Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
25/05/2024, 02:33
Behavioral task
behavioral1
Sample
b8e8f15724a793fcf69bda186f52c372e53db6c162b1475e32edfdcd51525033.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target b8e8f15724a793fcf69bda186f52c372e53db6c162b1475e32edfdcd51525033.exe
- Size 138KB
- Sample240525-c117ssbe4y
- SHA256 b8e8f15724a793fcf69bda186f52c372e53db6c162b1475e32edfdcd51525033
- MD5 2053d6dc08588fd9a543a7dd7217d097
- SHA1 ba9d184a51a484cb1fb9baea56f5b8393a6b9b03
- SHA512 c460ee324d46a05b99758ff23c476ed0b8d305379b0128a84caec69b5654b847c9e93cb067adba9065630f0202f30debbcad4515d79e04ac58ce53d6c783d5fe
- SSDEEP 3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BfDKPeGrRT:kcm4FmowdHoSphraHcpOaKHp
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4008-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1396-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2284-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4192-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2384-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4012-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/388-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4104-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1968-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2264-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1212-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4276-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2972-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4348-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2284-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2548-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2032-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1900-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3204-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2156-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4684-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1104-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3668-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1052-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2620-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3852-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2572-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2588-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1508-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2264-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2940-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/828-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-460-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1864-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1436-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3424-533-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-547-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3164-557-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-573-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/664-635-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4012-645-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-697-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2980-725-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2744-754-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-764-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-795-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/4008-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023298-3.dat UPX behavioral2/memory/4008-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0008000000023421-9.dat