Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 19:41
Behavioral task
behavioral1
Sample
24d33f26b845130bfe2acef96de5d7a03dc9c0e96a97dde222f32e6483948f3b.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
24d33f26b845130bfe2acef96de5d7a03dc9c0e96a97dde222f32e6483948f3b.exe
-
Size
464KB
-
MD5
02ea9ad902d1da3c5556a1436c884ca4
-
SHA1
5e1bb5bb74868e46112ac9d55bca1532fba1bab0
-
SHA256
24d33f26b845130bfe2acef96de5d7a03dc9c0e96a97dde222f32e6483948f3b
-
SHA512
f257c9083a7826223fc138e22b5d749ebb2c838921f6f2c768d2b93de6742079685fc3ada34bb4f2391029e4e55c54609dddb2481244d89fd9dba815eb4309da
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1VV:VeR0oykayRFp3lztP+OKaf1VV
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2960-1-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3088-12-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2876-14-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1592-25-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1928-27-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2904-31-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2904-38-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2932-43-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3248-49-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1968-59-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3240-67-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2616-72-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3444-79-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3460-87-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4480-93-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4580-102-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2096-110-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5040-122-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1000-129-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3628-136-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4708-154-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3440-161-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1092-168-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2292-173-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4264-183-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1668-189-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3536-190-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4364-195-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4008-201-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4804-211-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/976-227-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4864-234-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3992-238-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1840-248-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3896-255-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1108-258-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4480-265-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5024-275-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1424-285-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4220-292-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3300-303-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3752-304-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4748-315-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3948-340-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2740-351-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4840-358-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2448-369-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1268-380-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4632-417-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/436-418-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3116-440-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3924-444-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