Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 00:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9d5825cb8b4367817c827b3e4ccb61adc57ec29258d7d3905d23b31c00c0a556.exe
Resource
win7-20240419-en
windows7-x64
6 signatures
150 seconds
General
-
Target
9d5825cb8b4367817c827b3e4ccb61adc57ec29258d7d3905d23b31c00c0a556.exe
-
Size
408KB
-
MD5
07631942d45590495311962cad7e3a68
-
SHA1
dfbe2c6f7808add2d4c4e0ac037afb4c6d80477c
-
SHA256
9d5825cb8b4367817c827b3e4ccb61adc57ec29258d7d3905d23b31c00c0a556
-
SHA512
bc880c4726fe07b83b62aa82433776f5292f3ab3e970edb001a2fe4a13d8099134ac06fcfa718346998e3d0b459c6e246fbe98b1118579ff74a765ad43353b06
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAsACF486jJSp1Bwc4:Pcm7ImGddXtWrXD486jJq1Bwc4
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4872-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1992-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5348-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/924-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/6108-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1128-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5480-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/856-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5216-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/6004-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5280-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5392-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5768-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5688-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1376-332-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-343-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3404-379-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-383-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5328-405-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-413-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-426-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-430-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-540-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-564-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-577-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5600-590-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-600-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-604-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-658-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-699-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-712-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-749-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5128-750-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5500-821-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-923-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-1261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/4872-0-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4872-5-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2956-8-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3476-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4768-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1992-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4768-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5348-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/924-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4548-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/6108-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1128-57-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1972-64-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1128-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4976-74-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2336-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2404-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4904-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4964-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4356-110-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4060-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