Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
09/06/2024, 12:44
Behavioral task
behavioral1
Sample
f7f7da55156020bf0eed0aae9a54a7c3805575246c31211b8bbd17b36c29ff7b.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
- Target f7f7da55156020bf0eed0aae9a54a7c3805575246c31211b8bbd17b36c29ff7b.exe
- Size 94KB
- Sample240609-pymb3sbd25
- SHA256 f7f7da55156020bf0eed0aae9a54a7c3805575246c31211b8bbd17b36c29ff7b
- MD5 491415f215e5399fae71e386bca61145
- SHA1 2963c924032040389c8e411440f5ffc8f5235a79
- SHA512 5239755c385d41949f25b7b86bbf45f6d69dbb0b3c83134eecd9e640a5f0324f2a7a31303bf8622f4b5ec2eccaa34a9f0e99dad604e3ee91d39a1b558e3951a0
- SSDEEP 1536:cvQBeOGtrYS3srx93UBWfwC6Ggnouy8mVeygryFU2li0gx4EBbhnyLFW+Yd:chOmTsF93UYfwC6GIoutieyhC2lbgGij
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/3048-1-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4804-10-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2384-24-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1920-15-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2948-30-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5076-33-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1712-38-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/696-50-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4468-55-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4072-62-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4812-67-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3488-73-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3816-89-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3408-94-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4124-97-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4656-118-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4504-124-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4628-134-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4448-140-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/404-143-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1080-151-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/672-157-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2644-164-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1704-170-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3404-174-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3924-188-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/640-198-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2636-206-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/372-209-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3836-218-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4476-228-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2796-250-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4756-264-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3488-284-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5052-289-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4908-295-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1976-310-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4124-314-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3184-323-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4728-322-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2568-335-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3900-352-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3328-356-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3532-359-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4300-379-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3688-446-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4976-479-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1780-481-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4112-497-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4844-519-