Analysis
-
max time kernel
149s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 23:59
Behavioral task
behavioral1
Sample
87eadc9ab60596108d9e0c4dda37d10a0d97e0af005ddf03bf332a64bed8a76d.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
87eadc9ab60596108d9e0c4dda37d10a0d97e0af005ddf03bf332a64bed8a76d.exe
-
Size
107KB
-
MD5
c8857d4fd1dd292efc3b70c3733af487
-
SHA1
2a5e23f08b0d7129db29c98282662dbbe46f557a
-
SHA256
87eadc9ab60596108d9e0c4dda37d10a0d97e0af005ddf03bf332a64bed8a76d
-
SHA512
c1753ef2cf3f584e7e3757f1703ea19a1fe3bcbd84b6693b83860b5c3349235082458900b87129092c560231104758b28d7578a9316ad4098d460835041d33ba
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66krop7BcgU:kcm4FmowdHoSphraHcp7y/
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1536-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3580-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1436-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/636-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1196-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2624-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2652-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3284-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2936-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2468-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3452-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2732-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1632-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/868-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1048-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1392-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/332-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1764-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3740-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4064-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3136-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2472-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2936-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1136-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3152-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3608-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3224-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3472-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3360-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3836-496-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-509-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-516-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-527-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-533-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-549-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-586-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3268-618-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3608-652-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-702-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2308-708-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-743-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-747-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-973-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4100-1051-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/1536-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00090000000233dd-5.dat UPX behavioral2/memory/1536-4-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a00000002341d-9.dat UPX