Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
08/06/2024, 18:22
Behavioral task
behavioral1
Sample
05c04f68bfd9e60548a425e622beaff775e99d00fda478ce37dd1cafff7f80ae.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target 05c04f68bfd9e60548a425e622beaff775e99d00fda478ce37dd1cafff7f80ae.exe
- Size 279KB
- Sample240608-wzzgcsfb82
- SHA256 05c04f68bfd9e60548a425e622beaff775e99d00fda478ce37dd1cafff7f80ae
- MD5 18bf7b7bf8e48821ec96399a457db42b
- SHA1 a8fb7cc5281014eb4e46df5c3c8bdd25974656cd
- SHA512 e17a16ba081090c855b901a48107a4e5e3b5cf693782837ec9c491355c93750866d5f071fbc7750bd28c71a61b86a2b87a33b358be8aecfde553d835b115e1bb
- SSDEEP 6144:7cm4FmowdHoSoXSBcm4Vcm4FmowdHoSphra+cm4FMhraHcpOaKHpa:B4wFHoSoXW434wFHoS3eg4aeFaKHpa
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3704-5-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2708-13-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4504-19-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1420-25-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2036-34-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4284-39-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1852-56-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1248-55-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/760-48-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1852-63-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3052-70-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/5080-76-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4512-85-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3088-83-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3088-92-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/5028-98-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4528-108-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4520-106-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4420-117-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2064-123-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3864-131-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2268-132-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2268-137-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4396-144-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/720-151-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4716-153-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4716-158-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1444-165-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3084-172-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1772-178-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3444-185-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3108-190-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3108-196-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/32-200-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2316-206-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2012-215-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4636-221-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3988-227-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1924-228-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1924-232-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2980-233-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2980-237-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2708-242-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2848-247-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/428-254-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2296-259-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2540-262-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1136-263-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1136-267-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/760-272-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1456-277-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4868-278-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4868-282-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