Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
06/06/2024, 08:45
Behavioral task
behavioral1
Sample
f96f6a02aa092aedcd6c966a771a47436fb4dddb71ad601861f0ccef3d489099.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
f96f6a02aa092aedcd6c966a771a47436fb4dddb71ad601861f0ccef3d489099.exe
-
Size
381KB
-
MD5
1e594285a6c8af80156e094b46df9886
-
SHA1
96ba9aa37f4e56ac3de392805463e726f664c027
-
SHA256
f96f6a02aa092aedcd6c966a771a47436fb4dddb71ad601861f0ccef3d489099
-
SHA512
47d58e4eb917a97a7fdca75077238969a41bbbda99129f2f4b64cb6bf0c28bbf456ee0022539003481a20af68c6436c1918ad6880bc2681879f33a01044fb2ef
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpSwp9OD0IbswYTOZ:y4wFHoS3eFaKHpNKbbsweOZ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2284-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/820-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1188-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4684-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1448-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1740-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2652-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4696-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1540-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1972-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2116-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1308-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2264-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/528-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2864-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1036-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2232-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1904-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4684-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1972-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1380-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3704-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2264-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1556-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3044-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3272-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4160-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/448-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-475-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3184-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-501-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2384-511-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-570-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-577-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4676-687-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3104-706-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4984-722-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-840-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/2284-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0008000000022f51-3.dat UPX behavioral2/memory/2284-9-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/452-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2300-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002340d-12.dat UPX behavioral2/files/0x000700000002340e-14.dat UPX behavioral2/memory/2300-19-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/820-20-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3180-26-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023410-30.dat