Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 18:57
Behavioral task
behavioral1
Sample
13a77b57ce03be997379a3431c8265a281dc17ed980fd60f429534d45935cffd.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
13a77b57ce03be997379a3431c8265a281dc17ed980fd60f429534d45935cffd.exe
-
Size
367KB
-
MD5
501d5849fa7ba7d41d918d528c33e814
-
SHA1
147b97aa80106dc645a0e3b3b6331a5bb85a27cc
-
SHA256
13a77b57ce03be997379a3431c8265a281dc17ed980fd60f429534d45935cffd
-
SHA512
e6ac78158061f7ddbd9974677f695fc9d006e3d31f261bcbae90c1f8b00358accc2f4d17a398acda8cd889374081b184722063e0f6bd43a8032a6d778a6af742
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOFltH4tiAlSpgFZAzwdjcIlSpgFZZr3GSM/xX:y4wFHoS3eFplAlSpgFZAKjcIlSpgFZZG
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3036-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4772-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1092-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2784-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2132-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2736-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2264-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1848-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1160-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4100-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3232-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2064-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/784-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2948-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4984-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1324-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4660-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1272-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1656-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3384-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1364-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1280-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3472-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2128-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1064-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1992-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1364-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-496-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1616-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1360-536-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-548-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-560-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-628-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-688-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-895-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/816-1003-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4100-1066-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3036-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\rflxxxr.exe UPX behavioral2/memory/3036-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ffllffx.exe UPX behavioral2/memory/2016-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4772-14-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\hhhtnn.exe UPX behavioral2/memory/1092-19-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\1vvvp.exe UPX C:\djjdp.exe UPX behavioral2/memory/3064-30-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4148-31-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vjpjj.exe UPX \??