Analysis
- max time kernel
133s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
07/06/2024, 00:42
Behavioral task
behavioral1
Sample
6d6b89ad2ca7693d1610f0d822fd4bba7d0eac4eb3a0962e6a22c91a6d0e012d.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
- Target 6d6b89ad2ca7693d1610f0d822fd4bba7d0eac4eb3a0962e6a22c91a6d0e012d.exe
- Size 335KB
- Sample240607-a2kv4aff52
- SHA256 6d6b89ad2ca7693d1610f0d822fd4bba7d0eac4eb3a0962e6a22c91a6d0e012d
- MD5 68fb78e35c0fb0dd67724f242199870d
- SHA1 0a318454df1ce86134885f775a5a462bfa5a8425
- SHA512 50f8a4c803f46d295af2c31bf459686a9bda009ee7c0361c47bb1e173d7cd128117015a03a28746e604bc0761e89db01c99cc6627f7d5cc254f246b375bf2c2f
- SSDEEP 6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1i/S:x4wFHoS3eFaKHpv/VycgE8oS
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2848-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1252-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3008-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1856-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3788-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2904-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1340-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/380-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2128-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/512-795-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3848-803-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-708-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3680-704-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-673-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-646-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2524-606-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-596-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-586-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/984-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4440-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1320-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/724-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3320-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3084-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1944-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3464-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1320-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4572-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1264-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2952-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4984-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4748-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3164-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2172-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/688-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4328-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2464-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1988-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2784-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/2848-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2848-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000b0000000232f0-4.dat UPX behavioral2/files/0x000700000002340d-16.dat UPX behavioral2/files/0x000700000002340f-24.dat UPX behavioral2/memory/4836-31-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023412-42.dat UPX behavioral2/memory/2044-60-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023416-66.dat UPX behavioral2/files/0x0007000000023417-72.dat UPX behavioral2/files/0x0007000000023419-84.dat UPX behavioral2/files/0x000700000002341a-90.dat UPX behavioral2/memory/1252-89-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341b-96.dat UPX behavioral2/memory/3008-103-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2160-131-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023422-144.dat UPX behavioral2/memory/2844-154-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1856-156-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023425-161.dat UPX behavioral2/files/0x0007000000023427-169.dat UPX behavioral2/memory/3788-179-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2904-185-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0009000000023368-190.dat UPX