4256-287-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/5040-292-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/5040-291-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4032-297-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/5060-298-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/5060-302-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4936-1793-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1448-1802-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4332-1835-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1960-1844-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2404-2678-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/files/0x00090000000233ee-3.dat UPX behavioral2/memory/3704-5-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/2708-8-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/2708-13-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/files/0x0008000000023401-10.dat UPX behavioral2/files/0x0007000000023405-15.dat UPX behavioral2/memory/4504-19-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/1420-21-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/1420-25-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/files/0x0007000000023407-27.dat UPX behavioral2/files/0x0007000000023408-35.dat UPX behavioral2/memory/2036-34-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4284-32-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/files/0x0007000000023409-40.dat UPX behavioral2/memory/4284-39-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/1248-49-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/files/0x000700000002340b-52.dat UPX behavioral2/memory/1248-55-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/760-48-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/files/0x000700000002340a-46.dat UPX behavioral2/files/0x000700000002340c-59.dat UPX behavioral2/memory/3052-60-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/1852-63-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/files/0x000700000002340d-66.dat UPX behavioral2/memory/5080-71-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3052-70-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/files/0x000700000002340f-73.dat UPX behavioral2/memory/5080-76-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/files/0x0007000000023410-81.dat UPX behavioral2/memory/4512-85-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/5028-89-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3088-92-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/files/0x0007000000023412-95.dat UPX behavioral2/memory/5028-98-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4528-108-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4520-106-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/files/0x0007000000023414-109.dat UPX behavioral2/files/0x0007000000023413-102.dat UPX behavioral2/files/0x0007000000023411-88.dat UPX behavioral2/files/0x0007000000023415-114.dat UPX behavioral2/memory/4420-117-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/files/0x0007000000023416-121.dat UPX behavioral2/memory/2064-123-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/files/0x0008000000023402-128.dat UPX behavioral2/memory/3864-131-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/2268-132-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/files/0x0007000000023417-135.dat UPX behavioral2/memory/2268-137-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4396-139-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/files/0x0007000000023418-142.dat UPX behavioral2/memory/4396-144-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/720-145-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/files/0x0007000000023419-149.dat UPX behavioral2/memory/720-151-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4716-153-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/4716-158-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/files/0x000700000002341a-156.dat UPX