\c:\bthbnh.exe UPX behavioral2/memory/2784-43-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2132-42-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3jpjd.exe UPX C:\hbhbtb.exe UPX behavioral2/memory/3712-53-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3228-58-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\lxfxrll.exe UPX behavioral2/memory/2736-61-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\btnhbb.exe UPX behavioral2/memory/1844-66-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1844-71-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\htbnht.exe UPX C:\bthnth.exe UPX behavioral2/memory/4056-79-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3624-78-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xrlfxxl.exe UPX behavioral2/memory/884-85-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pjvjd.exe UPX behavioral2/memory/884-92-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\fxllxxl.exe UPX \??\c:\1bhbbb.exe UPX behavioral2/memory/2264-102-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\rlllfff.exe UPX C:\hnbbhn.exe UPX behavioral2/memory/2300-111-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\pdpdp.exe UPX behavioral2/memory/1952-118-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\hbhbtn.exe UPX behavioral2/memory/3652-124-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\tnbtbt.exe UPX behavioral2/memory/1848-130-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ppdvd.exe UPX C:\djdjv.exe UPX behavioral2/memory/1160-139-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\fllffxx.exe UPX behavioral2/memory/4100-149-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3232-145-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\nbhbtt.exe UPX behavioral2/memory/2064-153-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\llxrrrr.exe UPX C:\lxrfrlf.exe UPX C:\bhthhb.exe UPX C:\pjvpj.exe UPX C:\9lflrrx.exe UPX behavioral2/memory/784-179-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vpvpj.exe UPX behavioral2/memory/2848-189-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3216-193-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2948-201-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4984-207-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
rflxxxr.exeffllffx.exehhhtnn.exe1vvvp.exedjjdp.exevjpjj.exebthbnh.exe3jpjd.exehbhbtb.exelxfxrll.exebtnhbb.exehtbnht.exebthnth.exexrlfxxl.exepjvjd.exefxllxxl.exe1bhbbb.exerlllfff.exehnbbhn.exepdpdp.exehbhbtn.exetnbtbt.exeppdvd.exedjdjv.exefllffxx.exenbhbtt.exellxrrrr.exelxrfrlf.exebhthhb.exepjvpj.exe9lflrrx.exevpvpj.exentbthh.exe9hhbtt.exe1vdvp.exe9rxrlll.exenhttnh.exeppppj.exelfrfxrl.exenhnhht.exe7vdvp.exedvjvv.exellfxrrf.exehhtntt.exepdvpj.exeppdvj.exerlrllrl.exebnthbt.exe3djjp.exevdpjd.exehbhbbb.exenhnhnn.exexfxrflf.exehbhhbn.exebbnnnb.exe5ddvv.exexlllfff.exehnbbtt.exejpppp.exehnnnbb.exepvdvp.exevdvdv.exerrxrllf.exe5tnhbb.exepid