Analysis
- max time kernel
150s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
05/06/2024, 22:29
Behavioral task
behavioral1
Sample
4b63ed76419bbd4a80cf2281c7344b227aabc39862bcab8f164cd13744299ae9.exe
Resource
win7-20240221-en
7 signatures
150 seconds
General
- Target 4b63ed76419bbd4a80cf2281c7344b227aabc39862bcab8f164cd13744299ae9.exe
- Size 377KB
- Sample240605-2epdjsag71
- SHA256 4b63ed76419bbd4a80cf2281c7344b227aabc39862bcab8f164cd13744299ae9
- MD5 5c031a79482ab9ec0455f447e161688f
- SHA1 202531e2b29503f14b86e3b4cedb91be12ff286b
- SHA512 0e4d19773c2c2beca4f9d2fa01d529f801e05f1e75f35c37aadcae3fb3cace063956d6f4a65245dd2ae455e5adcf8e39df1221520239d251266aba028d5286df
- SSDEEP 6144:9cm4FmowdHoSABIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7+:/4wFHoSA4KofHfHTXQLzgvnzHPowYbvP
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/5116-5-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2396-14-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4540-34-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2548-29-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4808-22-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/440-39-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4020-48-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1612-54-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4060-60-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/556-62-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/556-55-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4060-68-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/5020-75-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4404-82-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4996-83-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3980-96-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2324-110-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2324-104-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4596-103-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4596-98-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2112-119-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4908-117-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3224-130-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4908-122-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4996-89-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/780-137-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3612-145-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2152-146-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2760-151-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2152-153-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2760-159-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3484-167-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1620-174-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1620-182-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2800-186-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3484-173-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2000-202-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/5104-201-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1992-194-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/752-166-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2000-208-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3812-215-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3676-216-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3676-222-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4900-223-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4900-227-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4580-233-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4992-232-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4580-239-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2640-242-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2640-237-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2252-247-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3396-251-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1936-253-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3396-257-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4968-262-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3596-267-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2068-268-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2068-272-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2868-273-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3336-282-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2868-279-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2388-284-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2692-288-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/files/0x0008000000023467-3.dat