Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
10/06/2024, 22:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5eef040b21bd60a2201731cc5d877b10fc81ddbb681b11550cfe2bed4cedf01f.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target 5eef040b21bd60a2201731cc5d877b10fc81ddbb681b11550cfe2bed4cedf01f.exe
- Size 521KB
- Sample240610-2jckjstfqq
- SHA256 5eef040b21bd60a2201731cc5d877b10fc81ddbb681b11550cfe2bed4cedf01f
- MD5 368a8980324ab69de4cce002acda2c6e
- SHA1 b88d5c855807317f304dfdc0cfa7b5bda8378079
- SHA512 79a113e78a71a40ab306dfe4cc6982c022b96aec802cf5497ffe53adc22573c2e4a6e23b23173ce376746464b6636df3a917ed301581655e6348f6ac03a4d49b
- SSDEEP 6144:8cm7ImGddXmNt251UriZFwfsDX2CfNnkymTwaJ3o89H3c:q7Tc2NYHUrAwfMHNnpls489s
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4804-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/352-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2804-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1120-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4208-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/348-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1316-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3880-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-752-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-769-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-782-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-914-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/1692-12-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4804-7-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/352-5-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1692-16-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2260-28-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1224-35-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4048-41-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1604-48-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3056-52-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2408-60-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1908-62-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3060-70-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1724-78-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2804-86-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4740-98-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3148-100-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3148-105-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4528-107-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4608-113-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3652-119-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3036-124-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1120-134-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4264-146-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3928-153-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4208-160-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/5084-166-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3180-176-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/552-190-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4200-183-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1532-193-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2436-197-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1052-201-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4568-205-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/408-207-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