UPX behavioral2/memory/1396-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023425-11.dat UPX behavioral2/memory/2284-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4192-20-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023426-24.dat UPX behavioral2/memory/3304-28-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023427-29.dat UPX behavioral2/memory/552-32-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023428-35.dat UPX behavioral2/memory/4536-37-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023429-41.dat UPX behavioral2/memory/4536-40-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342a-45.dat UPX behavioral2/memory/2384-48-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4012-49-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342b-52.dat UPX behavioral2/memory/4012-54-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342c-58.dat UPX behavioral2/memory/4432-59-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/388-61-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342e-64.dat UPX behavioral2/files/0x000700000002342f-69.dat UPX behavioral2/memory/4104-70-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023430-74.dat UPX behavioral2/files/0x0007000000023431-79.dat UPX behavioral2/memory/1968-81-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023432-85.dat UPX behavioral2/memory/2264-88-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023433-91.dat UPX behavioral2/files/0x0007000000023434-96.dat UPX behavioral2/memory/1212-98-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4276-104-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023435-105.dat UPX behavioral2/memory/2972-110-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023436-108.dat UPX behavioral2/files/0x0007000000023437-115.dat UPX behavioral2/memory/1884-118-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4888-114-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023438-121.dat UPX behavioral2/files/0x0007000000023439-128.dat UPX behavioral2/memory/4672-130-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002343a-133.dat UPX behavioral2/files/0x000700000002343b-137.dat UPX behavioral2/memory/3868-139-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002343c-145.dat UPX behavioral2/files/0x000700000002343d-148.dat UPX behavioral2/files/0x000700000002343e-153.dat UPX behavioral2/memory/3496-160-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0008000000023422-161.dat UPX behavioral2/files/0x000700000002343f-164.dat UPX behavioral2/memory/464-170-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023440-171.dat UPX behavioral2/memory/3400-174-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023441-176.dat UPX behavioral2/files/0x0007000000023442-181.dat UPX behavioral2/memory/4348-193-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4348-197-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2284-210-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2548-212-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2032-227-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 1396 7xfxrfx.exe 2284 btnhtn.exe 4192 jvvvp.exe 3304 rrfxlll.exe 552 xfxxrrr.exe 4536 hbnntt.exe 2384 5djjd.exe 4012 rlxrrlf.exe 4432 bnbnhb.exe 388 7pvvv.exe 4104 rxxlffl.exe 1616 btbbtt.exe 1968 ddjdv.exe 2264 xlxrrrl.exe 2900 nbhhht.exe 1212 pjddv.exe 4276 pjjjd.exe 2972 ffrxlll.exe 4888 3nhnhn.exe 1884 pdjdv.exe 4056 rxrrlll.exe 4672 llxxllx.exe 3868 nhbbbb.exe 4260 vvjjd.exe 740 rflfxxr.exe 4548 xffflrf.exe 3496 1nttnb.exe 4876 vdjpp.exe 464 xffxxxx.exe 3400 hnbnhn.exe 3680 nhnnht.exe 8 jvjjd.exe 2104 xlxxfrr.exe 1780 tnnhhb.exe 4348 bnntbt.exe 3020 djpdv.exe 3028 frxrfxl.exe 3688 hhtntn.exe 2284 djjjd.exe 2548 xxxrffx.exe 3064 bbbbhn.exe 2024 dpdvd.exe 2384 vvpjj.exe 2032 fffxfff.exe 2324 thbthh.exe 1900 ddvvd.exe 2240 jpvjd.exe 2336 5lrfrrf.exe 1508 htbtnh.exe 5016 vjjvv.exe 1968 rllfrlf.exe 3204 nhbtnn.exe 2168 vpvjd.exe 4592 jpjdp.exe 2156 rflfxxr.exe 2096 3tnhtt.exe 4928 jvvpd.exe 4684 dpppj.exe 1104 rxxrffx.exe 3668 tttnnn.exe 1052 hhhbnh.exe 2620 jvjdv.exe 4820 lxfxffx.exe 3476 lxlllrr.exe -
