Analysis
-
max time kernel
125s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09-06-2024 03:22
Behavioral task
behavioral1
Sample
82d6196037c75b541a772a96687cf2cae930a433d69df95a477e57dd6748fe86.exe
Resource
win7-20240215-en
windows7-x64
7 signatures
150 seconds
General
-
Target
82d6196037c75b541a772a96687cf2cae930a433d69df95a477e57dd6748fe86.exe
-
Size
377KB
-
MD5
bf7409096e1169fd1bdc1e1c141aac88
-
SHA1
9c644656341b6f4a38f1c1a9ee4ed7d04c0fbd42
-
SHA256
82d6196037c75b541a772a96687cf2cae930a433d69df95a477e57dd6748fe86
-
SHA512
1fa6aa81ebd11001847210f0d4f940abb0a8ab37fe2024976985eb937292b37d3eaac28dd7390dde12da1c53173b4e75da8f51982de0485bdf3538b1a75650c1
-
SSDEEP
6144:9cm4FmowdHoSABIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7w:/4wFHoSA4KofHfHTXQLzgvnzHPowYbvX
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4344-6-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4196-48-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2276-90-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3412-98-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4296-118-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2400-125-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4440-131-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/676-175-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4912-239-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3968-256-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/988-269-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/8-277-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4368-307-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3060-329-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2052-333-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4048-2252-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4276-2639-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2788-2942-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1360-2612-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4244-1768-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1968-1456-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3496-324-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3480-319-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3312-315-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4368-311-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3132-306-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2924-301-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4480-297-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1104-291-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2292-286-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/860-282-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4448-273-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3200-264-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1056-260-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4488-252-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4356-247-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2840-243-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/712-235-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/632-231-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2784-228-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/616-223-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3328-219-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/720-210-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4816-204-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3556-196-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3652-190-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1960-182-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3892-170-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/424-162-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/576-156-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/372-150-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4976-143-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4440-137-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/5104-110-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3412-103-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/756-96-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2668-82-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2276-83-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4540-76-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2192-68-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2192-63-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3628-62-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/452-54-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/452-49-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/4344-6-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/2408-21-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4196-48-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x00070000000233f7-69.dat