/408-210-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2184-211-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2656-225-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4488-229-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/348-233-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1316-235-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3640-251-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4048-260-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1604-267-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4824-271-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4360-281-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4816-285-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4832-307-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2144-323-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/5008-327-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4608-331-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3652-335-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3880-348-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1256-352-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3092-362-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1796-366-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1796-370-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/5116-380-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4456-384-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1500-404-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1692-426-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1992-436-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1380-455-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2408-468-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3296-475-0x0000000000400000-0x000000000042A000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 4804 tnbbbh.exe 1692 5pvjv.exe 4440 lrxrrrr.exe 2260 vpvpp.exe 1224 tnhhbh.exe 4048 xlfffll.exe 1604 thhtnn.exe 3056 tnhhhh.exe 2408 lfrllff.exe 1908 djvpd.exe 3060 lllrrrr.exe 1724 rrrrrrf.exe 3900 3nhnnn.exe 2804 3tbbtt.exe 2496 7ntnnn.exe 4740 ddvpj.exe 3148 vpppp.exe 4528 nhbbtt.exe 4608 jjjjd.exe 3652 frfffff.exe 3036 bhttnn.exe 1120 pdddd.exe 3880 7lrrrfr.exe 2516 lfxxxrr.exe 4264 bbhhhn.exe 3928 dpddv.exe 4208 jjddd.exe 5084 fxffxfx.exe 3180 ppdvj.exe 4200 1nhbhh.exe 552 dpddv.exe 1532 lrlllrx.exe 2436 thtnnt.exe 1052 xrxxxxf.exe 4568 7bnbbb.exe 408 vvddd.exe 2184 fxxxrlf.exe 4892 thtthb.exe 2168 bbnnnn.exe 3192 pjjpj.exe 2656 xlffxff.exe 348 ttbnnt.exe 1316 vjjdv.exe 1588 xrffxxx.exe 752 rrffllr.exe 2472 nntnht.exe 3560 vpvdj.exe 3640 ppddd.exe 2812 rlfxllf.exe 4048 tthhhh.exe 1380 jvjjp.exe 1604 lrffrxx.exe 4824 bnbbtb.exe 1012 3tnnnn.exe 828 jdjdd.exe 4360 frfffff.exe 4816 bbnhhh.exe 3512 ttbtnn.exe 1344 dvjdj.exe 3060 lxfffff.exe 4836 1bnnhn.exe 3844 nhhhbb.exe 2400 vvjjv.exe 4832 lrlxxxx.exe -
resource yara_rule behavioral2/memory/1692-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/352-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2804-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4208-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/348-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1316-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1256-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-475-0x0000000000400000-0x000000000042A000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 352 wrote to memory of 4804 352 5eef040b21bd60a2201731cc5d877b10fc81ddbb681b11550cfe2bed4cedf01f.exe 