UPX behavioral2/memory/5116-5-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x000800000002346a-10.dat UPX behavioral2/memory/2396-14-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x000700000002346e-13.dat UPX behavioral2/files/0x000700000002346f-25.dat UPX behavioral2/files/0x0007000000023470-31.dat UPX behavioral2/memory/4540-34-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/2548-29-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4808-22-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/2548-20-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023472-38.dat UPX behavioral2/memory/440-39-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4020-42-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023473-44.dat UPX behavioral2/memory/4020-48-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/1612-54-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023474-53.dat UPX behavioral2/files/0x0007000000023475-59.dat UPX behavioral2/memory/556-62-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/556-55-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023477-65.dat UPX behavioral2/memory/4060-68-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023478-73.dat UPX behavioral2/memory/5020-75-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023479-79.dat UPX behavioral2/memory/4404-82-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4996-83-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x000700000002347a-86.dat UPX behavioral2/files/0x000700000002347b-93.dat UPX behavioral2/memory/3980-96-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x000700000002347c-100.dat UPX behavioral2/files/0x000800000002346b-107.dat UPX behavioral2/memory/2324-110-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/2324-104-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x000700000002347d-114.dat UPX behavioral2/memory/4596-103-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4596-98-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/2112-119-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4908-117-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x000700000002347e-123.dat UPX behavioral2/files/0x000700000002347f-128.dat UPX behavioral2/memory/3224-130-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4908-122-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4996-89-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023480-135.dat UPX behavioral2/memory/780-137-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023481-142.dat UPX behavioral2/memory/3612-145-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/2152-146-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023482-150.dat UPX behavioral2/memory/2760-151-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023483-157.dat UPX behavioral2/memory/2152-153-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/2760-159-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023484-164.dat UPX behavioral2/files/0x0007000000023485-171.dat UPX behavioral2/memory/1620-182-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023486-178.dat UPX behavioral2/memory/2800-186-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023487-184.dat UPX behavioral2/memory/3484-173-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023488-191.dat UPX behavioral2/memory/5104-196-0x0000000000400000-0x0000000000460000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 2396 tbbtnn.exe 4808 vddjd.exe 2548 lfffrrr.exe 4540 ffrlfxl.exe 440 bttnnn.exe 4020 xrlfffx.exe 1612 nhhhbt.exe 556 lxrllff.exe 4060 pjppd.exe 5020 3vvpj.exe 4404 5lffxxf.exe 4996 htbtnn.exe 3980 rlxxfxx.exe 4596 3htntt.exe 2324 1djdv.exe 