2716-133-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4880-143-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2376-150-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5480-159-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3944-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2004-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4036-183-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/856-190-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2432-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3188-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5216-210-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/6004-214-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4244-224-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3720-228-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2768-235-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5280-248-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2880-254-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5392-263-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3280-264-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3508-283-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1648-287-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2140-298-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5768-304-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2036-311-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5688-312-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5044-322-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1376-332-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2092-336-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1464-343-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3680-356-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4996-369-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3404-379-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4548-383-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5328-405-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4220-409-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4220-413-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5072-426-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3580-430-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4316-443-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1372-471-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2420-521-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3636-540-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2072-564-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2956 llllfll.exe 5348 bnhhhh.exe 3476 pddpd.exe 4768 xlxlxxl.exe 1992 bhtnhb.exe 924 ddddd.exe 4548 hhnhbh.exe 6108 lxflfll.exe 1128 ntnnhn.exe 1972 vvjjj.exe 4976 vdvpp.exe 2336 nbnhhh.exe 2404 vddjd.exe 4904 lxlllrx.exe 4964 jpjjj.exe 5364 hbtnnn.exe 4356 tbhhtt.exe 1424 lxrlrrx.exe 4060 nbbtht.exe 5204 xlrfxfl.exe 6096 ppvjj.exe 2716 fflxlrf.exe 4880 hbhbbt.exe 5484 jvddv.exe 2376 frxlrlr.exe 5480 tbbhtt.exe 3944 jvjdp.exe 2004 ntnhbt.exe 3908 pjvvv.exe 1888 hnnbbn.exe 4036 ppvvv.exe 856 pvddv.exe 888 5xlflll.exe 2432 hntttt.exe 3188 pdjjd.exe 3808 lxllfll.exe 5216 ffrrffr.exe 6004 tnbhnn.exe 2764 djjjj.exe 1124 llffflf.exe 4244 btbtnn.exe 3720 ppjjj.exe 2220 pjvpp.exe 3244 3fffxff.exe 2768 jvjjd.exe 4008 lrfffff.exe 1664 frxlxlr.exe 5280 dvvpd.exe 2384 rfxrrxx.exe 2880 nbhbhh.exe 5076 bthbbb.exe 5392 vpvpj.exe 3280 fxlrrrx.exe 2608 xxlllrr.exe 832 nthbbt.exe 1684 vvjpv.exe 5372 7flfffx.exe 3508 fxrlffr.exe 5680 nhhhhh.exe 1648 dvjjj.exe 5168 fxrlllf.exe 2140 lxxxfrx.exe 1348 vvvvv.exe 628 pjjdd.exe -
