Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 20:33
Behavioral task
behavioral1
Sample
33070d093373cf14b8b2ff0fea1c15150b043c532368c4512fe8626ca352cb37.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
33070d093373cf14b8b2ff0fea1c15150b043c532368c4512fe8626ca352cb37.exe
-
Size
80KB
-
MD5
1c6a4f6c80f6476fd1cbf8a771b07633
-
SHA1
8cdde1f4a857ac6fef21db0e53a3a6795ad6d2e0
-
SHA256
33070d093373cf14b8b2ff0fea1c15150b043c532368c4512fe8626ca352cb37
-
SHA512
812649ec2e4c1a0d36329845a668834fead12a8b5de0a3475fbf8d23434ee8358f88b63c4cd3e74bb1090f5b41828629ab6afb0cea07617c5c7f6f1ea30c1dab
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6TVqMJ89V:zhOmTsF93UYfwC6GIoutiTU2HVS6cMJO
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4888-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1320-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/892-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1160-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1008-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1156-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4652-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3940-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/896-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1996-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3052-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3520-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4744-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3944-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3784-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2416-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2416-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2580-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2556-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3248-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2956-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3108-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2532-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3884-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3788-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1112-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3820-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3200-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/556-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2472-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/868-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1332-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2096-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2032-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1184-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1196-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4156-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1908-458-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-508-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-530-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-540-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/4888-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4888-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1320-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023296-4.dat UPX behavioral2/files/0x0008000000023433-9.dat UPX behavioral2/files/0x0007000000023437-11.dat UPX behavioral2/memory/4960-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/892-16-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023438-19.dat