behavioral2/memory/1444-159-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/files/0x000700000002341b-166.dat UPX behavioral2/memory/1444-165-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3084-167-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/files/0x000700000002341c-170.dat UPX behavioral2/memory/3084-172-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/1772-174-0x0000000000400000-0x000000000044D000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 2708 vpdvp.exe 4504 rrxrxrl.exe 1420 7htbnn.exe 2036 dvvpp.exe 4284 rfllfxx.exe 760 nbnhtn.exe 1248 7llxrrl.exe 1852 nnhtbt.exe 3052 jvpjd.exe 5080 9rxxxff.exe 4512 3dvvp.exe 3088 xllxffl.exe 5028 vjpjp.exe 4528 9rrlxrl.exe 4520 3djvv.exe 4420 jddjv.exe 2064 frxrxxx.exe 3864 rrfflrf.exe 2268 nhtnbb.exe 4396 lxxrrrl.exe 720 lxlfxxr.exe 4716 3pvpj.exe 1444 dvjjd.exe 3084 lflfxff.exe 1772 llxxfxl.exe 3444 nnhtbb.exe 3108 lxrlfxr.exe 32 tnnnnn.exe 2316 btbtnn.exe 2012 rfffxfx.exe 4636 hbbtnn.exe 3988 hbbbtt.exe 1924 ddvpj.exe 2980 1rxxxxx.exe 2708 hnnhbb.exe 2848 7dpdv.exe 428 frxrxll.exe 2296 rxffxfx.exe 2540 9btttb.exe 1136 5jppd.exe 760 nnnhbt.exe 1456 7tnhhh.exe 4868 vjjdp.exe 4256 rrxxxxx.exe 5040 thhnbt.exe 4032 pjjdv.exe 5060 5rrlffx.exe 2736 hbttnh.exe 4876 pdjjd.exe 5028 jvpdp.exe 4548 bntbbt.exe 4724 nhhbbn.exe 4304 ddppp.exe 4412 ffxrllf.exe 3600 frxrllf.exe 4560 bntntn.exe 3864 tnhbbb.exe 624 pdddv.exe 4752 3rrlfll.exe 1488 tnttnn.exe 2720 9tnnhn.exe 1276 ddvvv.exe 3140 pjpvv.exe 2396 frrrlll.exe -
resource yara_rule behavioral2/memory/3704-0-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/files/0x00090000000233ee-3.dat upx behavioral2/memory/3704-5-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/2708-8-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4504-11-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/2708-13-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/files/0x0008000000023401-10.dat upx behavioral2/files/0x0007000000023405-15.dat upx behavioral2/memory/4504-19-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1420-21-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1420-25-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1420-24-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/2036-28-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/files/0x0007000000023407-27.dat upx behavioral2/files/0x0007000000023408-35.dat upx behavioral2/memory/2036-34-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4284-32-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/files/0x0007000000023409-40.dat upx behavioral2/memory/4284-39-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/760-43-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1248-49-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/files/0x000700000002340b-52.dat upx behavioral2/memory/1852-56-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1248-55-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/760-48-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/files/0x000700000002340a-46.dat upx behavioral2/files/0x000700000002340c-59.dat upx behavioral2/memory/3052-60-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1852-63-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/files/0x000700000002340d-66.dat upx behavioral2/memory/5080-71-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3052-70-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/files/0x000700000002340f-73.dat upx behavioral2/memory/5080-76-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4512-77-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/files/0x0007000000023410-81.dat upx behavioral2/memory/4512-85-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3088-83-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/5028-89-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3088-92-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/files/0x0007000000023412-95.dat upx