Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 19:57
Behavioral task
behavioral1
Sample
24d33f26b845130bfe2acef96de5d7a03dc9c0e96a97dde222f32e6483948f3b.exe
Resource
win7-20240221-en
General
-
Target
24d33f26b845130bfe2acef96de5d7a03dc9c0e96a97dde222f32e6483948f3b.exe
-
Size
464KB
-
MD5
02ea9ad902d1da3c5556a1436c884ca4
-
SHA1
5e1bb5bb74868e46112ac9d55bca1532fba1bab0
-
SHA256
24d33f26b845130bfe2acef96de5d7a03dc9c0e96a97dde222f32e6483948f3b
-
SHA512
f257c9083a7826223fc138e22b5d749ebb2c838921f6f2c768d2b93de6742079685fc3ada34bb4f2391029e4e55c54609dddb2481244d89fd9dba815eb4309da
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1VV:VeR0oykayRFp3lztP+OKaf1VV
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/676-8-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1668-6-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/404-14-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5092-24-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3544-19-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1112-32-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4844-38-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3572-48-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1708-59-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3168-72-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1604-66-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4584-78-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1996-83-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1616-92-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3920-98-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2020-102-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4956-107-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4308-126-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3692-137-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3628-125-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2304-145-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/448-154-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4720-158-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2788-166-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1596-179-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2376-188-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4072-197-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2120-199-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3552-208-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1996-211-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4116-212-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1336-217-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4292-235-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3736-243-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4852-244-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2364-260-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2920-268-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1436-272-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1740-281-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4688-286-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/752-290-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3172-308-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4972-361-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2540-364-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1984-372-