behavioral2/memory/4292-208-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1340-218-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/380-284-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1884-288-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2128-311-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2308-366-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2848-390-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3696-413-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3700-420-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1448-569-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1884-610-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1796-744-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2356-771-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/512-795-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3848-803-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4892-813-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3708-799-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1944-788-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1480-781-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4900-767-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2872-757-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2888-722-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4672-718-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3672-708-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3680-704-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4484-673-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1516-663-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4968-653-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4300-646-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2160-627-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4064-617-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2524-606-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1204-596-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2044-586-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4756-579-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4836-559-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4388-537-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3424-506-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3316-496-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3636-486-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 2784 ttbttt.exe 1988 vpjdd.exe 2464 7rfxllr.exe 4328 nhttnn.exe 4836 pjjdv.exe 688 vppvp.exe 2172 rrrxrxx.exe 4540 nnhhht.exe 4976 nntbtt.exe 2044 jdjdv.exe 4960 lfxxrlf.exe 3540 nhhnhh.exe 3164 bttnhh.exe 1252 jvjjj.exe 2392 fflllrr.exe 4748 thhhbb.exe 3008 dddjp.exe 3036 vvvpv.exe 3836 1rxrllf.exe 2984 hhhbtt.exe 4984 pjdpj.exe 2160 5xfxxxr.exe 3264 1nnnhn.exe 1480 hhnhnn.exe 2844 vvvpj.exe 1856 7flllll.exe 3316 thnnhn.exe 3384 ddjdv.exe 3788 rflllll.exe 2904 xffxxrx.exe 4248 bbbnhn.exe 3592 pdjdv.exe 376 xlllxrl.exe 4024 9ntnhb.exe 2952 1hnhhn.exe 5028 dvddv.exe 4292 vvvpd.exe 832 lrrlfxr.exe 4020 ttttnh.exe 1340 hthbht.exe 4576 pjdvd.exe 2848 9xrrllf.exe 3808 lffxrrl.exe 4552 bnhbtt.exe 1524 ppvvj.exe 3672 xrxflll.exe 640 nnbtbt.exe 1264 vdjjp.exe 1448 lllfxxr.exe 4572 7btntt.exe 1644 hbhthb.exe 2328 vvppp.exe 4144 xllfxxr.exe 2332 lffxrlf.exe 3944 nnbbnn.exe 1320 nbttnt.exe 112 vjvjv.exe 1252 xrrlllf.exe 380 thnhhb.exe 1884 hhtnbb.exe 4620 pppdv.exe 3036 frllrlx.exe 3760 flrlllf.exe 3464 1ntnhb.exe -
resource yara_rule behavioral2/memory/2848-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2848-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b0000000232f0-4.dat upx behavioral2/files/0x000700000002340d-16.dat upx behavioral2/files/0x000700000002340f-24.dat upx behavioral2/memory/4836-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023412-42.dat upx behavioral2/memory/2044-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-66.dat upx behavioral2/files/0x0007000000023417-72.dat upx behavioral2/files/0x0007000000023419-84.dat upx behavioral2/files/0x000700000002341a-90.dat upx behavioral2/memory/1252-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341b-96.dat upx behavioral2/memory/3008-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2160-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023422-144.dat upx behavioral2/memory/2844-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1856-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-161.dat upx behavioral2/files/0x0007000000023427-169.dat upx