UPX behavioral2/files/0x00070000000233f9-84.dat UPX behavioral2/memory/2276-90-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4296-111-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4296-118-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/2400-125-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4440-131-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/372-144-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023402-155.dat UPX behavioral2/memory/3892-164-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/676-175-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/1960-177-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x00080000000233ec-212.dat UPX behavioral2/files/0x000700000002340b-216.dat UPX behavioral2/memory/4912-239-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/3968-256-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/988-269-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/8-277-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/3132-302-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/3060-329-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/2052-333-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4048-2252-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4276-2639-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/2788-2942-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/1360-2612-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4244-1768-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/1968-1456-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/3544-1399-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/3060-325-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/3496-324-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4368-311-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/3132-306-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/2924-301-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/2924-295-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/1104-287-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/860-282-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4448-273-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/988-265-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/3200-264-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/1056-260-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4356-247-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/712-235-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/632-231-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/2784-228-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/616-217-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/3328-211-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/4816-204-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023409-201.dat UPX behavioral2/files/0x0007000000023408-195.dat UPX behavioral2/memory/3652-190-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023407-189.dat UPX behavioral2/memory/1960-182-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023406-180.dat UPX behavioral2/files/0x0007000000023405-176.dat UPX behavioral2/memory/3892-170-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023404-168.dat UPX behavioral2/memory/424-162-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/424-157-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/memory/576-156-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral2/files/0x0007000000023402-153.dat UPX behavioral2/files/0x0007000000023401-149.dat UPX -
Executes dropped EXE 64 IoCs
