Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
09/06/2024, 10:48
Behavioral task
behavioral1
Sample
d5993dc670d27e986f810283e320e90de4a7c11f024de9f47c0839b71bd9294f.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target d5993dc670d27e986f810283e320e90de4a7c11f024de9f47c0839b71bd9294f.exe
- Size 93KB
- Sample240609-mwes4shf2s
- SHA256 d5993dc670d27e986f810283e320e90de4a7c11f024de9f47c0839b71bd9294f
- MD5 db079ed4911aad477b3cb45b4e228a89
- SHA1 4230268ab863af58592326649596cf5dffe1df60
- SHA512 29878a1ea7e8598a0c133c6c8b6c421e3d22da78cfae80ead5913fc51f2b6980495c571b91c407a7ea800081bcbf419ab8e07ee5f99ae875acf94c2377933129
- SSDEEP 1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWprCq:8hOmTsF93UYfwC6GIout0fmCiiiXA6mV
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3980-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3444-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/112-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4272-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2924-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4652-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3800-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3080-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4128-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4492-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1428-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/820-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3504-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1476-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1124-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1212-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2428-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2136-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4060-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2388-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/740-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1920-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2724-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1276-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2536-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4748-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3684-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1580-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3972-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2932-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1456-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3800-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1476-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4760-490-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2256-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/3980-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3980-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3444-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00090000000233bb-9.dat UPX behavioral2/memory/2792-11-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000600000002326e-4.dat UPX behavioral2/files/0x00070000000233c7-12.dat UPX behavioral2/memory/2792-15-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2276-20-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233c8-19.dat UPX behavioral2/files/0x00070000000233ca-24.dat UPX behavioral2/files/0x00070000000233cb-30.dat UPX