Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
07/06/2024, 08:50
Behavioral task
behavioral1
Sample
eb9dae260b3c0771c977cf20fe825a74731b47fd938ec333f2d2262039d00f63.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
- Target eb9dae260b3c0771c977cf20fe825a74731b47fd938ec333f2d2262039d00f63.exe
- Size 368KB
- Sample240607-krml2seh29
- SHA256 eb9dae260b3c0771c977cf20fe825a74731b47fd938ec333f2d2262039d00f63
- MD5 d909a38ccb5529ae851968bd9e96325d
- SHA1 6a168fd73b2aa9f3e7dc77f90e69e8c5a9cbd379
- SHA512 b43c0ba81ad65578823fe6b7346537352de3090a429b8a7e69557f18601aed9e7765caedee243427acdf996662541d8a046f768496eb98f3c20e17fb0cbf14de
- SSDEEP 6144:kcm4FmowdHoSphraHcpOFltH4tiAlSpgFZAzwdjcIlSpgFZZr3GSM/xN:y4wFHoS3eFplAlSpgFZAKjcIlSpgFZZM
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3128-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/460-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4696-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2828-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3204-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2196-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1592-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/804-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1708-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4472-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3904-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1100-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/540-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4652-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1472-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4040-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2196-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4100-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1984-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2236-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4448-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/228-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3116-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4756-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5072-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3112-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4472-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2320-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1824-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3168-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3796-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/628-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3092-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-617-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2228-630-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-613-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/3128-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000b00000002340f-3.dat UPX behavioral2/memory/3128-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3808-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0008000000023437-11.dat UPX behavioral2/files/0x000700000002343b-13.dat UPX behavioral2/files/0x000700000002343c-24.dat UPX behavioral2/memory/460-23-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/460-19-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002343e-30.dat UPX behavioral2/memory/1588-29-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023440-42.dat UPX behavioral2/files/0x0007000000023442-52.dat UPX behavioral2/memory/4696-55-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023443-60.dat