Analysis
- max time kernel
150s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
28/05/2024, 19:42
Behavioral task
behavioral1
Sample
27aaf14e151db6a76db808d185f989c60a194ac50b71f0122f975733fbc27f00.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target 27aaf14e151db6a76db808d185f989c60a194ac50b71f0122f975733fbc27f00.exe
- Size 90KB
- Sample240528-ye3dmaaf55
- SHA256 27aaf14e151db6a76db808d185f989c60a194ac50b71f0122f975733fbc27f00
- MD5 366b14266862cc46f35c47a22f559856
- SHA1 957ccf1623232fb9306810ec269b75d2f41b1486
- SHA512 709f3057e148c2bec6b264d1b5857b55aae23bd89b9bc07388c825b4edb72a172d59d0d881b19474c0f286e0a85190618b96131c2125bb911973d2db5f492246
- SSDEEP 1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0s1rR6e:8hOmTsF93UYfwC6GIout0fmCiiiXAwKe
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3112-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2116-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3068-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2532-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1372-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2800-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2536-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1208-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4724-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2124-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2588-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3132-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3060-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/784-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1312-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3420-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3684-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/372-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2500-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3940-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1812-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2336-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1912-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1360-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3840-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3972-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4380-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/572-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2976-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4680-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1484-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2932-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2672-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1812-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1088-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-477-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-552-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3740-689-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1936-694-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/3112-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0006000000023298-3.dat UPX behavioral2/memory/3112-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4360-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023452-9.dat UPX behavioral2/memory/2116-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4360-12-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3068-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023454-20.dat UPX behavioral2/files/0x0007000000023453-16.dat