pid Process 4048 pjppp.exe 2664 rfllfff.exe 2408 tbbbtt.exe 1800 pdvjv.exe 4652 dpvpj.exe 4196 lffffrl.exe 452 xxxrrxr.exe 3628 hhbtnn.exe 2192 3djdp.exe 4540 rrllxfx.exe 2668 frxxffx.exe 2276 3tbbth.exe 756 1djdd.exe 3412 lrrrlll.exe 5104 bbhbtt.exe 4296 tntnnn.exe 2400 jppvv.exe 4272 xfxrfxr.exe 4440 nnhbbh.exe 4976 jjjjd.exe 372 7xfffll.exe 576 xrxrffx.exe 424 bthhth.exe 3892 bbtnhh.exe 676 vpppj.exe 1960 3rfffxr.exe 3652 9nbnhn.exe 3556 jddvp.exe 4816 1frxlfr.exe 720 lxffffl.exe 3328 7nnbnh.exe 616 frxrrrl.exe 2784 hntttn.exe 632 9btnhh.exe 712 9jppj.exe 4912 lffxflr.exe 2840 lrffxxr.exe 4356 tnhhht.exe 4488 ddpvp.exe 3968 flrlffx.exe 1056 7xxxrrr.exe 3200 bttttn.exe 988 pppjd.exe 4448 1dddv.exe 8 7fxxlll.exe 860 lffrrrl.exe 2292 thnnnn.exe 1104 dvpvv.exe 4480 pjjjd.exe 2924 rllrlfx.exe 3132 rrllfff.exe 4368 1hnnhh.exe 3312 3vvpp.exe 3480 9rlrrxx.exe 3496 frrfxrr.exe 3060 hbhbbb.exe 2052 5dppj.exe 728 ppjdd.exe 4724 htbnhn.exe 1524 djjdv.exe 576 xxfxrxx.exe 524 3rxxrxf.exe 4648 btbtnn.exe 1452 dvvvp.exe -
Molebox Virtualization software 32 IoCs
Detects file using Molebox Virtualization software.
resource yara_rule behavioral2/files/0x00070000000233f7-69.dat molebox behavioral2/files/0x00070000000233f9-84.dat molebox behavioral2/files/0x0007000000023402-155.dat molebox behavioral2/files/0x00080000000233ec-212.dat molebox behavioral2/files/0x000700000002340b-216.dat molebox behavioral2/files/0x0007000000023409-201.dat molebox behavioral2/files/0x0007000000023408-195.dat molebox behavioral2/files/0x0007000000023407-189.dat molebox behavioral2/files/0x0007000000023406-180.dat molebox behavioral2/files/0x0007000000023405-176.dat molebox behavioral2/files/0x0007000000023404-168.dat molebox behavioral2/files/0x0007000000023402-153.dat molebox behavioral2/files/0x0007000000023401-149.dat molebox behavioral2/files/0x000d000000023355-142.dat molebox behavioral2/files/0x000e000000023354-134.dat molebox behavioral2/files/0x0007000000023400-130.dat molebox behavioral2/files/0x00070000000233ff-121.dat molebox behavioral2/files/0x00070000000233fe-115.dat molebox behavioral2/files/0x00070000000233fd-108.dat molebox behavioral2/files/0x00070000000233fc-101.dat molebox behavioral2/files/0x00070000000233fb-94.dat molebox behavioral2/files/0x00070000000233fa-87.dat molebox behavioral2/files/0x00070000000233f8-75.dat molebox behavioral2/files/0x00070000000233f6-61.dat molebox behavioral2/files/0x00070000000233f5-55.dat molebox behavioral2/files/0x00070000000233f4-45.dat molebox behavioral2/files/0x00070000000233f3-41.dat molebox behavioral2/files/0x00070000000233f2-34.dat molebox behavioral2/files/0x00070000000233f1-26.dat molebox behavioral2/files/0x00070000000233ef-17.dat molebox behavioral2/files/0x00080000000233eb-11.dat molebox behavioral2/files/0x0006000000023288-5.dat molebox -
resource yara_rule behavioral2/memory/4344-0-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4344-6-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2408-21-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4196-48-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3628-56-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00070000000233f7-69.dat upx behavioral2/files/0x00070000000233f9-84.dat upx behavioral2/memory/2276-90-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3412-98-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4296-111-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4296-118-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2400-125-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4440-131-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/372-144-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023402-155.dat upx behavioral2/memory/3892-164-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/676-175-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1960-177-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3652-184-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4816-198-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/720-205-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x00080000000233ec-212.dat upx behavioral2/files/0x000700000002340b-216.dat upx