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3328-524-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/656-537-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3300-545-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4632-554-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4804-576-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1932-656-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4676-714-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/752-834-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/564-842-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/640-860-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/836-1041-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3456-1170-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/3048-1-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000a00000002343d-4.dat UPX behavioral2/memory/4804-7-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4804-10-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000800000002344c-11.dat UPX behavioral2/files/0x0007000000023450-17.dat UPX behavioral2/files/0x0007000000023451-22.dat UPX behavioral2/memory/2384-24-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/2948-23-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/1920-15-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023453-28.dat UPX behavioral2/memory/2948-30-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/5076-33-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023454-36.dat UPX behavioral2/files/0x0007000000023455-41.dat UPX behavioral2/memory/1712-38-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023456-46.dat UPX behavioral2/memory/696-50-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023457-52.dat UPX behavioral2/memory/4072-56-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4468-55-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023458-59.dat UPX behavioral2/memory/4072-62-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4812-67-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023459-65.dat UPX behavioral2/files/0x000700000002345a-71.dat UPX behavioral2/memory/3488-73-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002345b-77.dat UPX behavioral2/memory/1988-80-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002345c-83.dat UPX behavioral2/files/0x000700000002345d-88.dat UPX behavioral2/memory/3816-89-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002345e-93.dat UPX behavioral2/memory/3408-94-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4124-97-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002345f-99.dat UPX behavioral2/files/0x0007000000023460-105.dat UPX behavioral2/files/0x0007000000023461-109.dat UPX behavioral2/files/0x0007000000023462-115.dat UPX behavioral2/memory/4656-118-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023463-121.dat UPX behavioral2/memory/4504-124-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023464-126.dat UPX behavioral2/memory/4628-129-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023465-132.dat UPX behavioral2/memory/4628-134-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023466-139.dat UPX behavioral2/memory/4448-140-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/404-143-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023467-146.dat UPX behavioral2/memory/1080-151-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023469-153.dat UPX behavioral2/files/0x000700000002346a-158.dat UPX behavioral2/memory/672-157-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002346b-165.dat UPX behavioral2/memory/2644-164-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/1704-166-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/1704-170-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002346c-171.dat UPX