behavioral2/memory/3788-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2904-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023368-190.dat upx behavioral2/memory/4292-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1340-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/380-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1884-288-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2128-311-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2308-366-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2848-390-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3696-413-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3700-420-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1448-569-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1884-610-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1796-744-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2356-771-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/512-795-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3848-803-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4892-813-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3708-799-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1944-788-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1480-781-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4900-767-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2872-757-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2888-722-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4672-718-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3672-708-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3680-704-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4484-673-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1516-663-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4968-653-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4300-646-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2160-627-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4064-617-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2524-606-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1204-596-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2044-586-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4756-579-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4836-559-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4388-537-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3424-506-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3316-496-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3636-486-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2784 2848 6d6b89ad2ca7693d1610f0d822fd4bba7d0eac4eb3a0962e6a22c91a6d0e012d.exe 269 PID 2848 wrote to memory of 2784 2848 6d6b89ad2ca7693d1610f0d822fd4bba7d0eac4eb3a0962e6a22c91a6d0e012d.exe 269 PID 2848 wrote to memory of 2784 2848 6d6b89ad2ca7693d1610f0d822fd4bba7d0eac4eb3a0962e6a22c91a6d0e012d.exe 269 PID 2784 wrote to memory of 1988 2784 ttbttt.exe 82 PID 2784 wrote to memory of 1988 2784 ttbttt.exe 82 PID 2784 wrote to memory of 1988 2784 ttbttt.exe 82 PID 1988 wrote to memory of 2464 1988 vpjdd.exe 83 PID 1988 wrote to memory of 2464 1988 vpjdd.exe 83 PID 1988 wrote to memory of 2464 1988 vpjdd.exe 83 PID 2464 wrote to memory of 4328 2464 7rfxllr.exe 85 PID 2464 wrote to memory of 4328 2464 7rfxllr.exe 85 PID 2464 wrote to memory of 4328 2464 7rfxllr.exe 85 PID 4328 wrote to memory of 4836 4328 nhttnn.exe 86 PID 4328 wrote to memory of 4836 4328 nhttnn.exe 86 PID 4328 wrote to memory of 4836 4328 nhttnn.exe 86 PID 4836 wrote to memory of 688 4836 pjjdv.exe 87 PID 4836 wrote to memory of 688 4836 pjjdv.exe 87 PID 4836 wrote to memory of 688 4836 pjjdv.exe 87 PID 688 wrote to memory of 2172 688 vppvp.exe 89 PID 688 wrote to memory of 2172 688 vppvp.exe 89 PID 688 wrote to memory of 2172 688 vppvp.exe 89 PID 2172 wrote to memory of 4540 2172 rrrxrxx.exe 90 PID 2172 wrote to memory of 4540 2172 rrrxrxx.exe 90 PID 2172 wrote to memory of 4540 2172 rrrxrxx.exe 90 PID 4540 wrote to memory of 4976 4540 nnhhht.exe 1125 PID 4540 wrote to memory of 4976 4540 nnhhht.exe 1125 PID 4540 wrote to memory of 4976 4540 nnhhht.exe 1125 PID 4976 wrote to memory of 2044 4976 nntbtt.exe 93 PID 4976 wrote to memory of 2044 4976 nntbtt.exe 93 PID 4976 wrote to memory of 2044 4976 nntbtt.exe 93 PID 2044 wrote to memory of 4960 2044 jdjdv.exe 94 PID 2044 wrote to memory of 4960 2044 jdjdv.exe 94 PID 2044 