behavioral2/memory/2792-14-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3580-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342a-16.dat UPX behavioral2/files/0x000700000002342c-21.dat UPX behavioral2/memory/3352-26-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342d-29.dat UPX behavioral2/files/0x000700000002342e-33.dat UPX behavioral2/memory/1436-36-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342f-40.dat UPX behavioral2/memory/636-41-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3524-25-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023430-45.dat UPX behavioral2/memory/636-48-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1196-50-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023431-53.dat UPX behavioral2/files/0x0007000000023432-58.dat UPX behavioral2/memory/1168-59-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023433-63.dat UPX behavioral2/memory/2624-66-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023434-69.dat UPX behavioral2/memory/2624-72-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4992-73-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023435-76.dat UPX behavioral2/memory/4992-78-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023436-82.dat UPX behavioral2/memory/2652-84-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023437-88.dat UPX behavioral2/memory/3284-93-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4612-92-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023438-95.dat UPX behavioral2/memory/2936-99-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023439-103.dat UPX behavioral2/memory/2468-110-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002343a-107.dat UPX behavioral2/memory/3012-111-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002343b-113.dat UPX behavioral2/memory/4448-116-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002343c-120.dat UPX behavioral2/files/0x000700000002343d-124.dat UPX behavioral2/memory/3452-131-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002343e-129.dat UPX behavioral2/files/0x0007000000023440-135.dat UPX behavioral2/memory/2732-141-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0008000000023427-142.dat UPX behavioral2/memory/1632-145-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023441-147.dat UPX behavioral2/memory/868-158-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1048-156-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023442-153.dat UPX behavioral2/files/0x0007000000023443-161.dat UPX behavioral2/files/0x0007000000023444-164.dat UPX behavioral2/files/0x0007000000023445-169.dat UPX behavioral2/files/0x0007000000023446-177.dat UPX behavioral2/memory/5048-176-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1392-178-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1392-183-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023447-184.dat UPX behavioral2/files/0x0007000000023448-187.dat UPX behavioral2/memory/332-196-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3244-203-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3580 djpjp.exe 2792 3nhttt.exe 3524 jpdvd.exe 3352 xrfflrx.exe 2964 ttnhhh.exe 1436 bntbhn.exe 636 5vpjd.exe 1196 nthbnt.exe 1168 vddvd.exe 2588 xlllfff.exe 2624 bnttbt.exe 4992 jpjpj.exe 2652 llrrlrr.exe 4612 httnnh.exe 3284 djdjv.exe 2936 pdppv.exe 2468 tntntt.exe 3012 pvjvd.exe 4448 pdjdd.exe 4540 httbbt.exe 3452 jpddv.exe 2464 fxxxxlr.exe 2732 3htnbh.exe 1632 jdjdd.exe 1048 xxxlrlr.exe 868 5bbtnn.exe 2008 nbhhbh.exe 2020 jvdvv.exe 5048 vvppv.exe 1392 xxrlffx.exe 4256 3xllfll.exe 4844 djvdd.exe 2364 vdpjj.exe 332 rrlrflr.exe 404 btntht.exe 3244 htnttb.exe 3860 9pddv.exe 2460 frflrfr.exe 1764 ttbbbh.exe 3360 jjvvd.exe 3580 vjpjj.exe 3344 xrfxxfl.exe 2792 lxffffl.exe 3524 tthbbh.exe 3740 pjjjd.exe 1616 vjdpj.exe 1440 frlxxrr.exe 872 1thhtb.exe 4316 bhthtn.exe 4064 dvpjd.exe 5096 rfrlrrf.exe 4952 fllfxxx.exe 5068 ntttnn.exe 2624 ntttnt.exe 1340 vpvpd.exe 3136 fxlfrxr.exe 1636 5flllrr.exe 228 btnnnn.exe 2472 nbnnhn.exe 3156 5vdpp.exe 2936 3jvvp.exe 4020 xrfrffx.exe 1852 9btnhh.exe 4596 hbbnhn.exe -