83 PID 352 wrote to memory of 4804 352 5eef040b21bd60a2201731cc5d877b10fc81ddbb681b11550cfe2bed4cedf01f.exe 83 PID 352 wrote to memory of 4804 352 5eef040b21bd60a2201731cc5d877b10fc81ddbb681b11550cfe2bed4cedf01f.exe 83 PID 4804 wrote to memory of 1692 4804 tnbbbh.exe 84 PID 4804 wrote to memory of 1692 4804 tnbbbh.exe 84 PID 4804 wrote to memory of 1692 4804 tnbbbh.exe 84 PID 1692 wrote to memory of 4440 1692 5pvjv.exe 85 PID 1692 wrote to memory of 4440 1692 5pvjv.exe 85 PID 1692 wrote to memory of 4440 1692 5pvjv.exe 85 PID 4440 wrote to memory of 2260 4440 lrxrrrr.exe 86 PID 4440 wrote to memory of 2260 4440 lrxrrrr.exe 86 PID 4440 wrote to memory of 2260 4440 lrxrrrr.exe 86 PID 2260 wrote to memory of 1224 2260 vpvpp.exe 87 PID 2260 wrote to memory of 1224 2260 vpvpp.exe 87 PID 2260 wrote to memory of 1224 2260 vpvpp.exe 87 PID 1224 wrote to memory of 4048 1224 tnhhbh.exe 89 PID 1224 wrote to memory of 4048 1224 tnhhbh.exe 89 PID 1224 wrote to memory of 4048 1224 tnhhbh.exe 89 PID 4048 wrote to memory of 1604 4048 xlfffll.exe 90 PID 4048 wrote to memory of 1604 4048 xlfffll.exe 90 PID 4048 wrote to memory of 1604 4048 xlfffll.exe 90 PID 1604 wrote to memory of 3056 1604 thhtnn.exe 91 PID 1604 wrote to memory of 3056 1604 thhtnn.exe 91 PID 1604 wrote to memory of 3056 1604 thhtnn.exe 91 PID 3056 wrote to memory of 2408 3056 tnhhhh.exe 92 PID 3056 wrote to memory of 2408 3056 tnhhhh.exe 92 PID 3056 wrote to memory of 2408 3056 tnhhhh.exe 92 PID 2408 wrote to memory of 1908 2408 lfrllff.exe 93 PID 2408 wrote to memory of 1908 2408 lfrllff.exe 93 PID 2408 wrote to memory of 1908 2408 lfrllff.exe 93 PID 1908 wrote to memory of 3060 1908 djvpd.exe 94 PID 1908 wrote to memory of 3060 1908 djvpd.exe 94 PID 1908 wrote to memory of 3060 1908 djvpd.exe 94 PID 3060 wrote to memory of 1724 3060 lllrrrr.exe 96 PID 3060 wrote to memory of 1724 3060 lllrrrr.exe 96 PID 3060 wrote to memory of 1724 3060 lllrrrr.exe 96 PID 1724 wrote to memory of 3900 1724 rrrrrrf.exe 97 PID 1724 wrote to memory of 3900 1724 rrrrrrf.exe 97 PID 1724 wrote to memory of 3900 1724 rrrrrrf.exe 97 PID 3900 wrote to memory of 2804 3900 3nhnnn.exe 98 PID 3900 wrote to memory of 2804 3900 3nhnnn.exe 98 PID 3900 wrote to memory of 2804 3900 3nhnnn.exe 98 PID 2804 wrote to memory of 2496 2804 3tbbtt.exe 99 PID 2804 wrote to memory of 2496 2804 3tbbtt.exe 99 PID 2804 wrote to memory of 2496 2804 3tbbtt.exe 99 PID 2496 wrote to memory of 4740 2496 7ntnnn.exe 100 PID 2496 wrote to memory of 4740 2496 7ntnnn.exe 100 PID 2496 wrote to memory of 4740 2496 7ntnnn.exe 100 PID 4740 wrote to memory of 3148 4740 ddvpj.exe 101 PID 4740 wrote to memory of 3148 4740 ddvpj.exe 101 PID 4740 wrote to memory of 3148 4740 ddvpj.exe 101 PID 3148 wrote to memory of 4528 3148 vpppp.exe 102 PID 3148 wrote to memory of 4528 3148 vpppp.exe 102 PID 3148 wrote to memory of 4528 3148 vpppp.exe 102 PID 4528 wrote to memory of 4608 4528 nhbbtt.exe 103 PID 4528 wrote to memory of 4608 4528 nhbbtt.exe 103 PID 4528 wrote to memory of 4608 4528 nhbbtt.exe 103 PID 4608 wrote to memory of 3652 4608 jjjjd.exe 104 PID 4608 wrote to memory of 3652 4608 jjjjd.exe 104 PID 4608 wrote to memory of 3652 4608 jjjjd.exe 104 PID 3652 wrote to memory of 3036 3652 frfffff.exe 105 PID 3652 wrote to memory of 3036 3652 frfffff.exe 105 PID 3652 wrote to memory of 3036 3652 frfffff.exe 105 PID 3036 wrote to memory of 1120 3036 