behavioral2/memory/4912-239-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3968-256-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/988-269-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/8-277-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4480-292-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3132-302-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4368-307-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3060-329-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2052-333-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4048-2252-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4276-2639-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2788-2942-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1360-2612-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4244-1768-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1968-1456-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3544-1399-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3060-325-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3496-324-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3496-320-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3480-319-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3312-315-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4368-311-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3132-306-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2924-301-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4480-297-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2924-295-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1104-291-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1104-287-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2292-286-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/860-282-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2292-281-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4448-273-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/988-265-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3200-264-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1056-260-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4488-252-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4488-248-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4356-247-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2840-243-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/712-235-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/632-231-0x0000000000400000-0x0000000000460000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4344 wrote to memory of 4048 4344 82d6196037c75b541a772a96687cf2cae930a433d69df95a477e57dd6748fe86.exe 1109 PID 4344 wrote to memory of 4048 4344 82d6196037c75b541a772a96687cf2cae930a433d69df95a477e57dd6748fe86.exe 1109 PID 4344 wrote to memory of 4048 4344 82d6196037c75b541a772a96687cf2cae930a433d69df95a477e57dd6748fe86.exe 1109 PID 4048 wrote to memory of 2664 4048 pjppp.exe 536 PID 4048 wrote to memory of 2664 4048 pjppp.exe 536 PID 4048 wrote to memory of 2664 4048 pjppp.exe 536 PID 2664 wrote to memory of 2408 2664 rfllfff.exe 487 PID 2664 wrote to memory of 2408 2664 rfllfff.exe 487 PID 2664 wrote to memory of 2408 2664 rfllfff.exe 487 PID 2408 wrote to memory of 1800 2408 tbbbtt.exe 84 PID 2408 wrote to memory of 1800 2408 tbbbtt.exe 84 PID 2408 wrote to memory of 1800 2408 tbbbtt.exe 84 PID 1800 wrote to memory of 4652 1800 pdvjv.exe 85 PID 1800 wrote to memory of 4652 1800 pdvjv.exe 85 PID 1800 wrote to memory of 4652 1800 pdvjv.exe 85 PID 4652 wrote to memory of 4196 4652 dpvpj.exe 87 PID 4652 wrote to memory of 4196 4652 dpvpj.exe 87 PID 4652 wrote to memory of 4196 4652 dpvpj.exe 87 PID 4196 wrote to memory of 452 4196 lffffrl.exe 88 PID 4196 wrote to memory of 452 4196 lffffrl.exe 88 PID 4196 wrote to memory of 452 4196 lffffrl.exe 88 PID 452 wrote to memory of 3628 452 xxxrrxr.exe 89 PID 452 wrote to memory of 3628 452 xxxrrxr.exe 89 PID 452 wrote to memory of 3628 452 xxxrrxr.exe 89 PID 3628 wrote to memory of 2192 3628 hhbtnn.exe 91 PID 3628 wrote to memory of 2192 3628 hhbtnn.exe 91 PID 3628 wrote to memory of 2192 3628 hhbtnn.exe 91 PID 2192 wrote to memory of 4540 2192 3djdp.exe 92 PID 2192 wrote to memory of 4540 2192 3djdp.exe 92 PID 2192 wrote to memory of 4540 2192 3djdp.exe 92 PID 4540 wrote to memory of 2668 4540 rrllxfx.exe 93 PID 4540 wrote to memory of 2668 4540 rrllxfx.exe 93 PID 4540 wrote to memory of 2668 4540 rrllxfx.exe 93 PID 2668 wrote to memory of 2276 2668 frxxffx.exe 95 PID 2668 wrote to memory of 2276 2668 frxxffx.exe 95 PID 2668 wrote to memory of 2276 2668 frxxffx.exe 95 PID 2276 wrote to memory of 756 2276 3tbbth.exe 96 PID 2276 wrote to memory of 756 