UPX behavioral2/memory/2288-22-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023439-25.dat UPX behavioral2/memory/1160-27-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002343a-29.dat UPX behavioral2/memory/1008-31-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002343c-34.dat UPX behavioral2/files/0x000700000002343d-38.dat UPX behavioral2/memory/1156-39-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002343e-43.dat UPX behavioral2/memory/4652-45-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002343f-48.dat UPX behavioral2/memory/4652-49-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023440-53.dat UPX behavioral2/memory/1872-56-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3940-57-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023441-59.dat UPX behavioral2/files/0x0007000000023442-63.dat UPX behavioral2/memory/4716-68-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023443-67.dat UPX behavioral2/files/0x0007000000023444-72.dat UPX behavioral2/files/0x0007000000023445-76.dat UPX behavioral2/memory/3140-80-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023446-81.dat UPX behavioral2/files/0x0007000000023447-84.dat UPX behavioral2/memory/2408-86-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3172-90-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023448-91.dat UPX behavioral2/files/0x0007000000023449-95.dat UPX behavioral2/memory/896-96-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002344a-100.dat UPX behavioral2/files/0x000700000002344b-105.dat UPX behavioral2/memory/4820-106-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1996-108-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002344c-111.dat UPX behavioral2/memory/5060-113-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002344d-115.dat UPX behavioral2/memory/4412-120-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002344e-119.dat UPX behavioral2/files/0x0008000000023434-124.dat UPX behavioral2/files/0x000700000002344f-128.dat UPX behavioral2/memory/2664-130-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5052-134-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023450-133.dat UPX behavioral2/files/0x0007000000023451-139.dat UPX behavioral2/files/0x0007000000023452-142.dat UPX behavioral2/memory/3052-143-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3520-147-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023453-148.dat UPX behavioral2/files/0x0007000000023455-153.dat UPX behavioral2/memory/4744-152-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3944-158-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3784-164-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4996-169-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2416-173-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2416-175-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1320 fflfxrl.exe 4960 frflffl.exe 892 5jppv.exe 2288 5dpjp.exe 1160 lfxrlfx.exe 1008 xlfxrrf.exe 1156 hhhtbh.exe 1088 xllfrrl.exe 4652 bttbtt.exe 1872 vjvpj.exe 3940 7ffxllf.exe 4200 xxxrlrr.exe 4716 bhnnnn.exe 3700 pvdvj.exe 3820 rlxxxxx.exe 3140 bnbbbb.exe 2408 dvvpp.exe 3172 rllfxlr.exe 896 bnntnt.exe 2524 dvddv.exe 4820 xrrrlll.exe 1996 1tbbhh.exe 5060 bttthh.exe 4412 vvppd.exe 932 lrxlrrl.exe 2664 bbnbtn.exe 5052 pjjdv.exe 4488 3vvpj.exe 3052 fxrrlll.exe 3520 bhtthb.exe 4744 7jvvp.exe 3944 vvvpj.exe 2164 xxxlrlr.exe 944 nhbbbh.exe 3784 hbnhtt.exe 4352 jdvvj.exe 4996 jddpp.exe 2116 lxllxxx.exe 2416 9rllffx.exe 2580 bbhhnb.exe 708 rrlxlxl.exe 4456 rlllfff.exe 4576 nhhbhh.exe 5080 7ddvv.exe 2556 5lrlfxx.exe 1964 ttttnn.exe 3248 vjjjp.exe 2956 dvvjv.exe 3108 lrlffll.exe 2532 1fffxxx.exe 1604 1httnh.exe 1624 3dvvp.exe 208 pddvp.exe 3884 rxxxrrr.exe 2236 lrrlrxr.exe 4384 bbtnhh.exe 4372 jvppp.exe 4496 jvvpj.exe 884 dppjj.exe 4612 llxrlll.exe 2028 nhbbtb.exe 892 nnnhhn.exe 3956 vpjdp.exe 4944 7jpjj.exe -