bhttnn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\5eef040b21bd60a2201731cc5d877b10fc81ddbb681b11550cfe2bed4cedf01f.exe"C:\Users\Admin\AppData\Local\Temp\5eef040b21bd60a2201731cc5d877b10fc81ddbb681b11550cfe2bed4cedf01f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\tnbbbh.exec:\tnbbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\5pvjv.exec:\5pvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\lrxrrrr.exec:\lrxrrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\vpvpp.exec:\vpvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\tnhhbh.exec:\tnhhbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\xlfffll.exec:\xlfffll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\thhtnn.exec:\thhtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\tnhhhh.exec:\tnhhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\lfrllff.exec:\lfrllff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\djvpd.exec:\djvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\lllrrrr.exec:\lllrrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\rrrrrrf.exec:\rrrrrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\3nhnnn.exec:\3nhnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\3tbbtt.exec:\3tbbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\7ntnnn.exec:\7ntnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\ddvpj.exec:\ddvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\vpppp.exec:\vpppp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\nhbbtt.exec:\nhbbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\jjjjd.exec:\jjjjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\frfffff.exec:\frfffff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\bhttnn.exec:\bhttnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\pdddd.exec:\pdddd.exe23⤵
- Executes dropped EXE
PID:1120 -
\??\c:\7lrrrfr.exec:\7lrrrfr.exe24⤵
- Executes dropped EXE
PID:3880 -
\??\c:\lfxxxrr.exec:\lfxxxrr.exe25⤵
- Executes dropped EXE
PID:2516 -
\??\c:\bbhhhn.exec:\bbhhhn.exe26⤵
- Executes dropped EXE
PID:4264 -
\??\c:\dpddv.exec:\dpddv.exe27⤵
- Executes dropped EXE
PID:3928 -
\??\c:\jjddd.exec:\jjddd.exe28⤵
- Executes dropped EXE
PID:4208 -
\??\c:\fxffxfx.exec:\fxffxfx.exe29⤵
- Executes dropped EXE
PID:5084 -
\??\c:\ppdvj.exec:\ppdvj.exe30⤵
- Executes dropped EXE
PID:3180 -
\??\c:\1nhbhh.exec:\1nhbhh.exe31⤵
- Executes dropped EXE
PID:4200 -
\??\c:\dpddv.exec:\dpddv.exe32⤵
- Executes dropped EXE
PID:552 -
\??\c:\lrlllrx.exec:\lrlllrx.exe33⤵
- Executes dropped EXE
PID:1532 -
\??\c:\thtnnt.exec:\thtnnt.exe34⤵
- Executes dropped EXE
PID:2436 -
\??\c:\xrxxxxf.exec:\xrxxxxf.exe35⤵
- Executes dropped EXE
PID:1052 -
\??\c:\7bnbbb.exec:\7bnbbb.exe36⤵
- Executes dropped EXE
PID:4568 -
\??\c:\vvddd.exec:\vvddd.exe37⤵
- Executes dropped EXE
PID:408 -
\??\c:\fxxxrlf.exec:\fxxxrlf.exe38⤵
- Executes dropped EXE
PID:2184 -
\??\c:\thtthb.exec:\thtthb.exe39⤵
- Executes dropped EXE
PID:4892 -
\??\c:\bbnnnn.exec:\bbnnnn.exe40⤵
- Executes dropped EXE
PID:2168 -
\??\c:\pjjpj.exec:\pjjpj.exe41⤵
- Executes dropped EXE
PID:3192 -
\??\c:\xlffxff.exec:\xlffxff.exe42⤵
- Executes dropped EXE
PID:2656 -
\??\c:\7xxxxxr.exec:\7xxxxxr.exe43⤵PID:4488
-
\??\c:\ttbnnt.exec:\ttbnnt.exe44⤵
- Executes dropped EXE
PID:348 -
\??\c:\vjjdv.exec:\vjjdv.exe45⤵
- Executes dropped EXE
PID:1316 -
\??\c:\xrffxxx.exec:\xrffxxx.exe46⤵
- Executes dropped EXE
PID:1588 -
\??\c:\rrffllr.exec:\rrffllr.exe47⤵
- Executes dropped EXE
PID:752 -
\??\c:\nntnht.exec:\nntnht.exe48⤵
- Executes dropped EXE
PID:2472 -
\??\c:\vpvdj.exec:\vpvdj.exe49⤵
- Executes dropped EXE
PID:3560 -
\??\c:\ppddd.exec:\ppddd.exe50⤵
- Executes dropped EXE
PID:3640 -
\??\c:\rlfxllf.exec:\rlfxllf.exe51⤵
- Executes dropped EXE
PID:2812 -
\??\c:\tthhhh.exec:\tthhhh.exe52⤵