UPX behavioral2/files/0x000700000002340f-25.dat UPX behavioral2/files/0x0007000000023411-34.dat UPX behavioral2/memory/1188-38-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023412-41.dat UPX behavioral2/memory/4684-43-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4728-39-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023413-47.dat UPX behavioral2/memory/4684-49-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023414-53.dat UPX behavioral2/memory/1448-55-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023416-59.dat UPX behavioral2/memory/1740-64-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023417-66.dat UPX behavioral2/memory/2652-70-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4696-65-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023418-73.dat UPX behavioral2/memory/1540-75-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023419-78.dat UPX behavioral2/files/0x000700000002341a-86.dat UPX behavioral2/memory/4628-84-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341b-90.dat UPX behavioral2/files/0x000800000002340a-94.dat UPX behavioral2/files/0x000700000002341c-101.dat UPX behavioral2/files/0x000700000002341d-106.dat UPX behavioral2/memory/1972-111-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341f-117.dat UPX behavioral2/files/0x0007000000023420-123.dat UPX behavioral2/files/0x0007000000023421-128.dat UPX behavioral2/memory/3868-131-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4852-130-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2116-119-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023422-134.dat UPX behavioral2/memory/3132-137-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341e-113.dat UPX behavioral2/files/0x0007000000023423-141.dat UPX behavioral2/files/0x0007000000023424-145.dat UPX behavioral2/memory/4612-93-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023425-151.dat UPX behavioral2/memory/2076-152-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023426-156.dat UPX behavioral2/memory/3696-159-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023427-162.dat UPX behavioral2/memory/3696-165-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023428-168.dat UPX behavioral2/memory/1308-170-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023429-174.dat UPX behavioral2/memory/4008-177-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342a-180.dat UPX behavioral2/files/0x000700000002342b-185.dat UPX behavioral2/memory/4988-187-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4964-192-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2264-193-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/528-201-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 452 5dpjd.exe 2300 xrxlfxr.exe 820 djpvv.exe 3180 vdvpv.exe 1188 fxfxrlf.exe 4728 pjpjd.exe 4684 rfllxxx.exe 1448 flrrrrr.exe 1740 ppjjd.exe 4696 bntnnn.exe 2652 hbnhtt.exe 1540 vpppd.exe 4628 thbbbb.exe 4540 pddpj.exe 4612 nhhhhh.exe 3816 7vjjv.exe 3464 xfffrrl.exe 1972 7bttnt.exe 4652 ppddv.exe 2116 7lxrlxx.exe 4852 ttntbn.exe 3868 3vpdj.exe 3132 1vdvj.exe 3028 5xfxllr.exe 3108 hhbbbt.exe 2076 jvvvd.exe 3696 tnttnt.exe 1308 xrfxrrl.exe 3368 bhhbbb.exe 4008 xrrfrfl.exe 4988 nnbtth.exe 4964 rffxllf.exe 2264 vjjpp.exe 528 pppvv.exe 3540 ffrrxlr.exe 4764 bbbhhh.exe 4524 pjjjv.exe 2864 xrfffll.exe 968 rfrrxll.exe 1036 5nbhth.exe 2232 ppvvd.exe 3872 vvvvd.exe 1548 xxxfllx.exe 4736 bntbbh.exe 1904 dvvdd.exe 4444 vvjjj.exe 4684 fffllrr.exe 3588 btnntb.exe 1740 nhhhhn.exe 3260 3djjd.exe 744 lrffflx.exe 548 xrrxxxf.exe 1540 tttbtb.exe 4848 ntnnnt.exe 4716 ddjpd.exe 2928 flxxrxl.exe 5012 lxrrxxx.exe 2224 bnnhnh.exe 1972 jvppv.exe 5036 jvjpp.exe 4160 lfrflrx.exe 1364 nbhhnt.exe 1380 ttnnhn.exe 4952 djddv.exe -