behavioral2/memory/112-29-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5012-25-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4272-32-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233cc-35.dat UPX behavioral2/memory/2924-37-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233cd-40.dat UPX behavioral2/memory/2924-41-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ce-45.dat UPX behavioral2/memory/1844-46-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233cf-50.dat UPX behavioral2/files/0x00070000000233d0-53.dat UPX behavioral2/memory/4888-55-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233d1-60.dat UPX behavioral2/memory/4652-59-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4468-63-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233d2-65.dat UPX behavioral2/memory/4356-70-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233d3-69.dat UPX behavioral2/memory/3800-72-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3800-76-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233d4-75.dat UPX behavioral2/files/0x00070000000233d5-80.dat UPX behavioral2/memory/3500-82-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233d6-85.dat UPX behavioral2/memory/3500-86-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233d7-90.dat UPX behavioral2/memory/4584-91-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233d8-95.dat UPX behavioral2/memory/3080-97-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233d9-101.dat UPX behavioral2/memory/4128-100-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4664-106-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233da-105.dat UPX behavioral2/memory/4492-109-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233db-112.dat UPX behavioral2/files/0x00070000000233dc-116.dat UPX behavioral2/memory/1428-115-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233dd-120.dat UPX behavioral2/files/0x00090000000233bf-125.dat UPX behavioral2/memory/3808-124-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2328-128-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233df-130.dat UPX behavioral2/files/0x00070000000233e0-134.dat UPX behavioral2/memory/820-135-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233e1-140.dat UPX behavioral2/memory/3504-139-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233e2-144.dat UPX behavioral2/memory/696-146-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233e3-149.dat UPX behavioral2/memory/4460-153-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233e4-154.dat UPX behavioral2/files/0x00070000000233e5-158.dat UPX - Executes dropped EXE 64 IoCs
pid Process 3444 lxfxrxx.exe 2792 fxxlffx.exe 2276 pvpjp.exe 5012 lllrffr.exe 112 7ttthb.exe 4272 dddvv.exe 2924 llrfllx.exe 1844 llllffx.exe 4404 9bhhtn.exe 4888 jppjj.exe 4652 lxxrxxf.exe 4468 tbbnhh.exe 4356 dvpjv.exe 3800 rlfrlll.exe 3900 3hhbbb.exe 3500 ddvpp.exe 4584 lrlrllx.exe 3080 nnhbhb.exe 4128 jjppj.exe 4664 rxllfrf.exe 4492 3bnnhh.exe 1428 1jjdv.exe 4784 dpvjd.exe 3808 rrrllrr.exe 2328 tnnnhh.exe 820 vvvjd.exe 3504 ffxxlll.exe 2900 7flxxrr.exe 696 xlrxlrl.exe 4460 rxxrlfr.exe 1476 btbttt.exe 1124 vvvvj.exe 3596 tnhbbb.exe 3232 7dvpd.exe 1904 bnhbtn.exe 1212 ddjjj.exe 2428 rflrfrf.exe 2136 bbtttb.exe 4060 jvvjd.exe 2388 pvddd.exe 2332 xrxfrrr.exe 3292 3nttnn.exe 4840 1pjjv.exe 2108 ppdpp.exe 3716 lfrlfff.exe 1052 nnhhbb.exe 3108 nbtnnh.exe 1976 jpppj.exe 4396 dddpj.exe 4924 7xfxllf.exe 3304 bhhbnn.exe 3352 tntnhh.exe 404 9jjjv.exe 740 fxlflxr.exe 1672 nttbtn.exe 4020 7bbbnn.exe 5108 vpppd.exe 3244 rlrlxxx.exe 4968 rxxlfxr.exe 3980 nttnnh.exe 1920 jdvpj.exe 5028 vvjdj.exe 2956 hbhhnn.exe 4640 djvvv.exe -