- Executes dropped EXE
PID:4048 -
\??\c:\jvjjp.exec:\jvjjp.exe53⤵
- Executes dropped EXE
PID:1380 -
\??\c:\lrffrxx.exec:\lrffrxx.exe54⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bnbbtb.exec:\bnbbtb.exe55⤵
- Executes dropped EXE
PID:4824 -
\??\c:\3tnnnn.exec:\3tnnnn.exe56⤵
- Executes dropped EXE
PID:1012 -
\??\c:\jdjdd.exec:\jdjdd.exe57⤵
- Executes dropped EXE
PID:828 -
\??\c:\frfffff.exec:\frfffff.exe58⤵
- Executes dropped EXE
PID:4360 -
\??\c:\bbnhhh.exec:\bbnhhh.exe59⤵
- Executes dropped EXE
PID:4816 -
\??\c:\ttbtnn.exec:\ttbtnn.exe60⤵
- Executes dropped EXE
PID:3512 -
\??\c:\dvjdj.exec:\dvjdj.exe61⤵
- Executes dropped EXE
PID:1344 -
\??\c:\lxfffff.exec:\lxfffff.exe62⤵
- Executes dropped EXE
PID:3060 -
\??\c:\1bnnhn.exec:\1bnnhn.exe63⤵
- Executes dropped EXE
PID:4836 -
\??\c:\nhhhbb.exec:\nhhhbb.exe64⤵
- Executes dropped EXE
PID:3844 -
\??\c:\vvjjv.exec:\vvjjv.exe65⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lrlxxxx.exec:\lrlxxxx.exe66⤵
- Executes dropped EXE
PID:4832 -
\??\c:\lrrrrrr.exec:\lrrrrrr.exe67⤵PID:1556
-
\??\c:\bnbhnh.exec:\bnbhnh.exe68⤵PID:5048
-
\??\c:\dppdd.exec:\dppdd.exe69⤵PID:4740
-
\??\c:\pdvdv.exec:\pdvdv.exe70⤵PID:5004
-
\??\c:\frxfxxx.exec:\frxfxxx.exe71⤵PID:2144
-
\??\c:\nnhhhh.exec:\nnhhhh.exe72⤵PID:5008
-
\??\c:\jdddd.exec:\jdddd.exe73⤵PID:4608
-
\??\c:\lfrlfxf.exec:\lfrlfxf.exe74⤵PID:3652
-
\??\c:\3nnnnt.exec:\3nnnnt.exe75⤵PID:948
-
\??\c:\vvvdp.exec:\vvvdp.exe76⤵PID:3736
-
\??\c:\rrrlffx.exec:\rrrlffx.exe77⤵PID:2504
-
\??\c:\7xlffff.exec:\7xlffff.exe78⤵PID:3880
-
\??\c:\nnbbhh.exec:\nnbbhh.exe79⤵PID:1552
-
\??\c:\vdpjp.exec:\vdpjp.exe80⤵PID:1256
-
\??\c:\llfxxxx.exec:\llfxxxx.exe81⤵PID:4212
-
\??\c:\5flrrrr.exec:\5flrrrr.exe82⤵PID:1988
-
\??\c:\ttbhbh.exec:\ttbhbh.exe83⤵PID:3092
-
\??\c:\9vvvp.exec:\9vvvp.exe84⤵PID:1796
-
\??\c:\xrxxrlf.exec:\xrxxrlf.exe85⤵PID:4448
-
\??\c:\tbnnhh.exec:\tbnnhh.exe86⤵PID:4200
-
\??\c:\hbhhhh.exec:\hbhhhh.exe87⤵PID:5116
-
\??\c:\5pdvv.exec:\5pdvv.exe88⤵PID:4456
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe89⤵PID:976
-
\??\c:\tbthhh.exec:\tbthhh.exe90⤵PID:2824
-
\??\c:\thtttb.exec:\thtttb.exe91⤵PID:2424
-
\??\c:\ppvvv.exec:\ppvvv.exe92⤵PID:876
-
\??\c:\lrrrrrr.exec:\lrrrrrr.exe93⤵PID:4540
-
\??\c:\tnnhbh.exec:\tnnhbh.exe94⤵PID:1968
-
\??\c:\pjjvp.exec:\pjjvp.exe95⤵PID:1500
-
\??\c:\vvddv.exec:\vvddv.exe96⤵PID:2000
-
\??\c:\rrxrrll.exec:\rrxrrll.exe97⤵PID:4392
-
\??\c:\hthbnh.exec:\hthbnh.exe98⤵PID:4316
-
\??\c:\ppjpj.exec:\ppjpj.exe99⤵PID:1416
-
\??\c:\xfffxff.exec:\xfffxff.exe100⤵PID:3104
-
\??\c:\lflfxxr.exec:\lflfxxr.exe101⤵PID:1816
-
\??\c:\5bbbbb.exec:\5bbbbb.exe102⤵PID:1692
-
\??\c:\pjpvp.exec:\pjpvp.exe103⤵PID:2800
-
\??\c:\frxfxxx.exec:\frxfxxx.exe104⤵PID:220
-
\??\c:\xxfxrrx.exec:\xxfxrrx.exe105⤵PID:1992
-
\??\c:\7bhbth.exec:\7bhbth.exe106⤵PID:3500
-
\??\c:\7jvvd.exec:\7jvvd.exe107⤵PID:3692
-
\??\c:\lllllll.exec:\lllllll.exe108⤵PID:856
-
\??\c:\tbbtnt.exec:\tbbtnt.exe109⤵PID:900
-
\??\c:\thhhhb.exec:\thhhhb.exe110⤵PID:1380
-
\??\c:\pjvvv.exec:\pjvvv.exe111⤵PID:4652
-
\??\c:\flrrrrx.exec:\flrrrrx.exe112⤵PID:1180
-
\??\c:\hhtthh.exec:\hhtthh.exe113⤵PID:1012
-
\??\c:\1hnhbb.exec:\1hnhbb.exe114⤵PID:2408
-
\??\c:\vpjvp.exec:\vpjvp.exe115⤵PID:4064
-
\??\c:\xfxfxxx.exec:\xfxfxxx.exe116⤵PID:1176
-
\??\c:\rxrrffr.exec:\rxrrffr.exe117⤵PID:3296
-
\??\c:\bnnhtn.exec:\bnnhtn.exe118⤵PID:3920
-
\??\c:\jvpdv.exec:\jvpdv.exe119⤵PID:1472
-
\??\c:\fllflll.exec:\fllflll.exe120⤵PID:5012
-
\??\c:\hhtttt.exec:\hhtttt.exe121⤵PID:3020
-
\??\c:\vdddd.exec:\vdddd.exe122⤵PID:2400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-