resource yara_rule behavioral2/memory/2284-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022f51-3.dat upx behavioral2/memory/2284-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/452-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2300-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340d-12.dat upx behavioral2/files/0x000700000002340e-14.dat upx behavioral2/memory/2300-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/820-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3180-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023410-30.dat upx behavioral2/files/0x000700000002340f-25.dat upx behavioral2/files/0x0007000000023411-34.dat upx behavioral2/memory/1188-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023412-41.dat upx behavioral2/memory/4684-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4728-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023413-47.dat upx behavioral2/memory/4684-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023414-53.dat upx behavioral2/memory/1448-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-59.dat upx behavioral2/memory/1740-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023417-66.dat upx behavioral2/memory/2652-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4696-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023418-73.dat upx behavioral2/memory/1540-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023419-78.dat upx behavioral2/files/0x000700000002341a-86.dat upx behavioral2/memory/4628-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341b-90.dat upx behavioral2/files/0x000800000002340a-94.dat upx behavioral2/files/0x000700000002341c-101.dat upx behavioral2/files/0x000700000002341d-106.dat upx behavioral2/memory/1972-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341f-117.dat upx behavioral2/files/0x0007000000023420-123.dat upx behavioral2/files/0x0007000000023421-128.dat upx behavioral2/memory/3868-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4852-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2116-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023422-134.dat upx behavioral2/memory/3132-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341e-113.dat upx behavioral2/files/0x0007000000023423-141.dat upx behavioral2/files/0x0007000000023424-145.dat upx behavioral2/memory/4612-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-151.dat upx behavioral2/memory/2076-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-156.dat upx behavioral2/memory/3696-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023427-162.dat upx behavioral2/memory/3696-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-168.dat upx behavioral2/memory/1308-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023429-174.dat upx behavioral2/memory/4008-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-180.dat upx behavioral2/files/0x000700000002342b-185.dat upx behavioral2/memory/4988-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4964-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2264-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/528-201-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2284 wrote to memory of 452 2284 f96f6a02aa092aedcd6c966a771a47436fb4dddb71ad601861f0ccef3d489099.exe 82 PID 2284 