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3896-374-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4936-399-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1968-421-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3948-427-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3692-451-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2512-459-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1740-477-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3696-487-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1288-495-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2296-513-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1740-561-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2024-597-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4160-607-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2340-630-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4160-742-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/412-773-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1888-793-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3740-1112-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4600-1137-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral2/memory/1668-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\hhbtnn.exe family_berbew behavioral2/memory/676-8-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1668-6-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/404-14-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\pjjdd.exe family_berbew C:\ffxrrrr.exe family_berbew behavioral2/memory/5092-24-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3544-19-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\dpppj.exe family_berbew C:\pvpjj.exe family_berbew behavioral2/memory/1112-32-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\rxfxxxr.exe family_berbew behavioral2/memory/4844-38-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\nbtnbh.exe family_berbew C:\xrxxrrl.exe family_berbew behavioral2/memory/3572-48-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\1hnntt.exe family_berbew C:\thnnnb.exe family_berbew behavioral2/memory/1708-59-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\llrrrfl.exe family_berbew C:\hbbbtb.exe family_berbew behavioral2/memory/3168-72-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1604-66-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vvppd.exe family_berbew behavioral2/memory/4584-78-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\pjvvp.exe family_berbew behavioral2/memory/1996-83-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\bhhhhh.exe family_berbew behavioral2/memory/1616-92-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vjppv.exe family_berbew behavioral2/memory/3920-98-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\bhtttt.exe family_berbew behavioral2/memory/2020-102-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\hbhhbh.exe family_berbew behavioral2/memory/4956-107-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\jdvvv.exe family_berbew C:\lflfxxx.exe family_berbew behavioral2/memory/3628-118-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\pjpjp.exe family_berbew behavioral2/memory/4308-126-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\5ffxlrl.exe family_berbew C:\dvpvp.exe family_berbew behavioral2/memory/3692-137-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3628-125-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\lrlfxrl.exe