2276 3tbbth.exe 96 PID 2276 wrote to memory of 756 2276 3tbbth.exe 96 PID 756 wrote to memory of 3412 756 1djdd.exe 97 PID 756 wrote to memory of 3412 756 1djdd.exe 97 PID 756 wrote to memory of 3412 756 1djdd.exe 97 PID 3412 wrote to memory of 5104 3412 lrrrlll.exe 98 PID 3412 wrote to memory of 5104 3412 lrrrlll.exe 98 PID 3412 wrote to memory of 5104 3412 lrrrlll.exe 98 PID 5104 wrote to memory of 4296 5104 bbhbtt.exe 99 PID 5104 wrote to memory of 4296 5104 bbhbtt.exe 99 PID 5104 wrote to memory of 4296 5104 bbhbtt.exe 99 PID 4296 wrote to memory of 2400 4296 tntnnn.exe 100 PID 4296 wrote to memory of 2400 4296 tntnnn.exe 100 PID 4296 wrote to memory of 2400 4296 tntnnn.exe 100 PID 2400 wrote to memory of 4272 2400 jppvv.exe 101 PID 2400 wrote to memory of 4272 2400 jppvv.exe 101 PID 2400 wrote to memory of 4272 2400 jppvv.exe 101 PID 4272 wrote to memory of 4440 4272 xfxrfxr.exe 102 PID 4272 wrote to memory of 4440 4272 xfxrfxr.exe 102 PID 4272 wrote to memory of 4440 4272 xfxrfxr.exe 102 PID 4440 wrote to memory of 4976 4440 nnhbbh.exe 103 PID 4440 wrote to memory of 4976 4440 nnhbbh.exe 103 PID 4440 wrote to memory of 4976 4440 nnhbbh.exe 103 PID 4976 wrote to memory of 372 4976 jjjjd.exe 104 PID 4976 wrote to memory of 372 4976 jjjjd.exe 104 PID 4976 wrote to memory of 372 4976 jjjjd.exe 104 PID 372 wrote to memory of 576 372 7xfffll.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\82d6196037c75b541a772a96687cf2cae930a433d69df95a477e57dd6748fe86.exe"C:\Users\Admin\AppData\Local\Temp\82d6196037c75b541a772a96687cf2cae930a433d69df95a477e57dd6748fe86.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\pjppp.exec:\pjppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\rfllfff.exec:\rfllfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\tbbbtt.exec:\tbbbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\pdvjv.exec:\pdvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\dpvpj.exec:\dpvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\lffffrl.exec:\lffffrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\xxxrrxr.exec:\xxxrrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\hhbtnn.exec:\hhbtnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\3djdp.exec:\3djdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\rrllxfx.exec:\rrllxfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\frxxffx.exec:\frxxffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\3tbbth.exec:\3tbbth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\1djdd.exec:\1djdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\lrrrlll.exec:\lrrrlll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\bbhbtt.exec:\bbhbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\tntnnn.exec:\tntnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\jppvv.exec:\jppvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\xfxrfxr.exec:\xfxrfxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\nnhbbh.exec:\nnhbbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\jjjjd.exec:\jjjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\7xfffll.exec:\7xfffll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\xrxrffx.exec:\xrxrffx.exe23⤵
- Executes dropped EXE
PID:576 -
\??\c:\bthhth.exec:\bthhth.exe24⤵
- Executes dropped EXE
PID:424 -
\??\c:\bbtnhh.exec:\bbtnhh.exe25⤵
- Executes dropped EXE
PID:3892 -
\??\c:\vpppj.exec:\vpppj.exe26⤵
- Executes dropped EXE
PID:676 -
\??\c:\3rfffxr.exec:\3rfffxr.exe27⤵
- Executes dropped EXE
PID:1960 -
\??\c:\9nbnhn.exec:\9nbnhn.exe28⤵
- Executes dropped EXE
PID:3652 -
\??\c:\jddvp.exec:\jddvp.exe29⤵
- Executes dropped EXE
PID:3556 -
\??\c:\1frxlfr.exec:\1frxlfr.exe30⤵
- Executes dropped EXE
PID:4816 -
\??\c:\lxffffl.exec:\lxffffl.exe31⤵
- Executes dropped EXE
PID:720 -
\??\c:\7nnbnh.exec:\7nnbnh.exe32⤵
- Executes dropped EXE
PID:3328 -
\??\c:\frxrrrl.exec:\frxrrrl.exe33⤵
- Executes dropped EXE
PID:616 -
\??\c:\hntttn.exec:\hntttn.exe34⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9btnhh.exec:\9btnhh.exe35⤵
- Executes dropped EXE
PID:632 -
\??\c:\9jppj.exec:\9jppj.exe36⤵
- Executes dropped EXE
PID:712 -
\??\c:\lffxflr.exec:\lffxflr.exe37⤵
- Executes dropped EXE
PID:4912 -
\??\c:\lrffxxr.exec:\lrffxxr.exe38⤵
- Executes dropped EXE
PID:2840 -
\??\c:\tnhhht.exec:\tnhhht.exe39⤵
- Executes dropped EXE
PID:4356 -
\??\c:\ddpvp.exec:\ddpvp.exe40⤵
- Executes dropped EXE
PID:4488 -