UPX behavioral2/files/0x0007000000023455-25.dat UPX behavioral2/memory/2532-26-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1372-28-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023456-30.dat UPX behavioral2/files/0x0007000000023457-34.dat UPX behavioral2/memory/2800-36-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4972-38-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023458-40.dat UPX behavioral2/files/0x0007000000023459-44.dat UPX behavioral2/memory/2536-46-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1208-49-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002345a-50.dat UPX behavioral2/memory/5068-55-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002345b-54.dat UPX behavioral2/files/0x000700000002345c-59.dat UPX behavioral2/memory/4724-62-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002345d-64.dat UPX behavioral2/files/0x000700000002345e-68.dat UPX behavioral2/memory/2124-69-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002345f-73.dat UPX behavioral2/memory/3432-75-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2588-79-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023460-78.dat UPX behavioral2/files/0x0007000000023461-83.dat UPX behavioral2/memory/3132-84-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1492-87-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023462-89.dat UPX behavioral2/memory/4920-91-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023463-94.dat UPX behavioral2/files/0x0007000000023464-99.dat UPX behavioral2/memory/3060-101-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023465-103.dat UPX behavioral2/files/0x0007000000023466-107.dat UPX behavioral2/memory/2204-108-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023467-112.dat UPX behavioral2/memory/784-114-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023468-117.dat UPX behavioral2/files/0x000900000002344d-121.dat UPX behavioral2/memory/3536-126-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023469-125.dat UPX behavioral2/memory/4080-130-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002346b-131.dat UPX behavioral2/files/0x000700000002346c-135.dat UPX behavioral2/files/0x000700000002346d-139.dat UPX behavioral2/files/0x000700000002346e-144.dat UPX behavioral2/files/0x000700000002346f-147.dat UPX behavioral2/files/0x0007000000023470-152.dat UPX behavioral2/memory/1312-151-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3420-156-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3684-167-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/372-178-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2500-183-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1168-193-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3940-196-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 4360 rrlflrx.exe 2116 jdppp.exe 3068 pdpjd.exe 2532 jjjdv.exe 1372 xrxlfrl.exe 2800 bhtntb.exe 4972 jvdvv.exe 2536 djvvd.exe 1208 1flfrrr.exe 5068 bttthn.exe 2716 jvjdd.exe 4724 xxlfxfl.exe 2124 nnnthb.exe 3432 pdppj.exe 2588 rrfxffl.exe 3132 nnntbn.exe 1492 jjppv.exe 4920 rxffffx.exe 3140 jjvpj.exe 3060 pdjjj.exe 2204 rxlxrfr.exe 4224 hbbnnt.exe 784 jjvvd.exe 2424 9llrlxx.exe 3536 tnhbbn.exe 4080 lllfxxx.exe 4056 bnbtbn.exe 1352 jvjjj.exe 1620 lrrfxrr.exe 2628 thhbtt.exe 1312 vvjdp.exe 1192 3rfllxf.exe 3420 hntbtt.exe 4384 1pdpv.exe 3488 lxfflrl.exe 1452 httbtb.exe 3684 1hbbbh.exe 2712 pvjjd.exe 640 rxffxff.exe 4368 tttttt.exe 228 jjddd.exe 372 djjjd.exe 2980 xxffrrx.exe 2500 rffxrrx.exe 2388 3ntnbb.exe 4680 vjvvp.exe 2740 pjvvp.exe 3740 rlllfff.exe 1168 5lxxxxr.exe 3940 thhbbn.exe 1484 pjjjd.exe 4364 pjjdv.exe 2140 ffffrxx.exe 1812 lrrxlxl.exe 4084 9nhhtb.exe 2120 pjppj.exe 3956 ppjdd.exe 5104 ffffxxx.exe 4372 xxffxxx.exe 2336 tthbbb.exe 1480 vdjjd.exe 4872 jvddj.exe 2900 fflllxx.exe 3436 nnbbhb.exe -
