.exe151⤵
-
\??\c:\llxfrrf.exec:\llxfrrf.exe152⤵
-
\??\c:\btnbhn.exec:\btnbhn.exe153⤵
-
\??\c:\tnnhbh.exec:\tnnhbh.exe154⤵
-
\??\c:\dvjpd.exec:\dvjpd.exe155⤵
-
\??\c:\llfrfrf.exec:\llfrfrf.exe156⤵
-
\??\c:\lfflrxl.exec:\lfflrxl.exe157⤵
-
\??\c:\bnhntb.exec:\bnhntb.exe158⤵
-
\??\c:\bbhbnb.exec:\bbhbnb.exe159⤵
-
\??\c:\rrfrrrf.exec:\rrfrrrf.exe160⤵
-
\??\c:\llxfrxx.exec:\llxfrxx.exe161⤵
-
\??\c:\hbtntt.exec:\hbtntt.exe162⤵
-
\??\c:\hbbnnn.exec:\hbbnnn.exe163⤵
-
\??\c:\vpvjp.exec:\vpvjp.exe164⤵
-
\??\c:\jjpvp.exec:\jjpvp.exe165⤵
-
\??\c:\xlxrfxx.exec:\xlxrfxx.exe166⤵
-
\??\c:\hbntbh.exec:\hbntbh.exe167⤵
-
\??\c:\1nbttt.exec:\1nbttt.exe168⤵
-
\??\c:\dvdjv.exec:\dvdjv.exe169⤵
-
\??\c:\9jvjp.exec:\9jvjp.exe170⤵
-
\??\c:\xlxxflx.exec:\xlxxflx.exe171⤵
-
\??\c:\llfflxf.exec:\llfflxf.exe172⤵
-
\??\c:\9hnnnt.exec:\9hnnnt.exe173⤵
-
\??\c:\nnntnb.exec:\nnntnb.exe174⤵
-
\??\c:\vpdjv.exec:\vpdjv.exe175⤵
-
\??\c:\jdjjv.exec:\jdjjv.exe176⤵
-
\??\c:\fflffxx.exec:\fflffxx.exe177⤵
-
\??\c:\1xlxlll.exec:\1xlxlll.exe178⤵
-
\??\c:\tnbbbb.exec:\tnbbbb.exe179⤵
-
\??\c:\htnbth.exec:\htnbth.exe180⤵
-
\??\c:\7xrxllr.exec:\7xrxllr.exe181⤵
-
\??\c:\3bttbb.exec:\3bttbb.exe182⤵
-
\??\c:\jdjpv.exec:\jdjpv.exe183⤵
-
\??\c:\pjvvj.exec:\pjvvj.exe184⤵
-
\??\c:\5fxrxrl.exec:\5fxrxrl.exe185⤵
-
\??\c:\xrlrffr.exec:\xrlrffr.exe186⤵
-
\??\c:\vvjpv.exec:\vvjpv.exe187⤵
-
\??\c:\fxrllxr.exec:\fxrllxr.exe188⤵
-
\??\c:\1rlfxfx.exec:\1rlfxfx.exe189⤵
-
\??\c:\hthnhn.exec:\hthnhn.exe190⤵
-
\??\c:\bttnhb.exec:\bttnhb.exe191⤵
-
\??\c:\pjvvv.exec:\pjvvv.exe192⤵
-
\??\c:\jdvdp.exec:\jdvdp.exe193⤵
-
\??\c:\xlfflfr.exec:\xlfflfr.exe194⤵
-
\??\c:\rfxxxlf.exec:\rfxxxlf.exe195⤵
-
\??\c:\5thhhb.exec:\5thhhb.exe196⤵
-
\??\c:\hhbbhh.exec:\hhbbhh.exe197⤵
-
\??\c:\ddvdj.exec:\ddvdj.exe198⤵
-
\??\c:\pjpvp.exec:\pjpvp.exe199⤵
-
\??\c:\3lffllx.exec:\3lffllx.exe200⤵
-
\??\c:\rrxrrlx.exec:\rrxrrlx.exe201⤵
-
\??\c:\1bhbnn.exec:\1bhbnn.exe202⤵
-
\??\c:\hbtttt.exec:\hbtttt.exe203⤵
-
\??\c:\9djjp.exec:\9djjp.exe204⤵
-
\??\c:\vdvvd.exec:\vdvvd.exe205⤵
-
\??\c:\7lffllr.exec:\7lffllr.exe206⤵
-
\??\c:\5rxffff.exec:\5rxffff.exe207⤵
-
\??\c:\tnhttt.exec:\tnhttt.exe208⤵
-
\??\c:\hbhbnn.exec:\hbhbnn.exe209⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe210⤵
-
\??\c:\1jvdd.exec:\1jvdd.exe211⤵
-
\??\c:\rxrflxl.exec:\rxrflxl.exe212⤵
-
\??\c:\ffxxrrf.exec:\ffxxrrf.exe213⤵
-
\??\c:\thtnnn.exec:\thtnnn.exe214⤵
-
\??\c:\tnhtnh.exec:\tnhtnh.exe215⤵
-
\??\c:\1vvvv.exec:\1vvvv.exe216⤵
-
\??\c:\pjvpv.exec:\pjvpv.exe217⤵
-
\??\c:\rfrxxxr.exec:\rfrxxxr.exe218⤵
-
\??\c:\3rlfllr.exec:\3rlfllr.exe219⤵
-
\??\c:\1nhntt.exec:\1nhntt.exe220⤵
-
\??\c:\tnbbbb.exec:\tnbbbb.exe221⤵
-
\??\c:\pdppd.exec:\pdppd.exe222⤵
-
\??\c:\dvppv.exec:\dvppv.exe223⤵
-
\??\c:\xfxxxff.exec:\xfxxxff.exe224⤵
-
\??\c:\xrfllll.exec:\xrfllll.exe225⤵
-
\??\c:\bhnhhn.exec:\bhnhhn.exe226⤵
-
\??\c:\7bhnbb.exec:\7bhnbb.exe227⤵
-
\??\c:\ddvvd.exec:\ddvvd.exe228⤵
-
\??\c:\dppvd.exec:\dppvd.exe229⤵
-
\??\c:\lfxflrf.exec:\lfxflrf.exe230⤵
-
\??\c:\xxlxrxl.exec:\xxlxrxl.exe231⤵
-
\??\c:\xrllrrf.exec:\xrllrrf.exe232⤵
-
\??\c:\tnhnbb.exec:\tnhnbb.exe233⤵
-
\??\c:\5bbhtb.exec:\5bbhtb.exe234⤵
-
\??\c:\vpvjv.exec:\vpvjv.exe235⤵
-
\??\c:\vpdjj.exec:\vpdjj.exe236⤵
-
\??\c:\frxlrlf.exec:\frxlrlf.exe237⤵
-
\??\c:\5rlrrxl.exec:\5rlrrxl.exe238⤵
-
\??\c:\9tttnb.exec:\9tttnb.exe239⤵
-
\??\c:\1hnhnn.exec:\1hnhnn.exe240⤵
-
\??\c:\3ddjd.exec:\3ddjd.exe241⤵