process 2016 rflxxxr.exe 4772 ffllffx.exe 1092 hhhtnn.exe 3064 1vvvp.exe 4148 djjdp.exe 2132 vjpjj.exe 2784 bthbnh.exe 3712 3jpjd.exe 3228 hbhbtb.exe 2736 lxfxrll.exe 1844 btnhbb.exe 3624 htbnht.exe 4056 bthnth.exe 884 xrlfxxl.exe 2224 pjvjd.exe 3780 fxllxxl.exe 2264 1bhbbb.exe 2300 rlllfff.exe 1952 hnbbhn.exe 2284 pdpdp.exe 3652 hbhbtn.exe 1848 tnbtbt.exe 1160 ppdvd.exe 3232 djdjv.exe 4100 fllffxx.exe 2064 nbhbtt.exe 3040 llxrrrr.exe 1228 lxrfrlf.exe 4920 bhthhb.exe 784 pjvpj.exe 3852 9lflrrx.exe 2848 vpvpj.exe 3216 ntbthh.exe 4560 9hhbtt.exe 2164 1vdvp.exe 2948 9rxrlll.exe 4984 nhttnh.exe 1324 ppppj.exe 4660 lfrfxrl.exe 3120 nhnhht.exe 3988 7vdvp.exe 4084 dvjvv.exe 3380 llfxrrf.exe 3464 hhtntt.exe 5068 pdvpj.exe 1868 ppdvj.exe 3276 rlrllrl.exe 3548 bnthbt.exe 2572 3djjp.exe 3116 vdpjd.exe 4200 hbhbbb.exe 3196 nhnhnn.exe 4844 xfxrflf.exe 1272 hbhhbn.exe 4064 bbnnnb.exe 4452 5ddvv.exe 2244 xlllfff.exe 552 hnbbtt.exe 744 jpppp.exe 2900 hnnnbb.exe 2372 pvdvp.exe 3396 vdvdv.exe 4540 rrxrllf.exe 3984 5tnhbb.exe -
Processes:
resource yara_rule behavioral2/memory/3036-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rflxxxr.exe upx behavioral2/memory/3036-6-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffllffx.exe upx behavioral2/memory/2016-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4772-14-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhhtnn.exe upx behavioral2/memory/1092-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1vvvp.exe upx C:\djjdp.exe upx behavioral2/memory/3064-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4148-31-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjpjj.exe upx \??\c:\bthbnh.exe upx behavioral2/memory/2784-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2132-42-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3jpjd.exe upx C:\hbhbtb.exe upx behavioral2/memory/3712-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3228-58-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxfxrll.exe upx behavioral2/memory/2736-61-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\btnhbb.exe upx behavioral2/memory/1844-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1844-71-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htbnht.exe upx C:\bthnth.exe upx behavioral2/memory/4056-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3624-78-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrlfxxl.exe upx behavioral2/memory/884-85-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjvjd.exe upx behavioral2/memory/884-92-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxllxxl.exe upx \??\c:\1bhbbb.exe upx behavioral2/memory/2264-102-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rlllfff.exe upx C:\hnbbhn.exe upx behavioral2/memory/2300-111-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdpdp.exe upx behavioral2/memory/1952-118-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hbhbtn.exe upx behavioral2/memory/3652-124-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnbtbt.exe upx behavioral2/memory/1848-130-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppdvd.exe upx C:\djdjv.exe upx