resource yara_rule behavioral2/memory/4888-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4888-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1320-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023296-4.dat upx behavioral2/files/0x0008000000023433-9.dat upx behavioral2/files/0x0007000000023437-11.dat upx behavioral2/memory/4960-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/892-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023438-19.dat upx behavioral2/memory/2288-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023439-25.dat upx behavioral2/memory/1160-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343a-29.dat upx behavioral2/memory/1008-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343c-34.dat upx behavioral2/files/0x000700000002343d-38.dat upx behavioral2/memory/1156-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343e-43.dat upx behavioral2/memory/4652-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343f-48.dat upx behavioral2/memory/4652-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023440-53.dat upx behavioral2/memory/1872-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3940-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023441-59.dat upx behavioral2/files/0x0007000000023442-63.dat upx behavioral2/memory/4716-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023443-67.dat upx behavioral2/files/0x0007000000023444-72.dat upx behavioral2/files/0x0007000000023445-76.dat upx behavioral2/memory/3140-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023446-81.dat upx behavioral2/files/0x0007000000023447-84.dat upx behavioral2/memory/2408-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3172-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023448-91.dat upx behavioral2/files/0x0007000000023449-95.dat upx behavioral2/memory/896-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344a-100.dat upx behavioral2/files/0x000700000002344b-105.dat upx behavioral2/memory/4820-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1996-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344c-111.dat upx behavioral2/memory/5060-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344d-115.dat upx behavioral2/memory/4412-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344e-119.dat upx behavioral2/files/0x0008000000023434-124.dat upx behavioral2/files/0x000700000002344f-128.dat upx behavioral2/memory/2664-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5052-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023450-133.dat upx behavioral2/files/0x0007000000023451-139.dat upx behavioral2/files/0x0007000000023452-142.dat upx behavioral2/memory/3052-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3520-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023453-148.dat upx behavioral2/files/0x0007000000023455-153.dat upx behavioral2/memory/4744-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3944-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3784-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4996-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2416-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2416-175-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4888 