behavioral2/memory/4528-96-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/5028-98-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4528-108-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4520-106-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/files/0x0007000000023414-109.dat upx behavioral2/memory/4420-111-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/files/0x0007000000023413-102.dat upx behavioral2/files/0x0007000000023411-88.dat upx behavioral2/files/0x0007000000023415-114.dat upx behavioral2/memory/4420-117-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/2064-119-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/files/0x0007000000023416-121.dat upx behavioral2/memory/3864-124-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/2064-123-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/files/0x0008000000023402-128.dat upx behavioral2/memory/3864-131-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/2268-132-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/files/0x0007000000023417-135.dat upx behavioral2/memory/2268-137-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4396-139-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/files/0x0007000000023418-142.dat upx behavioral2/memory/4396-144-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/720-145-0x0000000000400000-0x000000000044D000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3704 wrote to memory of 2708 3704 05c04f68bfd9e60548a425e622beaff775e99d00fda478ce37dd1cafff7f80ae.exe 81 PID 3704 wrote to memory of 2708 3704 05c04f68bfd9e60548a425e622beaff775e99d00fda478ce37dd1cafff7f80ae.exe 81 PID 3704 wrote to memory of 2708 3704 05c04f68bfd9e60548a425e622beaff775e99d00fda478ce37dd1cafff7f80ae.exe 81 PID 2708 wrote to memory of 4504 2708 vpdvp.exe 82 PID 2708 wrote to memory of 4504 2708 vpdvp.exe 82 PID 2708 wrote to memory of 4504 2708 vpdvp.exe 82 PID 4504 wrote to memory of 1420 4504 rrxrxrl.exe 83 PID 4504 wrote to memory of 1420 4504 rrxrxrl.exe 83 PID 4504 wrote to memory of 1420 4504 rrxrxrl.exe 83 PID 1420 wrote to memory of 2036 1420 7htbnn.exe 84 PID 1420 wrote to memory of 2036 1420 7htbnn.exe 84 PID 1420 wrote to memory of 2036 1420 7htbnn.exe 84 PID 2036 wrote to memory of 4284 2036 dvvpp.exe 85 PID 2036 wrote to memory of 4284 2036 dvvpp.exe 85 PID 2036 wrote to memory of 4284 2036 dvvpp.exe 85 PID 4284 wrote to memory of 760 4284 rfllfxx.exe 86 PID 4284 wrote to memory of 760 4284 rfllfxx.exe 86 PID 4284 wrote to memory of 760 4284 rfllfxx.exe 86 PID 760 wrote to memory of 1248 760 nbnhtn.exe 87 PID 760 wrote to memory of 1248 760 nbnhtn.exe 87 PID 760 wrote to memory of 1248 760 nbnhtn.exe 87 PID 1248 wrote to memory of 1852 1248 7llxrrl.exe 88 PID 1248 wrote to memory of 1852 1248 7llxrrl.exe 88 PID 1248 wrote to memory of 1852 1248 7llxrrl.exe 88 PID 1852 wrote to memory of 3052 1852 nnhtbt.exe 89 PID 1852 wrote to memory of 3052 1852 nnhtbt.exe 89 PID 1852 wrote to memory of 3052 1852 nnhtbt.exe 89 PID 3052 wrote to memory of 5080 3052 jvpjd.exe 90 PID 3052 wrote to memory of 5080 3052 jvpjd.exe 90 PID 3052 wrote to memory of 5080 3052 jvpjd.exe 90 PID 5080 wrote to memory of 4512 5080 9rxxxff.exe 91 PID 5080 wrote to memory of 4512 5080 9rxxxff.exe 91 PID 5080 wrote to memory of 4512 5080 9rxxxff.exe 91 PID 4512 wrote to memory of 3088 4512 3dvvp.exe 92 PID 4512 wrote to memory of 3088 4512 3dvvp.exe 92 PID 4512 wrote to memory of 3088 4512 3dvvp.exe 92 PID 3088 wrote to memory of 5028 3088 xllxffl.exe 93 PID 3088 wrote to memory of 5028 3088 xllxffl.exe 93 PID 3088 wrote to memory of 5028 3088 xllxffl.exe 93 PID 5028 wrote to memory of 4528 5028 vjpjp.exe 94 PID 5028 wrote to memory of 4528 5028 vjpjp.exe 94 PID 5028 wrote to memory of 4528 5028 vjpjp.exe 94 PID 4528 wrote to memory of 4520 4528 9rrlxrl.exe 95 PID 4528 wrote to memory of 4520 4528 9rrlxrl.exe 95 PID 4528 wrote to memory of 4520 4528 9rrlxrl.exe 95 PID 4520 wrote to memory of 4420 4520 3djvv.exe 96 PID 4520 wrote to memory of 4420 4520 3djvv.exe 96 PID 4520 wrote to memory of 4420 4520 3djvv.exe 96 PID 4420 wrote to memory of 2064 4420 jddjv.exe 97 PID 4420 wrote to memory of 