UPX behavioral2/memory/4960-65-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023444-66.dat UPX behavioral2/files/0x0007000000023445-72.dat UPX behavioral2/files/0x0007000000023446-75.dat UPX behavioral2/memory/2352-80-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023448-90.dat UPX behavioral2/memory/2572-97-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023449-96.dat UPX behavioral2/memory/4716-104-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002344b-108.dat UPX behavioral2/memory/4496-119-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4908-126-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002344f-124.dat UPX behavioral2/files/0x000700000002344d-120.dat UPX behavioral2/files/0x000700000002344c-114.dat UPX behavioral2/memory/2828-113-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023451-141.dat UPX behavioral2/files/0x0007000000023454-159.dat UPX behavioral2/memory/4756-166-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023456-172.dat UPX behavioral2/files/0x000c0000000233a0-182.dat UPX behavioral2/files/0x0007000000023458-188.dat UPX behavioral2/memory/5044-192-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3696-196-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3204-200-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2196-207-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1592-210-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/804-231-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5028-242-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3624-249-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1708-263-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5060-273-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5116-272-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5092-284-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4472-334-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2656-352-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3904-365-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1100-372-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1612-424-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/540-428-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4652-420-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1472-465-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4040-392-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2196-382-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1476-361-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3956-356-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4972-342-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4100-338-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1984-312-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 3808 3pjjd.exe 1884 jdpjj.exe 460 frlfflf.exe 1588 nhhbtb.exe 628 tttnbt.exe 3796 ppvjj.exe 1612 1ppdv.exe 3168 xflfrrl.exe 4696 bthtbt.exe 4960 hbhbtn.exe 2756 lllfxrl.exe 1824 tnhbtn.exe 2352 jjvpj.exe 2320 rllrlrf.exe 1768 nnbthb.exe 2572 jdvpd.exe 4716 xlfrfxl.exe 2828 rlrfrfl.exe 4496 7tnhbt.exe 4908 jvjvp.exe 3184 fllxlfx.exe 2188 bhbtnn.exe 4472 jpddd.exe 3112 pvdpd.exe 996 7lfxrrl.exe 1428 ttbtbt.exe 5072 jppjv.exe 4756 ddddv.exe 4384 lxfxxxr.exe 3400 hbtnhh.exe 3116 ddvpd.exe 5044 flrrrrl.exe 3696 fffffxx.exe 5084 rxxrllf.exe 3204 7bbtnh.exe 2196 nbhbtn.exe 1592 vpddd.exe 228 xrxrrrr.exe 4432 nbhthb.exe 4448 bthbtt.exe 5040 dpvvp.exe 1804 xfrlfff.exe 804 hbnbbt.exe 3476 nhhbhn.exe 3604 jvdvp.exe 5028 rlllflf.exe 456 xxxrrll.exe 3624 tnttnn.exe 1676 jpvvj.exe 2236 jvvpp.exe 2504 lxfxxxx.exe 1708 ffxrllf.exe 5008 nbnhtt.exe 4528 jpjvp.exe 5116 xxflfxl.exe 5060 llrlrlr.exe 4568 nttntn.exe 1076 pjpjj.exe 5092 1llxllx.exe 4208 lrxxrlf.exe 516 nbnbht.exe 4952 hhhhtn.exe 2572 jvddv.exe 2568 xfxrllx.exe -