3992-499-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4996-501-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4464-526-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3628-561-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3512-571-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2620-578-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4880-616-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/60-665-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3256-690-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4556-800-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3084-905-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1260-909-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/2960-1-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x000800000002327d-4.dat UPX behavioral2/memory/3088-6-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/memory/3088-12-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/memory/2876-14-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x000800000002340f-10.dat UPX behavioral2/files/0x0007000000023413-13.dat UPX behavioral2/memory/1592-18-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x0007000000023415-23.dat UPX behavioral2/memory/1592-25-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/memory/1928-27-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x0007000000023416-30.dat UPX behavioral2/memory/2904-31-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x0007000000023417-35.dat UPX behavioral2/memory/2904-38-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x0007000000023418-41.dat UPX behavioral2/memory/2932-43-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/memory/3248-49-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x0007000000023419-50.dat UPX behavioral2/files/0x000700000002341a-54.dat UPX behavioral2/memory/1968-59-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x000700000002341b-58.dat UPX behavioral2/files/0x000700000002341c-63.dat UPX behavioral2/memory/3240-67-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x000700000002341d-69.dat UPX behavioral2/memory/2616-72-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/memory/3444-79-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x0007000000023420-83.dat UPX behavioral2/files/0x000700000002341f-77.dat UPX behavioral2/memory/3460-87-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x0007000000023421-94.dat UPX behavioral2/memory/4480-93-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x0008000000023410-89.dat UPX behavioral2/files/0x0007000000023422-98.dat UPX behavioral2/memory/4580-102-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x0007000000023423-104.dat UPX behavioral2/files/0x0007000000023424-111.dat UPX behavioral2/memory/2096-110-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x0007000000023425-115.dat UPX behavioral2/files/0x0007000000023426-120.dat UPX behavioral2/memory/5040-122-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x0007000000023427-126.dat UPX behavioral2/memory/1000-129-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x0007000000023428-133.dat UPX behavioral2/memory/3628-136-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x0007000000023429-140.dat UPX behavioral2/files/0x000700000002342a-143.dat UPX behavioral2/files/0x000700000002342b-148.dat UPX behavioral2/memory/4708-154-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x000700000002342c-155.dat UPX behavioral2/memory/3440-157-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/memory/3440-161-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x000700000002342d-163.dat UPX behavioral2/memory/1092-168-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x000700000002342e-167.dat UPX behavioral2/files/0x000700000002342f-172.dat UPX behavioral2/memory/2292-173-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/files/0x0007000000023430-179.dat