2064 4420 jddjv.exe 97 PID 4420 wrote to memory of 2064 4420 jddjv.exe 97 PID 2064 wrote to memory of 3864 2064 frxrxxx.exe 98 PID 2064 wrote to memory of 3864 2064 frxrxxx.exe 98 PID 2064 wrote to memory of 3864 2064 frxrxxx.exe 98 PID 3864 wrote to memory of 2268 3864 rrfflrf.exe 100 PID 3864 wrote to memory of 2268 3864 rrfflrf.exe 100 PID 3864 wrote to memory of 2268 3864 rrfflrf.exe 100 PID 2268 wrote to memory of 4396 2268 nhtnbb.exe 101 PID 2268 wrote to memory of 4396 2268 nhtnbb.exe 101 PID 2268 wrote to memory of 4396 2268 nhtnbb.exe 101 PID 4396 wrote to memory of 720 4396 lxxrrrl.exe 102 PID 4396 wrote to memory of 720 4396 lxxrrrl.exe 102 PID 4396 wrote to memory of 720 4396 lxxrrrl.exe 102 PID 720 wrote to memory of 4716 720 lxlfxxr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\05c04f68bfd9e60548a425e622beaff775e99d00fda478ce37dd1cafff7f80ae.exe"C:\Users\Admin\AppData\Local\Temp\05c04f68bfd9e60548a425e622beaff775e99d00fda478ce37dd1cafff7f80ae.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\vpdvp.exec:\vpdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\rrxrxrl.exec:\rrxrxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\7htbnn.exec:\7htbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\dvvpp.exec:\dvvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\rfllfxx.exec:\rfllfxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\nbnhtn.exec:\nbnhtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\7llxrrl.exec:\7llxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\nnhtbt.exec:\nnhtbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\jvpjd.exec:\jvpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\9rxxxff.exec:\9rxxxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\3dvvp.exec:\3dvvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\xllxffl.exec:\xllxffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\vjpjp.exec:\vjpjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\9rrlxrl.exec:\9rrlxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\3djvv.exec:\3djvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\jddjv.exec:\jddjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\frxrxxx.exec:\frxrxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\rrfflrf.exec:\rrfflrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\nhtnbb.exec:\nhtnbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\lxxrrrl.exec:\lxxrrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\lxlfxxr.exec:\lxlfxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\3pvpj.exec:\3pvpj.exe23⤵
- Executes dropped EXE
PID:4716 -
\??\c:\dvjjd.exec:\dvjjd.exe24⤵
- Executes dropped EXE
PID:1444 -
\??\c:\lflfxff.exec:\lflfxff.exe25⤵
- Executes dropped EXE
PID:3084 -
\??\c:\llxxfxl.exec:\llxxfxl.exe26⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nnhtbb.exec:\nnhtbb.exe27⤵
- Executes dropped EXE
PID:3444 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe28⤵
- Executes dropped EXE
PID:3108 -
\??\c:\tnnnnn.exec:\tnnnnn.exe29⤵
- Executes dropped EXE
PID:32 -
\??\c:\btbtnn.exec:\btbtnn.exe30⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rfffxfx.exec:\rfffxfx.exe31⤵
- Executes dropped EXE
PID:2012 -
\??\c:\hbbtnn.exec:\hbbtnn.exe32⤵
- Executes dropped EXE
PID:4636 -
\??\c:\hbbbtt.exec:\hbbbtt.exe33⤵
- Executes dropped EXE
PID:3988 -
\??\c:\ddvpj.exec:\ddvpj.exe34⤵
- Executes dropped EXE
PID:1924 -
\??\c:\1rxxxxx.exec:\1rxxxxx.exe35⤵
- Executes dropped EXE
PID:2980 -
\??\c:\hnnhbb.exec:\hnnhbb.exe36⤵
- Executes dropped EXE
PID:2708 -
\??\c:\7dpdv.exec:\7dpdv.exe37⤵
- Executes dropped EXE
PID:2848 -
\??\c:\frxrxll.exec:\frxrxll.exe38⤵
- Executes dropped EXE
PID:428 -
\??\c:\rxffxfx.exec:\rxffxfx.exe39⤵
- Executes dropped EXE
PID:2296 -
\??\c:\9btttb.exec:\9btttb.exe40⤵
- Executes dropped EXE
PID:2540 -
\??\c:\5jppd.exec:\5jppd.exe41⤵
- Executes dropped EXE
PID:1136 -
\??\c:\nnnhbt.exec:\nnnhbt.exe42⤵
- Executes dropped EXE
PID:760 -
\??\c:\7tnhhh.exec:\7tnhhh.exe43⤵
- Executes dropped EXE
PID:1456 -
\??\c:\vjjdp.exec:\vjjdp.exe44⤵
- Executes dropped EXE