behavioral2/memory/1160-139-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fllffxx.exe upx behavioral2/memory/4100-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3232-145-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbhbtt.exe upx behavioral2/memory/2064-153-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llxrrrr.exe upx C:\lxrfrlf.exe upx C:\bhthhb.exe upx C:\pjvpj.exe upx C:\9lflrrx.exe upx behavioral2/memory/784-179-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpvpj.exe upx behavioral2/memory/2848-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3216-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2948-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4984-207-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
13a77b57ce03be997379a3431c8265a281dc17ed980fd60f429534d45935cffd.exerflxxxr.exeffllffx.exehhhtnn.exe1vvvp.exedjjdp.exevjpjj.exebthbnh.exe3jpjd.exehbhbtb.exelxfxrll.exebtnhbb.exehtbnht.exebthnth.exexrlfxxl.exepjvjd.exefxllxxl.exe1bhbbb.exerlllfff.exehnbbhn.exepdpdp.exehbhbtn.exedescription pid process target process PID 3036 wrote to memory of 2016 3036 13a77b57ce03be997379a3431c8265a281dc17ed980fd60f429534d45935cffd.exe rflxxxr.exe PID 3036 wrote to memory of 2016 3036 13a77b57ce03be997379a3431c8265a281dc17ed980fd60f429534d45935cffd.exe rflxxxr.exe PID 3036 wrote to memory of 2016 3036 13a77b57ce03be997379a3431c8265a281dc17ed980fd60f429534d45935cffd.exe rflxxxr.exe PID 2016 wrote to memory of 4772 2016 rflxxxr.exe ffllffx.exe PID 2016 wrote to memory of 4772 2016 rflxxxr.exe ffllffx.exe PID 2016 wrote to memory of 4772 2016 rflxxxr.exe ffllffx.exe PID 4772 wrote to memory of 1092 4772 ffllffx.exe hhhtnn.exe PID 4772 wrote to memory of 1092 4772 ffllffx.exe hhhtnn.exe PID 4772 wrote to memory of 1092 4772 ffllffx.exe hhhtnn.exe PID 1092 wrote to memory of 3064 1092 hhhtnn.exe 1vvvp.exe PID 1092 wrote to memory of 3064 1092 hhhtnn.exe 1vvvp.exe PID 1092 wrote to memory of 3064 1092 hhhtnn.exe 1vvvp.exe PID 3064 wrote to memory of 4148 3064 1vvvp.exe djjdp.exe PID 3064 wrote to memory of 4148 3064 1vvvp.exe djjdp.exe PID 3064 wrote to memory of 4148 3064 1vvvp.exe djjdp.exe PID 4148 wrote to memory of 2132 4148 djjdp.exe vjpjj.exe PID 4148 wrote to memory of 2132 4148 djjdp.exe vjpjj.exe PID 4148 wrote to memory of 2132 4148 djjdp.exe vjpjj.exe PID 2132 wrote to memory of 2784 2132 vjpjj.exe bthbnh.exe PID 2132 wrote to memory of 2784 2132 vjpjj.exe bthbnh.exe PID 2132 wrote to memory of 2784 2132 vjpjj.exe bthbnh.exe PID 2784 wrote to memory of 3712 2784 bthbnh.exe 3jpjd.exe PID 2784 wrote to memory of 3712 2784 bthbnh.exe 3jpjd.exe PID 2784 wrote to memory of 3712 2784 bthbnh.exe 3jpjd.exe PID 3712 wrote to memory of 3228 3712 3jpjd.exe hbhbtb.exe PID 3712 wrote to memory of 3228 3712 3jpjd.exe hbhbtb.exe PID 3712 wrote to memory of 3228 3712 3jpjd.exe hbhbtb.exe PID 3228 wrote to memory of 2736 3228 hbhbtb.exe lxfxrll.exe PID 3228 wrote to memory of 2736 3228 hbhbtb.exe lxfxrll.exe PID 3228 wrote to memory of 2736 3228 hbhbtb.exe lxfxrll.exe PID 2736 wrote to memory of 1844 2736 lxfxrll.exe btnhbb.exe PID 2736 wrote to memory of 1844 2736 lxfxrll.exe btnhbb.exe PID 2736 wrote to memory of 