UPX behavioral2/files/0x0007000000023431-184.dat UPX behavioral2/memory/4264-183-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/memory/1668-189-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/memory/3536-190-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/memory/4364-195-0x0000000000400000-0x000000000043A000-memory.dmp UPX behavioral2/memory/4008-201-0x0000000000400000-0x000000000043A000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3088 lxrlxlf.exe 2876 3hhbnn.exe 1592 fxrfxlf.exe 1928 3nnbnb.exe 2904 1bhhbb.exe 2932 pjvvj.exe 3248 lxfrffl.exe 544 jpjpp.exe 1968 nnnnhh.exe 5004 fxlfrxr.exe 3240 bhthbt.exe 2616 1dvjd.exe 3444 xlrllll.exe 3460 nhnhtn.exe 4480 9jjdp.exe 3792 nhtttt.exe 4580 vdvpj.exe 2096 5lrlfxl.exe 1424 3bbttt.exe 5040 xffrlfl.exe 4240 ttttnh.exe 1000 dpvdv.exe 3628 7frfffl.exe 1796 vvdjd.exe 4476 rflxrlf.exe 4708 bnnhbt.exe 3440 lxxlfxr.exe 1092 jvdvp.exe 2292 3nhnht.exe 3264 ddvpp.exe 4264 hnhtnb.exe 1668 dppvp.exe 3536 bnhbtn.exe 4364 7djdp.exe 2752 lllfxxx.exe 4008 bhttnt.exe 2092 jvddv.exe 4804 rxxrfxr.exe 2740 bntnhb.exe 4840 lrxrlfx.exe 3960 fxxfxlf.exe 4912 ttnhnh.exe 976 vppdv.exe 4188 fxlxrlr.exe 4864 1hthhh.exe 3992 dvdvd.exe 4236 lflxrlf.exe 3668 7tnhbb.exe 4120 jddvp.exe 1840 jvpjp.exe 3896 rxxrlfl.exe 1108 htnhtb.exe 2808 jjjpd.exe 5008 rrllrrr.exe 4480 tnnhtt.exe 1480 btbbtt.exe 2508 jdddd.exe 5024 xxfrffr.exe 4632 bhbhnt.exe 4088 jvvvp.exe 1424 vvdvj.exe 1676 xlffxrx.exe 4220 ttnhbt.exe 764 pdvvp.exe -
resource yara_rule behavioral2/memory/2960-1-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000800000002327d-4.dat upx behavioral2/memory/3088-6-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3088-12-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2876-14-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000800000002340f-10.dat upx behavioral2/files/0x0007000000023413-13.dat upx behavioral2/memory/1592-18-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023415-23.dat upx behavioral2/memory/1592-25-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1928-27-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023416-30.dat upx behavioral2/memory/2904-31-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023417-35.dat upx behavioral2/memory/2904-38-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023418-41.dat upx behavioral2/memory/2932-43-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3248-49-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023419-50.dat upx behavioral2/files/0x000700000002341a-54.dat upx behavioral2/memory/1968-59-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002341b-58.dat upx behavioral2/files/0x000700000002341c-63.dat upx behavioral2/memory/3240-67-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002341d-69.dat upx behavioral2/memory/2616-72-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3444-79-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023420-83.dat upx behavioral2/files/0x000700000002341f-77.dat upx behavioral2/memory/3460-87-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023421-94.dat upx behavioral2/memory/4480-93-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0008000000023410-89.dat upx behavioral2/files/0x0007000000023422-98.dat upx behavioral2/memory/4580-102-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023423-104.dat upx behavioral2/files/0x0007000000023424-111.dat upx behavioral2/memory/2096-110-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023425-115.dat upx behavioral2/files/0x0007000000023426-120.dat upx behavioral2/memory/5040-122-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023427-126.dat upx behavioral2/memory/1000-129-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023428-133.dat upx behavioral2/memory/3628-136-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023429-140.dat upx behavioral2/files/0x000700000002342a-143.dat