wrote to memory of 1320 4888 33070d093373cf14b8b2ff0fea1c15150b043c532368c4512fe8626ca352cb37.exe 81 PID 4888 wrote to memory of 1320 4888 33070d093373cf14b8b2ff0fea1c15150b043c532368c4512fe8626ca352cb37.exe 81 PID 4888 wrote to memory of 1320 4888 33070d093373cf14b8b2ff0fea1c15150b043c532368c4512fe8626ca352cb37.exe 81 PID 1320 wrote to memory of 4960 1320 fflfxrl.exe 82 PID 1320 wrote to memory of 4960 1320 fflfxrl.exe 82 PID 1320 wrote to memory of 4960 1320 fflfxrl.exe 82 PID 4960 wrote to memory of 892 4960 frflffl.exe 83 PID 4960 wrote to memory of 892 4960 frflffl.exe 83 PID 4960 wrote to memory of 892 4960 frflffl.exe 83 PID 892 wrote to memory of 2288 892 5jppv.exe 84 PID 892 wrote to memory of 2288 892 5jppv.exe 84 PID 892 wrote to memory of 2288 892 5jppv.exe 84 PID 2288 wrote to memory of 1160 2288 5dpjp.exe 85 PID 2288 wrote to memory of 1160 2288 5dpjp.exe 85 PID 2288 wrote to memory of 1160 2288 5dpjp.exe 85 PID 1160 wrote to memory of 1008 1160 lfxrlfx.exe 86 PID 1160 wrote to memory of 1008 1160 lfxrlfx.exe 86 PID 1160 wrote to memory of 1008 1160 lfxrlfx.exe 86 PID 1008 wrote to memory of 1156 1008 xlfxrrf.exe 87 PID 1008 wrote to memory of 1156 1008 xlfxrrf.exe 87 PID 1008 wrote to memory of 1156 1008 xlfxrrf.exe 87 PID 1156 wrote to memory of 1088 1156 hhhtbh.exe 88 PID 1156 wrote to memory of 1088 1156 hhhtbh.exe 88 PID 1156 wrote to memory of 1088 1156 hhhtbh.exe 88 PID 1088 wrote to memory of 4652 1088 xllfrrl.exe 89 PID 1088 wrote to memory of 4652 1088 xllfrrl.exe 89 PID 1088 wrote to memory of 4652 1088 xllfrrl.exe 89 PID 4652 wrote to memory of 1872 4652 bttbtt.exe 90 PID 4652 wrote to memory of 1872 4652 bttbtt.exe 90 PID 4652 wrote to memory of 1872 4652 bttbtt.exe 90 PID 1872 wrote to memory of 3940 1872 vjvpj.exe 91 PID 1872 wrote to memory of 3940 1872 vjvpj.exe 91 PID 1872 wrote to memory of 3940 1872 vjvpj.exe 91 PID 3940 wrote to memory of 4200 3940 7ffxllf.exe 92 PID 3940 wrote to memory of 4200 3940 7ffxllf.exe 92 PID 3940 wrote to memory of 4200 3940 7ffxllf.exe 92 PID 4200 wrote to memory of 4716 4200 xxxrlrr.exe 93 PID 4200 wrote to memory of 4716 4200 xxxrlrr.exe 93 PID 4200 wrote to memory of 4716 4200 xxxrlrr.exe 93 PID 4716 wrote to memory of 3700 4716 bhnnnn.exe 94 PID 4716 wrote to memory of 3700 4716 bhnnnn.exe 94 PID 4716 wrote to memory of 3700 4716 bhnnnn.exe 94 PID 3700 wrote to memory of 3820 3700 pvdvj.exe 95 PID 3700 wrote to memory of 3820 3700 pvdvj.exe 95 PID 3700 wrote to memory of 3820 3700 pvdvj.exe 95 PID 3820 wrote to memory of 3140 3820 rlxxxxx.exe 96 PID 3820 wrote to memory of 3140 3820 rlxxxxx.exe 96 PID 3820 wrote to memory of 3140 3820 rlxxxxx.exe 96 PID 3140 wrote to memory of 2408 3140 bnbbbb.exe 97 PID 3140 wrote to memory of 2408 3140 bnbbbb.exe 97 PID 3140 wrote to memory of 2408 3140 bnbbbb.exe 97 PID 2408 wrote to memory of 3172 2408 dvvpp.exe 98 PID 2408 wrote to memory of 3172 2408 dvvpp.exe 98 PID 2408 wrote to memory of 3172 2408 dvvpp.exe 98 PID 3172 wrote to memory of 896 3172 rllfxlr.exe 99 PID 3172 wrote to memory of 896 3172 rllfxlr.exe 99 PID 3172 wrote to memory of 896 3172 rllfxlr.exe 99 PID 896 wrote to memory of 2524 896 bnntnt.exe 100 PID 896 wrote to memory of 2524 896 bnntnt.exe 100 PID 896 wrote to memory of 2524 896 bnntnt.exe 100 PID 2524 wrote to memory of 4820 2524 dvddv.exe 101 PID 2524 wrote to memory of 4820 2524 dvddv.exe 101 PID 2524 wrote to memory of 4820 2524 dvddv.exe 101 PID 4820 wrote to memory of 1996 4820 xrrrlll.