resource yara_rule behavioral2/memory/4008-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023298-3.dat upx behavioral2/memory/4008-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023421-9.dat upx behavioral2/memory/1396-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-11.dat upx behavioral2/memory/2284-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4192-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-24.dat upx behavioral2/memory/3304-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023427-29.dat upx behavioral2/memory/552-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-35.dat upx behavioral2/memory/4536-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023429-41.dat upx behavioral2/memory/4536-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-45.dat upx behavioral2/memory/2384-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4012-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342b-52.dat upx behavioral2/memory/4012-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342c-58.dat upx behavioral2/memory/4432-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/388-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342e-64.dat upx behavioral2/files/0x000700000002342f-69.dat upx behavioral2/memory/4104-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023430-74.dat upx behavioral2/files/0x0007000000023431-79.dat upx behavioral2/memory/1968-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023432-85.dat upx behavioral2/memory/2264-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023433-91.dat upx behavioral2/files/0x0007000000023434-96.dat upx behavioral2/memory/1212-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4276-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023435-105.dat upx behavioral2/memory/2972-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023436-108.dat upx behavioral2/files/0x0007000000023437-115.dat upx behavioral2/memory/1884-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4888-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023438-121.dat upx behavioral2/files/0x0007000000023439-128.dat upx behavioral2/memory/4672-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343a-133.dat upx behavioral2/files/0x000700000002343b-137.dat upx behavioral2/memory/3868-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343c-145.dat upx behavioral2/files/0x000700000002343d-148.dat upx behavioral2/files/0x000700000002343e-153.dat upx behavioral2/memory/3496-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023422-161.dat upx behavioral2/files/0x000700000002343f-164.dat upx behavioral2/memory/464-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023440-171.dat upx behavioral2/memory/3400-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023441-176.dat upx behavioral2/files/0x0007000000023442-181.dat upx behavioral2/memory/4348-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4348-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2284-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2548-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2032-227-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4008 