family_berbew behavioral2/memory/2304-145-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\xxfrlll.exe family_berbew C:\nhtnhh.exe family_berbew behavioral2/memory/448-154-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\pvvjj.exe family_berbew behavioral2/memory/4720-158-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\jdjdv.exe family_berbew behavioral2/memory/2788-166-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\9rxrlrr.exe family_berbew C:\tbbbhh.exe family_berbew C:\rffrrxl.exe family_berbew behavioral2/memory/1596-179-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\jpvvp.exe family_berbew behavioral2/memory/2376-188-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4072-197-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2120-199-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3552-208-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1996-211-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
hhbtnn.exedpppj.exepjjdd.exeffxrrrr.exepvpjj.exerxfxxxr.exenbtnbh.exexrxxrrl.exe1hnntt.exethnnnb.exellrrrfl.exehbbbtb.exevvppd.exepjvvp.exebhhhhh.exevjppv.exebhtttt.exehbhhbh.exejdvvv.exelflfxxx.exepjpjp.exe5ffxlrl.exedvpvp.exexxfrlll.exelrlfxrl.exenhtnhh.exepvvjj.exejdjdv.exe9rxrlrr.exetbbbhh.exerffrrxl.exejpvvp.exerxfxrrl.exe3tbtnn.exepvjdv.exevpdpv.exennnhbb.exe9pjjp.exerlrllrx.exebtbbtt.exe5ppjd.exerlxxxll.exebtbbbb.exedvpdv.exejjdvv.exerllfxxr.exebnnhhh.exe5vvvv.exelxfffrx.exe1tnhbn.exevpvpp.exefflllfl.exexxxxrrr.exetnnhbn.exejddjv.exerllfrrl.exeflrrxxx.exedpvvp.exevvvpp.exerlllflf.exentnnhb.exedvppd.exelrrfxrl.exebbhbtt.exepid process 676 hhbtnn.exe 404 dpppj.exe 3544 pjjdd.exe 5092 ffxrrrr.exe 1112 pvpjj.exe 4844 rxfxxxr.exe 3496 nbtnbh.exe 3572 xrxxrrl.exe 1708 1hnntt.exe 2340 thnnnb.exe 1604 llrrrfl.exe 3168 hbbbtb.exe 4584 vvppd.exe 1996 pjvvp.exe 1616 bhhhhh.exe 3920 vjppv.exe 2020 bhtttt.exe 4956 hbhhbh.exe 4728 jdvvv.exe 3628 lflfxxx.exe 4308 pjpjp.exe 512 5ffxlrl.exe 3692 dvpvp.exe 2304 xxfrlll.exe 4744 lrlfxrl.exe 448 nhtnhh.exe 4720 pvvjj.exe 2788 jdjdv.exe 4712 9rxrlrr.exe 1596 tbbbhh.exe 4004 rffrrxl.exe 2376 jpvvp.exe 2700 rxfxrrl.exe 4072 3tbtnn.exe 2120 pvjdv.exe 2228 vpdpv.exe 3552 nnnhbb.exe 1996 9pjjp.exe 4116 rlrllrx.exe 1336 btbbtt.exe 3836 5ppjd.exe 1140 rlxxxll.exe 1320 btbbbb.exe 3532 dvpdv.exe 4292 jjdvv.exe 4208 rllfxxr.exe 3736 bnnhhh.exe 4852 5vvvv.exe 1444 lxfffrx.exe 3004 1tnhbn.exe 3764 vpvpp.exe 2364 fflllfl.exe 2512 xxxxrrr.exe 3304 tnnhbn.exe 2920 jddjv.exe 1436 rllfrrl.exe 696 flrrxxx.exe 1740 dpvvp.exe 4712 vvvpp.exe 4688 rlllflf.exe 752 ntnnhb.exe 1732 dvppd.exe 4936 lrrfxrl.exe 3148 bbhbtt.exe -
Processes:
resource yara_rule behavioral2/memory/1668-0-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\hhbtnn.exe upx behavioral2/memory/676-8-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1668-6-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/404-14-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\pjjdd.exe upx C:\ffxrrrr.exe upx behavioral2/memory/5092-24-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3544-19-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\dpppj.exe upx C:\pvpjj.exe upx behavioral2/memory/1112-32-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\rxfxxxr.exe upx behavioral2/memory/4844-38-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\nbtnbh.exe upx C:\xrxxrrl.exe upx behavioral2/memory/3572-48-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\1hnntt.exe