2112 frrrlfl.exe 4908 ddvpd.exe 3224 5rfrxrl.exe 780 7hhbbb.exe 3612 tttnhh.exe 2152 llrlfrl.exe 2760 1ttttt.exe 752 httnhh.exe 3484 pjppp.exe 1620 ppvjd.exe 2800 vjpjj.exe 1992 flrrxff.exe 5104 nbnhbb.exe 2000 bbnnnh.exe 3812 vpjjp.exe 3676 llfxrrl.exe 4900 3vvdd.exe 4992 hnthnb.exe 4580 5vppj.exe 2640 9jdjj.exe 2252 xfllfff.exe 1936 nbnnnn.exe 3396 jvjjj.exe 4968 tnnnhb.exe 3596 bbbbtb.exe 2068 pvjdv.exe 2868 1flflll.exe 3336 9bbbtt.exe 2388 7btttt.exe 2692 jdddv.exe 4760 xlxxrrr.exe 2004 bthbtt.exe 3748 jvdvp.exe 1820 fxxxxxx.exe 4388 tnbbbb.exe 2940 vvdvd.exe 4916 7xllflf.exe 4160 llrlfff.exe 5044 3htnhh.exe 3460 thnntt.exe 4216 pddvj.exe 2824 hnhbhn.exe 452 pdppp.exe 4420 xrflfxr.exe 1640 3nbbtt.exe 4632 vvdjj.exe 4868 xrflfff.exe 3256 1nbbtb.exe 3500 3thbtb.exe - Molebox Virtualization software 32 IoCs
Detects file using Molebox Virtualization software.
resource yara_rule behavioral2/files/0x0008000000023467-3.dat molebox behavioral2/files/0x000800000002346a-10.dat molebox behavioral2/files/0x000700000002346e-13.dat molebox behavioral2/files/0x000700000002346f-25.dat molebox behavioral2/files/0x0007000000023470-31.dat molebox behavioral2/files/0x0007000000023472-38.dat molebox behavioral2/files/0x0007000000023473-44.dat molebox behavioral2/files/0x0007000000023474-53.dat molebox behavioral2/files/0x0007000000023475-59.dat molebox behavioral2/files/0x0007000000023477-65.dat molebox behavioral2/files/0x0007000000023478-73.dat molebox behavioral2/files/0x0007000000023479-79.dat molebox behavioral2/files/0x000700000002347a-86.dat molebox behavioral2/files/0x000700000002347b-93.dat molebox behavioral2/files/0x000700000002347c-100.dat molebox behavioral2/files/0x000800000002346b-107.dat molebox behavioral2/files/0x000700000002347d-114.dat molebox behavioral2/files/0x000700000002347e-123.dat molebox behavioral2/files/0x000700000002347f-128.dat molebox behavioral2/files/0x0007000000023480-135.dat molebox behavioral2/files/0x0007000000023481-142.dat molebox behavioral2/files/0x0007000000023482-150.dat molebox behavioral2/files/0x0007000000023483-157.dat molebox behavioral2/files/0x0007000000023484-164.dat molebox behavioral2/files/0x0007000000023485-171.dat molebox behavioral2/files/0x0007000000023486-178.dat molebox behavioral2/files/0x0007000000023487-184.dat molebox behavioral2/files/0x0007000000023488-191.dat molebox behavioral2/files/0x0007000000023489-199.dat molebox behavioral2/files/0x000700000002348a-205.dat molebox behavioral2/files/0x000700000002348b-214.dat molebox behavioral2/files/0x000700000002348c-219.dat molebox -
resource yara_rule behavioral2/memory/5116-0-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0008000000023467-3.dat upx behavioral2/memory/5116-5-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000800000002346a-10.dat upx behavioral2/memory/2396-14-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4808-15-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000700000002346e-13.dat upx behavioral2/files/0x000700000002346f-25.dat upx behavioral2/files/0x0007000000023470-31.dat upx behavioral2/memory/4540-34-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/440-32-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2548-29-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4808-22-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2548-20-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2396-9-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023472-38.dat upx behavioral2/memory/440-39-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4020-42-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023473-44.dat upx behavioral2/memory/1612-46-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4020-48-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1612-54-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023474-53.dat upx behavioral2/files/0x0007000000023475-59.dat upx behavioral2/memory/4060-60-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/556-62-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/556-55-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023477-65.dat upx behavioral2/memory/4060-68-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/5020-69-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023478-73.dat