resource yara_rule behavioral2/memory/3112-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000023298-3.dat upx behavioral2/memory/3112-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4360-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023452-9.dat upx behavioral2/memory/2116-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4360-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3068-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023454-20.dat upx behavioral2/files/0x0007000000023453-16.dat upx behavioral2/files/0x0007000000023455-25.dat upx behavioral2/memory/2532-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1372-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023456-30.dat upx behavioral2/files/0x0007000000023457-34.dat upx behavioral2/memory/2800-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4972-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023458-40.dat upx behavioral2/files/0x0007000000023459-44.dat upx behavioral2/memory/2536-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1208-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345a-50.dat upx behavioral2/memory/5068-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345b-54.dat upx behavioral2/files/0x000700000002345c-59.dat upx behavioral2/memory/4724-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345d-64.dat upx behavioral2/files/0x000700000002345e-68.dat upx behavioral2/memory/2124-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345f-73.dat upx behavioral2/memory/3432-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2588-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023460-78.dat upx behavioral2/files/0x0007000000023461-83.dat upx behavioral2/memory/3132-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1492-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023462-89.dat upx behavioral2/memory/4920-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023463-94.dat upx behavioral2/files/0x0007000000023464-99.dat upx behavioral2/memory/3060-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023465-103.dat upx behavioral2/files/0x0007000000023466-107.dat upx behavioral2/memory/2204-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023467-112.dat upx behavioral2/memory/784-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023468-117.dat upx behavioral2/files/0x000900000002344d-121.dat upx behavioral2/memory/3536-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023469-125.dat upx behavioral2/memory/4080-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346b-131.dat upx behavioral2/files/0x000700000002346c-135.dat upx behavioral2/files/0x000700000002346d-139.dat upx behavioral2/files/0x000700000002346e-144.dat upx behavioral2/files/0x000700000002346f-147.dat upx behavioral2/files/0x0007000000023470-152.dat upx behavioral2/memory/1312-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3420-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3684-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/372-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2500-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1168-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3940-196-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3112 wrote to memory of 4360 3112 