resource yara_rule behavioral2/memory/4872-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1992-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5348-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/924-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/6108-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1128-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1128-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2404-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5480-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/856-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5216-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/6004-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5280-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5392-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5768-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-311-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5688-312-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-332-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-336-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-343-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-356-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-379-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-383-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5328-405-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-413-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-426-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-430-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-443-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-471-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-521-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-540-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-564-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-577-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4872 wrote to memory of 2956 4872 9d5825cb8b4367817c827b3e4ccb61adc57ec29258d7d3905d23b31c00c0a556.exe 83 PID 4872 wrote to memory of 2956 4872 9d5825cb8b4367817c827b3e4ccb61adc57ec29258d7d3905d23b31c00c0a556.exe 83 PID 4872 wrote to memory of 2956 4872 9d5825cb8b4367817c827b3e4ccb61adc57ec29258d7d3905d23b31c00c0a556.exe 83 PID 2956 wrote to memory of 5348 2956 llllfll.exe 84 PID 2956 wrote to memory of 5348 2956 llllfll.exe 84 PID 2956 wrote to memory of 5348 2956 llllfll.exe 84 PID 5348 wrote to memory of 3476 5348 bnhhhh.exe 85 PID 5348 wrote to memory of 3476 5348 bnhhhh.exe 85 PID 5348 wrote to memory of 3476 5348 bnhhhh.exe 85 PID 3476 wrote to memory of 4768 3476 pddpd.exe 86 PID 3476 wrote to memory of 4768 3476 pddpd.exe 86 PID 3476 wrote to memory of 4768 3476 pddpd.exe 86 PID 4768 wrote to memory of 1992 4768 xlxlxxl.exe 87 PID 4768 wrote to memory of 1992 4768 xlxlxxl.exe 87 PID 4768 wrote to memory of 1992 4768 xlxlxxl.exe 87 PID 1992 wrote to memory of 924 1992 bhtnhb.exe 88 PID 1992 wrote to memory of 924 1992 bhtnhb.exe 88 PID 1992 wrote to memory of 924 1992 bhtnhb.exe 88 PID 924 wrote to memory of 4548 924 ddddd.exe 89 PID 924 wrote to memory of 4548 924 ddddd.exe 89 PID 924 wrote to memory of 4548 924 ddddd.exe 89 PID 4548 wrote to memory of 6108 4548 hhnhbh.exe 90 PID 4548 wrote to memory of 6108 4548 hhnhbh.exe 90 PID 4548 wrote to memory of 6108 4548 hhnhbh.exe 90 PID 6108 wrote to memory of 1128 6108 lxflfll.exe 91 PID 6108 wrote to memory of 1128 6108 lxflfll.exe 91 PID 6108 wrote to memory of 1128 6108 lxflfll.exe 91 PID 1128 wrote to memory of 1972 1128 ntnnhn.exe 92 PID 1128 wrote to memory of 1972 1128 ntnnhn.exe 92 PID 1128 wrote to memory of 1972 1128 ntnnhn.exe 92 PID 1972 wrote to memory of 4976 1972 vvjjj.exe 95 PID 1972 wrote to memory of 4976 1972 vvjjj.exe 95 PID 1972 wrote to memory of 4976 1972 vvjjj.exe 95 PID 4976 wrote to memory of 2336 4976 vdvpp.exe 96 PID 4976 wrote to memory of 2336 4976 vdvpp.exe 96 PID 4976 wrote to memory of 2336 4976 vdvpp.exe 96 PID 2336 wrote to memory of 2404 2336 nbnhhh.exe 97 PID 2336 wrote to memory of 2404 2336 nbnhhh.exe 97 PID 2336 wrote to memory of 2404 2336 nbnhhh.exe 97 PID 2404 wrote to memory of 4904 2404 vddjd.exe 98 PID 2404 wrote to memory of 4904 2404 vddjd.exe 98 PID 2404 wrote to memory of 4904 2404 vddjd.exe 98 PID 4904 wrote to memory of 4964 4904 lxlllrx.exe 100 PID 4904 wrote to memory of 4964 4904 lxlllrx.exe 100 PID 4904 wrote to memory of 4964 4904 lxlllrx.exe 100 PID 4964 wrote to memory of 5364 4964 jpjjj.exe 101 PID 4964 wrote to memory of 5364 4964 