resource yara_rule behavioral2/memory/3980-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3980-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3444-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233bb-9.dat upx behavioral2/memory/2792-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000600000002326e-4.dat upx behavioral2/files/0x00070000000233c7-12.dat upx behavioral2/memory/2792-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2276-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233c8-19.dat upx behavioral2/files/0x00070000000233ca-24.dat upx behavioral2/files/0x00070000000233cb-30.dat upx behavioral2/memory/112-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5012-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4272-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233cc-35.dat upx behavioral2/memory/2924-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233cd-40.dat upx behavioral2/memory/2924-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ce-45.dat upx behavioral2/memory/1844-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233cf-50.dat upx behavioral2/files/0x00070000000233d0-53.dat upx behavioral2/memory/4888-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d1-60.dat upx behavioral2/memory/4652-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4468-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d2-65.dat upx behavioral2/memory/4356-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d3-69.dat upx behavioral2/memory/3800-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3800-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d4-75.dat upx behavioral2/files/0x00070000000233d5-80.dat upx behavioral2/memory/3500-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d6-85.dat upx behavioral2/memory/3500-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d7-90.dat upx behavioral2/memory/4584-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d8-95.dat upx behavioral2/memory/3080-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d9-101.dat upx behavioral2/memory/4128-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4664-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233da-105.dat upx behavioral2/memory/4492-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233db-112.dat upx behavioral2/files/0x00070000000233dc-116.dat upx behavioral2/memory/1428-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233dd-120.dat upx behavioral2/files/0x00090000000233bf-125.dat upx behavioral2/memory/3808-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2328-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233df-130.dat upx behavioral2/files/0x00070000000233e0-134.dat upx behavioral2/memory/820-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e1-140.dat upx behavioral2/memory/3504-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e2-144.dat upx behavioral2/memory/696-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e3-149.dat upx behavioral2/memory/4460-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e4-154.dat upx behavioral2/files/0x00070000000233e5-158.dat upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3980 wrote to memory of 3444 3980 d5993dc670d27e986f810283e320e90de4a7c11f024de9f47c0839b71bd9294f.exe 81 PID 3980 wrote to memory of 3444 3980 d5993dc670d27e986f810283e320e90de4a7c11f024de9f47c0839b71bd9294f.exe 81 PID 3980 wrote to memory of 3444 3980 