upx C:\thnnnb.exe upx behavioral2/memory/1708-59-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\llrrrfl.exe upx C:\hbbbtb.exe upx behavioral2/memory/3168-72-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1604-66-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vvppd.exe upx behavioral2/memory/4584-78-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\pjvvp.exe upx behavioral2/memory/1996-83-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\bhhhhh.exe upx behavioral2/memory/1616-92-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vjppv.exe upx behavioral2/memory/3920-98-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\bhtttt.exe upx behavioral2/memory/2020-102-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\hbhhbh.exe upx behavioral2/memory/4956-107-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\jdvvv.exe upx C:\lflfxxx.exe upx behavioral2/memory/3628-118-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\pjpjp.exe upx behavioral2/memory/4308-126-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\5ffxlrl.exe upx C:\dvpvp.exe upx behavioral2/memory/3692-137-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3628-125-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\lrlfxrl.exe upx behavioral2/memory/2304-145-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\xxfrlll.exe upx C:\nhtnhh.exe upx behavioral2/memory/448-154-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\pvvjj.exe upx behavioral2/memory/4720-158-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\jdjdv.exe upx behavioral2/memory/2788-166-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\9rxrlrr.exe upx C:\tbbbhh.exe upx C:\rffrrxl.exe upx behavioral2/memory/1596-179-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\jpvvp.exe upx behavioral2/memory/2376-188-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4072-197-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2120-199-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3552-208-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1996-211-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
24d33f26b845130bfe2acef96de5d7a03dc9c0e96a97dde222f32e6483948f3b.exehhbtnn.exedpppj.exepjjdd.exeffxrrrr.exepvpjj.exerxfxxxr.exenbtnbh.exexrxxrrl.exe1hnntt.exethnnnb.exellrrrfl.exehbbbtb.exevvppd.exepjvvp.exebhhhhh.exevjppv.exebhtttt.exehbhhbh.exejdvvv.exelflfxxx.exepjpjp.exedescription pid process target process PID 1668 wrote to memory of 676 1668 24d33f26b845130bfe2acef96de5d7a03dc9c0e96a97dde222f32e6483948f3b.exe hhbtnn.exe PID 1668 wrote to memory of 676 1668 24d33f26b845130bfe2acef96de5d7a03dc9c0e96a97dde222f32e6483948f3b.exe hhbtnn.exe PID 1668 wrote to memory of 676 1668 24d33f26b845130bfe2acef96de5d7a03dc9c0e96a97dde222f32e6483948f3b.exe hhbtnn.exe PID 676 wrote to memory of 404 676 hhbtnn.exe dpppj.exe PID 676 wrote to memory of 404 676 hhbtnn.exe dpppj.exe PID 676 wrote to memory of 404 676 hhbtnn.exe dpppj.exe PID 404 wrote to memory of 3544 404 dpppj.exe pjjdd.exe PID 404 wrote to memory of 3544 404 dpppj.exe pjjdd.exe PID 404 wrote to memory of 3544 404 dpppj.exe pjjdd.exe PID 3544 wrote to memory of 5092 3544 pjjdd.exe ffxrrrr.exe PID 3544 wrote to memory of 5092 3544 pjjdd.exe ffxrrrr.exe PID 3544 wrote to memory of 5092 3544 pjjdd.exe ffxrrrr.exe PID 5092 wrote to memory of 1112 5092 ffxrrrr.exe pvpjj.exe PID 5092 wrote to memory of 1112 5092 ffxrrrr.exe pvpjj.exe PID 5092 wrote to memory