Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 22:52
Behavioral task
behavioral1
Sample
65df030e908c060527d1d23a7dc0954ef7c3244d3fd9b15f9b6ee74bd376bb45.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
- Target 65df030e908c060527d1d23a7dc0954ef7c3244d3fd9b15f9b6ee74bd376bb45.exe
- Size 227KB
- Sample240611-2tlafaverr
- SHA256 65df030e908c060527d1d23a7dc0954ef7c3244d3fd9b15f9b6ee74bd376bb45
- MD5 6a233bc756f54203f81d22fa6aca5b10
- SHA1 eedd2096738681691dc2a600573534dbe0b7b6ac
- SHA512 7cf66ba403ed8c376d8c80a1eeeb0c594b8e3e39411f8a80a898343023123f74cd46a337d285347c7230f22c8fc38fd3a349c794fa4d97dcfc6753ca288cfce6
- SSDEEP 6144:Jcm4FmowdHoS3dGmS4Z1hraHcpOaKHpaztyzl+SK:T4wFHoS3dJS4ZzeFaKHpCc6
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2676-6-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1656-15-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4824-12-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4984-20-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3820-28-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3164-34-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3152-41-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4064-47-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2060-50-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3920-59-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/628-66-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2240-72-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2640-78-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2396-84-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3288-96-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4776-103-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2204-106-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2288-120-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1372-126-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4520-129-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3692-134-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1188-147-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4884-144-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4460-160-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3236-164-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/60-185-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2024-194-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4784-200-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4968-204-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3720-218-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2948-224-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3108-227-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4480-229-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4992-240-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1500-246-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5104-260-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4396-264-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3420-267-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4044-277-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1800-281-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1076-288-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4264-295-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4872-312-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1952-322-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3260-335-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2392-339-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2116-346-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3344-369-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4028-415-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3580-459-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5088-463-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5104-467-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4396-471-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1020-494-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3336-510-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4468-558-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2024-590-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4352-617-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4352-621-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2680-625-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/944-635-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3040-831-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2384-871-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2688-985-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/2676-0-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x000700000002329a-3.dat