d5993dc670d27e986f810283e320e90de4a7c11f024de9f47c0839b71bd9294f.exe 81 PID 3444 wrote to memory of 2792 3444 lxfxrxx.exe 82 PID 3444 wrote to memory of 2792 3444 lxfxrxx.exe 82 PID 3444 wrote to memory of 2792 3444 lxfxrxx.exe 82 PID 2792 wrote to memory of 2276 2792 fxxlffx.exe 83 PID 2792 wrote to memory of 2276 2792 fxxlffx.exe 83 PID 2792 wrote to memory of 2276 2792 fxxlffx.exe 83 PID 2276 wrote to memory of 5012 2276 pvpjp.exe 84 PID 2276 wrote to memory of 5012 2276 pvpjp.exe 84 PID 2276 wrote to memory of 5012 2276 pvpjp.exe 84 PID 5012 wrote to memory of 112 5012 lllrffr.exe 85 PID 5012 wrote to memory of 112 5012 lllrffr.exe 85 PID 5012 wrote to memory of 112 5012 lllrffr.exe 85 PID 112 wrote to memory of 4272 112 7ttthb.exe 86 PID 112 wrote to memory of 4272 112 7ttthb.exe 86 PID 112 wrote to memory of 4272 112 7ttthb.exe 86 PID 4272 wrote to memory of 2924 4272 dddvv.exe 87 PID 4272 wrote to memory of 2924 4272 dddvv.exe 87 PID 4272 wrote to memory of 2924 4272 dddvv.exe 87 PID 2924 wrote to memory of 1844 2924 llrfllx.exe 88 PID 2924 wrote to memory of 1844 2924 llrfllx.exe 88 PID 2924 wrote to memory of 1844 2924 llrfllx.exe 88 PID 1844 wrote to memory of 4404 1844 llllffx.exe 89 PID 1844 wrote to memory of 4404 1844 llllffx.exe 89 PID 1844 wrote to memory of 4404 1844 llllffx.exe 89 PID 4404 wrote to memory of 4888 4404 9bhhtn.exe 90 PID 4404 wrote to memory of 4888 4404 9bhhtn.exe 90 PID 4404 wrote to memory of 4888 4404 9bhhtn.exe 90 PID 4888 wrote to memory of 4652 4888 jppjj.exe 91 PID 4888 wrote to memory of 4652 4888 jppjj.exe 91 PID 4888 wrote to memory of 4652 4888 jppjj.exe 91 PID 4652 wrote to memory of 4468 4652 lxxrxxf.exe 92 PID 4652 wrote to memory of 4468 4652 lxxrxxf.exe 92 PID 4652 wrote to memory of 4468 4652 lxxrxxf.exe 92 PID 4468 wrote to memory of 4356 4468 tbbnhh.exe 93 PID 4468 wrote to memory of 4356 4468 tbbnhh.exe 93 PID 4468 wrote to memory of 4356 4468 tbbnhh.exe 93 PID 4356 wrote to memory of 3800 4356 dvpjv.exe 94 PID 4356 wrote to memory of 3800 4356 dvpjv.exe 94 PID 4356 wrote to memory of 3800 4356 dvpjv.exe 94 PID 3800 wrote to memory of 3900 3800 rlfrlll.exe 95 PID 3800 wrote to memory of 3900 3800 rlfrlll.exe 95 PID 3800 wrote to memory of 3900 3800 rlfrlll.exe 95 PID 3900 wrote to memory of 3500 3900 3hhbbb.exe 96 PID 3900 wrote to memory of 3500 3900 3hhbbb.exe 96 PID 3900 wrote to memory of 3500 3900 3hhbbb.exe 96 PID 3500 wrote to memory of 4584 3500 ddvpp.exe 97 PID 3500 wrote to memory of 4584 3500 ddvpp.exe 97 PID 3500 wrote to memory of 4584 3500 ddvpp.exe 97 PID 4584 wrote to memory of 3080 4584 lrlrllx.exe 98 PID 4584 wrote to memory of 3080 4584 lrlrllx.exe 98 PID 4584 wrote to memory of 3080 4584 lrlrllx.exe 98 PID 3080 wrote to memory of 4128 3080 nnhbhb.exe 99 PID 3080 wrote to memory of 4128 3080 nnhbhb.exe 99 PID 3080 wrote to memory of 4128 3080 nnhbhb.exe 99 PID 4128 wrote to memory of 4664 4128 jjppj.exe 100 PID 4128 wrote to memory of 4664 4128 jjppj.exe 100 PID 4128 wrote to memory of 4664 4128 jjppj.exe 100 PID 4664 wrote to memory of 4492 4664 rxllfrf.exe 101 PID 4664 wrote to memory of 4492 4664 rxllfrf.exe 101 PID 4664 wrote to memory of 4492 4664 rxllfrf.exe 101 PID 4492 wrote to memory of 1428 4492 3bnnhh.