wrote to memory of 4960 2044 jdjdv.exe 94 PID 4960 wrote to memory of 3540 4960 lfxxrlf.exe 95 PID 4960 wrote to memory of 3540 4960 lfxxrlf.exe 95 PID 4960 wrote to memory of 3540 4960 lfxxrlf.exe 95 PID 3540 wrote to memory of 3164 3540 nhhnhh.exe 96 PID 3540 wrote to memory of 3164 3540 nhhnhh.exe 96 PID 3540 wrote to memory of 3164 3540 nhhnhh.exe 96 PID 3164 wrote to memory of 1252 3164 bttnhh.exe 97 PID 3164 wrote to memory of 1252 3164 bttnhh.exe 97 PID 3164 wrote to memory of 1252 3164 bttnhh.exe 97 PID 1252 wrote to memory of 2392 1252 jvjjj.exe 98 PID 1252 wrote to memory of 2392 1252 jvjjj.exe 98 PID 1252 wrote to memory of 2392 1252 jvjjj.exe 98 PID 2392 wrote to memory of 4748 2392 fflllrr.exe 99 PID 2392 wrote to memory of 4748 2392 fflllrr.exe 99 PID 2392 wrote to memory of 4748 2392 fflllrr.exe 99 PID 4748 wrote to memory of 3008 4748 thhhbb.exe 100 PID 4748 wrote to memory of 3008 4748 thhhbb.exe 100 PID 4748 wrote to memory of 3008 4748 thhhbb.exe 100 PID 3008 wrote to memory of 3036 3008 dddjp.exe 101 PID 3008 wrote to memory of 3036 3008 dddjp.exe 101 PID 3008 wrote to memory of 3036 3008 dddjp.exe 101 PID 3036 wrote to memory of 3836 3036 vvvpv.exe 102 PID 3036 wrote to memory of 3836 3036 vvvpv.exe 102 PID 3036 wrote to memory of 3836 3036 vvvpv.exe 102 PID 3836 wrote to memory of 2984 3836 1rxrllf.exe 103 PID 3836 wrote to memory of 2984 3836 1rxrllf.exe 103 PID 3836 wrote to memory of 2984 3836 1rxrllf.exe 103 PID 2984 wrote to memory of 4984 2984 hhhbtt.exe 104 PID 2984 wrote to memory of 4984 2984 hhhbtt.exe 104 PID 2984 wrote to memory of 4984 2984 hhhbtt.exe 104 PID 4984 wrote to memory of 2160 4984 pjdpj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d6b89ad2ca7693d1610f0d822fd4bba7d0eac4eb3a0962e6a22c91a6d0e012d.exe"C:\Users\Admin\AppData\Local\Temp\6d6b89ad2ca7693d1610f0d822fd4bba7d0eac4eb3a0962e6a22c91a6d0e012d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\ttbttt.exec:\ttbttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\vpjdd.exec:\vpjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\7rfxllr.exec:\7rfxllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\nhttnn.exec:\nhttnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\pjjdv.exec:\pjjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\vppvp.exec:\vppvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\rrrxrxx.exec:\rrrxrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\nnhhht.exec:\nnhhht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\nntbtt.exec:\nntbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\jdjdv.exec:\jdjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\lfxxrlf.exec:\lfxxrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\nhhnhh.exec:\nhhnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\bttnhh.exec:\bttnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\jvjjj.exec:\jvjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\fflllrr.exec:\fflllrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\thhhbb.exec:\thhhbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\dddjp.exec:\dddjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\vvvpv.exec:\vvvpv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\1rxrllf.exec:\1rxrllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\hhhbtt.exec:\hhhbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\pjdpj.exec:\pjdpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\5xfxxxr.exec:\5xfxxxr.exe23⤵
- Executes dropped EXE
PID:2160 -
\??\c:\1nnnhn.exec:\1nnnhn.exe24⤵
- Executes dropped EXE
PID:3264 -
\??\c:\hhnhnn.exec:\hhnhnn.exe25⤵
- Executes dropped EXE
PID:1480 -
\??\c:\vvvpj.exec:\vvvpj.exe26⤵
- Executes dropped EXE
PID:2844 -
\??\c:\7flllll.exec:\7flllll.exe27⤵
- Executes dropped EXE
PID:1856 -
\??\c:\thnnhn.exec:\thnnhn.exe28⤵
- Executes dropped EXE
PID:3316 -
\??\c:\ddjdv.exec:\ddjdv.exe29⤵
- Executes dropped EXE
PID:3384 -
\??\c:\rflllll.exec:\rflllll.exe30⤵
- Executes dropped EXE
PID:3788 -
\??\c:\xffxxrx.exec:\xffxxrx.exe31⤵
- Executes dropped EXE
PID:2904 -
\??\c:\bbbnhn.exec:\bbbnhn.exe32⤵
- Executes dropped EXE
PID:4248 -
\??\c:\pdjdv.exec:\pdjdv.exe33⤵
- Executes dropped EXE
PID:3592 -
\??\c:\xlllxrl.exec:\xlllxrl.exe34⤵
- Executes dropped EXE
PID:376 -
\??\c:\9ntnhb.exec:\9ntnhb.exe35⤵
- Executes dropped EXE
PID:4024 -
\??\c:\1hnhhn.exec:\1hnhhn.exe36⤵
- Executes dropped EXE
PID:2952 -
\??\c:\dvddv.exec:\dvddv.exe37⤵
- Executes dropped EXE
PID:5028 -