wrote to memory of 1396 4008 b8e8f15724a793fcf69bda186f52c372e53db6c162b1475e32edfdcd51525033.exe 83 PID 4008 wrote to memory of 1396 4008 b8e8f15724a793fcf69bda186f52c372e53db6c162b1475e32edfdcd51525033.exe 83 PID 4008 wrote to memory of 1396 4008 b8e8f15724a793fcf69bda186f52c372e53db6c162b1475e32edfdcd51525033.exe 83 PID 1396 wrote to memory of 2284 1396 7xfxrfx.exe 84 PID 1396 wrote to memory of 2284 1396 7xfxrfx.exe 84 PID 1396 wrote to memory of 2284 1396 7xfxrfx.exe 84 PID 2284 wrote to memory of 4192 2284 btnhtn.exe 85 PID 2284 wrote to memory of 4192 2284 btnhtn.exe 85 PID 2284 wrote to memory of 4192 2284 btnhtn.exe 85 PID 4192 wrote to memory of 3304 4192 jvvvp.exe 86 PID 4192 wrote to memory of 3304 4192 jvvvp.exe 86 PID 4192 wrote to memory of 3304 4192 jvvvp.exe 86 PID 3304 wrote to memory of 552 3304 rrfxlll.exe 87 PID 3304 wrote to memory of 552 3304 rrfxlll.exe 87 PID 3304 wrote to memory of 552 3304 rrfxlll.exe 87 PID 552 wrote to memory of 4536 552 xfxxrrr.exe 88 PID 552 wrote to memory of 4536 552 xfxxrrr.exe 88 PID 552 wrote to memory of 4536 552 xfxxrrr.exe 88 PID 4536 wrote to memory of 2384 4536 hbnntt.exe 89 PID 4536 wrote to memory of 2384 4536 hbnntt.exe 89 PID 4536 wrote to memory of 2384 4536 hbnntt.exe 89 PID 2384 wrote to memory of 4012 2384 5djjd.exe 90 PID 2384 wrote to memory of 4012 2384 5djjd.exe 90 PID 2384 wrote to memory of 4012 2384 5djjd.exe 90 PID 4012 wrote to memory of 4432 4012 rlxrrlf.exe 91 PID 4012 wrote to memory of 4432 4012 rlxrrlf.exe 91 PID 4012 wrote to memory of 4432 4012 rlxrrlf.exe 91 PID 4432 wrote to memory of 388 4432 bnbnhb.exe 92 PID 4432 wrote to memory of 388 4432 bnbnhb.exe 92 PID 4432 wrote to memory of 388 4432 bnbnhb.exe 92 PID 388 wrote to memory of 4104 388 7pvvv.exe 93 PID 388 wrote to memory of 4104 388 7pvvv.exe 93 PID 388 wrote to memory of 4104 388 7pvvv.exe 93 PID 4104 wrote to memory of 1616 4104 rxxlffl.exe 94 PID 4104 wrote to memory of 1616 4104 rxxlffl.exe 94 PID 4104 wrote to memory of 1616 4104 rxxlffl.exe 94 PID 1616 wrote to memory of 1968 1616 btbbtt.exe 95 PID 1616 wrote to memory of 1968 1616 btbbtt.exe 95 PID 1616 wrote to memory of 1968 1616 btbbtt.exe 95 PID 1968 wrote to memory of 2264 1968 ddjdv.exe 96 PID 1968 wrote to memory of 2264 1968 ddjdv.exe 96 PID 1968 wrote to memory of 2264 1968 ddjdv.exe 96 PID 2264 wrote to memory of 2900 2264 xlxrrrl.exe 97 PID 2264 wrote to memory of 2900 2264 xlxrrrl.exe 97 PID 2264 wrote to memory of 2900 2264 xlxrrrl.exe 97 PID 2900 wrote to memory of 1212 2900 nbhhht.exe 99 PID 2900 wrote to memory of 1212 2900 nbhhht.exe 99 PID 2900 wrote to memory of 1212 2900 nbhhht.exe 99 PID 1212 wrote to memory of 4276 1212 pjddv.exe 100 PID 1212 wrote to memory of 4276 1212 pjddv.exe 100 PID 1212 wrote to memory of 4276 1212 pjddv.exe 100 PID 4276 wrote to memory of 2972 4276 pjjjd.exe 101 PID 4276 wrote to memory of 2972 4276 pjjjd.exe 101 PID 4276 wrote to memory of 2972 4276 pjjjd.exe 101 PID 2972 wrote to memory of 4888 2972 ffrxlll.exe 102 PID 2972 wrote to memory of 4888 2972 ffrxlll.exe 102 PID 2972 wrote to memory of 4888 2972 ffrxlll.exe 102 PID 4888 wrote to memory of 1884 4888 3nhnhn.exe 104 PID 4888 wrote to memory of 1884 4888 3nhnhn.exe 104 PID 4888 wrote to memory of 1884 4888 3nhnhn.exe 104 PID 1884 wrote to memory of 4056 1884 pdjdv.exe 105 PID 1884 wrote to memory of 4056 1884 pdjdv.exe 105 PID 1884 wrote to memory of 4056 1884 pdjdv.exe 105 PID 4056 wrote to memory of 4672 4056 rxrrlll.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8e8f15724a793fcf69bda186f52c372e53db6c162b1475e32edfdcd51525033.exe"C:\Users\Admin\AppData\Local\Temp\b8e8f15724a793fcf69bda186f52c372e53db6c162b1475e32edfdcd51525033.