resource yara_rule behavioral2/memory/1536-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233dd-5.dat upx behavioral2/memory/1536-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a00000002341d-9.dat upx behavioral2/memory/2792-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3580-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-16.dat upx behavioral2/files/0x000700000002342c-21.dat upx behavioral2/memory/3352-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-29.dat upx behavioral2/files/0x000700000002342e-33.dat upx behavioral2/memory/1436-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342f-40.dat upx behavioral2/memory/636-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3524-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023430-45.dat upx behavioral2/memory/636-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1196-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023431-53.dat upx behavioral2/files/0x0007000000023432-58.dat upx behavioral2/memory/1168-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023433-63.dat upx behavioral2/memory/2624-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023434-69.dat upx behavioral2/memory/2624-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4992-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023435-76.dat upx behavioral2/memory/4992-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023436-82.dat upx behavioral2/memory/2652-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023437-88.dat upx behavioral2/memory/3284-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4612-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023438-95.dat upx behavioral2/memory/2936-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023439-103.dat upx behavioral2/memory/2468-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343a-107.dat upx behavioral2/memory/3012-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343b-113.dat upx behavioral2/memory/4448-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343c-120.dat upx behavioral2/files/0x000700000002343d-124.dat upx behavioral2/memory/3452-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343e-129.dat upx behavioral2/files/0x0007000000023440-135.dat upx behavioral2/memory/2732-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023427-142.dat upx behavioral2/memory/1632-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023441-147.dat upx behavioral2/memory/868-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1048-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023442-153.dat upx behavioral2/files/0x0007000000023443-161.dat upx behavioral2/files/0x0007000000023444-164.dat upx behavioral2/files/0x0007000000023445-169.dat upx behavioral2/files/0x0007000000023446-177.dat upx behavioral2/memory/5048-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1392-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1392-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023447-184.dat upx behavioral2/files/0x0007000000023448-187.dat upx behavioral2/memory/332-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3244-203-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1536 