1844 2736 lxfxrll.exe btnhbb.exe PID 1844 wrote to memory of 3624 1844 btnhbb.exe htbnht.exe PID 1844 wrote to memory of 3624 1844 btnhbb.exe htbnht.exe PID 1844 wrote to memory of 3624 1844 btnhbb.exe htbnht.exe PID 3624 wrote to memory of 4056 3624 htbnht.exe bthnth.exe PID 3624 wrote to memory of 4056 3624 htbnht.exe bthnth.exe PID 3624 wrote to memory of 4056 3624 htbnht.exe bthnth.exe PID 4056 wrote to memory of 884 4056 bthnth.exe xrlfxxl.exe PID 4056 wrote to memory of 884 4056 bthnth.exe xrlfxxl.exe PID 4056 wrote to memory of 884 4056 bthnth.exe xrlfxxl.exe PID 884 wrote to memory of 2224 884 xrlfxxl.exe pjvjd.exe PID 884 wrote to memory of 2224 884 xrlfxxl.exe pjvjd.exe PID 884 wrote to memory of 2224 884 xrlfxxl.exe pjvjd.exe PID 2224 wrote to memory of 3780 2224 pjvjd.exe fxllxxl.exe PID 2224 wrote to memory of 3780 2224 pjvjd.exe fxllxxl.exe PID 2224 wrote to memory of 3780 2224 pjvjd.exe fxllxxl.exe PID 3780 wrote to memory of 2264 3780 fxllxxl.exe 1bhbbb.exe PID 3780 wrote to memory of 2264 3780 fxllxxl.exe 1bhbbb.exe PID 3780 wrote to memory of 2264 3780 fxllxxl.exe 1bhbbb.exe PID 2264 wrote to memory of 2300 2264 1bhbbb.exe rlllfff.exe PID 2264 wrote to memory of 2300 2264 1bhbbb.exe rlllfff.exe PID 2264 wrote to memory of 2300 2264 1bhbbb.exe rlllfff.exe PID 2300 wrote to memory of 1952 2300 rlllfff.exe hnbbhn.exe PID 2300 wrote to memory of 1952 2300 rlllfff.exe hnbbhn.exe PID 2300 wrote to memory of 1952 2300 rlllfff.exe hnbbhn.exe PID 1952 wrote to memory of 2284 1952 hnbbhn.exe pdpdp.exe PID 1952 wrote to memory of 2284 1952 hnbbhn.exe pdpdp.exe PID 1952 wrote to memory of 2284 1952 hnbbhn.exe pdpdp.exe PID 2284 wrote to memory of 3652 2284 pdpdp.exe hbhbtn.exe PID 2284 wrote to memory of 3652 2284 pdpdp.exe hbhbtn.exe PID 2284 wrote to memory of 3652 2284 pdpdp.exe hbhbtn.exe PID 3652 wrote to memory of 1848 3652 hbhbtn.exe tnbtbt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\13a77b57ce03be997379a3431c8265a281dc17ed980fd60f429534d45935cffd.exe"C:\Users\Admin\AppData\Local\Temp\13a77b57ce03be997379a3431c8265a281dc17ed980fd60f429534d45935cffd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\rflxxxr.exec:\rflxxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffllffx.exec:\ffllffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhtnn.exec:\hhhtnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1vvvp.exec:\1vvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djjdp.exec:\djjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjpjj.exec:\vjpjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bthbnh.exec:\bthbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3jpjd.exec:\3jpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhbtb.exec:\hbhbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxfxrll.exec:\lxfxrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btnhbb.exec:\btnhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htbnht.exec:\htbnht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bthnth.exec:\bthnth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrlfxxl.exec:\xrlfxxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvjd.exec:\pjvjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxllxxl.exec:\fxllxxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1bhbbb.exec:\1bhbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlllfff.exec:\rlllfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnbbhn.exec:\hnbbhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdpdp.exec:\pdpdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhbtn.exec:\hbhbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbtbt.exec:\tnbtbt.exe23⤵