resource yara_rule behavioral2/memory/3128-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b00000002340f-3.dat upx behavioral2/memory/3128-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3808-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023437-11.dat upx behavioral2/files/0x000700000002343b-13.dat upx behavioral2/files/0x000700000002343c-24.dat upx behavioral2/memory/460-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/460-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343e-30.dat upx behavioral2/memory/1588-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023440-42.dat upx behavioral2/files/0x0007000000023442-52.dat upx behavioral2/memory/4696-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023443-60.dat upx behavioral2/memory/4960-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023444-66.dat upx behavioral2/files/0x0007000000023445-72.dat upx behavioral2/files/0x0007000000023446-75.dat upx behavioral2/memory/2352-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023448-90.dat upx behavioral2/memory/2572-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023449-96.dat upx behavioral2/memory/4716-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344b-108.dat upx behavioral2/memory/4496-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4908-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344f-124.dat upx behavioral2/files/0x000700000002344d-120.dat upx behavioral2/files/0x000700000002344c-114.dat upx behavioral2/memory/2828-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023451-141.dat upx behavioral2/files/0x0007000000023454-159.dat upx behavioral2/memory/4756-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023456-172.dat upx behavioral2/files/0x000c0000000233a0-182.dat upx behavioral2/files/0x0007000000023458-188.dat upx behavioral2/memory/5044-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3696-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3204-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2196-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1592-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/804-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5028-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3624-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1708-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5060-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5116-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5092-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4472-334-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2656-352-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3904-365-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1100-372-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1612-424-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/540-428-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4652-420-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1472-465-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4040-392-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2196-382-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1476-361-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3956-356-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4972-342-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4100-338-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1984-312-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3128 