27aaf14e151db6a76db808d185f989c60a194ac50b71f0122f975733fbc27f00.exe 82 PID 3112 wrote to memory of 4360 3112 27aaf14e151db6a76db808d185f989c60a194ac50b71f0122f975733fbc27f00.exe 82 PID 3112 wrote to memory of 4360 3112 27aaf14e151db6a76db808d185f989c60a194ac50b71f0122f975733fbc27f00.exe 82 PID 4360 wrote to memory of 2116 4360 rrlflrx.exe 83 PID 4360 wrote to memory of 2116 4360 rrlflrx.exe 83 PID 4360 wrote to memory of 2116 4360 rrlflrx.exe 83 PID 2116 wrote to memory of 3068 2116 jdppp.exe 84 PID 2116 wrote to memory of 3068 2116 jdppp.exe 84 PID 2116 wrote to memory of 3068 2116 jdppp.exe 84 PID 3068 wrote to memory of 2532 3068 pdpjd.exe 85 PID 3068 wrote to memory of 2532 3068 pdpjd.exe 85 PID 3068 wrote to memory of 2532 3068 pdpjd.exe 85 PID 2532 wrote to memory of 1372 2532 jjjdv.exe 86 PID 2532 wrote to memory of 1372 2532 jjjdv.exe 86 PID 2532 wrote to memory of 1372 2532 jjjdv.exe 86 PID 1372 wrote to memory of 2800 1372 xrxlfrl.exe 87 PID 1372 wrote to memory of 2800 1372 xrxlfrl.exe 87 PID 1372 wrote to memory of 2800 1372 xrxlfrl.exe 87 PID 2800 wrote to memory of 4972 2800 bhtntb.exe 88 PID 2800 wrote to memory of 4972 2800 bhtntb.exe 88 PID 2800 wrote to memory of 4972 2800 bhtntb.exe 88 PID 4972 wrote to memory of 2536 4972 jvdvv.exe 89 PID 4972 wrote to memory of 2536 4972 jvdvv.exe 89 PID 4972 wrote to memory of 2536 4972 jvdvv.exe 89 PID 2536 wrote to memory of 1208 2536 djvvd.exe 90 PID 2536 wrote to memory of 1208 2536 djvvd.exe 90 PID 2536 wrote to memory of 1208 2536 djvvd.exe 90 PID 1208 wrote to memory of 5068 1208 1flfrrr.exe 91 PID 1208 wrote to memory of 5068 1208 1flfrrr.exe 91 PID 1208 wrote to memory of 5068 1208 1flfrrr.exe 91 PID 5068 wrote to memory of 2716 5068 bttthn.exe 92 PID 5068 wrote to memory of 2716 5068 bttthn.exe 92 PID 5068 wrote to memory of 2716 5068 bttthn.exe 92 PID 2716 wrote to memory of 4724 2716 jvjdd.exe 93 PID 2716 wrote to memory of 4724 2716 jvjdd.exe 93 PID 2716 wrote to memory of 4724 2716 jvjdd.exe 93 PID 4724 wrote to memory of 2124 4724 xxlfxfl.exe 94 PID 4724 wrote to memory of 2124 4724 xxlfxfl.exe 94 PID 4724 wrote to memory of 2124 4724 xxlfxfl.exe 94 PID 2124 wrote to memory of 3432 2124 nnnthb.exe 95 PID 2124 wrote to memory of 3432 2124 nnnthb.exe 95 PID 2124 wrote to memory of 3432 2124 nnnthb.exe 95 PID 3432 wrote to memory of 2588 3432 pdppj.exe 97 PID 3432 wrote to memory of 2588 3432 pdppj.exe 97 PID 3432 wrote to memory of 2588 3432 pdppj.exe 97 PID 2588 wrote to memory of 3132 2588 rrfxffl.exe 98 PID 2588 wrote to memory of 3132 2588 rrfxffl.exe 98 PID 2588 wrote to memory of 3132 2588 rrfxffl.exe 98 PID 3132 wrote to memory of 1492 3132 nnntbn.exe 99 PID 3132 wrote to memory of 1492 3132 nnntbn.exe 99 PID 3132 wrote to memory of 1492 3132 nnntbn.exe 99 PID 1492 wrote to memory of 4920 1492 jjppv.exe 100 PID 1492 wrote to memory of 4920 1492 jjppv.exe 100 PID 1492 wrote to memory of 4920 1492 jjppv.exe 100 PID 4920 wrote to memory of 3140 4920 rxffffx.exe 101 PID 4920 wrote to memory of 3140 4920 rxffffx.exe 101 PID 4920 wrote to memory of 3140 4920 rxffffx.exe 101 PID 3140 wrote to memory of 3060 3140 jjvpj.exe 103 PID 3140 wrote to memory of 3060 3140 jjvpj.exe 103 PID 3140 wrote to memory of 3060 3140 jjvpj.exe 103 PID 3060 wrote to memory of 2204 3060 pdjjj.exe 104 PID 3060 wrote to memory of 2204 3060 pdjjj.exe 104 PID 3060 wrote to memory of 2204 3060 pdjjj.exe 104 PID 2204 wrote to memory of 4224 2204 rxlxrfr.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\27aaf14e151db6a76db808d185f989c60a194ac50b71f0122f975733fbc27f00.exe"C:\Users\Admin\AppData\Local\Temp\27aaf14e151db6a76db808d185f989c60a194ac50b71f0122f975733fbc27f00.