- Executes dropped EXE
-
\??\c:\ppdvd.exec:\ppdvd.exe24⤵
- Executes dropped EXE
-
\??\c:\djdjv.exec:\djdjv.exe25⤵
- Executes dropped EXE
-
\??\c:\fllffxx.exec:\fllffxx.exe26⤵
- Executes dropped EXE
-
\??\c:\nbhbtt.exec:\nbhbtt.exe27⤵
- Executes dropped EXE
-
\??\c:\llxrrrr.exec:\llxrrrr.exe28⤵
- Executes dropped EXE
-
\??\c:\lxrfrlf.exec:\lxrfrlf.exe29⤵
- Executes dropped EXE
-
\??\c:\bhthhb.exec:\bhthhb.exe30⤵
- Executes dropped EXE
-
\??\c:\pjvpj.exec:\pjvpj.exe31⤵
- Executes dropped EXE
-
\??\c:\9lflrrx.exec:\9lflrrx.exe32⤵
- Executes dropped EXE
-
\??\c:\vpvpj.exec:\vpvpj.exe33⤵
- Executes dropped EXE
-
\??\c:\ntbthh.exec:\ntbthh.exe34⤵
- Executes dropped EXE
-
\??\c:\9hhbtt.exec:\9hhbtt.exe35⤵
- Executes dropped EXE
-
\??\c:\1vdvp.exec:\1vdvp.exe36⤵
- Executes dropped EXE
-
\??\c:\9rxrlll.exec:\9rxrlll.exe37⤵
- Executes dropped EXE
-
\??\c:\nhttnh.exec:\nhttnh.exe38⤵
- Executes dropped EXE
-
\??\c:\ppppj.exec:\ppppj.exe39⤵
- Executes dropped EXE
-
\??\c:\lfrfxrl.exec:\lfrfxrl.exe40⤵
- Executes dropped EXE
-
\??\c:\nhnhht.exec:\nhnhht.exe41⤵
- Executes dropped EXE
-
\??\c:\7vdvp.exec:\7vdvp.exe42⤵
- Executes dropped EXE
-
\??\c:\dvjvv.exec:\dvjvv.exe43⤵
- Executes dropped EXE
-
\??\c:\llfxrrf.exec:\llfxrrf.exe44⤵
- Executes dropped EXE
-
\??\c:\hhtntt.exec:\hhtntt.exe45⤵
- Executes dropped EXE
-
\??\c:\pdvpj.exec:\pdvpj.exe46⤵
- Executes dropped EXE
-
\??\c:\ppdvj.exec:\ppdvj.exe47⤵
- Executes dropped EXE
-
\??\c:\rlrllrl.exec:\rlrllrl.exe48⤵
- Executes dropped EXE
-
\??\c:\bnthbt.exec:\bnthbt.exe49⤵
- Executes dropped EXE
-
\??\c:\3djjp.exec:\3djjp.exe50⤵
- Executes dropped EXE
-
\??\c:\vdpjd.exec:\vdpjd.exe51⤵
- Executes dropped EXE
-
\??\c:\hbhbbb.exec:\hbhbbb.exe52⤵
- Executes dropped EXE
-
\??\c:\nhnhnn.exec:\nhnhnn.exe53⤵
- Executes dropped EXE
-
\??\c:\xfxrflf.exec:\xfxrflf.exe54⤵
- Executes dropped EXE
-
\??\c:\hbhhbn.exec:\hbhhbn.exe55⤵
- Executes dropped EXE
-
\??\c:\bbnnnb.exec:\bbnnnb.exe56⤵
- Executes dropped EXE
-
\??\c:\5ddvv.exec:\5ddvv.exe57⤵
- Executes dropped EXE
-
\??\c:\xlllfff.exec:\xlllfff.exe58⤵
- Executes dropped EXE
-
\??\c:\hnbbtt.exec:\hnbbtt.exe59⤵
- Executes dropped EXE
-
\??\c:\jpppp.exec:\jpppp.exe60⤵
- Executes dropped EXE
-
\??\c:\hnnnbb.exec:\hnnnbb.exe61⤵
- Executes dropped EXE
-
\??\c:\pvdvp.exec:\pvdvp.exe62⤵
- Executes dropped EXE
-
\??\c:\vdvdv.exec:\vdvdv.exe63⤵
- Executes dropped EXE
-
\??\c:\rrxrllf.exec:\rrxrllf.exe64⤵
- Executes dropped EXE
-
\??\c:\5tnhbb.exec:\5tnhbb.exe65⤵
- Executes dropped EXE
-
\??\c:\pjjdp.exec:\pjjdp.exe66⤵
-
\??\c:\jdvvv.exec:\jdvvv.exe67⤵
-
\??\c:\fxxffff.exec:\fxxffff.exe68⤵
-
\??\c:\1nnnhh.exec:\1nnnhh.exe69⤵
-
\??\c:\vvdvv.exec:\vvdvv.exe70⤵
-
\??\c:\djddj.exec:\djddj.exe71⤵
-
\??\c:\nbbttt.exec:\nbbttt.exe72⤵
-