\??\c:\vvvpd.exec:\vvvpd.exe38⤵
- Executes dropped EXE
PID:4292 -
\??\c:\lrrlfxr.exec:\lrrlfxr.exe39⤵
- Executes dropped EXE
PID:832 -
\??\c:\ttttnh.exec:\ttttnh.exe40⤵
- Executes dropped EXE
PID:4020 -
\??\c:\hthbht.exec:\hthbht.exe41⤵
- Executes dropped EXE
PID:1340 -
\??\c:\pjdvd.exec:\pjdvd.exe42⤵
- Executes dropped EXE
PID:4576 -
\??\c:\9xrrllf.exec:\9xrrllf.exe43⤵
- Executes dropped EXE
PID:2848 -
\??\c:\lffxrrl.exec:\lffxrrl.exe44⤵
- Executes dropped EXE
PID:3808 -
\??\c:\bnhbtt.exec:\bnhbtt.exe45⤵
- Executes dropped EXE
PID:4552 -
\??\c:\ppvvj.exec:\ppvvj.exe46⤵
- Executes dropped EXE
PID:1524 -
\??\c:\xrxflll.exec:\xrxflll.exe47⤵
- Executes dropped EXE
PID:3672 -
\??\c:\nnbtbt.exec:\nnbtbt.exe48⤵
- Executes dropped EXE
PID:640 -
\??\c:\vdjjp.exec:\vdjjp.exe49⤵
- Executes dropped EXE
PID:1264 -
\??\c:\lllfxxr.exec:\lllfxxr.exe50⤵
- Executes dropped EXE
PID:1448 -
\??\c:\7btntt.exec:\7btntt.exe51⤵
- Executes dropped EXE
PID:4572 -
\??\c:\hbhthb.exec:\hbhthb.exe52⤵
- Executes dropped EXE
PID:1644 -
\??\c:\vvppp.exec:\vvppp.exe53⤵
- Executes dropped EXE
PID:2328 -
\??\c:\xllfxxr.exec:\xllfxxr.exe54⤵
- Executes dropped EXE
PID:4144 -
\??\c:\lffxrlf.exec:\lffxrlf.exe55⤵
- Executes dropped EXE
PID:2332 -
\??\c:\nnbbnn.exec:\nnbbnn.exe56⤵
- Executes dropped EXE
PID:3944 -
\??\c:\nbttnt.exec:\nbttnt.exe57⤵
- Executes dropped EXE
PID:1320 -
\??\c:\vjvjv.exec:\vjvjv.exe58⤵
- Executes dropped EXE
PID:112 -
\??\c:\xrrlllf.exec:\xrrlllf.exe59⤵
- Executes dropped EXE
PID:1252 -
\??\c:\thnhhb.exec:\thnhhb.exe60⤵
- Executes dropped EXE
PID:380 -
\??\c:\hhtnbb.exec:\hhtnbb.exe61⤵
- Executes dropped EXE
PID:1884 -
\??\c:\pppdv.exec:\pppdv.exe62⤵
- Executes dropped EXE
PID:4620 -
\??\c:\frllrlx.exec:\frllrlx.exe63⤵
- Executes dropped EXE
PID:3036 -
\??\c:\flrlllf.exec:\flrlllf.exe64⤵
- Executes dropped EXE
PID:3760 -
\??\c:\1ntnhb.exec:\1ntnhb.exe65⤵
- Executes dropped EXE
PID:3464 -
\??\c:\dpjvp.exec:\dpjvp.exe66⤵PID:432
-
\??\c:\dvvjv.exec:\dvvjv.exe67⤵PID:2128
-
\??\c:\xrllxxl.exec:\xrllxxl.exe68⤵PID:3476
-
\??\c:\9tbntt.exec:\9tbntt.exe69⤵PID:4988
-
\??\c:\thhhtn.exec:\thhhtn.exe70⤵PID:1156
-
\??\c:\7ppjd.exec:\7ppjd.exe71⤵PID:932
-
\??\c:\lllfrlr.exec:\lllfrlr.exe72⤵PID:1944
-
\??\c:\rlfrlxr.exec:\rlfrlxr.exe73⤵PID:1856
-
\??\c:\nttthn.exec:\nttthn.exe74⤵PID:4804
-
\??\c:\xlxxlll.exec:\xlxxlll.exe75⤵PID:4972
-
\??\c:\hhhbbb.exec:\hhhbbb.exe76⤵PID:4068
-
\??\c:\3vjdj.exec:\3vjdj.exe77⤵PID:3084
-
\??\c:\dvdpv.exec:\dvdpv.exe78⤵PID:1376
-
\??\c:\xrrlfxl.exec:\xrrlfxl.exe79⤵PID:2412
-
\??\c:\ffrfxfx.exec:\ffrfxfx.exe80⤵PID:3320
-
\??\c:\7btnhh.exec:\7btnhh.exe81⤵PID:3620
-
\??\c:\dvpjj.exec:\dvpjj.exe82⤵PID:4464
-
\??\c:\vpjdv.exec:\vpjdv.exe83⤵PID:724
-
\??\c:\5fxrlfx.exec:\5fxrlfx.exe84⤵PID:2308
-
\??\c:\hbbthb.exec:\hbbthb.exe85⤵PID:4812
-
\??\c:\btnbbh.exec:\btnbbh.exe86⤵PID:4588
-
\??\c:\dpjdp.exec:\dpjdp.exe87⤵PID:2624
-
\??\c:\pdjdv.exec:\pdjdv.exe88⤵PID:1360
-
\??\c:\lffxllf.exec:\lffxllf.exe89⤵PID:4412
-
\??\c:\fllfxxr.exec:\fllfxxr.exe90⤵PID:2848
-
\??\c:\5htntn.exec:\5htntn.exe91⤵PID:4660
-
\??\c:\hbnhnn.exec:\hbnhnn.exe92⤵PID:1656
-
\??\c:\9pvjv.exec:\9pvjv.exe93⤵PID:1604
-
\??\c:\3jdpd.exec:\3jdpd.exe94⤵PID:4280
-
\??\c:\xxrllfr.exec:\xxrllfr.exe95⤵PID:4084
-
\??\c:\1ffxrlf.exec:\1ffxrlf.exe96⤵PID:1472
-
\??\c:\bnbbbb.exec:\bnbbbb.exe97⤵PID:3696
-
\??\c:\hnhbnb.exec:\hnhbnb.exe98⤵PID:3208
-
\??\c:\7pjvp.exec:\7pjvp.exe99⤵PID:4684
-
\??\c:\dppjj.exec:\dppjj.exe100⤵PID:3700
-
\??\c:\rffrfxl.exec:\rffrfxl.exe101⤵PID:3600
-
\??\c:\7bthbt.exec:\7bthbt.exe102⤵PID:4612
-
\??\c:\vjjdp.exec:\vjjdp.exe103⤵PID:4144
-
\??\c:\1djjv.exec:\1djjv.exe104⤵PID:2332
-
\??\c:\7xrlfff.exec:\7xrlfff.exe105⤵PID:3944
-
\??\c:\tnnhtn.exec:\tnnhtn.exe106⤵PID:1320
-
\??\c:\thbtnn.exec:\thbtnn.exe107⤵PID:3376
-
\??\c:\vjjdp.exec:\vjjdp.exe108⤵PID:3348
-
\??\c:\jdjdd.exec:\jdjdd.exe109⤵PID:4440
-
\??\c:\ffrrffx.exec:\ffrrffx.exe110⤵PID:1596
-
\??\c:\llxxxxl.exec:\llxxxxl.exe111⤵PID:4928
-
\??\c:\hhnnnh.exec:\hhnnnh.exe112⤵PID:4356
-
\??\c:\9bthhh.exec:\9bthhh.exe113⤵PID:2984
-
\??\c:\3ddpp.exec:\3ddpp.exe114⤵PID:4516
-
\??\c:\1djdv.exec:\1djdv.exe115⤵PID:984
-
\??\c:\1fxrllf.exec:\1fxrllf.exe116⤵PID:5100
-
\??\c:\flrlfxr.exec:\flrlfxr.exe117⤵PID:2900
-
\??\c:\bhhbhb.exec:\bhhbhb.exe118⤵PID:3864
-
\??\c:\pvjvj.exec:\pvjvj.exe119⤵PID:2604
-
\??\c:\ddvdj.exec:\ddvdj.exe120⤵PID:3636
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe121⤵PID:4008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-