wrote to memory of 3808 3128 eb9dae260b3c0771c977cf20fe825a74731b47fd938ec333f2d2262039d00f63.exe 81 PID 3128 wrote to memory of 3808 3128 eb9dae260b3c0771c977cf20fe825a74731b47fd938ec333f2d2262039d00f63.exe 81 PID 3128 wrote to memory of 3808 3128 eb9dae260b3c0771c977cf20fe825a74731b47fd938ec333f2d2262039d00f63.exe 81 PID 3808 wrote to memory of 1884 3808 3pjjd.exe 82 PID 3808 wrote to memory of 1884 3808 3pjjd.exe 82 PID 3808 wrote to memory of 1884 3808 3pjjd.exe 82 PID 1884 wrote to memory of 460 1884 jdpjj.exe 181 PID 1884 wrote to memory of 460 1884 jdpjj.exe 181 PID 1884 wrote to memory of 460 1884 jdpjj.exe 181 PID 460 wrote to memory of 1588 460 frlfflf.exe 182 PID 460 wrote to memory of 1588 460 frlfflf.exe 182 PID 460 wrote to memory of 1588 460 frlfflf.exe 182 PID 1588 wrote to memory of 628 1588 nhhbtb.exe 85 PID 1588 wrote to memory of 628 1588 nhhbtb.exe 85 PID 1588 wrote to memory of 628 1588 nhhbtb.exe 85 PID 628 wrote to memory of 3796 628 tttnbt.exe 86 PID 628 wrote to memory of 3796 628 tttnbt.exe 86 PID 628 wrote to memory of 3796 628 tttnbt.exe 86 PID 3796 wrote to memory of 1612 3796 ppvjj.exe 87 PID 3796 wrote to memory of 1612 3796 ppvjj.exe 87 PID 3796 wrote to memory of 1612 3796 ppvjj.exe 87 PID 1612 wrote to memory of 3168 1612 1ppdv.exe 238 PID 1612 wrote to memory of 3168 1612 1ppdv.exe 238 PID 1612 wrote to memory of 3168 1612 1ppdv.exe 238 PID 3168 wrote to memory of 4696 3168 xflfrrl.exe 240 PID 3168 wrote to memory of 4696 3168 xflfrrl.exe 240 PID 3168 wrote to memory of 4696 3168 xflfrrl.exe 240 PID 4696 wrote to memory of 4960 4696 bthtbt.exe 91 PID 4696 wrote to memory of 4960 4696 bthtbt.exe 91 PID 4696 wrote to memory of 4960 4696 bthtbt.exe 91 PID 4960 wrote to memory of 2756 4960 hbhbtn.exe 93 PID 4960 wrote to memory of 2756 4960 hbhbtn.exe 93 PID 4960 wrote to memory of 2756 4960 hbhbtn.exe 93 PID 2756 wrote to memory of 1824 2756 lllfxrl.exe 95 PID 2756 wrote to memory of 1824 2756 lllfxrl.exe 95 PID 2756 wrote to memory of 1824 2756 lllfxrl.exe 95 PID 1824 wrote to memory of 2352 1824 tnhbtn.exe 96 PID 1824 wrote to memory of 2352 1824 tnhbtn.exe 96 PID 1824 wrote to memory of 2352 1824 tnhbtn.exe 96 PID 2352 wrote to memory of 2320 2352 jjvpj.exe 98 PID 2352 wrote to memory of 2320 2352 jjvpj.exe 98 PID 2352 wrote to memory of 2320 2352 jjvpj.exe 98 PID 2320 wrote to memory of 1768 2320 rllrlrf.exe 99 PID 2320 wrote to memory of 1768 2320 rllrlrf.exe 99 PID 2320 wrote to memory of 1768 2320 rllrlrf.exe 99 PID 1768 wrote to memory of 2572 1768 nnbthb.exe 100 PID 1768 wrote to memory of 2572 1768 nnbthb.exe 100 PID 1768 wrote to memory of 2572 1768 nnbthb.exe 100 PID 2572 wrote to memory of 4716 2572 jdvpd.exe 101 PID 2572 wrote to memory of 4716 2572 jdvpd.exe 101 PID 2572 wrote to memory of 4716 2572 jdvpd.exe 101 PID 4716 wrote to memory of 2828 4716 xlfrfxl.exe 102 PID 4716 wrote to memory of 2828 4716 xlfrfxl.exe 102 PID 4716 wrote to memory of 2828 4716 xlfrfxl.exe 102 PID 2828 wrote to memory of 4496 2828 rlrfrfl.exe 103 PID 2828 wrote to memory of 4496 2828 rlrfrfl.exe 103 PID 2828 wrote to memory of 4496 2828 rlrfrfl.exe 103 PID 4496 wrote to memory of 4908 4496 7tnhbt.exe 104 PID 4496 wrote to memory of 4908 4496 7tnhbt.exe 104 PID 4496 wrote to memory of 4908 4496 7tnhbt.exe 104 PID 4908 wrote to memory of 3184 4908 jvjvp.exe 105 PID 4908 wrote to memory of 3184 4908 jvjvp.exe 105 PID 4908 wrote to memory of 3184 4908 jvjvp.exe 105 PID 3184 wrote to memory of 2188 3184 fllxlfx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb9dae260b3c0771c977cf20fe825a74731b47fd938ec333f2d2262039d00f63.exe"C:\Users\Admin\AppData\Local\Temp\eb9dae260b3c0771c977cf20fe825a74731b47fd938ec333f2d2262039d00f63.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\3pjjd.exec:\3pjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\jdpjj.exec:\jdpjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\frlfflf.exec:\frlfflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