\??\c:\ppddd.exec:\ppddd.exe73⤵
-
\??\c:\frrrlll.exec:\frrrlll.exe74⤵
-
\??\c:\fxxxrxr.exec:\fxxxrxr.exe75⤵
-
\??\c:\nhnhbb.exec:\nhnhbb.exe76⤵
-
\??\c:\nbbbtb.exec:\nbbbtb.exe77⤵
-
\??\c:\vvvpp.exec:\vvvpp.exe78⤵
-
\??\c:\lffxrrl.exec:\lffxrrl.exe79⤵
-
\??\c:\tnnhbb.exec:\tnnhbb.exe80⤵
-
\??\c:\5bhhbh.exec:\5bhhbh.exe81⤵
-
\??\c:\dpjdd.exec:\dpjdd.exe82⤵
-
\??\c:\pppjd.exec:\pppjd.exe83⤵
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe84⤵
-
\??\c:\bhttnb.exec:\bhttnb.exe85⤵
-
\??\c:\tnnnbb.exec:\tnnnbb.exe86⤵
-
\??\c:\dddvv.exec:\dddvv.exe87⤵
-
\??\c:\pjppv.exec:\pjppv.exe88⤵
-
\??\c:\xlrlllf.exec:\xlrlllf.exe89⤵
-
\??\c:\9httbb.exec:\9httbb.exe90⤵
-
\??\c:\ttttnt.exec:\ttttnt.exe91⤵
-
\??\c:\ppvpv.exec:\ppvpv.exe92⤵
-
\??\c:\5rfxxrf.exec:\5rfxxrf.exe93⤵
-
\??\c:\xflfxfx.exec:\xflfxfx.exe94⤵
-
\??\c:\ttnnhb.exec:\ttnnhb.exe95⤵
-
\??\c:\nnhnth.exec:\nnhnth.exe96⤵
-
\??\c:\ddvvv.exec:\ddvvv.exe97⤵
-
\??\c:\xffxxlr.exec:\xffxxlr.exe98⤵
-
\??\c:\lfxxrxr.exec:\lfxxrxr.exe99⤵
-
\??\c:\hnttnh.exec:\hnttnh.exe100⤵
-
\??\c:\jpvpv.exec:\jpvpv.exe101⤵
-
\??\c:\pdjdv.exec:\pdjdv.exe102⤵
-
\??\c:\rfxrllf.exec:\rfxrllf.exe103⤵
-
\??\c:\rxfflfl.exec:\rxfflfl.exe104⤵
-
\??\c:\nnbbtt.exec:\nnbbtt.exe105⤵
-
\??\c:\hhbbnn.exec:\hhbbnn.exe106⤵
-
\??\c:\pjjvj.exec:\pjjvj.exe107⤵
-
\??\c:\xxfffrr.exec:\xxfffrr.exe108⤵
-
\??\c:\hhnnnt.exec:\hhnnnt.exe109⤵
-
\??\c:\tnbtbb.exec:\tnbtbb.exe110⤵
-
\??\c:\jpvpj.exec:\jpvpj.exe111⤵
-
\??\c:\pjdvv.exec:\pjdvv.exe112⤵
-
\??\c:\btttnn.exec:\btttnn.exe113⤵
-
\??\c:\1tnnhh.exec:\1tnnhh.exe114⤵
-
\??\c:\vvvvp.exec:\vvvvp.exe115⤵
-
\??\c:\7pdvp.exec:\7pdvp.exe116⤵
-
\??\c:\1rffxfx.exec:\1rffxfx.exe117⤵
-
\??\c:\nbnttt.exec:\nbnttt.exe118⤵
-
\??\c:\ppvpj.exec:\ppvpj.exe119⤵
-
\??\c:\ppppp.exec:\ppppp.exe120⤵
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe121⤵
-
\??\c:\bntbhn.exec:\bntbhn.exe122⤵
-
\??\c:\tnbbbb.exec:\tnbbbb.exe123⤵
-
\??\c:\vdpjp.exec:\vdpjp.exe124⤵
-
\??\c:\xrrlffx.exec:\xrrlffx.exe125⤵
-
\??\c:\5xffxxx.exec:\5xffxxx.exe126⤵
-
\??\c:\bnnnnn.exec:\bnnnnn.exe127⤵
-
\??\c:\jdjjp.exec:\jdjjp.exe128⤵
-
\??\c:\ppddv.exec:\ppddv.exe129⤵
-
\??\c:\rfrrrxr.exec:\rfrrrxr.exe130⤵
-
\??\c:\hnhthn.exec:\hnhthn.exe131⤵
-
\??\c:\bhbhtn.exec:\bhbhtn.exe132⤵
-
\??\c:\5dvpp.exec:\5dvpp.exe133⤵
-
\??\c:\flxrrrr.exec:\flxrrrr.exe134⤵
-
\??\c:\tnhhht.exec:\tnhhht.exe135⤵
-
\??\c:\nnhhbh.exec:\nnhhbh.exe136⤵
-
\??\c:\dpvvv.exec:\dpvvv.exe137⤵
-
\??\c:\rrrllll.exec:\rrrllll.exe138⤵
-
\??\c:\hhbhnn.exec:\hhbhnn.exe139⤵
-
\??\c:\9dvpp.exec:\9dvpp.exe140⤵
-
\??\c:\ppvdp.exec:\ppvdp.exe141⤵
-
\??\c:\nnhhbb.exec:\nnhhbb.exe142⤵
-
\??\c:\vpvpp.exec:\vpvpp.exe143⤵
-
\??\c:\5fxxxlr.exec:\5fxxxlr.exe144⤵
-
\??\c:\tntttn.exec:\tntttn.exe145⤵
-
\??\c:\9vjjj.exec:\9vjjj.exe146⤵
-
\??\c:\3rrrxxl.exec:\3rrrxxl.exe147⤵
-
\??\c:\fxffxff.exec:\fxffxff.exe148⤵
-
\??\c:\hhnnth.exec:\hhnnth.exe149⤵
-
\??\c:\jpppv.exec:\jpppv.exe150⤵
-
\??\c:\rlrlllf.exec:\rlrlllf.exe151⤵
-
\??\c:\7hhnhn.exec:\7hhnhn.exe152⤵
-
\??\c:\3bnnhn.exec:\3bnnhn.exe153⤵
-
\??\c:\vpjdd.exec:\vpjdd.exe154⤵
-
\??\c:\rffxrrr.exec:\rffxrrr.exe155⤵
-
\??\c:\rffrxrf.exec:\rffrxrf.exe156⤵
-
\??\c:\hbhhhh.exec:\hbhhhh.exe157⤵
-
\??\c:\pjpvp.exec:\pjpvp.exe158⤵
-
\??\c:\xrffllr.exec:\xrffllr.exe159⤵