UPX behavioral2/memory/2676-6-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/4824-7-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0008000000023439-11.dat UPX behavioral2/memory/1656-15-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/4824-12-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x000700000002343a-14.dat UPX behavioral2/files/0x000700000002343b-24.dat UPX behavioral2/memory/4984-20-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x000700000002343d-29.dat UPX behavioral2/memory/3820-28-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/3164-34-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x000700000002343e-33.dat UPX behavioral2/files/0x000700000002343f-39.dat UPX behavioral2/memory/3152-41-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/4064-42-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0007000000023440-45.dat UPX behavioral2/memory/4064-47-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/2060-50-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0007000000023441-52.dat UPX behavioral2/files/0x0007000000023442-57.dat UPX behavioral2/memory/3920-59-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/628-61-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0007000000023443-64.dat UPX behavioral2/memory/628-66-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/2240-72-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0007000000023444-70.dat UPX behavioral2/files/0x0007000000023445-76.dat UPX behavioral2/memory/2640-78-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/2396-80-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0007000000023446-85.dat UPX behavioral2/memory/2396-84-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/3288-92-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0007000000023447-90.dat UPX behavioral2/memory/3288-96-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0007000000023448-97.dat UPX behavioral2/memory/4776-103-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0007000000023449-102.dat UPX behavioral2/memory/2204-106-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x000700000002344a-108.dat UPX behavioral2/files/0x0008000000023437-113.dat UPX behavioral2/files/0x000700000002344b-118.dat UPX behavioral2/memory/2288-120-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x000700000002344c-124.dat UPX behavioral2/memory/1372-126-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/4520-129-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x000700000002344d-131.dat UPX behavioral2/memory/3692-134-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x000700000002344e-139.dat UPX behavioral2/files/0x000700000002344f-142.dat UPX behavioral2/memory/1188-147-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/4884-144-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0007000000023450-149.dat UPX behavioral2/files/0x0007000000023452-155.dat UPX behavioral2/memory/4460-160-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0007000000023453-161.dat UPX behavioral2/memory/3236-164-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0007000000023454-167.dat UPX behavioral2/files/0x0007000000023455-171.dat UPX behavioral2/files/0x0007000000023456-177.dat UPX behavioral2/files/0x0007000000023457-182.dat UPX behavioral2/memory/60-185-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0007000000023458-187.dat UPX - Executes dropped EXE 64 IoCs
pid Process 4824 frxllff.exe 1656 bnttnn.exe 4984 1vvvj.exe 3820 fxllllf.exe 3164 nhnnhh.exe 3152 9rfxxff.exe 4064 bbttbb.exe 2060 rfrrllf.exe 3920 1tbttt.exe 628 vdpdv.exe 2240 xxxxrrr.exe 2640 5hbbtt.exe 2396 ffxrxxf.exe 4108 hbhtnt.exe 3288 pjdjj.exe 4776 lxlfxxx.exe 2204 hbbbbb.exe 5028 jdvjj.exe 2288 3xllfxl.exe 1372 nnthnn.exe 4520 pdpdv.exe 3692 rflllxf.exe 4884 hhbthb.exe 1188 7dpdp.exe 836 pdppp.exe 4460 1lxlxrf.exe 3236 thhthb.exe 4812 pdjdd.exe 1556 7flxllx.exe 2436 bbtbbb.exe 60 jpjvj.exe 3196 xxfxflf.exe 2024 bnnbnh.exe 4784 thhtbn.exe 4968 1ppdv.exe 2272 xfffffl.exe 384 nntnbb.exe 2836 thhnht.exe 3356 vjdpv.exe 3720 xrfflxr.exe 2948 fflxlrf.exe 3108 bnhbth.exe 4480 jjvpj.exe 3784 fllfrrx.exe 1300 rfxrfxr.exe 4992 nnhhtn.exe 1500 hthbnh.exe 1168 pjjjv.exe 3580 lrxfxxl.exe 2748 xlfrlxr.exe 5104 bnbnbn.exe 4396 pjjvd.exe 3420 rflxrlf.exe 2452 7rlrrrx.exe 2000 ttnhbh.exe 4044 vjjvj.exe 1800 fxfrffl.exe 4148 frlfrfx.exe 1076 hbnhtt.exe 4512 btbnbt.exe 4264 pjvjv.exe 4648 rfxlfxl.exe 3620 xfrlxxl.exe 4292 nbhbnh.exe -