wrote to memory of 3580 1536 87eadc9ab60596108d9e0c4dda37d10a0d97e0af005ddf03bf332a64bed8a76d.exe 83 PID 1536 wrote to memory of 3580 1536 87eadc9ab60596108d9e0c4dda37d10a0d97e0af005ddf03bf332a64bed8a76d.exe 83 PID 1536 wrote to memory of 3580 1536 87eadc9ab60596108d9e0c4dda37d10a0d97e0af005ddf03bf332a64bed8a76d.exe 83 PID 3580 wrote to memory of 2792 3580 djpjp.exe 84 PID 3580 wrote to memory of 2792 3580 djpjp.exe 84 PID 3580 wrote to memory of 2792 3580 djpjp.exe 84 PID 2792 wrote to memory of 3524 2792 3nhttt.exe 85 PID 2792 wrote to memory of 3524 2792 3nhttt.exe 85 PID 2792 wrote to memory of 3524 2792 3nhttt.exe 85 PID 3524 wrote to memory of 3352 3524 jpdvd.exe 86 PID 3524 wrote to memory of 3352 3524 jpdvd.exe 86 PID 3524 wrote to memory of 3352 3524 jpdvd.exe 86 PID 3352 wrote to memory of 2964 3352 xrfflrx.exe 87 PID 3352 wrote to memory of 2964 3352 xrfflrx.exe 87 PID 3352 wrote to memory of 2964 3352 xrfflrx.exe 87 PID 2964 wrote to memory of 1436 2964 ttnhhh.exe 88 PID 2964 wrote to memory of 1436 2964 ttnhhh.exe 88 PID 2964 wrote to memory of 1436 2964 ttnhhh.exe 88 PID 1436 wrote to memory of 636 1436 bntbhn.exe 89 PID 1436 wrote to memory of 636 1436 bntbhn.exe 89 PID 1436 wrote to memory of 636 1436 bntbhn.exe 89 PID 636 wrote to memory of 1196 636 5vpjd.exe 90 PID 636 wrote to memory of 1196 636 5vpjd.exe 90 PID 636 wrote to memory of 1196 636 5vpjd.exe 90 PID 1196 wrote to memory of 1168 1196 nthbnt.exe 91 PID 1196 wrote to memory of 1168 1196 nthbnt.exe 91 PID 1196 wrote to memory of 1168 1196 nthbnt.exe 91 PID 1168 wrote to memory of 2588 1168 vddvd.exe 92 PID 1168 wrote to memory of 2588 1168 vddvd.exe 92 PID 1168 wrote to memory of 2588 1168 vddvd.exe 92 PID 2588 wrote to memory of 2624 2588 xlllfff.exe 93 PID 2588 wrote to memory of 2624 2588 xlllfff.exe 93 PID 2588 wrote to memory of 2624 2588 xlllfff.exe 93 PID 2624 wrote to memory of 4992 2624 bnttbt.exe 94 PID 2624 wrote to memory of 4992 2624 bnttbt.exe 94 PID 2624 wrote to memory of 4992 2624 bnttbt.exe 94 PID 4992 wrote to memory of 2652 4992 jpjpj.exe 95 PID 4992 wrote to memory of 2652 4992 jpjpj.exe 95 PID 4992 wrote to memory of 2652 4992 jpjpj.exe 95 PID 2652 wrote to memory of 4612 2652 llrrlrr.exe 97 PID 2652 wrote to memory of 4612 2652 llrrlrr.exe 97 PID 2652 wrote to memory of 4612 2652 llrrlrr.exe 97 PID 4612 wrote to memory of 3284 4612 httnnh.exe 98 PID 4612 wrote to memory of 3284 4612 httnnh.exe 98 PID 4612 wrote to memory of 3284 4612 httnnh.exe 98 PID 3284 wrote to memory of 2936 3284 djdjv.exe 99 PID 3284 wrote to memory of 2936 3284 djdjv.exe 99 PID 3284 wrote to memory of 2936 3284 djdjv.exe 99 PID 2936 wrote to memory of 2468 2936 pdppv.exe 100 PID 2936 wrote to memory of 2468 2936 pdppv.exe 100 PID 2936 wrote to memory of 2468 2936 pdppv.exe 100 PID 2468 wrote to memory of 3012 2468 tntntt.exe 101 PID 2468 wrote to memory of 3012 2468 tntntt.exe 101 PID 2468 wrote to memory of 3012 2468 tntntt.exe 101 PID 3012 wrote to memory of 4448 3012 pvjvd.exe 102 PID 3012 wrote to memory of 4448 3012 pvjvd.exe 102 PID 3012 wrote to memory of 4448 3012 pvjvd.exe 102 PID 4448 wrote to memory of 4540 4448 pdjdd.exe 103 PID 4448 wrote to memory of 4540 4448 pdjdd.exe 103 PID 4448 wrote to memory of 4540 4448 pdjdd.exe 103 PID 4540 wrote to memory of 3452 4540 httbbt.exe 104 PID 4540 wrote to memory of 3452 4540 httbbt.exe 104 PID 4540 wrote to memory of 3452 4540 httbbt.exe 104 PID 3452 wrote to memory of 2464 3452 jpddv.