behavioral2/memory/3404-174-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002346d-178.dat UPX behavioral2/files/0x000800000002344d-182.dat UPX behavioral2/files/0x000700000002346e-186.dat UPX behavioral2/memory/3924-188-0x0000000000400000-0x0000000000436000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 4804 hbhhnh.exe 1920 3jpdv.exe 2384 dvppj.exe 2948 5lxrllf.exe 5076 9bnhhh.exe 1712 pvjjj.exe 696 vpvpj.exe 4468 rffxrrr.exe 4072 3lxxfxx.exe 4812 9hnhbn.exe 3488 rffrrrx.exe 4392 hbhhbh.exe 1988 hbhbnn.exe 3816 9vjdv.exe 3408 lrfffxr.exe 4124 tbbtnt.exe 1932 ttbbnn.exe 4924 vpddj.exe 4656 dvjdv.exe 2372 rffxrrl.exe 4504 tbbhbb.exe 4628 jvdjp.exe 4448 xlrrffx.exe 404 tnbbtt.exe 1080 nnnhtt.exe 672 ppjdp.exe 2644 xlllffx.exe 1704 3fllfrr.exe 3404 hbnhnn.exe 3284 vdddv.exe 3924 rllxrrr.exe 2416 bbttnt.exe 4796 vjddv.exe 640 9xllrrr.exe 3444 hbntht.exe 2636 3ttnhn.exe 372 ppjjd.exe 4500 vppjj.exe 3836 lrrlxxl.exe 2428 xxlxfrf.exe 2304 nhnttt.exe 4476 htntbt.exe 3612 vvvjp.exe 1368 lrrflfx.exe 4836 xrrxrrl.exe 2200 hbnnth.exe 3148 nnhhnt.exe 3464 5btttt.exe 2796 pjvvv.exe 1036 vjvdd.exe 3680 xrlfxfx.exe 3172 bhnnhh.exe 624 nbhbbb.exe 4756 nbhbnn.exe 4076 dpvpp.exe 5028 xrrlrrr.exe 4820 lxxrlff.exe 2104 hbbntt.exe 4840 tnnhbb.exe 3488 7pvjv.exe 5052 fxfxlfr.exe 2708 ffxrxxf.exe 4908 bbbbhh.exe 4032 ntnnhh.exe -
resource yara_rule behavioral2/memory/3048-1-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a00000002343d-4.dat upx behavioral2/memory/4804-7-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4804-10-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000800000002344c-11.dat upx behavioral2/files/0x0007000000023450-17.dat upx behavioral2/files/0x0007000000023451-22.dat upx behavioral2/memory/2384-24-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2948-23-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1920-15-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023453-28.dat upx behavioral2/memory/2948-30-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/5076-33-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023454-36.dat upx behavioral2/files/0x0007000000023455-41.dat upx behavioral2/memory/1712-38-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023456-46.dat upx behavioral2/memory/696-50-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023457-52.dat upx behavioral2/memory/4072-56-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4468-55-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023458-59.dat upx behavioral2/memory/4072-62-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4812-67-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023459-65.dat upx behavioral2/files/0x000700000002345a-71.dat upx behavioral2/memory/3488-73-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002345b-77.dat upx behavioral2/memory/1988-80-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002345c-83.dat upx behavioral2/files/0x000700000002345d-88.dat upx behavioral2/memory/3816-89-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002345e-93.dat upx behavioral2/memory/3408-94-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4124-97-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002345f-99.dat upx behavioral2/files/0x0007000000023460-105.dat upx behavioral2/files/0x0007000000023461-109.dat upx behavioral2/files/0x0007000000023462-115.dat upx behavioral2/memory/4656-118-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023463-121.dat upx behavioral2/memory/4504-124-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023464-126.dat upx behavioral2/memory/4628-129-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023465-132.dat upx behavioral2/memory/4628-134-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023466-139.dat upx behavioral2/memory/4448-140-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/404-143-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023467-146.dat