of 1112 5092 ffxrrrr.exe pvpjj.exe PID 1112 wrote to memory of 4844 1112 pvpjj.exe rxfxxxr.exe PID 1112 wrote to memory of 4844 1112 pvpjj.exe rxfxxxr.exe PID 1112 wrote to memory of 4844 1112 pvpjj.exe rxfxxxr.exe PID 4844 wrote to memory of 3496 4844 rxfxxxr.exe nbtnbh.exe PID 4844 wrote to memory of 3496 4844 rxfxxxr.exe nbtnbh.exe PID 4844 wrote to memory of 3496 4844 rxfxxxr.exe nbtnbh.exe PID 3496 wrote to memory of 3572 3496 nbtnbh.exe xrxxrrl.exe PID 3496 wrote to memory of 3572 3496 nbtnbh.exe xrxxrrl.exe PID 3496 wrote to memory of 3572 3496 nbtnbh.exe xrxxrrl.exe PID 3572 wrote to memory of 1708 3572 xrxxrrl.exe 1hnntt.exe PID 3572 wrote to memory of 1708 3572 xrxxrrl.exe 1hnntt.exe PID 3572 wrote to memory of 1708 3572 xrxxrrl.exe 1hnntt.exe PID 1708 wrote to memory of 2340 1708 1hnntt.exe thnnnb.exe PID 1708 wrote to memory of 2340 1708 1hnntt.exe thnnnb.exe PID 1708 wrote to memory of 2340 1708 1hnntt.exe thnnnb.exe PID 2340 wrote to memory of 1604 2340 thnnnb.exe llrrrfl.exe PID 2340 wrote to memory of 1604 2340 thnnnb.exe llrrrfl.exe PID 2340 wrote to memory of 1604 2340 thnnnb.exe llrrrfl.exe PID 1604 wrote to memory of 3168 1604 llrrrfl.exe hbbbtb.exe PID 1604 wrote to memory of 3168 1604 llrrrfl.exe hbbbtb.exe PID 1604 wrote to memory of 3168 1604 llrrrfl.exe hbbbtb.exe PID 3168 wrote to memory of 4584 3168 hbbbtb.exe vvppd.exe PID 3168 wrote to memory of 4584 3168 hbbbtb.exe vvppd.exe PID 3168 wrote to memory of 4584 3168 hbbbtb.exe vvppd.exe PID 4584 wrote to memory of 1996 4584 vvppd.exe pjvvp.exe PID 4584 wrote to memory of 1996 4584 vvppd.exe pjvvp.exe PID 4584 wrote to memory of 1996 4584 vvppd.exe pjvvp.exe PID 1996 wrote to memory of 1616 1996 pjvvp.exe bhhhhh.exe PID 1996 wrote to memory of 1616 1996 pjvvp.exe bhhhhh.exe PID 1996 wrote to memory of 1616 1996 pjvvp.exe bhhhhh.exe PID 1616 wrote to memory of 3920 1616 bhhhhh.exe vjppv.exe PID 1616 wrote to memory of 3920 1616 bhhhhh.exe vjppv.exe PID 1616 wrote to memory of 3920 1616 bhhhhh.exe vjppv.exe PID 3920 wrote to memory of 2020 3920 vjppv.exe bhtttt.exe PID 3920 wrote to memory of 2020 3920 vjppv.exe bhtttt.exe PID 3920 wrote to memory of 2020 3920 vjppv.exe bhtttt.exe PID 2020 wrote to memory of 4956 2020 bhtttt.exe hbhhbh.exe PID 2020 wrote to memory of 4956 2020 bhtttt.exe hbhhbh.exe PID 2020 wrote to memory of 4956 2020 bhtttt.exe hbhhbh.exe PID 4956 wrote to memory of 4728 4956 hbhhbh.exe jdvvv.exe PID 4956 wrote to memory of 4728 4956 hbhhbh.exe jdvvv.exe PID 4956 wrote to memory of 4728 4956 hbhhbh.exe jdvvv.exe PID 4728 wrote to memory of 3628 4728 jdvvv.exe lflfxxx.exe PID 4728 wrote to memory of 3628 4728 jdvvv.exe lflfxxx.exe PID 4728 wrote to memory of 3628 4728 jdvvv.exe lflfxxx.exe PID 3628 wrote to memory of 4308 3628 lflfxxx.exe pjpjp.exe PID 3628 wrote to memory of 4308 3628 lflfxxx.exe pjpjp.exe PID 3628 wrote to memory of 4308 3628 lflfxxx.exe pjpjp.exe PID 4308 wrote to memory of 512 4308 pjpjp.exe 5ffxlrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24d33f26b845130bfe2acef96de5d7a03dc9c0e96a97dde222f32e6483948f3b.exe"C:\Users\Admin\AppData\Local\Temp\24d33f26b845130bfe2acef96de5d7a03dc9c0e96a97dde222f32e6483948f3b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\hhbtnn.exec:\hhbtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpppj.exec:\dpppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjjdd.exec:\pjjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffxrrrr.exec:\ffxrrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvpjj.exec:\pvpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxfxxxr.exec:\rxfxxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbtnbh.exec:\nbtnbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1hnntt.exec:\1hnntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thnnnb.exec:\thnnnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llrrrfl.exec:\llrrrfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbbbtb.exec:\hbbbtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvppd.exec:\vvppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvvp.exec:\pjvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhhhhh.exec:\bhhhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjppv.exec:\vjppv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhtttt.exec:\bhtttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhhbh.exec:\hbhhbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdvvv.exec:\jdvvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lflfxxx.exec:\lflfxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjpjp.exec:\pjpjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5ffxlrl.exec:\5ffxlrl.exe23⤵
- Executes dropped EXE
-
\??\c:\dvpvp.exec:\dvpvp.exe24⤵
- Executes dropped EXE
-
\??\c:\xxfrlll.exec:\xxfrlll.exe25⤵
- Executes dropped EXE
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe26⤵
- Executes dropped EXE
-
\??\c:\nhtnhh.exec:\nhtnhh.exe27⤵
- Executes dropped EXE
-
\??\c:\pvvjj.exec:\pvvjj.exe28⤵
- Executes dropped EXE
-
\??\c:\jdjdv.exec:\jdjdv.exe29⤵
- Executes dropped EXE
-
\??\c:\9rxrlrr.exec:\9rxrlrr.exe30⤵
- Executes dropped EXE
-
\??\c:\tbbbhh.exec:\tbbbhh.exe31⤵
- Executes dropped EXE
-
\??\c:\rffrrxl.exec:\rffrrxl.exe32⤵
- Executes dropped EXE
-
\??\c:\jpvvp.exec:\jpvvp.exe33⤵
- Executes dropped EXE
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe34⤵
- Executes dropped EXE
-
\??\c:\3tbtnn.exec:\3tbtnn.exe35⤵
- Executes dropped EXE
-
\??\c:\pvjdv.exec:\pvjdv.exe36⤵
- Executes dropped EXE
-
\??\c:\vpdpv.exec:\vpdpv.exe37⤵
- Executes dropped EXE
-
\??\c:\nnnhbb.exec:\nnnhbb.exe38⤵
- Executes dropped EXE
-
\??\c:\9pjjp.exec:\9pjjp.exe39⤵
- Executes dropped EXE
-
\??\c:\rlrllrx.exec:\rlrllrx.exe40⤵
- Executes dropped EXE
-
\??\c:\btbbtt.exec:\btbbtt.exe41⤵
- Executes dropped EXE
-
\??\c:\5ppjd.exec:\5ppjd.exe42⤵
- Executes dropped EXE
-
\??\c:\rlxxxll.exec:\rlxxxll.exe43⤵
- Executes dropped EXE
-
\??\c:\btbbbb.exec:\btbbbb.exe44⤵
- Executes dropped EXE
-
\??\c:\dvpdv.exec:\dvpdv.exe45⤵
- Executes dropped EXE
-
\??\c:\jjdvv.exec:\jjdvv.exe46⤵
- Executes dropped EXE
-
\??\c:\rllfxxr.exec:\rllfxxr.exe47⤵
- Executes dropped EXE
-
\??\c:\bnnhhh.exec:\bnnhhh.exe48⤵
- Executes dropped EXE
-
\??\c:\5vvvv.exec:\5vvvv.exe49⤵
- Executes dropped EXE
-
\??\c:\lxfffrx.exec:\lxfffrx.exe50⤵
- Executes dropped EXE
-
\??\c:\1tnhbn.exec:\1tnhbn.exe51⤵
- Executes dropped EXE
-
\??\c:\vpvpp.exec:\vpvpp.exe52⤵
- Executes dropped EXE
-
\??\c:\fflllfl.exec:\fflllfl.exe53⤵
- Executes dropped EXE
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe54⤵
- Executes dropped EXE
-
\??\c:\tnnhbn.exec:\tnnhbn.exe55⤵
- Executes dropped EXE
-
\??\c:\jddjv.exec:\jddjv.exe56⤵
- Executes dropped EXE
-
\??\c:\rllfrrl.exec:\rllfrrl.exe57⤵
- Executes dropped EXE
-
\??\c:\flrrxxx.exec:\flrrxxx.exe58⤵
- Executes dropped EXE
-
\??\c:\dpvvp.exec:\dpvvp.exe59⤵
- Executes dropped EXE
-
\??\c:\vvvpp.exec:\vvvpp.exe60⤵
- Executes dropped EXE
-