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\33070d093373cf14b8b2ff0fea1c15150b043c532368c4512fe8626ca352cb37.exe"C:\Users\Admin\AppData\Local\Temp\33070d093373cf14b8b2ff0fea1c15150b043c532368c4512fe8626ca352cb37.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\fflfxrl.exec:\fflfxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\frflffl.exec:\frflffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\5jppv.exec:\5jppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\5dpjp.exec:\5dpjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\xlfxrrf.exec:\xlfxrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\hhhtbh.exec:\hhhtbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\xllfrrl.exec:\xllfrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\bttbtt.exec:\bttbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\vjvpj.exec:\vjvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\7ffxllf.exec:\7ffxllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\xxxrlrr.exec:\xxxrlrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\bhnnnn.exec:\bhnnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\pvdvj.exec:\pvdvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\bnbbbb.exec:\bnbbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\dvvpp.exec:\dvvpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\rllfxlr.exec:\rllfxlr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\bnntnt.exec:\bnntnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\dvddv.exec:\dvddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\xrrrlll.exec:\xrrrlll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\1tbbhh.exec:\1tbbhh.exe23⤵
- Executes dropped EXE
PID:1996 -
\??\c:\bttthh.exec:\bttthh.exe24⤵
- Executes dropped EXE
PID:5060 -
\??\c:\vvppd.exec:\vvppd.exe25⤵
- Executes dropped EXE
PID:4412 -
\??\c:\lrxlrrl.exec:\lrxlrrl.exe26⤵
- Executes dropped EXE
PID:932 -
\??\c:\bbnbtn.exec:\bbnbtn.exe27⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pjjdv.exec:\pjjdv.exe28⤵
- Executes dropped EXE
PID:5052 -
\??\c:\3vvpj.exec:\3vvpj.exe29⤵
- Executes dropped EXE
PID:4488 -
\??\c:\fxrrlll.exec:\fxrrlll.exe30⤵
- Executes dropped EXE
PID:3052 -
\??\c:\bhtthb.exec:\bhtthb.exe31⤵
- Executes dropped EXE
PID:3520 -
\??\c:\7jvvp.exec:\7jvvp.exe32⤵
- Executes dropped EXE
PID:4744 -
\??\c:\vvvpj.exec:\vvvpj.exe33⤵
- Executes dropped EXE
PID:3944 -
\??\c:\xxxlrlr.exec:\xxxlrlr.exe34⤵
- Executes dropped EXE
PID:2164 -
\??\c:\nhbbbh.exec:\nhbbbh.exe35⤵
- Executes dropped EXE
PID:944 -
\??\c:\hbnhtt.exec:\hbnhtt.exe36⤵
- Executes dropped EXE
PID:3784 -
\??\c:\jdvvj.exec:\jdvvj.exe37⤵
- Executes dropped EXE
PID:4352 -
\??\c:\jddpp.exec:\jddpp.exe38⤵
- Executes dropped EXE
PID:4996 -
\??\c:\lxllxxx.exec:\lxllxxx.exe39⤵
- Executes dropped EXE
PID:2116 -
\??\c:\9rllffx.exec:\9rllffx.exe40⤵
- Executes dropped EXE
PID:2416 -
\??\c:\bbhhnb.exec:\bbhhnb.exe41⤵
- Executes dropped EXE
PID:2580 -
\??\c:\rrlxlxl.exec:\rrlxlxl.exe42⤵
- Executes dropped EXE
PID:708 -
\??\c:\rlllfff.exec:\rlllfff.exe43⤵
- Executes dropped EXE
PID:4456 -
\??\c:\nhhbhh.exec:\nhhbhh.exe44⤵
- Executes dropped EXE
PID:4576 -
\??\c:\7ddvv.exec:\7ddvv.exe45⤵
- Executes dropped EXE
PID:5080 -
\??\c:\5lrlfxx.exec:\5lrlfxx.exe46⤵
- Executes dropped EXE
PID:2556 -
\??\c:\ttttnn.exec:\ttttnn.exe47⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vjjjp.exec:\vjjjp.exe48⤵
- Executes dropped EXE
PID:3248 -
\??\c:\dvvjv.exec:\dvvjv.exe49⤵
- Executes dropped EXE
PID:2956 -
\??\c:\lrlffll.exec:\lrlffll.exe50⤵
- Executes dropped EXE
PID:3108 -
\??\c:\1fffxxx.exec:\1fffxxx.exe51⤵
- Executes dropped EXE
PID:2532 -