\??\c:\flrlffx.exec:\flrlffx.exe41⤵
- Executes dropped EXE
PID:3968 -
\??\c:\7xxxrrr.exec:\7xxxrrr.exe42⤵
- Executes dropped EXE
PID:1056 -
\??\c:\bttttn.exec:\bttttn.exe43⤵
- Executes dropped EXE
PID:3200 -
\??\c:\pppjd.exec:\pppjd.exe44⤵
- Executes dropped EXE
PID:988 -
\??\c:\1dddv.exec:\1dddv.exe45⤵
- Executes dropped EXE
PID:4448 -
\??\c:\7fxxlll.exec:\7fxxlll.exe46⤵
- Executes dropped EXE
PID:8 -
\??\c:\lffrrrl.exec:\lffrrrl.exe47⤵
- Executes dropped EXE
PID:860 -
\??\c:\thnnnn.exec:\thnnnn.exe48⤵
- Executes dropped EXE
PID:2292 -
\??\c:\dvpvv.exec:\dvpvv.exe49⤵
- Executes dropped EXE
PID:1104 -
\??\c:\pjjjd.exec:\pjjjd.exe50⤵
- Executes dropped EXE
PID:4480 -
\??\c:\rllrlfx.exec:\rllrlfx.exe51⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rrllfff.exec:\rrllfff.exe52⤵
- Executes dropped EXE
PID:3132 -
\??\c:\1hnnhh.exec:\1hnnhh.exe53⤵
- Executes dropped EXE
PID:4368 -
\??\c:\3vvpp.exec:\3vvpp.exe54⤵
- Executes dropped EXE
PID:3312 -
\??\c:\9rlrrxx.exec:\9rlrrxx.exe55⤵
- Executes dropped EXE
PID:3480 -
\??\c:\frrfxrr.exec:\frrfxrr.exe56⤵
- Executes dropped EXE
PID:3496 -
\??\c:\hbhbbb.exec:\hbhbbb.exe57⤵
- Executes dropped EXE
PID:3060 -
\??\c:\5dppj.exec:\5dppj.exe58⤵
- Executes dropped EXE
PID:2052 -
\??\c:\ppjdd.exec:\ppjdd.exe59⤵
- Executes dropped EXE
PID:728 -
\??\c:\htbnhn.exec:\htbnhn.exe60⤵
- Executes dropped EXE
PID:4724 -
\??\c:\djjdv.exec:\djjdv.exe61⤵
- Executes dropped EXE
PID:1524 -
\??\c:\xxfxrxx.exec:\xxfxrxx.exe62⤵
- Executes dropped EXE
PID:576 -
\??\c:\3rxxrxf.exec:\3rxxrxf.exe63⤵
- Executes dropped EXE
PID:524 -
\??\c:\btbtnn.exec:\btbtnn.exe64⤵
- Executes dropped EXE
PID:4648 -
\??\c:\dvvvp.exec:\dvvvp.exe65⤵
- Executes dropped EXE
PID:1452 -
\??\c:\fxrrllf.exec:\fxrrllf.exe66⤵PID:5072
-
\??\c:\bbnhtt.exec:\bbnhtt.exe67⤵PID:4896
-
\??\c:\5tbtbb.exec:\5tbtbb.exe68⤵PID:3056
-
\??\c:\3vjdd.exec:\3vjdd.exe69⤵PID:3960
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe70⤵PID:4316
-
\??\c:\5lrllll.exec:\5lrllll.exe71⤵PID:4388
-
\??\c:\9bttnt.exec:\9bttnt.exe72⤵PID:3424
-
\??\c:\pvvvv.exec:\pvvvv.exe73⤵PID:1972
-
\??\c:\vjjdj.exec:\vjjdj.exe74⤵PID:4600
-
\??\c:\jvddv.exec:\jvddv.exe75⤵PID:4912
-
\??\c:\vdpjd.exec:\vdpjd.exe76⤵PID:3420
-
\??\c:\5lffxfx.exec:\5lffxfx.exe77⤵PID:2504
-
\??\c:\llfffff.exec:\llfffff.exe78⤵PID:4744
-
\??\c:\bthbtt.exec:\bthbtt.exe79⤵PID:3968
-
\??\c:\nbhhhh.exec:\nbhhhh.exe80⤵PID:4712
-
\??\c:\1dddv.exec:\1dddv.exe81⤵PID:2152
-
\??\c:\jddpj.exec:\jddpj.exe82⤵PID:3988
-
\??\c:\9tttnn.exec:\9tttnn.exe83⤵PID:4196
-
\??\c:\nbbnbh.exec:\nbbnbh.exe84⤵PID:8
-
\??\c:\jjvpj.exec:\jjvpj.exe85⤵PID:1316
-
\??\c:\1vddv.exec:\1vddv.exe86⤵PID:1196
-
\??\c:\3frlxxl.exec:\3frlxxl.exe87⤵PID:4480
-
\??\c:\7llfxxr.exec:\7llfxxr.exe88⤵PID:2936
-
\??\c:\3nttnn.exec:\3nttnn.exe89⤵PID:1620
-
\??\c:\vdddd.exec:\vdddd.exe90⤵PID:3412
-
\??\c:\pdvvv.exec:\pdvvv.exe91⤵PID:384
-
\??\c:\9rxrlfx.exec:\9rxrlfx.exe92⤵PID:2856
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe93⤵PID:2588
-
\??\c:\tnbthh.exec:\tnbthh.exe94⤵PID:3660
-
\??\c:\jdpjv.exec:\jdpjv.exe95⤵PID:2280
-
\??\c:\jdjdd.exec:\jdjdd.exe96⤵PID:4392
-
\??\c:\xfrllxr.exec:\xfrllxr.exe97⤵PID:4668
-
\??\c:\rlffllf.exec:\rlffllf.exe98⤵PID:1784
-
\??\c:\3tbhht.exec:\3tbhht.exe99⤵PID:4456
-
\??\c:\nbhhbb.exec:\nbhhbb.exe100⤵PID:3592
-
\??\c:\jpvvj.exec:\jpvvj.exe101⤵PID:5024
-
\??\c:\jdjdd.exec:\jdjdd.exe102⤵PID:3652
-
\??\c:\9lrllll.exec:\9lrllll.exe103⤵PID:5072
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe104⤵PID:2696
-
\??\c:\9ttbbh.exec:\9ttbbh.exe105⤵PID:2268
-
\??\c:\bhhbnb.exec:\bhhbnb.exe106⤵PID:4064
-
\??\c:\vdvpj.exec:\vdvpj.exe107⤵PID:1168
-
\??\c:\pdvjd.exec:\pdvjd.exe108⤵PID:4316
-
\??\c:\lfrlllr.exec:\lfrlllr.exe109⤵PID:4388
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe110⤵PID:4948
-
\??\c:\ttnbtt.exec:\ttnbtt.exe111⤵PID:2848
-
\??\c:\jvjdv.exec:\jvjdv.exe112⤵PID:1500
-
\??\c:\3jpjd.exec:\3jpjd.exe113⤵PID:4360
-
\??\c:\fflflrr.exec:\fflflrr.exe114⤵PID:4344
-
\??\c:\lrxrrrr.exec:\lrxrrrr.exe115⤵PID:3420
-
\??\c:\thbthb.exec:\thbthb.exe116⤵PID:1504
-
\??\c:\bbnhbb.exec:\bbnhbb.exe117⤵PID:708
-
\??\c:\jjpjj.exec:\jjpjj.exe118⤵PID:4844
-
\??\c:\pppjd.exec:\pppjd.exe119⤵PID:3200
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe120⤵PID:4740
-
\??\c:\xlrlrll.exec:\xlrlrll.exe121⤵PID:2152
-
\??\c:\hhbtnb.exec:\hhbtnb.exe122⤵PID:452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-