\??\c:\rlllflf.exec:\rlllflf.exe61⤵
- Executes dropped EXE
-
\??\c:\ntnnhb.exec:\ntnnhb.exe62⤵
- Executes dropped EXE
-
\??\c:\dvppd.exec:\dvppd.exe63⤵
- Executes dropped EXE
-
\??\c:\lrrfxrl.exec:\lrrfxrl.exe64⤵
- Executes dropped EXE
-
\??\c:\bbhbtt.exec:\bbhbtt.exe65⤵
- Executes dropped EXE
-
\??\c:\thnbtt.exec:\thnbtt.exe66⤵
-
\??\c:\pddpv.exec:\pddpv.exe67⤵
-
\??\c:\lllfxfx.exec:\lllfxfx.exe68⤵
-
\??\c:\nhnnhn.exec:\nhnnhn.exe69⤵
-
\??\c:\pddvp.exec:\pddvp.exe70⤵
-
\??\c:\7xrllfr.exec:\7xrllfr.exe71⤵
-
\??\c:\fxrlffr.exec:\fxrlffr.exe72⤵
-
\??\c:\1nhbhh.exec:\1nhbhh.exe73⤵
-
\??\c:\jpdvp.exec:\jpdvp.exe74⤵
-
\??\c:\vvddd.exec:\vvddd.exe75⤵
-
\??\c:\rlffxxx.exec:\rlffxxx.exe76⤵
-
\??\c:\ntnhbt.exec:\ntnhbt.exe77⤵
-
\??\c:\hhhtnn.exec:\hhhtnn.exe78⤵
-
\??\c:\vvvvd.exec:\vvvvd.exe79⤵
-
\??\c:\rrrlffx.exec:\rrrlffx.exe80⤵
-
\??\c:\7xrxrxl.exec:\7xrxrxl.exe81⤵
-
\??\c:\tthbnt.exec:\tthbnt.exe82⤵
-
\??\c:\jdpjd.exec:\jdpjd.exe83⤵
-
\??\c:\pvpvp.exec:\pvpvp.exe84⤵
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe85⤵
-
\??\c:\bbhhbb.exec:\bbhhbb.exe86⤵
-
\??\c:\ntbhtb.exec:\ntbhtb.exe87⤵
-
\??\c:\jjjjd.exec:\jjjjd.exe88⤵
-
\??\c:\3lfllrl.exec:\3lfllrl.exe89⤵
-
\??\c:\xrfxxll.exec:\xrfxxll.exe90⤵
-
\??\c:\9bthhh.exec:\9bthhh.exe91⤵
-
\??\c:\ppvpj.exec:\ppvpj.exe92⤵
-
\??\c:\rlrlxrl.exec:\rlrlxrl.exe93⤵
-
\??\c:\flrxrrr.exec:\flrxrrr.exe94⤵
-
\??\c:\bnnhnh.exec:\bnnhnh.exe95⤵
-
\??\c:\jpvpv.exec:\jpvpv.exe96⤵
-
\??\c:\rrffllx.exec:\rrffllx.exe97⤵
-
\??\c:\xxxxrff.exec:\xxxxrff.exe98⤵
-
\??\c:\3hnhtn.exec:\3hnhtn.exe99⤵
-
\??\c:\vvjdd.exec:\vvjdd.exe100⤵
-
\??\c:\rxffxxr.exec:\rxffxxr.exe101⤵
-
\??\c:\lfffxxx.exec:\lfffxxx.exe102⤵
-
\??\c:\5bnbtb.exec:\5bnbtb.exe103⤵
-
\??\c:\flxlfxr.exec:\flxlfxr.exe104⤵
-
\??\c:\hhnbtn.exec:\hhnbtn.exe105⤵
-
\??\c:\htttnn.exec:\htttnn.exe106⤵
-
\??\c:\vpdvv.exec:\vpdvv.exe107⤵
-
\??\c:\1hbbtt.exec:\1hbbtt.exe108⤵
-
\??\c:\pdpjd.exec:\pdpjd.exe109⤵
-
\??\c:\rllfxrl.exec:\rllfxrl.exe110⤵
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe111⤵
-
\??\c:\tttnnh.exec:\tttnnh.exe112⤵
-
\??\c:\jpvpp.exec:\jpvpp.exe113⤵
-
\??\c:\tbhbnn.exec:\tbhbnn.exe114⤵
-
\??\c:\pvdvp.exec:\pvdvp.exe115⤵
-
\??\c:\rrxxxll.exec:\rrxxxll.exe116⤵
-
\??\c:\xlxrxxr.exec:\xlxrxxr.exe117⤵
-
\??\c:\5bthbb.exec:\5bthbb.exe118⤵
-
\??\c:\vpvpp.exec:\vpvpp.exe119⤵
-
\??\c:\lffxrrl.exec:\lffxrrl.exe120⤵
-
\??\c:\hbbntt.exec:\hbbntt.exe121⤵
-
\??\c:\3ppjj.exec:\3ppjj.exe122⤵
-
\??\c:\jvjdp.exec:\jvjdp.exe123⤵
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe124⤵
-
\??\c:\bnbbbn.exec:\bnbbbn.exe125⤵
-
\??\c:\3vvvj.exec:\3vvvj.exe126⤵
-
\??\c:\jpdjp.exec:\jpdjp.exe127⤵
-
\??\c:\xxxrffx.exec:\xxxrffx.exe128⤵
-
\??\c:\7thhtt.exec:\7thhtt.exe129⤵
-
\??\c:\djjjj.exec:\djjjj.exe130⤵
-
\??\c:\frxrxxr.exec:\frxrxxr.exe131⤵
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe132⤵
-
\??\c:\9bbtnt.exec:\9bbtnt.exe133⤵
-
\??\c:\jppjv.exec:\jppjv.exe134⤵
-
\??\c:\rrrxrrl.exec:\rrrxrrl.exe135⤵
-
\??\c:\lffxllf.exec:\lffxllf.exe136⤵
-
\??\c:\nhhbtt.exec:\nhhbtt.exe137⤵
-
\??\c:\jvvvp.exec:\jvvvp.exe138⤵
-
\??\c:\flllllf.exec:\flllllf.exe139⤵
-
\??\c:\7nnhnn.exec:\7nnhnn.exe140⤵
-
\??\c:\5dvpp.exec:\5dvpp.exe141⤵
-
\??\c:\rrxlfxr.exec:\rrxlfxr.exe142⤵
-
\??\c:\bnnnbb.exec:\bnnnbb.exe143⤵
-
\??\c:\hbbnhh.exec:\hbbnhh.exe144⤵
-
\??\c:\9dvpp.exec:\9dvpp.exe145⤵
-
\??\c:\ffrlxlf.exec:\ffrlxlf.exe146⤵
-
\??\c:\7ttnhb.exec:\7ttnhb.exe147⤵
-
\??\c:\jdjdd.exec:\jdjdd.exe148⤵
-
\??\c:\jpppj.exec:\jpppj.exe149⤵
-
\??\c:\llxrlfx.exec:\llxrlfx.exe150⤵