upx behavioral2/files/0x000700000002342b-148.dat upx behavioral2/memory/4708-154-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002342c-155.dat upx behavioral2/memory/3440-157-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3440-161-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002342d-163.dat upx behavioral2/memory/1092-168-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002342e-167.dat upx behavioral2/files/0x000700000002342f-172.dat upx behavioral2/memory/2292-173-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023430-179.dat upx behavioral2/files/0x0007000000023431-184.dat upx behavioral2/memory/4264-183-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1668-189-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3536-190-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4364-195-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4008-201-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2960 wrote to memory of 3088 2960 24d33f26b845130bfe2acef96de5d7a03dc9c0e96a97dde222f32e6483948f3b.exe 83 PID 2960 wrote to memory of 3088 2960 24d33f26b845130bfe2acef96de5d7a03dc9c0e96a97dde222f32e6483948f3b.exe 83 PID 2960 wrote to memory of 3088 2960 24d33f26b845130bfe2acef96de5d7a03dc9c0e96a97dde222f32e6483948f3b.exe 83 PID 3088 wrote to memory of 2876 3088 lxrlxlf.exe 84 PID 3088 wrote to memory of 2876 3088 lxrlxlf.exe 84 PID 3088 wrote to memory of 2876 3088 lxrlxlf.exe 84 PID 2876 wrote to memory of 1592 2876 3hhbnn.exe 85 PID 2876 wrote to memory of 1592 2876 3hhbnn.exe 85 PID 2876 wrote to memory of 1592 2876 3hhbnn.exe 85 PID 1592 wrote to memory of 1928 1592 fxrfxlf.exe 86 PID 1592 wrote to memory of 1928 1592 fxrfxlf.exe 86 PID 1592 wrote to memory of 1928 1592 fxrfxlf.exe 86 PID 1928 wrote to memory of 2904 1928 3nnbnb.exe 87 PID 1928 wrote to memory of 2904 1928 3nnbnb.exe 87 PID 1928 wrote to memory of 2904 1928 3nnbnb.exe 87 PID 2904 wrote to memory of 2932 2904 1bhhbb.exe 88 PID 2904 wrote to memory of 2932 2904 1bhhbb.exe 88 PID 2904 wrote to memory of 2932 2904 1bhhbb.exe 88 PID 2932 wrote to memory of 3248 2932 pjvvj.exe 89 PID 2932 wrote to memory of 3248 2932 pjvvj.exe 89 PID 2932 wrote to memory of 3248 2932 pjvvj.exe 89 PID 3248 wrote to memory of 544 3248 lxfrffl.exe 90 PID 3248 wrote to memory of 544 3248 lxfrffl.exe 90 PID 3248 wrote to memory of 544 3248 lxfrffl.exe 90 PID 544 wrote to memory of 1968 544 jpjpp.exe 91 PID 544 wrote to memory of 1968 544 jpjpp.exe 91 PID 544 wrote to memory of 1968 544 jpjpp.exe 91 PID 1968 wrote to memory of 5004 1968 nnnnhh.exe 93 PID 1968 wrote to memory of 5004 1968 nnnnhh.exe 93 PID 1968 wrote to memory of 5004 1968 nnnnhh.exe 93 PID 5004 wrote to memory of 3240 5004 fxlfrxr.exe 94 PID 5004 wrote to memory of 3240 5004 fxlfrxr.exe 94 PID 5004 wrote to memory of 3240 5004 fxlfrxr.exe 94 PID 3240 wrote to memory of 2616 3240 bhthbt.exe 95 PID 3240 wrote to memory of 2616 3240 bhthbt.exe 95 PID 3240 wrote to memory of 2616 3240 bhthbt.exe 95 PID 2616 wrote to memory of 3444 2616 1dvjd.exe 96 PID 2616 wrote to memory of 3444 2616 1dvjd.exe 96 PID 2616 wrote to memory of 3444 2616 1dvjd.exe 96 PID 3444 wrote to memory of 3460 3444 xlrllll.exe 98 PID 3444 wrote to memory of 3460 3444 xlrllll.exe 98 PID 3444 wrote to memory of 3460 3444 xlrllll.exe 98 PID 3460 wrote to memory of 4480 3460 nhnhtn.exe 99 PID 3460 wrote to memory of 4480 3460 nhnhtn.exe 99 PID 3460 wrote to memory of 4480 3460 nhnhtn.exe 99 PID 4480 wrote to memory of 3792 4480 9jjdp.exe 100 PID 4480 wrote to memory of 3792 4480 9jjdp.exe 100 PID 4480 wrote to memory of 3792 4480 9jjdp.exe 100 PID 3792 wrote to memory of 4580 3792 nhtttt.exe 101 PID 3792 wrote to memory of 4580 3792 nhtttt.exe 101 PID 3792 wrote to memory of 4580 3792 nhtttt.exe 101 PID 4580 wrote to memory of 2096 4580 vdvpj.exe 102 PID 4580 wrote to memory of 2096 4580 vdvpj.exe 102 PID 4580 wrote to memory of 2096 4580 vdvpj.exe 102 PID 2096 wrote to memory of 1424 2096 5lrlfxl.exe 103 PID 2096 wrote to memory of 1424 2096 5lrlfxl.exe 103 PID 2096 wrote to memory of 1424 2096 5lrlfxl.exe 103 PID 1424 wrote to memory of 5040 1424 3bbttt.exe 104 PID 1424 wrote to memory of 5040 1424 3bbttt.exe 104 PID 1424 wrote to memory of 5040 1424 3bbttt.exe 104 PID 5040 wrote to memory of 4240 5040 xffrlfl.exe 106 PID 5040 wrote to memory of 4240 5040 xffrlfl.exe 106 PID 5040 wrote to memory of 4240 5040 xffrlfl.exe 106 PID 4240 wrote to memory of 1000 4240 ttttnh.