jpjjj.exe 101 PID 4964 wrote to memory of 5364 4964 jpjjj.exe 101 PID 5364 wrote to memory of 4356 5364 hbtnnn.exe 102 PID 5364 wrote to memory of 4356 5364 hbtnnn.exe 102 PID 5364 wrote to memory of 4356 5364 hbtnnn.exe 102 PID 4356 wrote to memory of 1424 4356 tbhhtt.exe 103 PID 4356 wrote to memory of 1424 4356 tbhhtt.exe 103 PID 4356 wrote to memory of 1424 4356 tbhhtt.exe 103 PID 1424 wrote to memory of 4060 1424 lxrlrrx.exe 104 PID 1424 wrote to memory of 4060 1424 lxrlrrx.exe 104 PID 1424 wrote to memory of 4060 1424 lxrlrrx.exe 104 PID 4060 wrote to memory of 5204 4060 nbbtht.exe 105 PID 4060 wrote to memory of 5204 4060 nbbtht.exe 105 PID 4060 wrote to memory of 5204 4060 nbbtht.exe 105 PID 5204 wrote to memory of 6096 5204 xlrfxfl.exe 106 PID 5204 wrote to memory of 6096 5204 xlrfxfl.exe 106 PID 5204 wrote to memory of 6096 5204 xlrfxfl.exe 106 PID 6096 wrote to memory of 2716 6096 ppvjj.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d5825cb8b4367817c827b3e4ccb61adc57ec29258d7d3905d23b31c00c0a556.exe"C:\Users\Admin\AppData\Local\Temp\9d5825cb8b4367817c827b3e4ccb61adc57ec29258d7d3905d23b31c00c0a556.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\llllfll.exec:\llllfll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\bnhhhh.exec:\bnhhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5348 -
\??\c:\pddpd.exec:\pddpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\xlxlxxl.exec:\xlxlxxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\bhtnhb.exec:\bhtnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\ddddd.exec:\ddddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\hhnhbh.exec:\hhnhbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\lxflfll.exec:\lxflfll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
\??\c:\ntnnhn.exec:\ntnnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\vvjjj.exec:\vvjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\vdvpp.exec:\vdvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\nbnhhh.exec:\nbnhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\vddjd.exec:\vddjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\lxlllrx.exec:\lxlllrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\jpjjj.exec:\jpjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\hbtnnn.exec:\hbtnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
\??\c:\tbhhtt.exec:\tbhhtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\lxrlrrx.exec:\lxrlrrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\nbbtht.exec:\nbbtht.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\xlrfxfl.exec:\xlrfxfl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5204 -
\??\c:\ppvjj.exec:\ppvjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
\??\c:\fflxlrf.exec:\fflxlrf.exe23⤵
- Executes dropped EXE
PID:2716 -
\??\c:\hbhbbt.exec:\hbhbbt.exe24⤵
- Executes dropped EXE
PID:4880 -
\??\c:\jvddv.exec:\jvddv.exe25⤵
- Executes dropped EXE
PID:5484 -
\??\c:\frxlrlr.exec:\frxlrlr.exe26⤵
- Executes dropped EXE
PID:2376 -
\??\c:\tbbhtt.exec:\tbbhtt.exe27⤵
- Executes dropped EXE
PID:5480 -
\??\c:\jvjdp.exec:\jvjdp.exe28⤵
- Executes dropped EXE
PID:3944 -
\??\c:\ntnhbt.exec:\ntnhbt.exe29⤵
- Executes dropped EXE
PID:2004 -
\??\c:\pjvvv.exec:\pjvvv.exe30⤵
- Executes dropped EXE
PID:3908 -
\??\c:\hnnbbn.exec:\hnnbbn.exe31⤵
- Executes dropped EXE
PID:1888 -
\??\c:\ppvvv.exec:\ppvvv.exe32⤵
- Executes dropped EXE
PID:4036 -
\??\c:\pvddv.exec:\pvddv.exe33⤵
- Executes dropped EXE
PID:856 -
\??\c:\5xlflll.exec:\5xlflll.exe34⤵
- Executes dropped EXE
PID:888 -
\??\c:\hntttt.exec:\hntttt.exe35⤵
- Executes dropped EXE
PID:2432 -
\??\c:\pdjjd.exec:\pdjjd.exe36⤵
- Executes dropped EXE
PID:3188 -
\??\c:\lxllfll.exec:\lxllfll.exe37⤵
- Executes dropped EXE
PID:3808 -
\??\c:\ffrrffr.exec:\ffrrffr.exe38⤵
- Executes dropped EXE
PID:5216 -
\??\c:\tnbhnn.exec:\tnbhnn.exe39⤵
- Executes dropped EXE
PID:6004 -
\??\c:\djjjj.exec:\djjjj.exe40⤵
- Executes dropped EXE
PID:2764 -
\??\c:\llffflf.exec:\llffflf.exe41⤵
- Executes dropped EXE
PID:1124 -
\??\c:\btbtnn.exec:\btbtnn.exe42⤵
- Executes dropped EXE
PID:4244 -
\??\c:\ppjjj.exec:\ppjjj.exe43⤵