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\7xfxrfx.exec:\7xfxrfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\btnhtn.exec:\btnhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\jvvvp.exec:\jvvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\rrfxlll.exec:\rrfxlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\xfxxrrr.exec:\xfxxrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\hbnntt.exec:\hbnntt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\5djjd.exec:\5djjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\rlxrrlf.exec:\rlxrrlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\bnbnhb.exec:\bnbnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\7pvvv.exec:\7pvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\rxxlffl.exec:\rxxlffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\btbbtt.exec:\btbbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\ddjdv.exec:\ddjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\xlxrrrl.exec:\xlxrrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\nbhhht.exec:\nbhhht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\pjddv.exec:\pjddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\pjjjd.exec:\pjjjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\ffrxlll.exec:\ffrxlll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\3nhnhn.exec:\3nhnhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\pdjdv.exec:\pdjdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\rxrrlll.exec:\rxrrlll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\llxxllx.exec:\llxxllx.exe23⤵
- Executes dropped EXE
PID:4672 -
\??\c:\nhbbbb.exec:\nhbbbb.exe24⤵
- Executes dropped EXE
PID:3868 -
\??\c:\vvjjd.exec:\vvjjd.exe25⤵
- Executes dropped EXE
PID:4260 -
\??\c:\rflfxxr.exec:\rflfxxr.exe26⤵
- Executes dropped EXE
PID:740 -
\??\c:\xffflrf.exec:\xffflrf.exe27⤵
- Executes dropped EXE
PID:4548 -
\??\c:\1nttnb.exec:\1nttnb.exe28⤵
- Executes dropped EXE
PID:3496 -
\??\c:\vdjpp.exec:\vdjpp.exe29⤵
- Executes dropped EXE
PID:4876 -
\??\c:\xffxxxx.exec:\xffxxxx.exe30⤵
- Executes dropped EXE
PID:464 -
\??\c:\hnbnhn.exec:\hnbnhn.exe31⤵
- Executes dropped EXE
PID:3400 -
\??\c:\nhnnht.exec:\nhnnht.exe32⤵
- Executes dropped EXE
PID:3680 -
\??\c:\jvjjd.exec:\jvjjd.exe33⤵
- Executes dropped EXE
PID:8 -
\??\c:\xlxxfrr.exec:\xlxxfrr.exe34⤵
- Executes dropped EXE
PID:2104 -
\??\c:\tnnhhb.exec:\tnnhhb.exe35⤵
- Executes dropped EXE
PID:1780 -
\??\c:\bnntbt.exec:\bnntbt.exe36⤵
- Executes dropped EXE
PID:4348 -
\??\c:\djpdv.exec:\djpdv.exe37⤵
- Executes dropped EXE
PID:3020 -
\??\c:\frxrfxl.exec:\frxrfxl.exe38⤵
- Executes dropped EXE
PID:3028 -
\??\c:\hhtntn.exec:\hhtntn.exe39⤵
- Executes dropped EXE
PID:3688 -
\??\c:\djjjd.exec:\djjjd.exe40⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xxxrffx.exec:\xxxrffx.exe41⤵
- Executes dropped EXE
PID:2548 -
\??\c:\bbbbhn.exec:\bbbbhn.exe42⤵
- Executes dropped EXE
PID:3064 -
\??\c:\dpdvd.exec:\dpdvd.exe43⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vvpjj.exec:\vvpjj.exe44⤵
- Executes dropped EXE
PID:2384 -
\??\c:\fffxfff.exec:\fffxfff.exe45⤵
- Executes dropped EXE
PID:2032 -
\??\c:\thbthh.exec:\thbthh.exe46⤵
- Executes dropped EXE
PID:2324 -
\??\c:\ddvvd.exec:\ddvvd.exe47⤵
- Executes dropped EXE
PID:1900 -
\??\c:\jpvjd.exec:\jpvjd.exe48⤵
- Executes dropped EXE
PID:2240 -
\??\c:\5lrfrrf.exec:\5lrfrrf.exe49⤵
- Executes dropped EXE
PID:2336 -
\??\c:\htbtnh.exec:\htbtnh.exe50⤵
- Executes dropped EXE
PID:1508 -
\??\c:\vjjvv.exec:\vjjvv.exe51⤵
- Executes dropped EXE