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\24d33f26b845130bfe2acef96de5d7a03dc9c0e96a97dde222f32e6483948f3b.exe"C:\Users\Admin\AppData\Local\Temp\24d33f26b845130bfe2acef96de5d7a03dc9c0e96a97dde222f32e6483948f3b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\lxrlxlf.exec:\lxrlxlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\3hhbnn.exec:\3hhbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\fxrfxlf.exec:\fxrfxlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\3nnbnb.exec:\3nnbnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\1bhhbb.exec:\1bhhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\pjvvj.exec:\pjvvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\lxfrffl.exec:\lxfrffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\jpjpp.exec:\jpjpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\nnnnhh.exec:\nnnnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\fxlfrxr.exec:\fxlfrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\bhthbt.exec:\bhthbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\1dvjd.exec:\1dvjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\xlrllll.exec:\xlrllll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\nhnhtn.exec:\nhnhtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\9jjdp.exec:\9jjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\nhtttt.exec:\nhtttt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\vdvpj.exec:\vdvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\5lrlfxl.exec:\5lrlfxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\3bbttt.exec:\3bbttt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\xffrlfl.exec:\xffrlfl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\ttttnh.exec:\ttttnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\dpvdv.exec:\dpvdv.exe23⤵
- Executes dropped EXE
PID:1000 -
\??\c:\7frfffl.exec:\7frfffl.exe24⤵
- Executes dropped EXE
PID:3628 -
\??\c:\vvdjd.exec:\vvdjd.exe25⤵
- Executes dropped EXE
PID:1796 -
\??\c:\rflxrlf.exec:\rflxrlf.exe26⤵
- Executes dropped EXE
PID:4476 -
\??\c:\bnnhbt.exec:\bnnhbt.exe27⤵
- Executes dropped EXE
PID:4708 -
\??\c:\lxxlfxr.exec:\lxxlfxr.exe28⤵
- Executes dropped EXE
PID:3440 -
\??\c:\jvdvp.exec:\jvdvp.exe29⤵
- Executes dropped EXE
PID:1092 -
\??\c:\3nhnht.exec:\3nhnht.exe30⤵
- Executes dropped EXE
PID:2292 -
\??\c:\ddvpp.exec:\ddvpp.exe31⤵
- Executes dropped EXE
PID:3264 -
\??\c:\hnhtnb.exec:\hnhtnb.exe32⤵
- Executes dropped EXE
PID:4264 -
\??\c:\dppvp.exec:\dppvp.exe33⤵
- Executes dropped EXE
PID:1668 -
\??\c:\bnhbtn.exec:\bnhbtn.exe34⤵
- Executes dropped EXE
PID:3536 -
\??\c:\7djdp.exec:\7djdp.exe35⤵
- Executes dropped EXE
PID:4364 -
\??\c:\lllfxxx.exec:\lllfxxx.exe36⤵
- Executes dropped EXE
PID:2752 -
\??\c:\bhttnt.exec:\bhttnt.exe37⤵
- Executes dropped EXE
PID:4008 -
\??\c:\jvddv.exec:\jvddv.exe38⤵
- Executes dropped EXE
PID:2092 -
\??\c:\rxxrfxr.exec:\rxxrfxr.exe39⤵
- Executes dropped EXE
PID:4804 -
\??\c:\bntnhb.exec:\bntnhb.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe41⤵
- Executes dropped EXE
PID:4840 -
\??\c:\fxxfxlf.exec:\fxxfxlf.exe42⤵
- Executes dropped EXE
PID:3960 -
\??\c:\ttnhnh.exec:\ttnhnh.exe43⤵
- Executes dropped EXE
PID:4912 -
\??\c:\vppdv.exec:\vppdv.exe44⤵
- Executes dropped EXE
PID:976 -
\??\c:\fxlxrlr.exec:\fxlxrlr.exe45⤵
- Executes dropped EXE
PID:4188 -
\??\c:\1hthhh.exec:\1hthhh.exe46⤵