-
\??\c:\nnhhnn.exec:\nnhhnn.exe151⤵
-
\??\c:\vjpdj.exec:\vjpdj.exe152⤵
-
\??\c:\3jjjj.exec:\3jjjj.exe153⤵
-
\??\c:\fffxrxr.exec:\fffxrxr.exe154⤵
-
\??\c:\nhhbnn.exec:\nhhbnn.exe155⤵
-
\??\c:\jjjpd.exec:\jjjpd.exe156⤵
-
\??\c:\frrlfxr.exec:\frrlfxr.exe157⤵
-
\??\c:\xxlrffx.exec:\xxlrffx.exe158⤵
-
\??\c:\ttthtb.exec:\ttthtb.exe159⤵
-
\??\c:\ddpjd.exec:\ddpjd.exe160⤵
-
\??\c:\rrffxfx.exec:\rrffxfx.exe161⤵
-
\??\c:\xxxrllf.exec:\xxxrllf.exe162⤵
-
\??\c:\3thnnn.exec:\3thnnn.exe163⤵
-
\??\c:\dvpjp.exec:\dvpjp.exe164⤵
-
\??\c:\rrxlfxr.exec:\rrxlfxr.exe165⤵
-
\??\c:\fffffxr.exec:\fffffxr.exe166⤵
-
\??\c:\ttbbnb.exec:\ttbbnb.exe167⤵
-
\??\c:\djpjd.exec:\djpjd.exe168⤵
-
\??\c:\jdpvp.exec:\jdpvp.exe169⤵
-
\??\c:\bnnnbb.exec:\bnnnbb.exe170⤵
-
\??\c:\dvvjd.exec:\dvvjd.exe171⤵
-
\??\c:\djpjj.exec:\djpjj.exe172⤵
-
\??\c:\9ffxxxr.exec:\9ffxxxr.exe173⤵
-
\??\c:\ttbbbh.exec:\ttbbbh.exe174⤵
-
\??\c:\dvjjj.exec:\dvjjj.exe175⤵
-
\??\c:\xxfxllf.exec:\xxfxllf.exe176⤵
-
\??\c:\xfflxll.exec:\xfflxll.exe177⤵
-
\??\c:\ntnhhh.exec:\ntnhhh.exe178⤵
-
\??\c:\djppj.exec:\djppj.exe179⤵
-
\??\c:\fxxxxff.exec:\fxxxxff.exe180⤵
-
\??\c:\flfflxf.exec:\flfflxf.exe181⤵
-
\??\c:\btnhbh.exec:\btnhbh.exe182⤵
-
\??\c:\vpvjd.exec:\vpvjd.exe183⤵
-
\??\c:\rrffxrr.exec:\rrffxrr.exe184⤵
-
\??\c:\3rlfxxr.exec:\3rlfxxr.exe185⤵
-
\??\c:\tnhtnh.exec:\tnhtnh.exe186⤵
-
\??\c:\pdvdv.exec:\pdvdv.exe187⤵
-
\??\c:\xrllrrf.exec:\xrllrrf.exe188⤵
-
\??\c:\rrlllll.exec:\rrlllll.exe189⤵
-
\??\c:\hhnnhn.exec:\hhnnhn.exe190⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe191⤵
-
\??\c:\frllxrf.exec:\frllxrf.exe192⤵
-
\??\c:\rflffrx.exec:\rflffrx.exe193⤵
-
\??\c:\ttbhbt.exec:\ttbhbt.exe194⤵
-
\??\c:\jpvpp.exec:\jpvpp.exe195⤵
-
\??\c:\rllfrrx.exec:\rllfrrx.exe196⤵
-
\??\c:\frxrllf.exec:\frxrllf.exe197⤵
-
\??\c:\thnnhb.exec:\thnnhb.exe198⤵
-
\??\c:\vpvpv.exec:\vpvpv.exe199⤵
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe200⤵
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe201⤵
-
\??\c:\bhnttb.exec:\bhnttb.exe202⤵
-
\??\c:\5jvdd.exec:\5jvdd.exe203⤵
-
\??\c:\rxxrrrr.exec:\rxxrrrr.exe204⤵
-
\??\c:\xfrrlfx.exec:\xfrrlfx.exe205⤵
-
\??\c:\5tthhh.exec:\5tthhh.exe206⤵
-
\??\c:\pjdvd.exec:\pjdvd.exe207⤵
-
\??\c:\pjvjd.exec:\pjvjd.exe208⤵
-
\??\c:\frrlfxr.exec:\frrlfxr.exe209⤵
-
\??\c:\hnthhh.exec:\hnthhh.exe210⤵
-
\??\c:\vjjjd.exec:\vjjjd.exe211⤵
-
\??\c:\vpvdv.exec:\vpvdv.exe212⤵
-
\??\c:\lrxrrrr.exec:\lrxrrrr.exe213⤵
-
\??\c:\nbnbbb.exec:\nbnbbb.exe214⤵
-
\??\c:\pvddd.exec:\pvddd.exe215⤵
-
\??\c:\dpvpd.exec:\dpvpd.exe216⤵
-
\??\c:\9lffxrx.exec:\9lffxrx.exe217⤵
-
\??\c:\btbtnn.exec:\btbtnn.exe218⤵
-
\??\c:\5jddp.exec:\5jddp.exe219⤵
-
\??\c:\5rxrllx.exec:\5rxrllx.exe220⤵
-
\??\c:\7thbnn.exec:\7thbnn.exe221⤵
-
\??\c:\dpdvv.exec:\dpdvv.exe222⤵
-
\??\c:\1vpjd.exec:\1vpjd.exe223⤵
-
\??\c:\xrxxflr.exec:\xrxxflr.exe224⤵
-
\??\c:\nhbtnt.exec:\nhbtnt.exe225⤵
-
\??\c:\9vpjv.exec:\9vpjv.exe226⤵
-
\??\c:\xlrrlrl.exec:\xlrrlrl.exe227⤵
-
\??\c:\xffxllf.exec:\xffxllf.exe228⤵
-
\??\c:\hnttth.exec:\hnttth.exe229⤵
-
\??\c:\ppdvd.exec:\ppdvd.exe230⤵
-
\??\c:\ppjvd.exec:\ppjvd.exe231⤵
-
\??\c:\rlxxfrf.exec:\rlxxfrf.exe232⤵
-
\??\c:\5bnhbb.exec:\5bnhbb.exe233⤵
-
\??\c:\tbthth.exec:\tbthth.exe234⤵
-
\??\c:\7djjd.exec:\7djjd.exe235⤵
-
\??\c:\5rrfxxr.exec:\5rrfxxr.exe236⤵
-
\??\c:\hnnbbt.exec:\hnnbbt.exe237⤵
-
\??\c:\3tttnn.exec:\3tttnn.exe238⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe239⤵
-
\??\c:\fxxrrrx.exec:\fxxrrrx.exe240⤵
-
\??\c:\bnnbtt.exec:\bnnbtt.exe241⤵