upx behavioral2/memory/1080-151-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023469-153.dat upx behavioral2/files/0x000700000002346a-158.dat upx behavioral2/memory/672-157-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002346b-165.dat upx behavioral2/memory/2644-164-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1704-166-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1704-170-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002346c-171.dat upx behavioral2/memory/3404-174-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002346d-178.dat upx behavioral2/files/0x000800000002344d-182.dat upx behavioral2/files/0x000700000002346e-186.dat upx behavioral2/memory/3924-188-0x0000000000400000-0x0000000000436000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 4804 3048 f7f7da55156020bf0eed0aae9a54a7c3805575246c31211b8bbd17b36c29ff7b.exe 82 PID 3048 wrote to memory of 4804 3048 f7f7da55156020bf0eed0aae9a54a7c3805575246c31211b8bbd17b36c29ff7b.exe 82 PID 3048 wrote to memory of 4804 3048 f7f7da55156020bf0eed0aae9a54a7c3805575246c31211b8bbd17b36c29ff7b.exe 82 PID 4804 wrote to memory of 1920 4804 hbhhnh.exe 83 PID 4804 wrote to memory of 1920 4804 hbhhnh.exe 83 PID 4804 wrote to memory of 1920 4804 hbhhnh.exe 83 PID 1920 wrote to memory of 2384 1920 3jpdv.exe 84 PID 1920 wrote to memory of 2384 1920 3jpdv.exe 84 PID 1920 wrote to memory of 2384 1920 3jpdv.exe 84 PID 2384 wrote to memory of 2948 2384 dvppj.exe 85 PID 2384 wrote to memory of 2948 2384 dvppj.exe 85 PID 2384 wrote to memory of 2948 2384 dvppj.exe 85 PID 2948 wrote to memory of 5076 2948 5lxrllf.exe 87 PID 2948 wrote to memory of 5076 2948 5lxrllf.exe 87 PID 2948 wrote to memory of 5076 2948 5lxrllf.exe 87 PID 5076 wrote to memory of 1712 5076 9bnhhh.exe 88 PID 5076 wrote to memory of 1712 5076 9bnhhh.exe 88 PID 5076 wrote to memory of 1712 5076 9bnhhh.exe 88 PID 1712 wrote to memory of 696 1712 pvjjj.exe 89 PID 1712 wrote to memory of 696 1712 pvjjj.exe 89 PID 1712 wrote to memory of 696 1712 pvjjj.exe 89 PID 696 wrote to memory of 4468 696 vpvpj.exe 90 PID 696 wrote to memory of 4468 696 vpvpj.exe 90 PID 696 wrote to memory of 4468 696 vpvpj.exe 90 PID 4468 wrote to memory of 4072 4468 rffxrrr.exe 91 PID 4468 wrote to memory of 4072 4468 rffxrrr.exe 91 PID 4468 wrote to memory of 4072 4468 rffxrrr.exe 91 PID 4072 wrote to memory of 4812 4072 3lxxfxx.exe 92 PID 4072 wrote to memory of 4812 4072 3lxxfxx.exe 92 PID 4072 wrote to memory of 4812 4072 3lxxfxx.exe 92 PID 4812 wrote to memory of 3488 4812 9hnhbn.exe 93 PID 4812 wrote to memory of 3488 4812 9hnhbn.exe 93 PID 4812 wrote to memory of 3488 4812 9hnhbn.exe 93 PID 3488 wrote to memory of 4392 3488 rffrrrx.exe 95 PID 3488 wrote to memory of 4392 3488 rffrrrx.exe 95 PID 3488 wrote to memory of 4392 3488 rffrrrx.exe 95 PID 4392 wrote to memory of 1988 4392 hbhhbh.exe 96 PID 4392 wrote to memory of 1988 4392 hbhhbh.exe 96 PID 4392 wrote to memory of 1988 4392 hbhhbh.exe 96 PID 1988 wrote to memory of 3816 1988 hbhbnn.exe 97 PID 1988 wrote to memory of 3816 1988 hbhbnn.exe 97 PID 1988 wrote to memory of 3816 1988 hbhbnn.exe 97 PID 3816 wrote to memory of 3408 3816 9vjdv.exe 98 PID 3816 wrote to memory of 3408 3816 9vjdv.exe 98 PID 3816 wrote to memory of 3408 3816 9vjdv.exe 98 PID 3408 wrote to memory of 4124 3408 lrfffxr.exe 99 PID 3408 wrote to memory of 4124 3408 lrfffxr.exe 99 PID 3408 wrote to memory of 4124 3408 lrfffxr.exe 99 PID 4124 wrote to memory of 1932 4124 tbbtnt.exe 100 PID 4124 wrote to memory of 1932 4124 tbbtnt.exe 100 PID 4124 wrote to memory of 1932 4124 tbbtnt.exe 100 PID 1932 wrote to memory of 4924 1932 ttbbnn.exe 101 PID 1932 wrote to memory of 4924 1932 ttbbnn.exe 101 PID 1932 wrote to memory of 4924 1932 ttbbnn.exe 101 PID 4924 wrote to memory of 4656 4924 vpddj.exe 102 PID 4924 wrote to memory of 4656 4924 vpddj.exe 102 PID 4924 wrote to memory of 4656 4924 vpddj.exe 102 PID 4656 wrote to memory of 2372 4656 dvjdv.exe 103 PID 4656 wrote to memory of 2372 4656 dvjdv.exe 103 PID 4656 wrote to memory of 2372 4656 dvjdv.exe 103 PID 2372 wrote to memory of 4504 2372 rffxrrl.exe 104 PID 2372 wrote to memory of 4504 2372 rffxrrl.exe 104 PID 2372 wrote to memory of 4504 2372 rffxrrl.exe 104 PID 4504 wrote to memory of 4628 4504 tbbhbb.