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\87eadc9ab60596108d9e0c4dda37d10a0d97e0af005ddf03bf332a64bed8a76d.exe"C:\Users\Admin\AppData\Local\Temp\87eadc9ab60596108d9e0c4dda37d10a0d97e0af005ddf03bf332a64bed8a76d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\djpjp.exec:\djpjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\3nhttt.exec:\3nhttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\jpdvd.exec:\jpdvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\xrfflrx.exec:\xrfflrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\ttnhhh.exec:\ttnhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\bntbhn.exec:\bntbhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\5vpjd.exec:\5vpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\nthbnt.exec:\nthbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\vddvd.exec:\vddvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\xlllfff.exec:\xlllfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\bnttbt.exec:\bnttbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\jpjpj.exec:\jpjpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\llrrlrr.exec:\llrrlrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\httnnh.exec:\httnnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\djdjv.exec:\djdjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\pdppv.exec:\pdppv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\tntntt.exec:\tntntt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\pvjvd.exec:\pvjvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\pdjdd.exec:\pdjdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\httbbt.exec:\httbbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\jpddv.exec:\jpddv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\fxxxxlr.exec:\fxxxxlr.exe23⤵
- Executes dropped EXE
PID:2464 -
\??\c:\3htnbh.exec:\3htnbh.exe24⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jdjdd.exec:\jdjdd.exe25⤵
- Executes dropped EXE
PID:1632 -
\??\c:\xxxlrlr.exec:\xxxlrlr.exe26⤵
- Executes dropped EXE
PID:1048 -
\??\c:\5bbtnn.exec:\5bbtnn.exe27⤵
- Executes dropped EXE
PID:868 -
\??\c:\nbhhbh.exec:\nbhhbh.exe28⤵
- Executes dropped EXE
PID:2008 -
\??\c:\jvdvv.exec:\jvdvv.exe29⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vvppv.exec:\vvppv.exe30⤵
- Executes dropped EXE
PID:5048 -
\??\c:\xxrlffx.exec:\xxrlffx.exe31⤵
- Executes dropped EXE
PID:1392 -
\??\c:\3xllfll.exec:\3xllfll.exe32⤵
- Executes dropped EXE
PID:4256 -
\??\c:\djvdd.exec:\djvdd.exe33⤵
- Executes dropped EXE
PID:4844 -
\??\c:\vdpjj.exec:\vdpjj.exe34⤵
- Executes dropped EXE
PID:2364 -
\??\c:\rrlrflr.exec:\rrlrflr.exe35⤵
- Executes dropped EXE
PID:332 -
\??\c:\btntht.exec:\btntht.exe36⤵
- Executes dropped EXE
PID:404 -
\??\c:\htnttb.exec:\htnttb.exe37⤵
- Executes dropped EXE
PID:3244 -
\??\c:\9pddv.exec:\9pddv.exe38⤵
- Executes dropped EXE
PID:3860 -
\??\c:\frflrfr.exec:\frflrfr.exe39⤵
- Executes dropped EXE
PID:2460 -
\??\c:\ttbbbh.exec:\ttbbbh.exe40⤵
- Executes dropped EXE
PID:1764 -
\??\c:\jjvvd.exec:\jjvvd.exe41⤵
- Executes dropped EXE
PID:3360 -
\??\c:\vjpjj.exec:\vjpjj.exe42⤵
- Executes dropped EXE
PID:3580 -
\??\c:\xrfxxfl.exec:\xrfxxfl.exe43⤵
- Executes dropped EXE
PID:3344 -
\??\c:\lxffffl.exec:\lxffffl.exe44⤵
- Executes dropped EXE
PID:2792 -
\??\c:\tthbbh.exec:\tthbbh.exe45⤵
- Executes dropped EXE
PID:3524 -
\??\c:\pjjjd.exec:\pjjjd.exe46⤵
- Executes dropped EXE
PID:3740 -
\??\c:\vjdpj.exec:\vjdpj.exe47⤵
- Executes dropped EXE
PID:1616 -
\??\c:\frlxxrr.exec:\frlxxrr.exe48⤵
- Executes dropped EXE
PID:1440 -
\??\c:\1thhtb.exec:\1thhtb.exe49⤵
- Executes dropped EXE
PID:872 -
\??\c:\bhthtn.exec:\bhthtn.exe50⤵
- Executes dropped EXE
PID:4316 -
\??\c:\dvpjd.exec:\dvpjd.exe51⤵