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\rrlflrx.exec:\rrlflrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\jdppp.exec:\jdppp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\pdpjd.exec:\pdpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\jjjdv.exec:\jjjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\xrxlfrl.exec:\xrxlfrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\bhtntb.exec:\bhtntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\jvdvv.exec:\jvdvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\djvvd.exec:\djvvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\1flfrrr.exec:\1flfrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\bttthn.exec:\bttthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\jvjdd.exec:\jvjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\xxlfxfl.exec:\xxlfxfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\nnnthb.exec:\nnnthb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\pdppj.exec:\pdppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\rrfxffl.exec:\rrfxffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\nnntbn.exec:\nnntbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\jjppv.exec:\jjppv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\rxffffx.exec:\rxffffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\jjvpj.exec:\jjvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\pdjjj.exec:\pdjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\rxlxrfr.exec:\rxlxrfr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\hbbnnt.exec:\hbbnnt.exe23⤵
- Executes dropped EXE
PID:4224 -
\??\c:\jjvvd.exec:\jjvvd.exe24⤵
- Executes dropped EXE
PID:784 -
\??\c:\9llrlxx.exec:\9llrlxx.exe25⤵
- Executes dropped EXE
PID:2424 -
\??\c:\tnhbbn.exec:\tnhbbn.exe26⤵
- Executes dropped EXE
PID:3536 -
\??\c:\lllfxxx.exec:\lllfxxx.exe27⤵
- Executes dropped EXE
PID:4080 -
\??\c:\bnbtbn.exec:\bnbtbn.exe28⤵
- Executes dropped EXE
PID:4056 -
\??\c:\jvjjj.exec:\jvjjj.exe29⤵
- Executes dropped EXE
PID:1352 -
\??\c:\lrrfxrr.exec:\lrrfxrr.exe30⤵
- Executes dropped EXE
PID:1620 -
\??\c:\thhbtt.exec:\thhbtt.exe31⤵
- Executes dropped EXE
PID:2628 -
\??\c:\vvjdp.exec:\vvjdp.exe32⤵
- Executes dropped EXE
PID:1312 -
\??\c:\3rfllxf.exec:\3rfllxf.exe33⤵
- Executes dropped EXE
PID:1192 -
\??\c:\hntbtt.exec:\hntbtt.exe34⤵
- Executes dropped EXE
PID:3420 -
\??\c:\1pdpv.exec:\1pdpv.exe35⤵
- Executes dropped EXE
PID:4384 -
\??\c:\lxfflrl.exec:\lxfflrl.exe36⤵
- Executes dropped EXE
PID:3488 -
\??\c:\httbtb.exec:\httbtb.exe37⤵
- Executes dropped EXE
PID:1452 -
\??\c:\1hbbbh.exec:\1hbbbh.exe38⤵
- Executes dropped EXE
PID:3684 -
\??\c:\pvjjd.exec:\pvjjd.exe39⤵
- Executes dropped EXE
PID:2712 -
\??\c:\rxffxff.exec:\rxffxff.exe40⤵
- Executes dropped EXE
PID:640 -
\??\c:\tttttt.exec:\tttttt.exe41⤵
- Executes dropped EXE
PID:4368 -
\??\c:\jjddd.exec:\jjddd.exe42⤵
- Executes dropped EXE
PID:228 -
\??\c:\djjjd.exec:\djjjd.exe43⤵
- Executes dropped EXE
PID:372 -
\??\c:\xxffrrx.exec:\xxffrrx.exe44⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rffxrrx.exec:\rffxrrx.exe45⤵
- Executes dropped EXE
PID:2500 -
\??\c:\3ntnbb.exec:\3ntnbb.exe46⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vjvvp.exec:\vjvvp.exe47⤵
- Executes dropped EXE
PID:4680 -
\??\c:\pjvvp.exec:\pjvvp.exe48⤵
- Executes dropped EXE
PID:2740 -
\??\c:\rlllfff.exec:\rlllfff.exe49⤵
- Executes dropped EXE
PID:3740 -
\??\c:\5lxxxxr.exec:\5lxxxxr.exe50⤵
- Executes dropped EXE
PID:1168 -
\??\c:\thhbbn.exec:\thhbbn.exe51⤵