\??\c:\1httnh.exec:\1httnh.exe52⤵
- Executes dropped EXE
PID:1604 -
\??\c:\3dvvp.exec:\3dvvp.exe53⤵
- Executes dropped EXE
PID:1624 -
\??\c:\pddvp.exec:\pddvp.exe54⤵
- Executes dropped EXE
PID:208 -
\??\c:\rxxxrrr.exec:\rxxxrrr.exe55⤵
- Executes dropped EXE
PID:3884 -
\??\c:\lrrlrxr.exec:\lrrlrxr.exe56⤵
- Executes dropped EXE
PID:2236 -
\??\c:\bbtnhh.exec:\bbtnhh.exe57⤵
- Executes dropped EXE
PID:4384 -
\??\c:\jvppp.exec:\jvppp.exe58⤵
- Executes dropped EXE
PID:4372 -
\??\c:\jvvpj.exec:\jvvpj.exe59⤵
- Executes dropped EXE
PID:4496 -
\??\c:\dppjj.exec:\dppjj.exe60⤵
- Executes dropped EXE
PID:884 -
\??\c:\llxrlll.exec:\llxrlll.exe61⤵
- Executes dropped EXE
PID:4612 -
\??\c:\nhbbtb.exec:\nhbbtb.exe62⤵
- Executes dropped EXE
PID:2028 -
\??\c:\nnnhhn.exec:\nnnhhn.exe63⤵
- Executes dropped EXE
PID:892 -
\??\c:\vpjdp.exec:\vpjdp.exe64⤵
- Executes dropped EXE
PID:3956 -
\??\c:\7jpjj.exec:\7jpjj.exe65⤵
- Executes dropped EXE
PID:4944 -
\??\c:\fxlfrlr.exec:\fxlfrlr.exe66⤵PID:3628
-
\??\c:\xfrflll.exec:\xfrflll.exe67⤵PID:1480
-
\??\c:\ttbbtt.exec:\ttbbtt.exe68⤵PID:3992
-
\??\c:\ddvdj.exec:\ddvdj.exe69⤵PID:2572
-
\??\c:\dpvvv.exec:\dpvvv.exe70⤵PID:3788
-
\??\c:\vjjjj.exec:\vjjjj.exe71⤵PID:5008
-
\??\c:\ffrlfrx.exec:\ffrlfrx.exe72⤵PID:4652
-
\??\c:\nhnhbt.exec:\nhnhbt.exe73⤵PID:1020
-
\??\c:\hbttnn.exec:\hbttnn.exe74⤵PID:1112
-
\??\c:\7jpjd.exec:\7jpjd.exe75⤵PID:3940
-
\??\c:\pjjvv.exec:\pjjvv.exe76⤵PID:4992
-
\??\c:\rllffxf.exec:\rllffxf.exe77⤵PID:1932
-
\??\c:\ntnnhh.exec:\ntnnhh.exe78⤵PID:396
-
\??\c:\rffrfxr.exec:\rffrfxr.exe79⤵PID:452
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe80⤵PID:3456
-
\??\c:\hbbhtn.exec:\hbbhtn.exe81⤵PID:3820
-
\??\c:\ppppj.exec:\ppppj.exe82⤵PID:3592
-
\??\c:\7xllflf.exec:\7xllflf.exe83⤵PID:3952
-
\??\c:\xllfxrx.exec:\xllfxrx.exe84⤵PID:1536
-
\??\c:\5bbbtt.exec:\5bbbtt.exe85⤵PID:1792
-
\??\c:\hthbtn.exec:\hthbtn.exe86⤵PID:2892
-
\??\c:\pdvvv.exec:\pdvvv.exe87⤵PID:1684
-
\??\c:\jpvpj.exec:\jpvpj.exe88⤵PID:4620
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe89⤵PID:3200
-
\??\c:\5lxxlll.exec:\5lxxlll.exe90⤵PID:4088
-
\??\c:\tnbbtt.exec:\tnbbtt.exe91⤵PID:2264
-
\??\c:\tnhbnh.exec:\tnhbnh.exe92⤵PID:1908
-
\??\c:\7vdvp.exec:\7vdvp.exe93⤵PID:2008
-
\??\c:\rllxffr.exec:\rllxffr.exe94⤵PID:4644
-
\??\c:\bnbtnh.exec:\bnbtnh.exe95⤵PID:556
-
\??\c:\tthbtt.exec:\tthbtt.exe96⤵PID:1636
-
\??\c:\1ddvd.exec:\1ddvd.exe97⤵PID:700
-
\??\c:\llrflff.exec:\llrflff.exe98⤵PID:1460
-
\??\c:\fxxxllf.exec:\fxxxllf.exe99⤵PID:1584
-
\??\c:\3hhbbb.exec:\3hhbbb.exe100⤵PID:2472
-
\??\c:\nnhhhh.exec:\nnhhhh.exe101⤵PID:3880
-
\??\c:\jdddj.exec:\jdddj.exe102⤵PID:4000
-
\??\c:\xflxxrl.exec:\xflxxrl.exe103⤵PID:2240
-
\??\c:\rfrxxrf.exec:\rfrxxrf.exe104⤵PID:3132
-
\??\c:\hbthnn.exec:\hbthnn.exe105⤵PID:3536
-
\??\c:\tthbbb.exec:\tthbbb.exe106⤵PID:868
-
\??\c:\jppjv.exec:\jppjv.exe107⤵PID:2164
-
\??\c:\xllfffx.exec:\xllfffx.exe108⤵PID:4876
-
\??\c:\rlffffx.exec:\rlffffx.exe109⤵PID:2448
-
\??\c:\tnnnhh.exec:\tnnnhh.exe110⤵PID:3332
-
\??\c:\nbbbbb.exec:\nbbbbb.exe111⤵PID:3392
-
\??\c:\1btthh.exec:\1btthh.exe112⤵PID:1784
-
\??\c:\1pjjj.exec:\1pjjj.exe113⤵PID:3208
-
\??\c:\ppppd.exec:\ppppd.exe114⤵PID:1972
-
\??\c:\1frxrrl.exec:\1frxrrl.exe115⤵PID:2916
-
\??\c:\bhhbnn.exec:\bhhbnn.exe116⤵PID:5088
-
\??\c:\nnhbnh.exec:\nnhbnh.exe117⤵PID:4456
-
\??\c:\ddddv.exec:\ddddv.exe118⤵PID:4576
-
\??\c:\dvpjv.exec:\dvpjv.exe119⤵PID:4804
-
\??\c:\xlfxrlr.exec:\xlfxrlr.exe120⤵PID:4864
-
\??\c:\1lfxfff.exec:\1lfxfff.exe121⤵PID:4540
-
\??\c:\httnnn.exec:\httnnn.exe122⤵PID:652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-