PID:5016 -
\??\c:\rllfrlf.exec:\rllfrlf.exe52⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nhbtnn.exec:\nhbtnn.exe53⤵
- Executes dropped EXE
PID:3204 -
\??\c:\vpvjd.exec:\vpvjd.exe54⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jpjdp.exec:\jpjdp.exe55⤵
- Executes dropped EXE
PID:4592 -
\??\c:\rflfxxr.exec:\rflfxxr.exe56⤵
- Executes dropped EXE
PID:2156 -
\??\c:\3tnhtt.exec:\3tnhtt.exe57⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jvvpd.exec:\jvvpd.exe58⤵
- Executes dropped EXE
PID:4928 -
\??\c:\dpppj.exec:\dpppj.exe59⤵
- Executes dropped EXE
PID:4684 -
\??\c:\rxxrffx.exec:\rxxrffx.exe60⤵
- Executes dropped EXE
PID:1104 -
\??\c:\tttnnn.exec:\tttnnn.exe61⤵
- Executes dropped EXE
PID:3668 -
\??\c:\hhhbnh.exec:\hhhbnh.exe62⤵
- Executes dropped EXE
PID:1052 -
\??\c:\jvjdv.exec:\jvjdv.exe63⤵
- Executes dropped EXE
PID:2620 -
\??\c:\lxfxffx.exec:\lxfxffx.exe64⤵
- Executes dropped EXE
PID:4820 -
\??\c:\lxlllrr.exec:\lxlllrr.exe65⤵
- Executes dropped EXE
PID:3476 -
\??\c:\bthnhh.exec:\bthnhh.exe66⤵PID:4260
-
\??\c:\hnnhbt.exec:\hnnhbt.exe67⤵PID:400
-
\??\c:\dddvp.exec:\dddvp.exe68⤵PID:2260
-
\??\c:\ffxlfxx.exec:\ffxlfxx.exe69⤵PID:1744
-
\??\c:\3xlfxrl.exec:\3xlfxrl.exe70⤵PID:2132
-
\??\c:\bnhhbt.exec:\bnhhbt.exe71⤵PID:448
-
\??\c:\pjvpp.exec:\pjvpp.exe72⤵PID:4876
-
\??\c:\pjjvj.exec:\pjjvj.exe73⤵PID:444
-
\??\c:\3xrfxrl.exec:\3xrfxrl.exe74⤵PID:3400
-
\??\c:\ntnhbb.exec:\ntnhbb.exe75⤵PID:2944
-
\??\c:\bbnbtn.exec:\bbnbtn.exe76⤵PID:1612
-
\??\c:\jvddp.exec:\jvddp.exe77⤵PID:3852
-
\??\c:\rrfflrl.exec:\rrfflrl.exe78⤵PID:4416
-
\??\c:\lrlfrlf.exec:\lrlfrlf.exe79⤵PID:1780
-
\??\c:\hhthtn.exec:\hhthtn.exe80⤵PID:5032
-
\??\c:\jpdvv.exec:\jpdvv.exe81⤵PID:4008
-
\??\c:\pdpvd.exec:\pdpvd.exe82⤵PID:3692
-
\??\c:\xfrxrrl.exec:\xfrxrrl.exe83⤵PID:2884
-
\??\c:\bnhbnn.exec:\bnhbnn.exe84⤵PID:2572
-
\??\c:\bhtnbb.exec:\bhtnbb.exe85⤵PID:2036
-
\??\c:\3jpjj.exec:\3jpjj.exe86⤵PID:2744
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe87⤵PID:3936
-
\??\c:\rffxlfx.exec:\rffxlfx.exe88⤵PID:5028
-
\??\c:\thtnhb.exec:\thtnhb.exe89⤵PID:1980
-
\??\c:\bnhbnt.exec:\bnhbnt.exe90⤵PID:3096
-
\??\c:\djvvv.exec:\djvvv.exe91⤵PID:1272
-
\??\c:\xlrflff.exec:\xlrflff.exe92⤵PID:2324
-
\??\c:\fxrxrlf.exec:\fxrxrlf.exe93⤵PID:2588
-
\??\c:\9ttnhb.exec:\9ttnhb.exe94⤵PID:2624
-
\??\c:\hbbthh.exec:\hbbthh.exe95⤵PID:2568
-
\??\c:\vvvjd.exec:\vvvjd.exe96⤵PID:1508
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe97⤵PID:2264
-
\??\c:\7hnntt.exec:\7hnntt.exe98⤵PID:2876
-
\??\c:\nbtnhh.exec:\nbtnhh.exe99⤵PID:3428
-
\??\c:\pvvjv.exec:\pvvjv.exe100⤵PID:1212
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe101⤵PID:3456
-
\??\c:\lxrlfxx.exec:\lxrlfxx.exe102⤵PID:3372
-
\??\c:\ntnthb.exec:\ntnthb.exe103⤵PID:1748
-
\??\c:\bnnhtn.exec:\bnnhtn.exe104⤵PID:2940
-
\??\c:\jppdv.exec:\jppdv.exe105⤵PID:1808
-
\??\c:\pdpdv.exec:\pdpdv.exe106⤵PID:1840
-
\??\c:\xrlxlfx.exec:\xrlxlfx.exe107⤵PID:4520
-
\??\c:\ttnhht.exec:\ttnhht.exe108⤵PID:1172
-
\??\c:\tnhnhb.exec:\tnhnhb.exe109⤵PID:1184
-
\??\c:\jdppd.exec:\jdppd.exe110⤵PID:4248
-
\??\c:\rxfxfrf.exec:\rxfxfrf.exe111⤵PID:5008
-
\??\c:\fxlxflf.exec:\fxlxflf.exe112⤵PID:4744
-
\??\c:\bbhntn.exec:\bbhntn.exe113⤵PID:3092
-
\??\c:\dpdpp.exec:\dpdpp.exe114⤵PID:828
-
\??\c:\vpvvv.exec:\vpvvv.exe115⤵PID:3436
-
\??\c:\5rllllf.exec:\5rllllf.exe116⤵PID:2080
-
\??\c:\xfrfxrx.exec:\xfrfxrx.exe117⤵PID:1220
-
\??\c:\ppvdj.exec:\ppvdj.exe118⤵PID:2980
-
\??\c:\xlffxxx.exec:\xlffxxx.exe119⤵PID:2896
-
\??\c:\tnhbhb.exec:\tnhbhb.exe120⤵PID:4240
-
\??\c:\tnnnnh.exec:\tnnnnh.exe121⤵PID:4884
-
\??\c:\3pddp.exec:\3pddp.exe122⤵PID:4336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-