- Executes dropped EXE
PID:3720 -
\??\c:\pjvpp.exec:\pjvpp.exe44⤵
- Executes dropped EXE
PID:2220 -
\??\c:\3fffxff.exec:\3fffxff.exe45⤵
- Executes dropped EXE
PID:3244 -
\??\c:\jvjjd.exec:\jvjjd.exe46⤵
- Executes dropped EXE
PID:2768 -
\??\c:\lrfffff.exec:\lrfffff.exe47⤵
- Executes dropped EXE
PID:4008 -
\??\c:\frxlxlr.exec:\frxlxlr.exe48⤵
- Executes dropped EXE
PID:1664 -
\??\c:\dvvpd.exec:\dvvpd.exe49⤵
- Executes dropped EXE
PID:5280 -
\??\c:\rfxrrxx.exec:\rfxrrxx.exe50⤵
- Executes dropped EXE
PID:2384 -
\??\c:\nbhbhh.exec:\nbhbhh.exe51⤵
- Executes dropped EXE
PID:2880 -
\??\c:\bthbbb.exec:\bthbbb.exe52⤵
- Executes dropped EXE
PID:5076 -
\??\c:\vpvpj.exec:\vpvpj.exe53⤵
- Executes dropped EXE
PID:5392 -
\??\c:\fxlrrrx.exec:\fxlrrrx.exe54⤵
- Executes dropped EXE
PID:3280 -
\??\c:\xxlllrr.exec:\xxlllrr.exe55⤵
- Executes dropped EXE
PID:2608 -
\??\c:\nthbbt.exec:\nthbbt.exe56⤵
- Executes dropped EXE
PID:832 -
\??\c:\vvjpv.exec:\vvjpv.exe57⤵
- Executes dropped EXE
PID:1684 -
\??\c:\7flfffx.exec:\7flfffx.exe58⤵
- Executes dropped EXE
PID:5372 -
\??\c:\fxrlffr.exec:\fxrlffr.exe59⤵
- Executes dropped EXE
PID:3508 -
\??\c:\nhhhhh.exec:\nhhhhh.exe60⤵
- Executes dropped EXE
PID:5680 -
\??\c:\dvjjj.exec:\dvjjj.exe61⤵
- Executes dropped EXE
PID:1648 -
\??\c:\fxrlllf.exec:\fxrlllf.exe62⤵
- Executes dropped EXE
PID:5168 -
\??\c:\lxxxfrx.exec:\lxxxfrx.exe63⤵
- Executes dropped EXE
PID:2140 -
\??\c:\vvvvv.exec:\vvvvv.exe64⤵
- Executes dropped EXE
PID:1348 -
\??\c:\pjjdd.exec:\pjjdd.exe65⤵
- Executes dropped EXE
PID:628 -
\??\c:\xfxxrrl.exec:\xfxxrrl.exe66⤵PID:5768
-
\??\c:\ttbbbb.exec:\ttbbbb.exe67⤵PID:2036
-
\??\c:\dpjdd.exec:\dpjdd.exe68⤵PID:5688
-
\??\c:\rlxrlll.exec:\rlxrlll.exe69⤵PID:3668
-
\??\c:\bhnhtt.exec:\bhnhtt.exe70⤵PID:5044
-
\??\c:\dvdpv.exec:\dvdpv.exe71⤵PID:5540
-
\??\c:\3xflffr.exec:\3xflffr.exe72⤵PID:3724
-
\??\c:\tttthh.exec:\tttthh.exe73⤵PID:1376
-
\??\c:\jjjdp.exec:\jjjdp.exe74⤵PID:5156
-
\??\c:\9lfrrff.exec:\9lfrrff.exe75⤵PID:2092
-
\??\c:\bnbthn.exec:\bnbthn.exe76⤵PID:1464
-
\??\c:\vpppv.exec:\vpppv.exe77⤵PID:4424
-
\??\c:\9rxxlll.exec:\9rxxlll.exe78⤵PID:2936
-
\??\c:\xxllllx.exec:\xxllllx.exe79⤵PID:2888
-
\??\c:\1httnn.exec:\1httnn.exe80⤵PID:4600
-
\??\c:\pvdvv.exec:\pvdvv.exe81⤵PID:3680
-
\??\c:\ttbhbb.exec:\ttbhbb.exe82⤵PID:4924
-
\??\c:\7pddd.exec:\7pddd.exe83⤵PID:6060
-
\??\c:\fxrrxll.exec:\fxrrxll.exe84⤵PID:4996
-
\??\c:\ttnnnh.exec:\ttnnnh.exe85⤵PID:3560
-
\??\c:\jdpdj.exec:\jdpdj.exe86⤵PID:3728
-
\??\c:\dddvp.exec:\dddvp.exe87⤵PID:3404
-
\??\c:\frfrxfl.exec:\frfrxfl.exe88⤵PID:4548
-
\??\c:\thntnt.exec:\thntnt.exe89⤵PID:2416
-
\??\c:\5xllfrx.exec:\5xllfrx.exe90⤵PID:1600
-
\??\c:\hnnnhb.exec:\hnnnhb.exe91⤵PID:1904
-
\??\c:\bbhhbb.exec:\bbhhbb.exe92⤵PID:2492
-
\??\c:\ppvvd.exec:\ppvvd.exe93⤵PID:3624
-
\??\c:\fxlxxll.exec:\fxlxxll.exe94⤵PID:4992
-
\??\c:\7bhbtt.exec:\7bhbtt.exe95⤵PID:5328
-
\??\c:\3jddd.exec:\3jddd.exe96⤵PID:2336
-
\??\c:\jvdjd.exec:\jvdjd.exe97⤵PID:4220
-
\??\c:\xrrlrrx.exec:\xrrlrrx.exe98⤵PID:3900
-
\??\c:\tbhbbt.exec:\tbhbbt.exe99⤵PID:4968
-
\??\c:\9jppj.exec:\9jppj.exe100⤵PID:4188
-
\??\c:\xlxffrl.exec:\xlxffrl.exe101⤵PID:5072
-
\??\c:\9fllflx.exec:\9fllflx.exe102⤵PID:3580
-
\??\c:\9htnnt.exec:\9htnnt.exe103⤵PID:3132
-
\??\c:\jdvpp.exec:\jdvpp.exe104⤵PID:1300
-
\??\c:\rrlllxl.exec:\rrlllxl.exe105⤵PID:6096
-
\??\c:\3ffffff.exec:\3ffffff.exe106⤵PID:1280
-
\??\c:\9ntttt.exec:\9ntttt.exe107⤵PID:4316
-
\??\c:\jjpjj.exec:\jjpjj.exe108⤵PID:5484
-
\??\c:\rflrrfr.exec:\rflrrfr.exe109⤵PID:4372
-
\??\c:\hhbthh.exec:\hhbthh.exe110⤵PID:1516
-
\??\c:\dvppp.exec:\dvppp.exe111⤵PID:5480
-
\??\c:\xllfffx.exec:\xllfffx.exe112⤵PID:2628
-
\??\c:\nhbtbh.exec:\nhbtbh.exe113⤵PID:5504
-
\??\c:\ddpjj.exec:\ddpjj.exe114⤵PID:2004
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe115⤵PID:4240
-
\??\c:\3flxrxf.exec:\3flxrxf.exe116⤵PID:1372
-
\??\c:\tntnhh.exec:\tntnhh.exe117⤵PID:3976
-
\??\c:\7jjdp.exec:\7jjdp.exe118⤵PID:724
-
\??\c:\jvjjv.exec:\jvjjv.exe119⤵PID:736
-
\??\c:\rrfxxxx.exec:\rrfxxxx.exe120⤵PID:1028
-
\??\c:\nbhbtt.exec:\nbhbtt.exe121⤵PID:3472
-
\??\c:\pvpjv.exec:\pvpjv.exe122⤵PID:4720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-