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7f7da55156020bf0eed0aae9a54a7c3805575246c31211b8bbd17b36c29ff7b.exe"C:\Users\Admin\AppData\Local\Temp\f7f7da55156020bf0eed0aae9a54a7c3805575246c31211b8bbd17b36c29ff7b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\hbhhnh.exec:\hbhhnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\3jpdv.exec:\3jpdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\dvppj.exec:\dvppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\5lxrllf.exec:\5lxrllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\9bnhhh.exec:\9bnhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\pvjjj.exec:\pvjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\vpvpj.exec:\vpvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\rffxrrr.exec:\rffxrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\3lxxfxx.exec:\3lxxfxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\9hnhbn.exec:\9hnhbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\rffrrrx.exec:\rffrrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\hbhhbh.exec:\hbhhbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\hbhbnn.exec:\hbhbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\9vjdv.exec:\9vjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\lrfffxr.exec:\lrfffxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\tbbtnt.exec:\tbbtnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\ttbbnn.exec:\ttbbnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\vpddj.exec:\vpddj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\dvjdv.exec:\dvjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\rffxrrl.exec:\rffxrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\tbbhbb.exec:\tbbhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\jvdjp.exec:\jvdjp.exe23⤵
- Executes dropped EXE
PID:4628 -
\??\c:\xlrrffx.exec:\xlrrffx.exe24⤵
- Executes dropped EXE
PID:4448 -
\??\c:\tnbbtt.exec:\tnbbtt.exe25⤵
- Executes dropped EXE
PID:404 -
\??\c:\nnnhtt.exec:\nnnhtt.exe26⤵
- Executes dropped EXE
PID:1080 -
\??\c:\ppjdp.exec:\ppjdp.exe27⤵
- Executes dropped EXE
PID:672 -
\??\c:\xlllffx.exec:\xlllffx.exe28⤵
- Executes dropped EXE
PID:2644 -
\??\c:\3fllfrr.exec:\3fllfrr.exe29⤵
- Executes dropped EXE
PID:1704 -
\??\c:\hbnhnn.exec:\hbnhnn.exe30⤵
- Executes dropped EXE
PID:3404 -
\??\c:\vdddv.exec:\vdddv.exe31⤵
- Executes dropped EXE
PID:3284 -
\??\c:\rllxrrr.exec:\rllxrrr.exe32⤵
- Executes dropped EXE
PID:3924 -
\??\c:\bbttnt.exec:\bbttnt.exe33⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vjddv.exec:\vjddv.exe34⤵
- Executes dropped EXE
PID:4796 -
\??\c:\9xllrrr.exec:\9xllrrr.exe35⤵
- Executes dropped EXE
PID:640 -
\??\c:\hbntht.exec:\hbntht.exe36⤵
- Executes dropped EXE
PID:3444 -
\??\c:\3ttnhn.exec:\3ttnhn.exe37⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ppjjd.exec:\ppjjd.exe38⤵
- Executes dropped EXE
PID:372 -
\??\c:\vppjj.exec:\vppjj.exe39⤵
- Executes dropped EXE
PID:4500 -
\??\c:\lrrlxxl.exec:\lrrlxxl.exe40⤵
- Executes dropped EXE
PID:3836 -
\??\c:\xxlxfrf.exec:\xxlxfrf.exe41⤵
- Executes dropped EXE
PID:2428 -
\??\c:\nhnttt.exec:\nhnttt.exe42⤵
- Executes dropped EXE
PID:2304 -
\??\c:\htntbt.exec:\htntbt.exe43⤵
- Executes dropped EXE
PID:4476 -
\??\c:\vvvjp.exec:\vvvjp.exe44⤵
- Executes dropped EXE
PID:3612 -
\??\c:\lrrflfx.exec:\lrrflfx.exe45⤵
- Executes dropped EXE
PID:1368 -
\??\c:\xrrxrrl.exec:\xrrxrrl.exe46⤵
- Executes dropped EXE