- Executes dropped EXE
PID:3940 -
\??\c:\pjjjd.exec:\pjjjd.exe52⤵
- Executes dropped EXE
PID:1484 -
\??\c:\pjjdv.exec:\pjjdv.exe53⤵
- Executes dropped EXE
PID:4364 -
\??\c:\ffffrxx.exec:\ffffrxx.exe54⤵
- Executes dropped EXE
PID:2140 -
\??\c:\lrrxlxl.exec:\lrrxlxl.exe55⤵
- Executes dropped EXE
PID:1812 -
\??\c:\9nhhtb.exec:\9nhhtb.exe56⤵
- Executes dropped EXE
PID:4084 -
\??\c:\pjppj.exec:\pjppj.exe57⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ppjdd.exec:\ppjdd.exe58⤵
- Executes dropped EXE
PID:3956 -
\??\c:\ffffxxx.exec:\ffffxxx.exe59⤵
- Executes dropped EXE
PID:5104 -
\??\c:\xxffxxx.exec:\xxffxxx.exe60⤵
- Executes dropped EXE
PID:4372 -
\??\c:\tthbbb.exec:\tthbbb.exe61⤵
- Executes dropped EXE
PID:2336 -
\??\c:\vdjjd.exec:\vdjjd.exe62⤵
- Executes dropped EXE
PID:1480 -
\??\c:\jvddj.exec:\jvddj.exe63⤵
- Executes dropped EXE
PID:4872 -
\??\c:\fflllxx.exec:\fflllxx.exe64⤵
- Executes dropped EXE
PID:2900 -
\??\c:\nnbbhb.exec:\nnbbhb.exe65⤵
- Executes dropped EXE
PID:3436 -
\??\c:\ddvjj.exec:\ddvjj.exe66⤵PID:2124
-
\??\c:\xflrrfx.exec:\xflrrfx.exe67⤵PID:1912
-
\??\c:\bnnhnn.exec:\bnnhnn.exe68⤵PID:4864
-
\??\c:\pjjjj.exec:\pjjjj.exe69⤵PID:2692
-
\??\c:\3rxxlfr.exec:\3rxxlfr.exe70⤵PID:4900
-
\??\c:\nhthbh.exec:\nhthbh.exe71⤵PID:1472
-
\??\c:\pjjjj.exec:\pjjjj.exe72⤵PID:3356
-
\??\c:\rflfffx.exec:\rflfffx.exe73⤵PID:4860
-
\??\c:\rrrrlll.exec:\rrrrlll.exe74⤵PID:4920
-
\??\c:\bnbhnn.exec:\bnbhnn.exe75⤵PID:4260
-
\??\c:\ntbttt.exec:\ntbttt.exe76⤵PID:1832
-
\??\c:\jpjjj.exec:\jpjjj.exe77⤵PID:3232
-
\??\c:\lxflffl.exec:\lxflffl.exe78⤵PID:2204
-
\??\c:\lllfxll.exec:\lllfxll.exe79⤵PID:1360
-
\??\c:\bbnbtt.exec:\bbnbtt.exe80⤵PID:4400
-
\??\c:\dpvvp.exec:\dpvvp.exe81⤵PID:4092
-
\??\c:\vjppj.exec:\vjppj.exe82⤵PID:496
-
\??\c:\9rllxff.exec:\9rllxff.exe83⤵PID:4952
-
\??\c:\lfrrxxr.exec:\lfrrxxr.exe84⤵PID:3840
-
\??\c:\bhhnnt.exec:\bhhnnt.exe85⤵PID:1460
-
\??\c:\pdddj.exec:\pdddj.exe86⤵PID:3456
-
\??\c:\dvvpv.exec:\dvvpv.exe87⤵PID:4720
-
\??\c:\xrffflr.exec:\xrffflr.exe88⤵PID:3784
-
\??\c:\hnnhhb.exec:\hnnhhb.exe89⤵PID:2196
-
\??\c:\bthhnn.exec:\bthhnn.exe90⤵PID:3972
-
\??\c:\ppvdv.exec:\ppvdv.exe91⤵PID:3036
-
\??\c:\lxxfxff.exec:\lxxfxff.exe92⤵PID:5048
-
\??\c:\xrlxrrr.exec:\xrlxrrr.exe93⤵PID:2664
-
\??\c:\nnhbbb.exec:\nnhbbb.exe94⤵PID:3928
-
\??\c:\jvdjv.exec:\jvdjv.exe95⤵PID:456
-
\??\c:\jvjpp.exec:\jvjpp.exe96⤵PID:1584
-
\??\c:\rllrfrr.exec:\rllrfrr.exe97⤵PID:392
-
\??\c:\bthbbh.exec:\bthbbh.exe98⤵PID:4264
-
\??\c:\nthbhh.exec:\nthbhh.exe99⤵PID:4380
-
\??\c:\jjddd.exec:\jjddd.exe100⤵PID:572
-
\??\c:\djppd.exec:\djppd.exe101⤵PID:4220
-
\??\c:\tththh.exec:\tththh.exe102⤵PID:2976
-
\??\c:\nhbtbb.exec:\nhbtbb.exe103⤵PID:3268
-
\??\c:\jjdjp.exec:\jjdjp.exe104⤵PID:3472
-
\??\c:\ppvvv.exec:\ppvvv.exe105⤵PID:4524
-
\??\c:\xflxxxf.exec:\xflxxxf.exe106⤵PID:4680
-
\??\c:\nhtbbb.exec:\nhtbbb.exe107⤵PID:4868
-
\??\c:\jjvvd.exec:\jjvvd.exe108⤵PID:3552
-
\??\c:\vvvvv.exec:\vvvvv.exe109⤵PID:4136
-
\??\c:\tbbbbt.exec:\tbbbbt.exe110⤵PID:3940
-
\??\c:\jjdjp.exec:\jjdjp.exe111⤵PID:1484
-
\??\c:\lxffxfx.exec:\lxffxfx.exe112⤵PID:2300
-
\??\c:\flfrxxl.exec:\flfrxxl.exe113⤵PID:2932
-
\??\c:\bnnnhh.exec:\bnnnhh.exe114⤵PID:1088
-
\??\c:\vvpvv.exec:\vvpvv.exe115⤵PID:3980
-
\??\c:\dvjdd.exec:\dvjdd.exe116⤵PID:2120
-
\??\c:\7xxxxxx.exec:\7xxxxxx.exe117⤵PID:3956
-
\??\c:\rffffff.exec:\rffffff.exe118⤵PID:2672
-
\??\c:\rlflfll.exec:\rlflfll.exe119⤵PID:2340
-
\??\c:\hhtntb.exec:\hhtntb.exe120⤵PID:2336
-
\??\c:\hbhhhn.exec:\hbhhhn.exe121⤵PID:2392
-
\??\c:\dvddp.exec:\dvddp.exe122⤵PID:2716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-