wrote to memory of 452 2284 f96f6a02aa092aedcd6c966a771a47436fb4dddb71ad601861f0ccef3d489099.exe 82 PID 2284 wrote to memory of 452 2284 f96f6a02aa092aedcd6c966a771a47436fb4dddb71ad601861f0ccef3d489099.exe 82 PID 452 wrote to memory of 2300 452 5dpjd.exe 83 PID 452 wrote to memory of 2300 452 5dpjd.exe 83 PID 452 wrote to memory of 2300 452 5dpjd.exe 83 PID 2300 wrote to memory of 820 2300 xrxlfxr.exe 84 PID 2300 wrote to memory of 820 2300 xrxlfxr.exe 84 PID 2300 wrote to memory of 820 2300 xrxlfxr.exe 84 PID 820 wrote to memory of 3180 820 djpvv.exe 85 PID 820 wrote to memory of 3180 820 djpvv.exe 85 PID 820 wrote to memory of 3180 820 djpvv.exe 85 PID 3180 wrote to memory of 1188 3180 vdvpv.exe 86 PID 3180 wrote to memory of 1188 3180 vdvpv.exe 86 PID 3180 wrote to memory of 1188 3180 vdvpv.exe 86 PID 1188 wrote to memory of 4728 1188 fxfxrlf.exe 87 PID 1188 wrote to memory of 4728 1188 fxfxrlf.exe 87 PID 1188 wrote to memory of 4728 1188 fxfxrlf.exe 87 PID 4728 wrote to memory of 4684 4728 pjpjd.exe 88 PID 4728 wrote to memory of 4684 4728 pjpjd.exe 88 PID 4728 wrote to memory of 4684 4728 pjpjd.exe 88 PID 4684 wrote to memory of 1448 4684 rfllxxx.exe 89 PID 4684 wrote to memory of 1448 4684 rfllxxx.exe 89 PID 4684 wrote to memory of 1448 4684 rfllxxx.exe 89 PID 1448 wrote to memory of 1740 1448 flrrrrr.exe 91 PID 1448 wrote to memory of 1740 1448 flrrrrr.exe 91 PID 1448 wrote to memory of 1740 1448 flrrrrr.exe 91 PID 1740 wrote to memory of 4696 1740 ppjjd.exe 92 PID 1740 wrote to memory of 4696 1740 ppjjd.exe 92 PID 1740 wrote to memory of 4696 1740 ppjjd.exe 92 PID 4696 wrote to memory of 2652 4696 bntnnn.exe 93 PID 4696 wrote to memory of 2652 4696 bntnnn.exe 93 PID 4696 wrote to memory of 2652 4696 bntnnn.exe 93 PID 2652 wrote to memory of 1540 2652 hbnhtt.exe 139 PID 2652 wrote to memory of 1540 2652 hbnhtt.exe 139 PID 2652 wrote to memory of 1540 2652 hbnhtt.exe 139 PID 1540 wrote to memory of 4628 1540 vpppd.exe 95 PID 1540 wrote to memory of 4628 1540 vpppd.exe 95 PID 1540 wrote to memory of 4628 1540 vpppd.exe 95 PID 4628 wrote to memory of 4540 4628 thbbbb.exe 96 PID 4628 wrote to memory of 4540 4628 thbbbb.exe 96 PID 4628 wrote to memory of 4540 4628 thbbbb.exe 96 PID 4540 wrote to memory of 4612 4540 pddpj.exe 97 PID 4540 wrote to memory of 4612 4540 pddpj.exe 97 PID 4540 wrote to memory of 4612 4540 pddpj.exe 97 PID 4612 wrote to memory of 3816 4612 nhhhhh.exe 98 PID 4612 wrote to memory of 3816 4612 nhhhhh.exe 98 PID 4612 wrote to memory of 3816 4612 nhhhhh.exe 98 PID 3816 wrote to memory of 3464 3816 7vjjv.exe 99 PID 3816 wrote to memory of 3464 3816 7vjjv.exe 99 PID 3816 wrote to memory of 3464 3816 7vjjv.exe 99 PID 3464 wrote to memory of 1972 3464 xfffrrl.exe 145 PID 3464 wrote to memory of 1972 3464 xfffrrl.exe 145 PID 3464 wrote to memory of 1972 3464 xfffrrl.exe 145 PID 1972 wrote to memory of 4652 1972 7bttnt.exe 101 PID 1972 wrote to memory of 4652 1972 7bttnt.exe 101 PID 1972 wrote to memory of 4652 1972 7bttnt.exe 101 PID 4652 wrote to memory of 2116 4652 ppddv.exe 102 PID 4652 wrote to memory of 2116 4652 ppddv.exe 102 PID 4652 wrote to memory of 2116 4652 ppddv.exe 102 PID 2116 wrote to memory of 4852 2116 7lxrlxx.exe 103 PID 2116 wrote to memory of 4852 2116 7lxrlxx.exe 103 PID 2116 wrote to memory of 4852 2116 7lxrlxx.exe 103 PID 4852 wrote to memory of 3868 4852 ttntbn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\f96f6a02aa092aedcd6c966a771a47436fb4dddb71ad601861f0ccef3d489099.exe"C:\Users\Admin\AppData\Local\Temp\f96f6a02aa092aedcd6c966a771a47436fb4dddb71ad601861f0ccef3d489099.