\??\c:\nhhbtb.exec:\nhhbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\tttnbt.exec:\tttnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\ppvjj.exec:\ppvjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\1ppdv.exec:\1ppdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\xflfrrl.exec:\xflfrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\bthtbt.exec:\bthtbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\hbhbtn.exec:\hbhbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\lllfxrl.exec:\lllfxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\tnhbtn.exec:\tnhbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\jjvpj.exec:\jjvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\rllrlrf.exec:\rllrlrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\nnbthb.exec:\nnbthb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\jdvpd.exec:\jdvpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\xlfrfxl.exec:\xlfrfxl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\rlrfrfl.exec:\rlrfrfl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\7tnhbt.exec:\7tnhbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\jvjvp.exec:\jvjvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\fllxlfx.exec:\fllxlfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\bhbtnn.exec:\bhbtnn.exe23⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jpddd.exec:\jpddd.exe24⤵
- Executes dropped EXE
PID:4472 -
\??\c:\pvdpd.exec:\pvdpd.exe25⤵
- Executes dropped EXE
PID:3112 -
\??\c:\7lfxrrl.exec:\7lfxrrl.exe26⤵
- Executes dropped EXE
PID:996 -
\??\c:\ttbtbt.exec:\ttbtbt.exe27⤵
- Executes dropped EXE
PID:1428 -
\??\c:\jppjv.exec:\jppjv.exe28⤵
- Executes dropped EXE
PID:5072 -
\??\c:\ddddv.exec:\ddddv.exe29⤵
- Executes dropped EXE
PID:4756 -
\??\c:\lxfxxxr.exec:\lxfxxxr.exe30⤵
- Executes dropped EXE
PID:4384 -
\??\c:\hbtnhh.exec:\hbtnhh.exe31⤵
- Executes dropped EXE
PID:3400 -
\??\c:\ddvpd.exec:\ddvpd.exe32⤵
- Executes dropped EXE
PID:3116 -
\??\c:\flrrrrl.exec:\flrrrrl.exe33⤵
- Executes dropped EXE
PID:5044 -
\??\c:\fffffxx.exec:\fffffxx.exe34⤵
- Executes dropped EXE
PID:3696 -
\??\c:\rxxrllf.exec:\rxxrllf.exe35⤵
- Executes dropped EXE
PID:5084 -
\??\c:\7bbtnh.exec:\7bbtnh.exe36⤵
- Executes dropped EXE
PID:3204 -
\??\c:\nbhbtn.exec:\nbhbtn.exe37⤵
- Executes dropped EXE
PID:2196 -
\??\c:\vpddd.exec:\vpddd.exe38⤵
- Executes dropped EXE
PID:1592 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe39⤵
- Executes dropped EXE
PID:228 -
\??\c:\nbhthb.exec:\nbhthb.exe40⤵
- Executes dropped EXE
PID:4432 -
\??\c:\bthbtt.exec:\bthbtt.exe41⤵
- Executes dropped EXE
PID:4448 -
\??\c:\dpvvp.exec:\dpvvp.exe42⤵
- Executes dropped EXE
PID:5040 -
\??\c:\xfrlfff.exec:\xfrlfff.exe43⤵
- Executes dropped EXE
PID:1804 -
\??\c:\hbnbbt.exec:\hbnbbt.exe44⤵
- Executes dropped EXE
PID:804 -
\??\c:\nhhbhn.exec:\nhhbhn.exe45⤵
- Executes dropped EXE
PID:3476 -
\??\c:\jvdvp.exec:\jvdvp.exe46⤵
- Executes dropped EXE
PID:3604 -
\??\c:\rlllflf.exec:\rlllflf.exe47⤵
- Executes dropped EXE
PID:5028 -
\??\c:\xxxrrll.exec:\xxxrrll.exe48⤵
- Executes dropped EXE
PID:456 -
\??\c:\tnttnn.exec:\tnttnn.exe49⤵
- Executes dropped EXE
PID:3624 -
\??\c:\jpvvj.exec:\jpvvj.exe50⤵