upx behavioral2/memory/4404-77-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/5020-75-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023479-79.dat upx behavioral2/memory/4404-82-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4996-83-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000700000002347a-86.dat upx behavioral2/files/0x000700000002347b-93.dat upx behavioral2/memory/3980-96-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000700000002347c-100.dat upx behavioral2/files/0x000800000002346b-107.dat upx behavioral2/memory/2112-111-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2324-110-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2324-104-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000700000002347d-114.dat upx behavioral2/memory/4596-103-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4596-98-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3980-91-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2112-119-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4908-117-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000700000002347e-123.dat upx behavioral2/files/0x000700000002347f-128.dat upx behavioral2/memory/3224-130-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3224-124-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/780-131-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4908-122-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4996-89-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023480-135.dat upx behavioral2/memory/780-137-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3612-139-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023481-142.dat upx behavioral2/memory/3612-145-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2152-146-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023482-150.dat upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5116 wrote to memory of 2396 5116 4b63ed76419bbd4a80cf2281c7344b227aabc39862bcab8f164cd13744299ae9.exe 84 PID 5116 wrote to memory of 2396 5116 4b63ed76419bbd4a80cf2281c7344b227aabc39862bcab8f164cd13744299ae9.exe 84 PID 5116 wrote to memory of 2396 5116 4b63ed76419bbd4a80cf2281c7344b227aabc39862bcab8f164cd13744299ae9.exe 84 PID 2396 wrote to memory of 4808 2396 tbbtnn.exe 85 PID 2396 wrote to memory of 4808 2396 tbbtnn.exe 85 PID 2396 wrote to memory of 4808 2396 tbbtnn.exe 85 PID 4808 wrote to memory of 2548 4808 vddjd.exe 86 PID 4808 wrote to memory of 2548 4808 vddjd.exe 86 PID 4808 wrote to memory of 2548 4808 vddjd.exe 86 PID 2548 wrote to memory of 4540 2548 lfffrrr.exe 87 PID 2548 wrote to memory of 4540 2548 lfffrrr.exe 87 PID 2548 wrote to memory of 4540 2548 lfffrrr.exe 87 PID 4540 wrote to memory of 440 4540 ffrlfxl.exe 88 PID 4540 wrote to memory of 440 4540 ffrlfxl.exe 88 PID 4540 wrote to memory of 440 4540 ffrlfxl.exe 88 PID 440 wrote to memory of 4020 440 bttnnn.exe 89 PID 440 wrote to memory of 4020 440 bttnnn.exe 89 PID 440 wrote to memory of 4020 440 bttnnn.exe 89 PID 4020 wrote to memory of 1612 4020 xrlfffx.exe 90 PID 4020 wrote to memory of 1612 4020 xrlfffx.exe 90 PID 4020 wrote to memory of 1612 4020 xrlfffx.exe 90 PID 1612 wrote to memory of 556 1612 nhhhbt.exe 91 PID 1612 wrote to memory of 556 1612 nhhhbt.exe 91 PID 1612 wrote to memory of 556 1612 nhhhbt.exe 91 PID 556 wrote to memory of 4060 556 lxrllff.exe 92 PID 556 wrote to memory of 4060 556 lxrllff.exe 92 PID 556 wrote to memory of 4060 556 lxrllff.exe 92 PID 4060 wrote to memory of 5020 4060 pjppd.exe 94 PID 4060 wrote to memory of 5020 4060 pjppd.exe 94 PID 4060 wrote to memory of 5020 4060 pjppd.exe 94 PID 5020 wrote to memory of 4404 5020 3vvpj.exe 96 PID 5020 wrote to memory of 4404 5020 3vvpj.exe 96 PID 5020 wrote to memory of 4404 5020 3vvpj.exe 96 PID 4404 wrote to memory of 4996 4404 5lffxxf.exe 97 PID 4404 wrote to memory of 4996 4404 5lffxxf.exe 97 PID 4404 wrote to memory of 4996 4404 5lffxxf.exe 97 PID 4996 wrote to memory of 3980 4996 htbtnn.exe 98 PID 4996 wrote to memory of 3980 4996 htbtnn.exe 98 PID 4996 wrote to memory of 3980 4996 htbtnn.exe 98 PID 3980 wrote to memory of 4596 3980 rlxxfxx.exe 99 PID 3980 wrote to memory of 4596 3980 rlxxfxx.exe 99 PID 3980 wrote to memory of 4596 