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe160⤵
-
\??\c:\bnttnh.exec:\bnttnh.exe161⤵
-
\??\c:\5bttnn.exec:\5bttnn.exe162⤵
-
\??\c:\ddjpp.exec:\ddjpp.exe163⤵
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe164⤵
-
\??\c:\fxlffll.exec:\fxlffll.exe165⤵
-
\??\c:\7bhhhh.exec:\7bhhhh.exe166⤵
-
\??\c:\dvjjj.exec:\dvjjj.exe167⤵
-
\??\c:\pdddp.exec:\pdddp.exe168⤵
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe169⤵
-
\??\c:\hhnthh.exec:\hhnthh.exe170⤵
-
\??\c:\nhnhnn.exec:\nhnhnn.exe171⤵
-
\??\c:\vvjjv.exec:\vvjjv.exe172⤵
-
\??\c:\rlffffl.exec:\rlffffl.exe173⤵
-
\??\c:\tttnhn.exec:\tttnhn.exe174⤵
-
\??\c:\bbhbbb.exec:\bbhbbb.exe175⤵
-
\??\c:\vddvp.exec:\vddvp.exe176⤵
-
\??\c:\lrflllr.exec:\lrflllr.exe177⤵
-
\??\c:\rlfflrx.exec:\rlfflrx.exe178⤵
-
\??\c:\hthbtt.exec:\hthbtt.exe179⤵
-
\??\c:\1pdjj.exec:\1pdjj.exe180⤵
-
\??\c:\7rrlfff.exec:\7rrlfff.exe181⤵
-
\??\c:\lxlfffx.exec:\lxlfffx.exe182⤵
-
\??\c:\ttnbtt.exec:\ttnbtt.exe183⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe184⤵
-
\??\c:\1rfxxff.exec:\1rfxxff.exe185⤵
-
\??\c:\nhbtnn.exec:\nhbtnn.exe186⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe187⤵
-
\??\c:\fxffxxx.exec:\fxffxxx.exe188⤵
-
\??\c:\flxrrll.exec:\flxrrll.exe189⤵
-
\??\c:\djdpp.exec:\djdpp.exe190⤵
-
\??\c:\jjvvv.exec:\jjvvv.exe191⤵
-
\??\c:\ntbtnt.exec:\ntbtnt.exe192⤵
-
\??\c:\hhbthh.exec:\hhbthh.exe193⤵
-
\??\c:\vddvp.exec:\vddvp.exe194⤵
-
\??\c:\ffrrxxf.exec:\ffrrxxf.exe195⤵
-
\??\c:\bhnnht.exec:\bhnnht.exe196⤵
-
\??\c:\nbnhbb.exec:\nbnhbb.exe197⤵
-
\??\c:\djvvp.exec:\djvvp.exe198⤵
-
\??\c:\lfxrlll.exec:\lfxrlll.exe199⤵
-
\??\c:\hbbbnt.exec:\hbbbnt.exe200⤵
-
\??\c:\vjpvj.exec:\vjpvj.exe201⤵
-
\??\c:\9flfllr.exec:\9flfllr.exe202⤵
-
\??\c:\fxlllfx.exec:\fxlllfx.exe203⤵
-
\??\c:\nhhbbn.exec:\nhhbbn.exe204⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe205⤵
-
\??\c:\xxxfflr.exec:\xxxfflr.exe206⤵
-
\??\c:\tnnnnn.exec:\tnnnnn.exe207⤵
-
\??\c:\vvdjp.exec:\vvdjp.exe208⤵
-
\??\c:\9fffllf.exec:\9fffllf.exe209⤵
-
\??\c:\flfllff.exec:\flfllff.exe210⤵
-
\??\c:\tbbnhn.exec:\tbbnhn.exe211⤵
-
\??\c:\3jpjd.exec:\3jpjd.exe212⤵
-
\??\c:\xrfxrlr.exec:\xrfxrlr.exe213⤵
-
\??\c:\xrfxrlf.exec:\xrfxrlf.exe214⤵
-
\??\c:\tnbthh.exec:\tnbthh.exe215⤵
-
\??\c:\vjvpj.exec:\vjvpj.exe216⤵
-
\??\c:\xxrflfx.exec:\xxrflfx.exe217⤵
-
\??\c:\btnhth.exec:\btnhth.exe218⤵
-
\??\c:\hnttbt.exec:\hnttbt.exe219⤵
-
\??\c:\rxxrlxr.exec:\rxxrlxr.exe220⤵
-
\??\c:\tnbntt.exec:\tnbntt.exe221⤵
-
\??\c:\nhbttb.exec:\nhbttb.exe222⤵
-
\??\c:\7djjv.exec:\7djjv.exe223⤵
-
\??\c:\ppvdd.exec:\ppvdd.exe224⤵
-
\??\c:\7xlfflf.exec:\7xlfflf.exe225⤵
-
\??\c:\btntbt.exec:\btntbt.exe226⤵
-
\??\c:\7vvpj.exec:\7vvpj.exe227⤵
-
\??\c:\pddjj.exec:\pddjj.exe228⤵
-
\??\c:\rlxxffx.exec:\rlxxffx.exe229⤵
-
\??\c:\nhbtbb.exec:\nhbtbb.exe230⤵
-
\??\c:\jjvvv.exec:\jjvvv.exe231⤵
-
\??\c:\vpvvp.exec:\vpvvp.exe232⤵
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe233⤵
-
\??\c:\nthhbb.exec:\nthhbb.exe234⤵
-
\??\c:\nbnnnh.exec:\nbnnnh.exe235⤵
-
\??\c:\vjvpp.exec:\vjvpp.exe236⤵
-
\??\c:\fffxrrl.exec:\fffxrrl.exe237⤵
-
\??\c:\nbnnnn.exec:\nbnnnn.exe238⤵
-
\??\c:\dvddd.exec:\dvddd.exe239⤵
-
\??\c:\vvddd.exec:\vvddd.exe240⤵
-
\??\c:\rfllffx.exec:\rfllffx.exe241⤵