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\5dpjd.exec:\5dpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\xrxlfxr.exec:\xrxlfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\djpvv.exec:\djpvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\vdvpv.exec:\vdvpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\pjpjd.exec:\pjpjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\rfllxxx.exec:\rfllxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\flrrrrr.exec:\flrrrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\ppjjd.exec:\ppjjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\bntnnn.exec:\bntnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\hbnhtt.exec:\hbnhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vpppd.exec:\vpppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\thbbbb.exec:\thbbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\pddpj.exec:\pddpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\nhhhhh.exec:\nhhhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\7vjjv.exec:\7vjjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\xfffrrl.exec:\xfffrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\7bttnt.exec:\7bttnt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\ppddv.exec:\ppddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\7lxrlxx.exec:\7lxrlxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\ttntbn.exec:\ttntbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\3vpdj.exec:\3vpdj.exe23⤵
- Executes dropped EXE
PID:3868 -
\??\c:\1vdvj.exec:\1vdvj.exe24⤵
- Executes dropped EXE
PID:3132 -
\??\c:\5xfxllr.exec:\5xfxllr.exe25⤵
- Executes dropped EXE
PID:3028 -
\??\c:\hhbbbt.exec:\hhbbbt.exe26⤵
- Executes dropped EXE
PID:3108 -
\??\c:\jvvvd.exec:\jvvvd.exe27⤵
- Executes dropped EXE
PID:2076 -
\??\c:\tnttnt.exec:\tnttnt.exe28⤵
- Executes dropped EXE
PID:3696 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe29⤵
- Executes dropped EXE
PID:1308 -
\??\c:\bhhbbb.exec:\bhhbbb.exe30⤵
- Executes dropped EXE
PID:3368 -
\??\c:\xrrfrfl.exec:\xrrfrfl.exe31⤵
- Executes dropped EXE
PID:4008 -
\??\c:\nnbtth.exec:\nnbtth.exe32⤵
- Executes dropped EXE
PID:4988 -
\??\c:\rffxllf.exec:\rffxllf.exe33⤵
- Executes dropped EXE
PID:4964 -
\??\c:\vjjpp.exec:\vjjpp.exe34⤵
- Executes dropped EXE
PID:2264 -
\??\c:\pppvv.exec:\pppvv.exe35⤵
- Executes dropped EXE
PID:528 -
\??\c:\ffrrxlr.exec:\ffrrxlr.exe36⤵
- Executes dropped EXE
PID:3540 -
\??\c:\bbbhhh.exec:\bbbhhh.exe37⤵
- Executes dropped EXE
PID:4764 -
\??\c:\pjjjv.exec:\pjjjv.exe38⤵
- Executes dropped EXE
PID:4524 -
\??\c:\xrfffll.exec:\xrfffll.exe39⤵
- Executes dropped EXE
PID:2864 -
\??\c:\rfrrxll.exec:\rfrrxll.exe40⤵
- Executes dropped EXE
PID:968 -
\??\c:\5nbhth.exec:\5nbhth.exe41⤵
- Executes dropped EXE
PID:1036 -
\??\c:\ppvvd.exec:\ppvvd.exe42⤵
- Executes dropped EXE
PID:2232 -
\??\c:\vvvvd.exec:\vvvvd.exe43⤵
- Executes dropped EXE
PID:3872 -
\??\c:\xxxfllx.exec:\xxxfllx.exe44⤵
- Executes dropped EXE
PID:1548 -
\??\c:\bntbbh.exec:\bntbbh.exe45⤵
- Executes dropped EXE
PID:4736 -
\??\c:\dvvdd.exec:\dvvdd.exe46⤵
- Executes dropped EXE
PID:1904 -
\??\c:\vvjjj.exec:\vvjjj.exe47⤵
- Executes dropped EXE
PID:4444 -
\??\c:\fffllrr.exec:\fffllrr.exe48⤵
- Executes dropped EXE
PID:4684 -
\??\c:\btnntb.exec:\btnntb.exe49⤵
- Executes dropped EXE
PID:3588 -
\??\c:\nhhhhn.exec:\nhhhhn.exe50⤵
- Executes dropped EXE
PID:1740 -
\??\c:\3djjd.exec:\3djjd.exe51⤵
- Executes dropped EXE
PID:3260 -