PID:4836 -
\??\c:\hbnnth.exec:\hbnnth.exe47⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nnhhnt.exec:\nnhhnt.exe48⤵
- Executes dropped EXE
PID:3148 -
\??\c:\5btttt.exec:\5btttt.exe49⤵
- Executes dropped EXE
PID:3464 -
\??\c:\pjvvv.exec:\pjvvv.exe50⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vjvdd.exec:\vjvdd.exe51⤵
- Executes dropped EXE
PID:1036 -
\??\c:\xrlfxfx.exec:\xrlfxfx.exe52⤵
- Executes dropped EXE
PID:3680 -
\??\c:\bhnnhh.exec:\bhnnhh.exe53⤵
- Executes dropped EXE
PID:3172 -
\??\c:\nbhbbb.exec:\nbhbbb.exe54⤵
- Executes dropped EXE
PID:624 -
\??\c:\nbhbnn.exec:\nbhbnn.exe55⤵
- Executes dropped EXE
PID:4756 -
\??\c:\dpvpp.exec:\dpvpp.exe56⤵
- Executes dropped EXE
PID:4076 -
\??\c:\xrrlrrr.exec:\xrrlrrr.exe57⤵
- Executes dropped EXE
PID:5028 -
\??\c:\lxxrlff.exec:\lxxrlff.exe58⤵
- Executes dropped EXE
PID:4820 -
\??\c:\hbbntt.exec:\hbbntt.exe59⤵
- Executes dropped EXE
PID:2104 -
\??\c:\tnnhbb.exec:\tnnhbb.exe60⤵
- Executes dropped EXE
PID:4840 -
\??\c:\7pvjv.exec:\7pvjv.exe61⤵
- Executes dropped EXE
PID:3488 -
\??\c:\fxfxlfr.exec:\fxfxlfr.exe62⤵
- Executes dropped EXE
PID:5052 -
\??\c:\ffxrxxf.exec:\ffxrxxf.exe63⤵
- Executes dropped EXE
PID:2708 -
\??\c:\bbbbhh.exec:\bbbbhh.exe64⤵
- Executes dropped EXE
PID:4908 -
\??\c:\ntnnhh.exec:\ntnnhh.exe65⤵
- Executes dropped EXE
PID:4032 -
\??\c:\5pjjv.exec:\5pjjv.exe66⤵PID:3492
-
\??\c:\jvddv.exec:\jvddv.exe67⤵PID:4424
-
\??\c:\lrfxrrf.exec:\lrfxrrf.exe68⤵PID:1976
-
\??\c:\1tbtnt.exec:\1tbtnt.exe69⤵PID:4124
-
\??\c:\3bhbtt.exec:\3bhbtt.exe70⤵PID:1932
-
\??\c:\tnbbbb.exec:\tnbbbb.exe71⤵PID:4728
-
\??\c:\pjddv.exec:\pjddv.exe72⤵PID:3184
-
\??\c:\lrxxlrl.exec:\lrxxlrl.exe73⤵PID:4656
-
\??\c:\3lrrxfl.exec:\3lrrxfl.exe74⤵PID:3644
-
\??\c:\nbbtth.exec:\nbbtth.exe75⤵PID:2568
-
\??\c:\jvppd.exec:\jvppd.exe76⤵PID:4080
-
\??\c:\3ppjp.exec:\3ppjp.exe77⤵PID:4436
-
\??\c:\xxrrlll.exec:\xxrrlll.exe78⤵PID:4448
-
\??\c:\9xlfllx.exec:\9xlfllx.exe79⤵PID:5012
-
\??\c:\btnbbn.exec:\btnbbn.exe80⤵PID:4880
-
\??\c:\ppjdp.exec:\ppjdp.exe81⤵PID:3900
-
\??\c:\jdvpj.exec:\jdvpj.exe82⤵PID:3328
-
\??\c:\rxffxrr.exec:\rxffxrr.exe83⤵PID:3532
-
\??\c:\frfffll.exec:\frfffll.exe84⤵PID:3424
-
\??\c:\hbttnh.exec:\hbttnh.exe85⤵PID:3608
-
\??\c:\tbbbtn.exec:\tbbbtn.exe86⤵PID:4864
-
\??\c:\pppvv.exec:\pppvv.exe87⤵PID:3932
-
\??\c:\fffxxxx.exec:\fffxxxx.exe88⤵PID:4300
-
\??\c:\fxxrxrr.exec:\fxxrxrr.exe89⤵PID:4608
-
\??\c:\hhtbhh.exec:\hhtbhh.exe90⤵PID:2392
-
\??\c:\nnttbb.exec:\nnttbb.exe91⤵PID:4444
-
\??\c:\jddvp.exec:\jddvp.exe92⤵PID:2848
-
\??\c:\ppdvd.exec:\ppdvd.exe93⤵PID:1420
-
\??\c:\vdddp.exec:\vdddp.exe94⤵PID:4084
-
\??\c:\lffxllf.exec:\lffxllf.exe95⤵PID:3684
-
\??\c:\xxrrlll.exec:\xxrrlll.exe96⤵PID:3836
-
\??\c:\tntnhh.exec:\tntnhh.exe97⤵PID:2976
-
\??\c:\vdjjj.exec:\vdjjj.exe98⤵PID:3824
-
\??\c:\lffxrrr.exec:\lffxrrr.exe99⤵PID:4356
-
\??\c:\lxflllf.exec:\lxflllf.exe100⤵PID:64
-
\??\c:\nnbbhn.exec:\nnbbhn.exe101⤵PID:1608
-
\??\c:\hhttbh.exec:\hhttbh.exe102⤵PID:1028
-
\??\c:\pdvpd.exec:\pdvpd.exe103⤵PID:436
-
\??\c:\3pjdp.exec:\3pjdp.exe104⤵PID:3448
-
\??\c:\9rffflr.exec:\9rffflr.exe105⤵PID:2948
-
\??\c:\nnhhnt.exec:\nnhhnt.exe106⤵PID:1776
-
\??\c:\7bbtnn.exec:\7bbtnn.exe107⤵PID:5076
-
\??\c:\vpvvv.exec:\vpvvv.exe108⤵PID:3592
-
\??\c:\jdddd.exec:\jdddd.exe109⤵PID:4468
-
\??\c:\xlllxxx.exec:\xlllxxx.exe110⤵PID:3688
-
\??\c:\rlrflxr.exec:\rlrflxr.exe111⤵PID:3104
-
\??\c:\thnnnn.exec:\thnnnn.exe112⤵PID:4052
-
\??\c:\pvvvp.exec:\pvvvp.exe113⤵PID:3280
-
\??\c:\dvdjj.exec:\dvdjj.exe114⤵PID:2968
-
\??\c:\1pppv.exec:\1pppv.exe115⤵PID:632
-
\??\c:\rrlffff.exec:\rrlffff.exe116⤵PID:2964
-
\??\c:\fflffxr.exec:\fflffxr.exe117⤵PID:2444
-
\??\c:\tnnhbt.exec:\tnnhbt.exe118⤵PID:3044
-
\??\c:\nhnhhh.exec:\nhnhhh.exe119⤵PID:4172
-
\??\c:\jpppp.exec:\jpppp.exe120⤵PID:4976
-
\??\c:\dvvdp.exec:\dvvdp.exe121⤵PID:1780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-