resource yara_rule behavioral2/memory/2676-0-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000700000002329a-3.dat upx behavioral2/memory/2676-6-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4824-7-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0008000000023439-11.dat upx behavioral2/memory/1656-15-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4824-12-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000700000002343a-14.dat upx behavioral2/files/0x000700000002343b-24.dat upx behavioral2/memory/4984-20-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000700000002343d-29.dat upx behavioral2/memory/3820-28-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3164-34-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000700000002343e-33.dat upx behavioral2/files/0x000700000002343f-39.dat upx behavioral2/memory/3152-41-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4064-42-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023440-45.dat upx behavioral2/memory/4064-47-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2060-50-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023441-52.dat upx behavioral2/files/0x0007000000023442-57.dat upx behavioral2/memory/3920-59-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/628-61-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023443-64.dat upx behavioral2/memory/628-66-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2240-72-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023444-70.dat upx behavioral2/files/0x0007000000023445-76.dat upx behavioral2/memory/2640-78-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2396-80-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023446-85.dat upx behavioral2/memory/2396-84-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3288-92-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023447-90.dat upx behavioral2/memory/3288-96-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023448-97.dat upx behavioral2/memory/4776-103-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023449-102.dat upx behavioral2/memory/2204-106-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000700000002344a-108.dat upx behavioral2/files/0x0008000000023437-113.dat upx behavioral2/files/0x000700000002344b-118.dat upx behavioral2/memory/2288-120-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000700000002344c-124.dat upx behavioral2/memory/1372-126-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4520-129-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000700000002344d-131.dat upx behavioral2/memory/3692-134-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000700000002344e-139.dat upx behavioral2/files/0x000700000002344f-142.dat upx behavioral2/memory/1188-147-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4884-144-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023450-149.dat upx behavioral2/files/0x0007000000023452-155.dat upx behavioral2/memory/4460-160-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023453-161.dat upx behavioral2/memory/3236-164-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023454-167.dat upx behavioral2/files/0x0007000000023455-171.dat upx behavioral2/files/0x0007000000023456-177.dat upx behavioral2/files/0x0007000000023457-182.dat upx behavioral2/memory/60-185-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023458-187.dat upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2676 wrote to memory of 4824 2676 65df030e908c060527d1d23a7dc0954ef7c3244d3fd9b15f9b6ee74bd376bb45.exe 80 PID 2676 wrote to memory of 4824 2676 65df030e908c060527d1d23a7dc0954ef7c3244d3fd9b15f9b6ee74bd376bb45.exe 80 PID 2676 wrote to memory of 4824 2676 65df030e908c060527d1d23a7dc0954ef7c3244d3fd9b15f9b6ee74bd376bb45.exe 80 PID 4824 wrote to memory of 1656 4824 frxllff.exe 81 PID 4824 wrote to memory of 1656 4824 frxllff.exe 81 PID 4824 wrote to memory of 1656 4824 frxllff.exe 81 PID 1656 wrote to memory of 4984 1656 bnttnn.exe 82 