\??\c:\lrffflx.exec:\lrffflx.exe52⤵
- Executes dropped EXE
PID:744 -
\??\c:\xrrxxxf.exec:\xrrxxxf.exe53⤵
- Executes dropped EXE
PID:548 -
\??\c:\tttbtb.exec:\tttbtb.exe54⤵
- Executes dropped EXE
PID:1540 -
\??\c:\ntnnnt.exec:\ntnnnt.exe55⤵
- Executes dropped EXE
PID:4848 -
\??\c:\ddjpd.exec:\ddjpd.exe56⤵
- Executes dropped EXE
PID:4716 -
\??\c:\flxxrxl.exec:\flxxrxl.exe57⤵
- Executes dropped EXE
PID:2928 -
\??\c:\lxrrxxx.exec:\lxrrxxx.exe58⤵
- Executes dropped EXE
PID:5012 -
\??\c:\bnnhnh.exec:\bnnhnh.exe59⤵
- Executes dropped EXE
PID:2224 -
\??\c:\jvppv.exec:\jvppv.exe60⤵
- Executes dropped EXE
PID:1972 -
\??\c:\jvjpp.exec:\jvjpp.exe61⤵
- Executes dropped EXE
PID:5036 -
\??\c:\lfrflrx.exec:\lfrflrx.exe62⤵
- Executes dropped EXE
PID:4160 -
\??\c:\nbhhnt.exec:\nbhhnt.exe63⤵
- Executes dropped EXE
PID:1364 -
\??\c:\ttnnhn.exec:\ttnnhn.exe64⤵
- Executes dropped EXE
PID:1380 -
\??\c:\djddv.exec:\djddv.exe65⤵
- Executes dropped EXE
PID:4952 -
\??\c:\lxllrxx.exec:\lxllrxx.exe66⤵PID:2380
-
\??\c:\hbnnnt.exec:\hbnnnt.exe67⤵PID:3704
-
\??\c:\9thhtb.exec:\9thhtb.exe68⤵PID:3132
-
\??\c:\9pvvv.exec:\9pvvv.exe69⤵PID:2776
-
\??\c:\5lrrxxx.exec:\5lrrxxx.exe70⤵PID:1244
-
\??\c:\7rrrlrr.exec:\7rrrlrr.exe71⤵PID:3156
-
\??\c:\nttnhh.exec:\nttnhh.exe72⤵PID:1292
-
\??\c:\vjvvd.exec:\vjvvd.exe73⤵PID:5044
-
\??\c:\xlxxxxx.exec:\xlxxxxx.exe74⤵PID:3168
-
\??\c:\hhbbbb.exec:\hhbbbb.exe75⤵PID:1852
-
\??\c:\thnttt.exec:\thnttt.exe76⤵PID:4984
-
\??\c:\ddvvj.exec:\ddvvj.exe77⤵PID:3576
-
\??\c:\rrlfrxx.exec:\rrlfrxx.exe78⤵PID:4008
-
\??\c:\fxfxfrx.exec:\fxfxfrx.exe79⤵PID:4988
-
\??\c:\hnhhnb.exec:\hnhhnb.exe80⤵PID:3084
-
\??\c:\ddjjj.exec:\ddjjj.exe81⤵PID:2264
-
\??\c:\vjvdp.exec:\vjvdp.exe82⤵PID:1860
-
\??\c:\bhhhhn.exec:\bhhhhn.exe83⤵PID:2820
-
\??\c:\ddjpv.exec:\ddjpv.exe84⤵PID:1556
-
\??\c:\7jjpj.exec:\7jjpj.exe85⤵PID:2540
-
\??\c:\7rxfxfx.exec:\7rxfxfx.exe86⤵PID:672
-
\??\c:\nhnnnt.exec:\nhnnnt.exe87⤵PID:3404
-
\??\c:\btbbhn.exec:\btbbhn.exe88⤵PID:4736
-
\??\c:\dvjjd.exec:\dvjjd.exe89⤵PID:1840
-
\??\c:\rrffllr.exec:\rrffllr.exe90⤵PID:4452
-
\??\c:\lfrxxff.exec:\lfrxxff.exe91⤵PID:3044
-
\??\c:\bbbbhn.exec:\bbbbhn.exe92⤵PID:2104
-
\??\c:\ppdjj.exec:\ppdjj.exe93⤵PID:1444
-
\??\c:\rflllrx.exec:\rflllrx.exe94⤵PID:4656
-
\??\c:\rlfffff.exec:\rlfffff.exe95⤵PID:640
-
\??\c:\jvddd.exec:\jvddd.exe96⤵PID:1580
-
\??\c:\9ffrxrx.exec:\9ffrxrx.exe97⤵PID:4540
-
\??\c:\1hbtnn.exec:\1hbtnn.exe98⤵PID:3272
-
\??\c:\hhbnbh.exec:\hhbnbh.exe99⤵PID:3816
-
\??\c:\xxlllll.exec:\xxlllll.exe100⤵PID:4708
-
\??\c:\rxllllx.exec:\rxllllx.exe101⤵PID:2212
-
\??\c:\tbhhbt.exec:\tbhhbt.exe102⤵PID:1972
-
\??\c:\dvddd.exec:\dvddd.exe103⤵PID:5036
-
\??\c:\3lrrllx.exec:\3lrrllx.exe104⤵PID:4160
-
\??\c:\fxlrlrr.exec:\fxlrlrr.exe105⤵PID:1364
-
\??\c:\btbbtb.exec:\btbbtb.exe106⤵PID:3428
-
\??\c:\xrfxrrf.exec:\xrfxrrf.exe107⤵PID:2868
-
\??\c:\btbbtt.exec:\btbbtt.exe108⤵PID:4940
-
\??\c:\lllrxfr.exec:\lllrxfr.exe109⤵PID:3704
-
\??\c:\djppj.exec:\djppj.exe110⤵PID:2296
-
\??\c:\ppvvd.exec:\ppvvd.exe111⤵PID:3108
-
\??\c:\1llfxxr.exec:\1llfxxr.exe112⤵PID:1304
-
\??\c:\bhnnhn.exec:\bhnnhn.exe113⤵PID:448
-
\??\c:\vjppj.exec:\vjppj.exe114⤵PID:3820
-
\??\c:\rlrrxll.exec:\rlrrxll.exe115⤵PID:5044
-
\??\c:\hntnbt.exec:\hntnbt.exe116⤵PID:3168
-
\??\c:\djppp.exec:\djppp.exe117⤵PID:1852
-
\??\c:\rfxxrxf.exec:\rfxxrxf.exe118⤵PID:4556
-
\??\c:\htbtnn.exec:\htbtnn.exe119⤵PID:4244
-
\??\c:\jddvp.exec:\jddvp.exe120⤵PID:4008
-
\??\c:\jpdvv.exec:\jpdvv.exe121⤵PID:3184
-
\??\c:\lflxxrr.exec:\lflxxrr.exe122⤵PID:2404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-