- Executes dropped EXE
PID:1676 -
\??\c:\jvvpp.exec:\jvvpp.exe51⤵
- Executes dropped EXE
PID:2236 -
\??\c:\lxfxxxx.exec:\lxfxxxx.exe52⤵
- Executes dropped EXE
PID:2504 -
\??\c:\ffxrllf.exec:\ffxrllf.exe53⤵
- Executes dropped EXE
PID:1708 -
\??\c:\nbnhtt.exec:\nbnhtt.exe54⤵
- Executes dropped EXE
PID:5008 -
\??\c:\jpjvp.exec:\jpjvp.exe55⤵
- Executes dropped EXE
PID:4528 -
\??\c:\xxflfxl.exec:\xxflfxl.exe56⤵
- Executes dropped EXE
PID:5116 -
\??\c:\llrlrlr.exec:\llrlrlr.exe57⤵
- Executes dropped EXE
PID:5060 -
\??\c:\nttntn.exec:\nttntn.exe58⤵
- Executes dropped EXE
PID:4568 -
\??\c:\pjpjj.exec:\pjpjj.exe59⤵
- Executes dropped EXE
PID:1076 -
\??\c:\1llxllx.exec:\1llxllx.exe60⤵
- Executes dropped EXE
PID:5092 -
\??\c:\lrxxrlf.exec:\lrxxrlf.exe61⤵
- Executes dropped EXE
PID:4208 -
\??\c:\nbnbht.exec:\nbnbht.exe62⤵
- Executes dropped EXE
PID:516 -
\??\c:\hhhhtn.exec:\hhhhtn.exe63⤵
- Executes dropped EXE
PID:4952 -
\??\c:\jvddv.exec:\jvddv.exe64⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xfxrllx.exec:\xfxrllx.exe65⤵
- Executes dropped EXE
PID:2568 -
\??\c:\lrxlxrr.exec:\lrxlxrr.exe66⤵PID:1748
-
\??\c:\btnhbn.exec:\btnhbn.exe67⤵PID:1984
-
\??\c:\pvdpp.exec:\pvdpp.exe68⤵PID:2220
-
\??\c:\fxrlfrr.exec:\fxrlfrr.exe69⤵PID:920
-
\??\c:\1hhhbt.exec:\1hhhbt.exe70⤵PID:216
-
\??\c:\bttnnh.exec:\bttnnh.exe71⤵PID:812
-
\??\c:\3ddvp.exec:\3ddvp.exe72⤵PID:3144
-
\??\c:\dvvvp.exec:\dvvvp.exe73⤵PID:3272
-
\??\c:\xlrfxrr.exec:\xlrfxrr.exe74⤵PID:4472
-
\??\c:\5fxlfrx.exec:\5fxlfrx.exe75⤵PID:4316
-
\??\c:\ttthhb.exec:\ttthhb.exe76⤵PID:4100
-
\??\c:\dpjdv.exec:\dpjdv.exe77⤵PID:4972
-
\??\c:\jpvpd.exec:\jpvpd.exe78⤵PID:1124
-
\??\c:\xfrxfrr.exec:\xfrxfrr.exe79⤵PID:2576
-
\??\c:\fxfxfxx.exec:\fxfxfxx.exe80⤵PID:2656
-
\??\c:\ttnnhh.exec:\ttnnhh.exe81⤵PID:3956
-
\??\c:\pjjdv.exec:\pjjdv.exe82⤵PID:2804
-
\??\c:\pjjdv.exec:\pjjdv.exe83⤵PID:1476
-
\??\c:\lrrlffx.exec:\lrrlffx.exe84⤵PID:3904
-
\??\c:\xrrlxxl.exec:\xrrlxxl.exe85⤵PID:1100
-
\??\c:\bbtbnb.exec:\bbtbnb.exe86⤵PID:1028
-
\??\c:\bhbttn.exec:\bhbttn.exe87⤵PID:2992
-
\??\c:\jdddv.exec:\jdddv.exe88⤵PID:3088
-
\??\c:\vpvpv.exec:\vpvpv.exe89⤵PID:2196
-
\??\c:\rlrrlfl.exec:\rlrrlfl.exe90⤵PID:1592
-
\??\c:\bbhnbt.exec:\bbhnbt.exe91⤵PID:2768
-
\??\c:\tnhbbb.exec:\tnhbbb.exe92⤵PID:4040
-
\??\c:\pdppj.exec:\pdppj.exe93⤵PID:4448
-
\??\c:\9vvpj.exec:\9vvpj.exe94⤵PID:2080
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe95⤵PID:4308
-
\??\c:\hbhbth.exec:\hbhbth.exe96⤵PID:460
-
\??\c:\pvdvv.exec:\pvdvv.exe97⤵PID:1588
-
\??\c:\vpvpd.exec:\vpvpd.exe98⤵PID:1016
-
\??\c:\xrxrlrf.exec:\xrxrlrf.exe99⤵PID:4784
-
\??\c:\rfllfrl.exec:\rfllfrl.exe100⤵PID:4652
-
\??\c:\nbnhhh.exec:\nbnhhh.exe101⤵PID:1612
-
\??\c:\pdjdd.exec:\pdjdd.exe102⤵PID:4564
-
\??\c:\7jjdp.exec:\7jjdp.exe103⤵PID:540
-
\??\c:\fxlxlfl.exec:\fxlxlfl.exe104⤵PID:2524
-
\??\c:\rrrxxll.exec:\rrrxxll.exe105⤵PID:4924
-
\??\c:\tnhtnh.exec:\tnhtnh.exe106⤵PID:4492
-
\??\c:\pvdpp.exec:\pvdpp.exe107⤵PID:4656
-
\??\c:\dvjjd.exec:\dvjjd.exe108⤵PID:5008
-
\??\c:\rllfrrf.exec:\rllfrrf.exe109⤵PID:3760
-
\??\c:\xlrrllf.exec:\xlrrllf.exe110⤵PID:2540
-
\??\c:\5bbbtb.exec:\5bbbtb.exe111⤵PID:2764
-
\??\c:\jdvdd.exec:\jdvdd.exe112⤵PID:1988
-
\??\c:\vppdd.exec:\vppdd.exe113⤵PID:4892
-
\??\c:\rlfrfrf.exec:\rlfrfrf.exe114⤵PID:2828
-
\??\c:\rrrrlrl.exec:\rrrrlrl.exe115⤵PID:1472
-
\??\c:\nttnbn.exec:\nttnbn.exe116⤵PID:3236
-
\??\c:\pdpdj.exec:\pdpdj.exe117⤵PID:4252
-
\??\c:\jvdvv.exec:\jvdvv.exe118⤵PID:3728
-
\??\c:\5xfxrrr.exec:\5xfxrrr.exe119⤵PID:216
-
\??\c:\7lrllff.exec:\7lrllff.exe120⤵PID:4832
-
\??\c:\thtbnn.exec:\thtbnn.exe121⤵PID:60
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-