PID:4868 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe45⤵
- Executes dropped EXE
PID:4256 -
\??\c:\thhnbt.exec:\thhnbt.exe46⤵
- Executes dropped EXE
PID:5040 -
\??\c:\pjjdv.exec:\pjjdv.exe47⤵
- Executes dropped EXE
PID:4032 -
\??\c:\5rrlffx.exec:\5rrlffx.exe48⤵
- Executes dropped EXE
PID:5060 -
\??\c:\hbttnh.exec:\hbttnh.exe49⤵
- Executes dropped EXE
PID:2736 -
\??\c:\pdjjd.exec:\pdjjd.exe50⤵
- Executes dropped EXE
PID:4876 -
\??\c:\jvpdp.exec:\jvpdp.exe51⤵
- Executes dropped EXE
PID:5028 -
\??\c:\bntbbt.exec:\bntbbt.exe52⤵
- Executes dropped EXE
PID:4548 -
\??\c:\nhhbbn.exec:\nhhbbn.exe53⤵
- Executes dropped EXE
PID:4724 -
\??\c:\ddppp.exec:\ddppp.exe54⤵
- Executes dropped EXE
PID:4304 -
\??\c:\ffxrllf.exec:\ffxrllf.exe55⤵
- Executes dropped EXE
PID:4412 -
\??\c:\frxrllf.exec:\frxrllf.exe56⤵
- Executes dropped EXE
PID:3600 -
\??\c:\bntntn.exec:\bntntn.exe57⤵
- Executes dropped EXE
PID:4560 -
\??\c:\tnhbbb.exec:\tnhbbb.exe58⤵
- Executes dropped EXE
PID:3864 -
\??\c:\pdddv.exec:\pdddv.exe59⤵
- Executes dropped EXE
PID:624 -
\??\c:\3rrlfll.exec:\3rrlfll.exe60⤵
- Executes dropped EXE
PID:4752 -
\??\c:\tnttnn.exec:\tnttnn.exe61⤵
- Executes dropped EXE
PID:1488 -
\??\c:\9tnnhn.exec:\9tnnhn.exe62⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ddvvv.exec:\ddvvv.exe63⤵
- Executes dropped EXE
PID:1276 -
\??\c:\pjpvv.exec:\pjpvv.exe64⤵
- Executes dropped EXE
PID:3140 -
\??\c:\frrrlll.exec:\frrrlll.exe65⤵
- Executes dropped EXE
PID:2396 -
\??\c:\7hnhnn.exec:\7hnhnn.exe66⤵PID:3400
-
\??\c:\hbhnnn.exec:\hbhnnn.exe67⤵PID:3352
-
\??\c:\jdvdv.exec:\jdvdv.exe68⤵PID:208
-
\??\c:\frxrllf.exec:\frxrllf.exe69⤵PID:388
-
\??\c:\7llfrxf.exec:\7llfrxf.exe70⤵PID:4720
-
\??\c:\7btbbh.exec:\7btbbh.exe71⤵PID:4636
-
\??\c:\9tbttt.exec:\9tbttt.exe72⤵PID:2080
-
\??\c:\pvdvj.exec:\pvdvj.exe73⤵PID:3988
-
\??\c:\frfxrrl.exec:\frfxrrl.exe74⤵PID:4332
-
\??\c:\xfxrlfx.exec:\xfxrlfx.exe75⤵PID:1904
-
\??\c:\7hnhtt.exec:\7hnhtt.exe76⤵PID:1420
-
\??\c:\dvvpd.exec:\dvvpd.exe77⤵PID:1004
-
\??\c:\djddd.exec:\djddd.exe78⤵PID:2784
-
\??\c:\xlrfllr.exec:\xlrfllr.exe79⤵PID:1736
-
\??\c:\tbbhnt.exec:\tbbhnt.exe80⤵PID:1676
-
\??\c:\9pjdv.exec:\9pjdv.exe81⤵PID:4300
-
\??\c:\9vjvj.exec:\9vjvj.exe82⤵PID:748
-
\??\c:\xllxlfr.exec:\xllxlfr.exe83⤵PID:4868
-
\??\c:\lrlxlfr.exec:\lrlxlfr.exe84⤵PID:1872
-
\??\c:\htbnbt.exec:\htbnbt.exe85⤵PID:744
-
\??\c:\jvpjd.exec:\jvpjd.exe86⤵PID:1768
-
\??\c:\pdvpj.exec:\pdvpj.exe87⤵PID:2920
-
\??\c:\9btnhh.exec:\9btnhh.exe88⤵PID:3088
-
\??\c:\pdvpp.exec:\pdvpp.exe89⤵PID:4876
-
\??\c:\rllxrrr.exec:\rllxrrr.exe90⤵PID:4392
-
\??\c:\hbbnht.exec:\hbbnht.exe91⤵PID:4132
-
\??\c:\ntnhtt.exec:\ntnhtt.exe92⤵PID:980
-
\??\c:\5vpjv.exec:\5vpjv.exe93⤵PID:4580
-
\??\c:\dvdvp.exec:\dvdvp.exe94⤵PID:632
-
\??\c:\9ffxrlx.exec:\9ffxrlx.exe95⤵PID:4172
-
\??\c:\tnnbnn.exec:\tnnbnn.exe96⤵PID:3980
-
\??\c:\7nnhbt.exec:\7nnhbt.exe97⤵PID:2268
-
\??\c:\5vpdv.exec:\5vpdv.exe98⤵PID:796
-
\??\c:\vjpdv.exec:\vjpdv.exe99⤵PID:4396
-
\??\c:\lfxlflf.exec:\lfxlflf.exe100⤵PID:1560
-
\??\c:\5lxfxrr.exec:\5lxfxrr.exe101⤵PID:1028
-
\??\c:\nhbhnn.exec:\nhbhnn.exe102⤵PID:2228
-
\??\c:\1jpdv.exec:\1jpdv.exe103⤵PID:4648
-
\??\c:\vjdvv.exec:\vjdvv.exe104⤵PID:2660
-
\??\c:\9lxlrll.exec:\9lxlrll.exe105⤵PID:1332
-
\??\c:\ntttnt.exec:\ntttnt.exe106⤵PID:3108
-
\??\c:\dppjv.exec:\dppjv.exe107⤵PID:1468
-
\??\c:\3vpdp.exec:\3vpdp.exe108⤵PID:608
-
\??\c:\9lffxff.exec:\9lffxff.exe109⤵PID:1888
-
\??\c:\tnnbbb.exec:\tnnbbb.exe110⤵PID:5088
-
\??\c:\hnnbth.exec:\hnnbth.exe111⤵PID:4552
-
\??\c:\5jpdd.exec:\5jpdd.exe112⤵PID:3552
-
\??\c:\xxlxrlf.exec:\xxlxrlf.exe113⤵PID:2980
-
\??\c:\jdpvv.exec:\jdpvv.exe114⤵PID:2820
-
\??\c:\3tnbnt.exec:\3tnbnt.exe115⤵PID:8
-
\??\c:\frxlrll.exec:\frxlrll.exe116⤵PID:1436
-
\??\c:\rlfrxlf.exec:\rlfrxlf.exe117⤵PID:5100
-
\??\c:\5thbnn.exec:\5thbnn.exe118⤵PID:4264
-
\??\c:\djpdp.exec:\djpdp.exe119⤵PID:1248
-
\??\c:\ffflxxr.exec:\ffflxxr.exe120⤵PID:1456
-
\??\c:\nttnth.exec:\nttnth.exe121⤵PID:2524
-
\??\c:\nhthnh.exec:\nhthnh.exe122⤵PID:3680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-