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5993dc670d27e986f810283e320e90de4a7c11f024de9f47c0839b71bd9294f.exe"C:\Users\Admin\AppData\Local\Temp\d5993dc670d27e986f810283e320e90de4a7c11f024de9f47c0839b71bd9294f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\lxfxrxx.exec:\lxfxrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\fxxlffx.exec:\fxxlffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\pvpjp.exec:\pvpjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\lllrffr.exec:\lllrffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\7ttthb.exec:\7ttthb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\dddvv.exec:\dddvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\llrfllx.exec:\llrfllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\llllffx.exec:\llllffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\9bhhtn.exec:\9bhhtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\jppjj.exec:\jppjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\lxxrxxf.exec:\lxxrxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\tbbnhh.exec:\tbbnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\dvpjv.exec:\dvpjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\rlfrlll.exec:\rlfrlll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\3hhbbb.exec:\3hhbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\ddvpp.exec:\ddvpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\lrlrllx.exec:\lrlrllx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\nnhbhb.exec:\nnhbhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\jjppj.exec:\jjppj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\rxllfrf.exec:\rxllfrf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\3bnnhh.exec:\3bnnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\1jjdv.exec:\1jjdv.exe23⤵
- Executes dropped EXE
PID:1428 -
\??\c:\dpvjd.exec:\dpvjd.exe24⤵
- Executes dropped EXE
PID:4784 -
\??\c:\rrrllrr.exec:\rrrllrr.exe25⤵
- Executes dropped EXE
PID:3808 -
\??\c:\tnnnhh.exec:\tnnnhh.exe26⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vvvjd.exec:\vvvjd.exe27⤵
- Executes dropped EXE
PID:820 -
\??\c:\ffxxlll.exec:\ffxxlll.exe28⤵
- Executes dropped EXE
PID:3504 -
\??\c:\7flxxrr.exec:\7flxxrr.exe29⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xlrxlrl.exec:\xlrxlrl.exe30⤵
- Executes dropped EXE
PID:696 -
\??\c:\rxxrlfr.exec:\rxxrlfr.exe31⤵
- Executes dropped EXE
PID:4460 -
\??\c:\btbttt.exec:\btbttt.exe32⤵
- Executes dropped EXE
PID:1476 -
\??\c:\vvvvj.exec:\vvvvj.exe33⤵
- Executes dropped EXE
PID:1124 -
\??\c:\tnhbbb.exec:\tnhbbb.exe34⤵
- Executes dropped EXE
PID:3596 -
\??\c:\7dvpd.exec:\7dvpd.exe35⤵
- Executes dropped EXE
PID:3232 -
\??\c:\bnhbtn.exec:\bnhbtn.exe36⤵
- Executes dropped EXE
PID:1904 -
\??\c:\ddjjj.exec:\ddjjj.exe37⤵
- Executes dropped EXE
PID:1212 -
\??\c:\rflrfrf.exec:\rflrfrf.exe38⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bbtttb.exec:\bbtttb.exe39⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jvvjd.exec:\jvvjd.exe40⤵
- Executes dropped EXE
PID:4060 -
\??\c:\pvddd.exec:\pvddd.exe41⤵
- Executes dropped EXE
PID:2388 -
\??\c:\xrxfrrr.exec:\xrxfrrr.exe42⤵
- Executes dropped EXE
PID:2332 -
\??\c:\3nttnn.exec:\3nttnn.exe43⤵
- Executes dropped EXE
PID:3292 -
\??\c:\1pjjv.exec:\1pjjv.exe44⤵
- Executes dropped EXE
PID:4840 -
\??\c:\ppdpp.exec:\ppdpp.exe45⤵
- Executes dropped EXE
PID:2108 -
\??\c:\lfrlfff.exec:\lfrlfff.exe46⤵
- Executes dropped EXE
PID:3716 -
\??\c:\nnhhbb.exec:\nnhhbb.exe47⤵
- Executes dropped EXE
PID:1052 -
\??\c:\nbtnnh.exec:\nbtnnh.exe48⤵
- Executes dropped EXE
PID:3108 -
\??\c:\jpppj.exec:\jpppj.exe49⤵
- Executes dropped EXE
PID:1976 -
\??\c:\dddpj.exec:\dddpj.exe50⤵
- Executes dropped EXE
PID:4396 -
\??\c:\7xfxllf.exec:\7xfxllf.exe51⤵
- Executes dropped EXE
PID:4924 -
\??\c:\bhhbnn.exec:\bhhbnn.exe52⤵