3980 rlxxfxx.exe 99 PID 4596 wrote to memory of 2324 4596 3htntt.exe 100 PID 4596 wrote to memory of 2324 4596 3htntt.exe 100 PID 4596 wrote to memory of 2324 4596 3htntt.exe 100 PID 2324 wrote to memory of 2112 2324 1djdv.exe 101 PID 2324 wrote to memory of 2112 2324 1djdv.exe 101 PID 2324 wrote to memory of 2112 2324 1djdv.exe 101 PID 2112 wrote to memory of 4908 2112 frrrlfl.exe 102 PID 2112 wrote to memory of 4908 2112 frrrlfl.exe 102 PID 2112 wrote to memory of 4908 2112 frrrlfl.exe 102 PID 4908 wrote to memory of 3224 4908 ddvpd.exe 103 PID 4908 wrote to memory of 3224 4908 ddvpd.exe 103 PID 4908 wrote to memory of 3224 4908 ddvpd.exe 103 PID 3224 wrote to memory of 780 3224 5rfrxrl.exe 104 PID 3224 wrote to memory of 780 3224 5rfrxrl.exe 104 PID 3224 wrote to memory of 780 3224 5rfrxrl.exe 104 PID 780 wrote to memory of 3612 780 7hhbbb.exe 106 PID 780 wrote to memory of 3612 780 7hhbbb.exe 106 PID 780 wrote to memory of 3612 780 7hhbbb.exe 106 PID 3612 wrote to memory of 2152 3612 tttnhh.exe 107 PID 3612 wrote to memory of 2152 3612 tttnhh.exe 107 PID 3612 wrote to memory of 2152 3612 tttnhh.exe 107 PID 2152 wrote to memory of 2760 2152 llrlfrl.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b63ed76419bbd4a80cf2281c7344b227aabc39862bcab8f164cd13744299ae9.exe"C:\Users\Admin\AppData\Local\Temp\4b63ed76419bbd4a80cf2281c7344b227aabc39862bcab8f164cd13744299ae9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\tbbtnn.exec:\tbbtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\vddjd.exec:\vddjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\lfffrrr.exec:\lfffrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\ffrlfxl.exec:\ffrlfxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\bttnnn.exec:\bttnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\xrlfffx.exec:\xrlfffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\nhhhbt.exec:\nhhhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\lxrllff.exec:\lxrllff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\pjppd.exec:\pjppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\3vvpj.exec:\3vvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\5lffxxf.exec:\5lffxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\htbtnn.exec:\htbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\rlxxfxx.exec:\rlxxfxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\3htntt.exec:\3htntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\1djdv.exec:\1djdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\frrrlfl.exec:\frrrlfl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\ddvpd.exec:\ddvpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\5rfrxrl.exec:\5rfrxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\7hhbbb.exec:\7hhbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\tttnhh.exec:\tttnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\llrlfrl.exec:\llrlfrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\1ttttt.exec:\1ttttt.exe23⤵
- Executes dropped EXE
PID:2760 -
\??\c:\httnhh.exec:\httnhh.exe24⤵
- Executes dropped EXE
PID:752 -
\??\c:\pjppp.exec:\pjppp.exe25⤵
- Executes dropped EXE
PID:3484 -
\??\c:\ppvjd.exec:\ppvjd.exe26⤵
- Executes dropped EXE
PID:1620 -
\??\c:\vjpjj.exec:\vjpjj.exe27⤵
- Executes dropped EXE
PID:2800 -
\??\c:\flrrxff.exec:\flrrxff.exe28⤵
- Executes dropped EXE
PID:1992 -
\??\c:\nbnhbb.exec:\nbnhbb.exe29⤵
- Executes dropped EXE
PID:5104 -
\??\c:\bbnnnh.exec:\bbnnnh.exe30⤵
- Executes dropped EXE
PID:2000 -
\??\c:\vpjjp.exec:\vpjjp.exe31⤵
- Executes dropped EXE
PID:3812 -
\??\c:\llfxrrl.exec:\llfxrrl.exe32⤵
- Executes dropped EXE
PID:3676 -
\??\c:\3vvdd.exec:\3vvdd.exe33⤵
- Executes dropped EXE
PID:4900 -
\??\c:\hnthnb.exec:\hnthnb.exe34⤵
- Executes dropped EXE
PID:4992 -
\??\c:\5vppj.exec:\5vppj.exe35⤵
- Executes dropped EXE
PID:4580 -
\??\c:\9jdjj.exec:\9jdjj.exe36⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xfllfff.exec:\xfllfff.exe37⤵
- Executes dropped EXE
PID:2252 -
\??\c:\nbnnnn.exec:\nbnnnn.exe38⤵
- Executes dropped EXE
PID:1936 -
\??\c:\jvjjj.exec:\jvjjj.exe39⤵
- Executes dropped EXE
PID:3396 -
\??\c:\tnnnhb.exec:\tnnnhb.exe40⤵
- Executes dropped EXE
PID:4968 -
\??\c:\bbbbtb.exec:\bbbbtb.exe41⤵
- Executes dropped EXE
PID:3596 -