- Executes dropped EXE
PID:4864 -
\??\c:\dvdvd.exec:\dvdvd.exe47⤵
- Executes dropped EXE
PID:3992 -
\??\c:\lflxrlf.exec:\lflxrlf.exe48⤵
- Executes dropped EXE
PID:4236 -
\??\c:\7tnhbb.exec:\7tnhbb.exe49⤵
- Executes dropped EXE
PID:3668 -
\??\c:\jddvp.exec:\jddvp.exe50⤵
- Executes dropped EXE
PID:4120 -
\??\c:\jvpjp.exec:\jvpjp.exe51⤵
- Executes dropped EXE
PID:1840 -
\??\c:\rxxrlfl.exec:\rxxrlfl.exe52⤵
- Executes dropped EXE
PID:3896 -
\??\c:\htnhtb.exec:\htnhtb.exe53⤵
- Executes dropped EXE
PID:1108 -
\??\c:\jjjpd.exec:\jjjpd.exe54⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rrllrrr.exec:\rrllrrr.exe55⤵
- Executes dropped EXE
PID:5008 -
\??\c:\tnnhtt.exec:\tnnhtt.exe56⤵
- Executes dropped EXE
PID:4480 -
\??\c:\btbbtt.exec:\btbbtt.exe57⤵
- Executes dropped EXE
PID:1480 -
\??\c:\jdddd.exec:\jdddd.exe58⤵
- Executes dropped EXE
PID:2508 -
\??\c:\xxfrffr.exec:\xxfrffr.exe59⤵
- Executes dropped EXE
PID:5024 -
\??\c:\bhbhnt.exec:\bhbhnt.exe60⤵
- Executes dropped EXE
PID:4632 -
\??\c:\jvvvp.exec:\jvvvp.exe61⤵
- Executes dropped EXE
PID:4088 -
\??\c:\vvdvj.exec:\vvdvj.exe62⤵
- Executes dropped EXE
PID:1424 -
\??\c:\xlffxrx.exec:\xlffxrx.exe63⤵
- Executes dropped EXE
PID:1676 -
\??\c:\ttnhbt.exec:\ttnhbt.exe64⤵
- Executes dropped EXE
PID:4220 -
\??\c:\pdvvp.exec:\pdvvp.exe65⤵
- Executes dropped EXE
PID:764 -
\??\c:\jjddd.exec:\jjddd.exe66⤵PID:3300
-
\??\c:\bbhhht.exec:\bbhhht.exe67⤵PID:3752
-
\??\c:\vpppp.exec:\vpppp.exe68⤵PID:5108
-
\??\c:\jdjdv.exec:\jdjdv.exe69⤵PID:4748
-
\??\c:\lllxllf.exec:\lllxllf.exe70⤵PID:2688
-
\??\c:\hhnhbt.exec:\hhnhbt.exe71⤵PID:3760
-
\??\c:\dvjjd.exec:\dvjjd.exe72⤵PID:2856
-
\??\c:\fxrrlrl.exec:\fxrrlrl.exe73⤵PID:2948
-
\??\c:\btnhhh.exec:\btnhhh.exe74⤵PID:2292
-
\??\c:\nnhhbb.exec:\nnhhbb.exe75⤵PID:4788
-
\??\c:\9ppdv.exec:\9ppdv.exe76⤵PID:4164
-
\??\c:\xrrfxrl.exec:\xrrfxrl.exe77⤵PID:4380
-
\??\c:\bhhtnh.exec:\bhhtnh.exe78⤵PID:3948
-
\??\c:\htbnhh.exec:\htbnhh.exe79⤵PID:1744
-
\??\c:\jjppp.exec:\jjppp.exe80⤵PID:3524
-
\??\c:\fffxrrl.exec:\fffxrrl.exe81⤵PID:2740
-
\??\c:\nhnhhh.exec:\nhnhhh.exe82⤵PID:4840
-
\??\c:\5hnntt.exec:\5hnntt.exe83⤵PID:672
-
\??\c:\dvdpp.exec:\dvdpp.exe84⤵PID:3860
-
\??\c:\xlxlffx.exec:\xlxlffx.exe85⤵PID:3936
-
\??\c:\hbnnhb.exec:\hbnnhb.exe86⤵PID:2448
-
\??\c:\bnnhht.exec:\bnnhht.exe87⤵PID:4996
-
\??\c:\jvvpj.exec:\jvvpj.exe88⤵PID:4964
-
\??\c:\7xxrlll.exec:\7xxrlll.exe89⤵PID:1268
-
\??\c:\ntbhbt.exec:\ntbhbt.exe90⤵PID:4120
-
\??\c:\ppjpp.exec:\ppjpp.exe91⤵PID:1840
-
\??\c:\jvdpj.exec:\jvdpj.exe92⤵PID:3896
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe93⤵PID:1108
-
\??\c:\nnnbtt.exec:\nnnbtt.exe94⤵PID:2808
-
\??\c:\3pvdv.exec:\3pvdv.exe95⤵PID:1572
-
\??\c:\jvjpj.exec:\jvjpj.exe96⤵PID:3236
-
\??\c:\llffxxx.exec:\llffxxx.exe97⤵PID:1480
-
\??\c:\5thbhn.exec:\5thbhn.exe98⤵PID:2248
-
\??\c:\vpjvj.exec:\vpjvj.exe99⤵PID:4512
-
\??\c:\vvpvp.exec:\vvpvp.exe100⤵PID:4632
-
\??\c:\xrxrllf.exec:\xrxrllf.exe101⤵PID:436
-
\??\c:\nnttnb.exec:\nnttnb.exe102⤵PID:2152
-
\??\c:\dvjdp.exec:\dvjdp.exe103⤵PID:3032
-
\??\c:\vdddp.exec:\vdddp.exe104⤵PID:3084
-
\??\c:\llrfrlf.exec:\llrfrlf.exe105⤵PID:4920
-
\??\c:\5bhnhb.exec:\5bhnhb.exe106⤵PID:4288
-
\??\c:\nnbthb.exec:\nnbthb.exe107⤵PID:3116
-
\??\c:\ddjdd.exec:\ddjdd.exe108⤵PID:3644
-
\??\c:\llfxrll.exec:\llfxrll.exe109⤵PID:3924
-
\??\c:\tnbbnh.exec:\tnbbnh.exe110⤵PID:2120
-
\??\c:\vdpjp.exec:\vdpjp.exe111⤵PID:3760
-
\??\c:\xlrrxrl.exec:\xlrrxrl.exe112⤵PID:2272
-
\??\c:\rllrlfx.exec:\rllrlfx.exe113⤵PID:3804
-
\??\c:\tbbttn.exec:\tbbttn.exe114⤵PID:2292
-
\??\c:\tbbthn.exec:\tbbthn.exe115⤵PID:716
-
\??\c:\7pjdj.exec:\7pjdj.exe116⤵PID:4376
-
\??\c:\7xrlxrl.exec:\7xrlxrl.exe117⤵PID:2032
-
\??\c:\tthbtn.exec:\tthbtn.exe118⤵PID:4804
-
\??\c:\pdvpd.exec:\pdvpd.exe119⤵PID:1744
-
\??\c:\3pppp.exec:\3pppp.exe120⤵PID:1928
-
\??\c:\rxfrllx.exec:\rxfrllx.exe121⤵PID:3412
-
\??\c:\hhnbnb.exec:\hhnbnb.exe122⤵PID:4840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-