- Executes dropped EXE
PID:3304 -
\??\c:\tntnhh.exec:\tntnhh.exe53⤵
- Executes dropped EXE
PID:3352 -
\??\c:\9jjjv.exec:\9jjjv.exe54⤵
- Executes dropped EXE
PID:404 -
\??\c:\fxlflxr.exec:\fxlflxr.exe55⤵
- Executes dropped EXE
PID:740 -
\??\c:\nttbtn.exec:\nttbtn.exe56⤵
- Executes dropped EXE
PID:1672 -
\??\c:\7bbbnn.exec:\7bbbnn.exe57⤵
- Executes dropped EXE
PID:4020 -
\??\c:\vpppd.exec:\vpppd.exe58⤵
- Executes dropped EXE
PID:5108 -
\??\c:\rlrlxxx.exec:\rlrlxxx.exe59⤵
- Executes dropped EXE
PID:3244 -
\??\c:\rxxlfxr.exec:\rxxlfxr.exe60⤵
- Executes dropped EXE
PID:4968 -
\??\c:\nttnnh.exec:\nttnnh.exe61⤵
- Executes dropped EXE
PID:3980 -
\??\c:\jdvpj.exec:\jdvpj.exe62⤵
- Executes dropped EXE
PID:1920 -
\??\c:\vvjdj.exec:\vvjdj.exe63⤵
- Executes dropped EXE
PID:5028 -
\??\c:\hbhhnn.exec:\hbhhnn.exe64⤵
- Executes dropped EXE
PID:2956 -
\??\c:\djvvv.exec:\djvvv.exe65⤵
- Executes dropped EXE
PID:4640 -
\??\c:\jddvp.exec:\jddvp.exe66⤵PID:5012
-
\??\c:\xlffxxx.exec:\xlffxxx.exe67⤵PID:2412
-
\??\c:\xxxfxxr.exec:\xxxfxxr.exe68⤵PID:2724
-
\??\c:\1hnnhn.exec:\1hnnhn.exe69⤵PID:1856
-
\??\c:\vppdv.exec:\vppdv.exe70⤵PID:2924
-
\??\c:\xlrrlrr.exec:\xlrrlrr.exe71⤵PID:4972
-
\??\c:\nnnnnn.exec:\nnnnnn.exe72⤵PID:4608
-
\??\c:\hthbtt.exec:\hthbtt.exe73⤵PID:1276
-
\??\c:\vdvvv.exec:\vdvvv.exe74⤵PID:2572
-
\??\c:\5xfffff.exec:\5xfffff.exe75⤵PID:1388
-
\??\c:\5xrrlxx.exec:\5xrrlxx.exe76⤵PID:544
-
\??\c:\hnbbth.exec:\hnbbth.exe77⤵PID:620
-
\??\c:\ttnnhb.exec:\ttnnhb.exe78⤵PID:5088
-
\??\c:\dvvvp.exec:\dvvvp.exe79⤵PID:4468
-
\??\c:\lxxrfxx.exec:\lxxrfxx.exe80⤵PID:2536
-
\??\c:\7nbbtt.exec:\7nbbtt.exe81⤵PID:4144
-
\??\c:\bhhhbn.exec:\bhhhbn.exe82⤵PID:764
-
\??\c:\pjvvp.exec:\pjvvp.exe83⤵PID:4912
-
\??\c:\3jpjj.exec:\3jpjj.exe84⤵PID:5020
-
\??\c:\7frxlrl.exec:\7frxlrl.exe85⤵PID:3500
-
\??\c:\nthbbt.exec:\nthbbt.exe86⤵PID:1484
-
\??\c:\bthhhh.exec:\bthhhh.exe87⤵PID:1916
-
\??\c:\jpppp.exec:\jpppp.exe88⤵PID:1608
-
\??\c:\vjjdv.exec:\vjjdv.exe89⤵PID:232
-
\??\c:\7xffrrl.exec:\7xffrrl.exe90⤵PID:3152
-
\??\c:\hbnntn.exec:\hbnntn.exe91⤵PID:4664
-
\??\c:\thnhbb.exec:\thnhbb.exe92⤵PID:1960
-
\??\c:\1ppvp.exec:\1ppvp.exe93⤵PID:3892
-
\??\c:\xrxfffl.exec:\xrxfffl.exe94⤵PID:2260
-
\??\c:\nnnhhh.exec:\nnnhhh.exe95⤵PID:4784
-
\??\c:\nbnhhh.exec:\nbnhhh.exe96⤵PID:636
-
\??\c:\rrlxrrr.exec:\rrlxrrr.exe97⤵PID:4736
-
\??\c:\frlxxxr.exec:\frlxxxr.exe98⤵PID:5092
-
\??\c:\btttnn.exec:\btttnn.exe99⤵PID:3540
-
\??\c:\hhhhbh.exec:\hhhhbh.exe100⤵PID:368
-
\??\c:\pppdp.exec:\pppdp.exe101⤵PID:4800
-
\??\c:\vvvpj.exec:\vvvpj.exe102⤵PID:3780
-
\??\c:\rlllllx.exec:\rlllllx.exe103⤵PID:3924
-
\??\c:\hhbhhh.exec:\hhbhhh.exe104⤵PID:4804
-
\??\c:\djjjv.exec:\djjjv.exe105⤵PID:1444
-
\??\c:\dpppp.exec:\dpppp.exe106⤵PID:4932
-
\??\c:\vjppp.exec:\vjppp.exe107⤵PID:4748
-
\??\c:\nnhhnn.exec:\nnhhnn.exe108⤵PID:3596
-
\??\c:\1vddv.exec:\1vddv.exe109⤵PID:4288
-
\??\c:\frrlffx.exec:\frrlffx.exe110⤵PID:1904
-
\??\c:\lffxrrl.exec:\lffxrrl.exe111⤵PID:4860
-
\??\c:\thbtnt.exec:\thbtnt.exe112⤵PID:3600
-
\??\c:\ntbtnb.exec:\ntbtnb.exe113⤵PID:2136
-
\??\c:\5dvdp.exec:\5dvdp.exe114⤵PID:1648
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe115⤵PID:2452
-
\??\c:\5rrxrrx.exec:\5rrxrrx.exe116⤵PID:2388
-
\??\c:\3hnhth.exec:\3hnhth.exe117⤵PID:3684
-
\??\c:\pdjdp.exec:\pdjdp.exe118⤵PID:3292
-
\??\c:\3vppj.exec:\3vppj.exe119⤵PID:2804
-
\??\c:\fxxfxlf.exec:\fxxfxlf.exe120⤵PID:1580
-
\??\c:\1ttttb.exec:\1ttttb.exe121⤵PID:3560
-
\??\c:\nttnnn.exec:\nttnnn.exe122⤵PID:4088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-