\??\c:\pvjdv.exec:\pvjdv.exe42⤵
- Executes dropped EXE
PID:2068 -
\??\c:\1flflll.exec:\1flflll.exe43⤵
- Executes dropped EXE
PID:2868 -
\??\c:\9bbbtt.exec:\9bbbtt.exe44⤵
- Executes dropped EXE
PID:3336 -
\??\c:\7btttt.exec:\7btttt.exe45⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jdddv.exec:\jdddv.exe46⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xlxxrrr.exec:\xlxxrrr.exe47⤵
- Executes dropped EXE
PID:4760 -
\??\c:\bthbtt.exec:\bthbtt.exe48⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jvdvp.exec:\jvdvp.exe49⤵
- Executes dropped EXE
PID:3748 -
\??\c:\fxxxxxx.exec:\fxxxxxx.exe50⤵
- Executes dropped EXE
PID:1820 -
\??\c:\tnbbbb.exec:\tnbbbb.exe51⤵
- Executes dropped EXE
PID:4388 -
\??\c:\vvdvd.exec:\vvdvd.exe52⤵
- Executes dropped EXE
PID:2940 -
\??\c:\7xllflf.exec:\7xllflf.exe53⤵
- Executes dropped EXE
PID:4916 -
\??\c:\llrlfff.exec:\llrlfff.exe54⤵
- Executes dropped EXE
PID:4160 -
\??\c:\3htnhh.exec:\3htnhh.exe55⤵
- Executes dropped EXE
PID:5044 -
\??\c:\thnntt.exec:\thnntt.exe56⤵
- Executes dropped EXE
PID:3460 -
\??\c:\pddvj.exec:\pddvj.exe57⤵
- Executes dropped EXE
PID:4216 -
\??\c:\hnhbhn.exec:\hnhbhn.exe58⤵
- Executes dropped EXE
PID:2824 -
\??\c:\pdppp.exec:\pdppp.exe59⤵
- Executes dropped EXE
PID:452 -
\??\c:\xrflfxr.exec:\xrflfxr.exe60⤵
- Executes dropped EXE
PID:4420 -
\??\c:\3nbbtt.exec:\3nbbtt.exe61⤵
- Executes dropped EXE
PID:1640 -
\??\c:\vvdjj.exec:\vvdjj.exe62⤵
- Executes dropped EXE
PID:4632 -
\??\c:\xrflfff.exec:\xrflfff.exe63⤵
- Executes dropped EXE
PID:4868 -
\??\c:\1nbbtb.exec:\1nbbtb.exe64⤵
- Executes dropped EXE
PID:3256 -
\??\c:\3thbtb.exec:\3thbtb.exe65⤵
- Executes dropped EXE
PID:3500 -
\??\c:\rlrlfrl.exec:\rlrlfrl.exe66⤵PID:2100
-
\??\c:\rxrrrrx.exec:\rxrrrrx.exe67⤵PID:1568
-
\??\c:\5nhhhh.exec:\5nhhhh.exe68⤵PID:5116
-
\??\c:\ddpjd.exec:\ddpjd.exe69⤵PID:5084
-
\??\c:\ppvvp.exec:\ppvvp.exe70⤵PID:5076
-
\??\c:\lflfxxx.exec:\lflfxxx.exe71⤵PID:1960
-
\??\c:\vpddv.exec:\vpddv.exe72⤵PID:5092
-
\??\c:\jvdvp.exec:\jvdvp.exe73⤵PID:1600
-
\??\c:\ffrrlff.exec:\ffrrlff.exe74⤵PID:3148
-
\??\c:\nnnnnh.exec:\nnnnnh.exe75⤵PID:2352
-
\??\c:\htnhbb.exec:\htnhbb.exe76⤵PID:1780
-
\??\c:\vjpjd.exec:\vjpjd.exe77⤵PID:2068
-
\??\c:\xxfffxx.exec:\xxfffxx.exe78⤵PID:4284
-
\??\c:\bhtnhb.exec:\bhtnhb.exe79⤵PID:3920
-
\??\c:\bthbtn.exec:\bthbtn.exe80⤵PID:512
-
\??\c:\pjjdv.exec:\pjjdv.exe81⤵PID:1944
-
\??\c:\xfrrfff.exec:\xfrrfff.exe82⤵PID:4996
-
\??\c:\bhnhbt.exec:\bhnhbt.exe83⤵PID:2268
-
\??\c:\dvvpj.exec:\dvvpj.exe84⤵PID:4092
-
\??\c:\lfxrllx.exec:\lfxrllx.exe85⤵PID:1820
-
\??\c:\nthhbb.exec:\nthhbb.exe86⤵PID:1672
-
\??\c:\vjppp.exec:\vjppp.exe87⤵PID:1916
-
\??\c:\pvvdj.exec:\pvvdj.exe88⤵PID:1208
-
\??\c:\xrffxxr.exec:\xrffxxr.exe89⤵PID:1856
-
\??\c:\hbnttt.exec:\hbnttt.exe90⤵PID:3908
-
\??\c:\nbtbtb.exec:\nbtbtb.exe91⤵PID:1816
-
\??\c:\dvddd.exec:\dvddd.exe92⤵PID:3132
-
\??\c:\xrxlfxr.exec:\xrxlfxr.exe93⤵PID:4216
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe94⤵PID:2224
-
\??\c:\nhntnn.exec:\nhntnn.exe95⤵PID:1572
-
\??\c:\nbbtnn.exec:\nbbtnn.exe96⤵PID:3784
-
\??\c:\ddjjj.exec:\ddjjj.exe97⤵PID:3612
-
\??\c:\dpdvd.exec:\dpdvd.exe98⤵PID:4480
-
\??\c:\5rlfxxr.exec:\5rlfxxr.exe99⤵PID:2620
-
\??\c:\bnbbtb.exec:\bnbbtb.exe100⤵PID:4680
-
\??\c:\bttnnn.exec:\bttnnn.exe101⤵PID:3380
-
\??\c:\1vdvv.exec:\1vdvv.exe102⤵PID:5004
-
\??\c:\xxllfff.exec:\xxllfff.exe103⤵PID:3060
-
\??\c:\lrffxxf.exec:\lrffxxf.exe104⤵PID:5000
-
\??\c:\ttnhnt.exec:\ttnhnt.exe105⤵PID:4632
-
\??\c:\7jppj.exec:\7jppj.exe106⤵PID:2664
-
\??\c:\ddppp.exec:\ddppp.exe107⤵PID:1624
-
\??\c:\3rfxrxr.exec:\3rfxrxr.exe108⤵PID:1040
-
\??\c:\xlrllrl.exec:\xlrllrl.exe109⤵PID:4408
-
\??\c:\hbbbbh.exec:\hbbbbh.exe110⤵PID:4900
-
\??\c:\9jjdv.exec:\9jjdv.exe111⤵PID:2400
-
\??\c:\fllfrxl.exec:\fllfrxl.exe112⤵PID:4540
-
\??\c:\frfxxxr.exec:\frfxxxr.exe113⤵PID:3228
-
\??\c:\nbhhbb.exec:\nbhhbb.exe114⤵PID:1008
-
\??\c:\vpppv.exec:\vpppv.exe115⤵PID:3416
-
\??\c:\7jvvp.exec:\7jvvp.exe116⤵PID:2580
-
\??\c:\rrxrfxf.exec:\rrxrfxf.exe117⤵PID:4240
-
\??\c:\bnbbnn.exec:\bnbbnn.exe118⤵PID:2068
-
\??\c:\tnthnt.exec:\tnthnt.exe119⤵PID:4224
-
\??\c:\frxrrrr.exec:\frxrrrr.exe120⤵PID:4676
-
\??\c:\xrrfrrx.exec:\xrrfrrx.exe121⤵PID:2156
-
\??\c:\hhtnbh.exec:\hhtnbh.exe122⤵PID:232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-