PID 1656 wrote to memory of 4984 1656 bnttnn.exe 82 PID 1656 wrote to memory of 4984 1656 bnttnn.exe 82 PID 4984 wrote to memory of 3820 4984 1vvvj.exe 83 PID 4984 wrote to memory of 3820 4984 1vvvj.exe 83 PID 4984 wrote to memory of 3820 4984 1vvvj.exe 83 PID 3820 wrote to memory of 3164 3820 fxllllf.exe 84 PID 3820 wrote to memory of 3164 3820 fxllllf.exe 84 PID 3820 wrote to memory of 3164 3820 fxllllf.exe 84 PID 3164 wrote to memory of 3152 3164 nhnnhh.exe 85 PID 3164 wrote to memory of 3152 3164 nhnnhh.exe 85 PID 3164 wrote to memory of 3152 3164 nhnnhh.exe 85 PID 3152 wrote to memory of 4064 3152 9rfxxff.exe 86 PID 3152 wrote to memory of 4064 3152 9rfxxff.exe 86 PID 3152 wrote to memory of 4064 3152 9rfxxff.exe 86 PID 4064 wrote to memory of 2060 4064 bbttbb.exe 87 PID 4064 wrote to memory of 2060 4064 bbttbb.exe 87 PID 4064 wrote to memory of 2060 4064 bbttbb.exe 87 PID 2060 wrote to memory of 3920 2060 rfrrllf.exe 88 PID 2060 wrote to memory of 3920 2060 rfrrllf.exe 88 PID 2060 wrote to memory of 3920 2060 rfrrllf.exe 88 PID 3920 wrote to memory of 628 3920 1tbttt.exe 89 PID 3920 wrote to memory of 628 3920 1tbttt.exe 89 PID 3920 wrote to memory of 628 3920 1tbttt.exe 89 PID 628 wrote to memory of 2240 628 vdpdv.exe 90 PID 628 wrote to memory of 2240 628 vdpdv.exe 90 PID 628 wrote to memory of 2240 628 vdpdv.exe 90 PID 2240 wrote to memory of 2640 2240 xxxxrrr.exe 91 PID 2240 wrote to memory of 2640 2240 xxxxrrr.exe 91 PID 2240 wrote to memory of 2640 2240 xxxxrrr.exe 91 PID 2640 wrote to memory of 2396 2640 5hbbtt.exe 92 PID 2640 wrote to memory of 2396 2640 5hbbtt.exe 92 PID 2640 wrote to memory of 2396 2640 5hbbtt.exe 92 PID 2396 wrote to memory of 4108 2396 ffxrxxf.exe 93 PID 2396 wrote to memory of 4108 2396 ffxrxxf.exe 93 PID 2396 wrote to memory of 4108 2396 ffxrxxf.exe 93 PID 4108 wrote to memory of 3288 4108 hbhtnt.exe 94 PID 4108 wrote to memory of 3288 4108 hbhtnt.exe 94 PID 4108 wrote to memory of 3288 4108 hbhtnt.exe 94 PID 3288 wrote to memory of 4776 3288 pjdjj.exe 95 PID 3288 wrote to memory of 4776 3288 pjdjj.exe 95 PID 3288 wrote to memory of 4776 3288 pjdjj.exe 95 PID 4776 wrote to memory of 2204 4776 lxlfxxx.exe 96 PID 4776 wrote to memory of 2204 4776 lxlfxxx.exe 96 PID 4776 wrote to memory of 2204 4776 lxlfxxx.exe 96 PID 2204 wrote to memory of 5028 2204 hbbbbb.exe 97 PID 2204 wrote to memory of 5028 2204 hbbbbb.exe 97 PID 2204 wrote to memory of 5028 2204 hbbbbb.exe 97 PID 5028 wrote to memory of 2288 5028 jdvjj.exe 98 PID 5028 wrote to memory of 2288 5028 jdvjj.exe 98 PID 5028 wrote to memory of 2288 5028 jdvjj.exe 98 PID 2288 wrote to memory of 1372 2288 3xllfxl.exe 99 PID 2288 wrote to memory of 1372 2288 3xllfxl.exe 99 PID 2288 wrote to memory of 1372 2288 3xllfxl.exe 99 PID 1372 wrote to memory of 4520 1372 nnthnn.exe 100 PID 1372 wrote to memory of 4520 1372 nnthnn.exe 100 PID 1372 wrote to memory of 4520 1372 nnthnn.exe 100 PID 4520 wrote to memory of 3692 4520 pdpdv.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\65df030e908c060527d1d23a7dc0954ef7c3244d3fd9b15f9b6ee74bd376bb45.exe"C:\Users\Admin\AppData\Local\Temp\65df030e908c060527d1d23a7dc0954ef7c3244d3fd9b15f9b6ee74bd376bb45.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\frxllff.exec:\frxllff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\bnttnn.exec:\bnttnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\1vvvj.exec:\1vvvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\fxllllf.exec:\fxllllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\nhnnhh.exec:\nhnnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\9rfxxff.exec:\9rfxxff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\bbttbb.exec:\bbttbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\rfrrllf.exec:\rfrrllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\1tbttt.exec:\1tbttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\vdpdv.exec:\vdpdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\xxxxrrr.exec:\xxxxrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\5hbbtt.exec:\5hbbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\ffxrxxf.exec:\ffxrxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\hbhtnt.exec:\hbhtnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\pjdjj.exec:\pjdjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\hbbbbb.exec:\hbbbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\jdvjj.exec:\jdvjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\3xllfxl.exec:\3xllfxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\nnthnn.exec:\nnthnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\pdpdv.exec:\pdpdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\rflllxf.exec:\rflllxf.exe23⤵