- Executes dropped EXE
PID:4064 -
\??\c:\rfrlrrf.exec:\rfrlrrf.exe52⤵
- Executes dropped EXE
PID:5096 -
\??\c:\fllfxxx.exec:\fllfxxx.exe53⤵
- Executes dropped EXE
PID:4952 -
\??\c:\ntttnn.exec:\ntttnn.exe54⤵
- Executes dropped EXE
PID:5068 -
\??\c:\ntttnt.exec:\ntttnt.exe55⤵
- Executes dropped EXE
PID:2624 -
\??\c:\vpvpd.exec:\vpvpd.exe56⤵
- Executes dropped EXE
PID:1340 -
\??\c:\fxlfrxr.exec:\fxlfrxr.exe57⤵
- Executes dropped EXE
PID:3136 -
\??\c:\5flllrr.exec:\5flllrr.exe58⤵
- Executes dropped EXE
PID:1636 -
\??\c:\btnnnn.exec:\btnnnn.exe59⤵
- Executes dropped EXE
PID:228 -
\??\c:\nbnnhn.exec:\nbnnhn.exe60⤵
- Executes dropped EXE
PID:2472 -
\??\c:\5vdpp.exec:\5vdpp.exe61⤵
- Executes dropped EXE
PID:3156 -
\??\c:\3jvvp.exec:\3jvvp.exe62⤵
- Executes dropped EXE
PID:2936 -
\??\c:\xrfrffx.exec:\xrfrffx.exe63⤵
- Executes dropped EXE
PID:4020 -
\??\c:\9btnhh.exec:\9btnhh.exe64⤵
- Executes dropped EXE
PID:1852 -
\??\c:\hbbnhn.exec:\hbbnhn.exe65⤵
- Executes dropped EXE
PID:4596 -
\??\c:\jjjjj.exec:\jjjjj.exe66⤵PID:4676
-
\??\c:\lrffffx.exec:\lrffffx.exe67⤵PID:740
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe68⤵PID:1476
-
\??\c:\vvvvp.exec:\vvvvp.exe69⤵PID:1996
-
\??\c:\ffrrllx.exec:\ffrrllx.exe70⤵PID:1520
-
\??\c:\btnbtb.exec:\btnbtb.exe71⤵PID:4984
-
\??\c:\hbtbnn.exec:\hbtbnn.exe72⤵PID:3972
-
\??\c:\vvjjd.exec:\vvjjd.exe73⤵PID:5020
-
\??\c:\3jpjv.exec:\3jpjv.exe74⤵PID:3064
-
\??\c:\fflllll.exec:\fflllll.exe75⤵PID:4508
-
\??\c:\bbntnn.exec:\bbntnn.exe76⤵PID:2344
-
\??\c:\ppdpv.exec:\ppdpv.exe77⤵PID:4204
-
\??\c:\rlxrffl.exec:\rlxrffl.exe78⤵PID:3836
-
\??\c:\rlrxxff.exec:\rlrxxff.exe79⤵PID:664
-
\??\c:\5hhnnn.exec:\5hhnnn.exe80⤵PID:3076
-
\??\c:\tnbbhh.exec:\tnbbhh.exe81⤵PID:1136
-
\??\c:\dvjjd.exec:\dvjjd.exe82⤵PID:3436
-
\??\c:\fffxflf.exec:\fffxflf.exe83⤵PID:4680
-
\??\c:\lllxxlr.exec:\lllxxlr.exe84⤵PID:1420
-
\??\c:\tttnnn.exec:\tttnnn.exe85⤵PID:884
-
\??\c:\bbtnnb.exec:\bbtnnb.exe86⤵PID:3152
-
\??\c:\vpvpp.exec:\vpvpp.exe87⤵PID:3608
-
\??\c:\lflffff.exec:\lflffff.exe88⤵PID:3224
-
\??\c:\xlrrrxx.exec:\xlrrrxx.exe89⤵PID:3576
-
\??\c:\nbbnhh.exec:\nbbnhh.exe90⤵PID:440
-
\??\c:\pjddv.exec:\pjddv.exe91⤵PID:3472
-
\??\c:\xffxrrl.exec:\xffxrrl.exe92⤵PID:3360
-
\??\c:\lfrllfl.exec:\lfrllfl.exe93⤵PID:3492
-
\??\c:\hbtntb.exec:\hbtntb.exe94⤵PID:2560
-
\??\c:\5vjdv.exec:\5vjdv.exe95⤵PID:1384
-
\??\c:\vdjdp.exec:\vdjdp.exe96⤵PID:3352
-
\??\c:\lfxlfxx.exec:\lfxlfxx.exe97⤵PID:1076
-
\??\c:\9fllfff.exec:\9fllfff.exe98⤵PID:1604
-
\??\c:\bbbnnb.exec:\bbbnnb.exe99⤵PID:2360
-
\??\c:\hnttnn.exec:\hnttnn.exe100⤵PID:1776
-
\??\c:\vvjvp.exec:\vvjvp.exe101⤵PID:3368
-
\??\c:\9fxrrrr.exec:\9fxrrrr.exe102⤵PID:5080
-
\??\c:\9fllfrr.exec:\9fllfrr.exe103⤵PID:3816
-
\??\c:\3frrllf.exec:\3frrllf.exe104⤵PID:4920
-
\??\c:\tbnbhh.exec:\tbnbhh.exe105⤵PID:1780
-
\??\c:\ththbh.exec:\ththbh.exe106⤵PID:2868
-
\??\c:\vvppd.exec:\vvppd.exe107⤵PID:3612
-
\??\c:\rrrrxfl.exec:\rrrrxfl.exe108⤵PID:3960
-
\??\c:\3rrrrrf.exec:\3rrrrrf.exe109⤵PID:1096
-
\??\c:\5bhbtt.exec:\5bhbtt.exe110⤵PID:3260
-
\??\c:\hbttnn.exec:\hbttnn.exe111⤵PID:2284
-
\??\c:\jdjdj.exec:\jdjdj.exe112⤵PID:4928
-
\??\c:\btthbb.exec:\btthbb.exe113⤵PID:1568
-
\??\c:\hnbbnb.exec:\hnbbnb.exe114⤵PID:1292
-
\??\c:\jjjpp.exec:\jjjpp.exe115⤵PID:1160
-
\??\c:\pdpjj.exec:\pdpjj.exe116⤵PID:3796
-
\??\c:\lrlfffl.exec:\lrlfffl.exe117⤵PID:1728
-
\??\c:\9tbtbb.exec:\9tbtbb.exe118⤵PID:1232
-
\??\c:\jdjpp.exec:\jdjpp.exe119⤵PID:2464
-
\??\c:\djpjd.exec:\djpjd.exe120⤵PID:4720
-
\??\c:\llfxflx.exec:\llfxflx.exe121⤵PID:1632
-
\??\c:\frxxxff.exec:\frxxxff.exe122⤵PID:1524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-