- Executes dropped EXE
PID:3692 -
\??\c:\hhbthb.exec:\hhbthb.exe24⤵
- Executes dropped EXE
PID:4884 -
\??\c:\7dpdp.exec:\7dpdp.exe25⤵
- Executes dropped EXE
PID:1188 -
\??\c:\pdppp.exec:\pdppp.exe26⤵
- Executes dropped EXE
PID:836 -
\??\c:\1lxlxrf.exec:\1lxlxrf.exe27⤵
- Executes dropped EXE
PID:4460 -
\??\c:\thhthb.exec:\thhthb.exe28⤵
- Executes dropped EXE
PID:3236 -
\??\c:\pdjdd.exec:\pdjdd.exe29⤵
- Executes dropped EXE
PID:4812 -
\??\c:\7flxllx.exec:\7flxllx.exe30⤵
- Executes dropped EXE
PID:1556 -
\??\c:\bbtbbb.exec:\bbtbbb.exe31⤵
- Executes dropped EXE
PID:2436 -
\??\c:\jpjvj.exec:\jpjvj.exe32⤵
- Executes dropped EXE
PID:60 -
\??\c:\xxfxflf.exec:\xxfxflf.exe33⤵
- Executes dropped EXE
PID:3196 -
\??\c:\bnnbnh.exec:\bnnbnh.exe34⤵
- Executes dropped EXE
PID:2024 -
\??\c:\thhtbn.exec:\thhtbn.exe35⤵
- Executes dropped EXE
PID:4784 -
\??\c:\1ppdv.exec:\1ppdv.exe36⤵
- Executes dropped EXE
PID:4968 -
\??\c:\xfffffl.exec:\xfffffl.exe37⤵
- Executes dropped EXE
PID:2272 -
\??\c:\nntnbb.exec:\nntnbb.exe38⤵
- Executes dropped EXE
PID:384 -
\??\c:\thhnht.exec:\thhnht.exe39⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vjdpv.exec:\vjdpv.exe40⤵
- Executes dropped EXE
PID:3356 -
\??\c:\xrfflxr.exec:\xrfflxr.exe41⤵
- Executes dropped EXE
PID:3720 -
\??\c:\fflxlrf.exec:\fflxlrf.exe42⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bnhbth.exec:\bnhbth.exe43⤵
- Executes dropped EXE
PID:3108 -
\??\c:\jjvpj.exec:\jjvpj.exe44⤵
- Executes dropped EXE
PID:4480 -
\??\c:\fllfrrx.exec:\fllfrrx.exe45⤵
- Executes dropped EXE
PID:3784 -
\??\c:\rfxrfxr.exec:\rfxrfxr.exe46⤵
- Executes dropped EXE
PID:1300 -
\??\c:\nnhhtn.exec:\nnhhtn.exe47⤵
- Executes dropped EXE
PID:4992 -
\??\c:\hthbnh.exec:\hthbnh.exe48⤵
- Executes dropped EXE
PID:1500 -
\??\c:\pjjjv.exec:\pjjjv.exe49⤵
- Executes dropped EXE
PID:1168 -
\??\c:\lrxfxxl.exec:\lrxfxxl.exe50⤵
- Executes dropped EXE
PID:3580 -
\??\c:\xlfrlxr.exec:\xlfrlxr.exe51⤵
- Executes dropped EXE
PID:2748 -
\??\c:\bnbnbn.exec:\bnbnbn.exe52⤵
- Executes dropped EXE
PID:5104 -
\??\c:\pjjvd.exec:\pjjvd.exe53⤵
- Executes dropped EXE
PID:4396 -
\??\c:\rflxrlf.exec:\rflxrlf.exe54⤵
- Executes dropped EXE
PID:3420 -
\??\c:\7rlrrrx.exec:\7rlrrrx.exe55⤵
- Executes dropped EXE
PID:2452 -
\??\c:\ttnhbh.exec:\ttnhbh.exe56⤵
- Executes dropped EXE
PID:2000 -
\??\c:\vjjvj.exec:\vjjvj.exe57⤵
- Executes dropped EXE
PID:4044 -
\??\c:\fxfrffl.exec:\fxfrffl.exe58⤵
- Executes dropped EXE
PID:1800 -
\??\c:\frlfrfx.exec:\frlfrfx.exe59⤵
- Executes dropped EXE
PID:4148 -
\??\c:\hbnhtt.exec:\hbnhtt.exe60⤵
- Executes dropped EXE
PID:1076 -
\??\c:\btbnbt.exec:\btbnbt.exe61⤵
- Executes dropped EXE
PID:4512 -
\??\c:\pjvjv.exec:\pjvjv.exe62⤵
- Executes dropped EXE
PID:4264 -
\??\c:\rfxlfxl.exec:\rfxlfxl.exe63⤵
- Executes dropped EXE
PID:4648 -
\??\c:\xfrlxxl.exec:\xfrlxxl.exe64⤵
- Executes dropped EXE
PID:3620 -
\??\c:\nbhbnh.exec:\nbhbnh.exe65⤵
- Executes dropped EXE
PID:4292 -
\??\c:\7pjvp.exec:\7pjvp.exe66⤵PID:2468
-
\??\c:\vjjvj.exec:\vjjvj.exe67⤵PID:3068
-
\??\c:\fxrfrlf.exec:\fxrfrlf.exe68⤵PID:4872
-
\??\c:\fxrfrlf.exec:\fxrfrlf.exe69⤵PID:3220
-
\??\c:\3ntnbt.exec:\3ntnbt.exe70⤵PID:4052
-
\??\c:\hthbhh.exec:\hthbhh.exe71⤵PID:1952
-
\??\c:\vjjdp.exec:\vjjdp.exe72⤵PID:4364
-
\??\c:\xxrlxrl.exec:\xxrlxrl.exe73⤵PID:4768
-
\??\c:\xflxrxr.exec:\xflxrxr.exe74⤵PID:3076
-
\??\c:\thhbnh.exec:\thhbnh.exe75⤵PID:3260
-
\??\c:\5bbntn.exec:\5bbntn.exe76⤵PID:2392
-
\??\c:\vjddv.exec:\vjddv.exe77⤵PID:1956
-
\??\c:\lrxlfrr.exec:\lrxlfrr.exe78⤵PID:2116
-
\??\c:\rrrfrfx.exec:\rrrfrfx.exe79⤵PID:1676
-
\??\c:\3htnbt.exec:\3htnbt.exe80⤵PID:3616
-
\??\c:\pvvdp.exec:\pvvdp.exe81⤵PID:1372
-
\??\c:\jjjdp.exec:\jjjdp.exe82⤵PID:1544
-
\??\c:\xlfrlxr.exec:\xlfrlxr.exe83⤵PID:4260
-
\??\c:\3bbnnb.exec:\3bbnnb.exe84⤵PID:4452
-
\??\c:\bhhnnt.exec:\bhhnnt.exe85⤵PID:2360
-
\??\c:\ppdpv.exec:\ppdpv.exe86⤵PID:3344
-
\??\c:\vjjvj.exec:\vjjvj.exe87⤵PID:4868
-
\??\c:\1fxffxr.exec:\1fxffxr.exe88⤵PID:1944
-
\??\c:\nbtthb.exec:\nbtthb.exe89⤵PID:4460
-
\??\c:\tbbnbn.exec:\tbbnbn.exe90⤵PID:5080
-
\??\c:\1jvpd.exec:\1jvpd.exe91⤵PID:800
-
\??\c:\jdpdp.exec:\jdpdp.exe92⤵PID:1772
-
\??\c:\fxfrfxl.exec:\fxfrfxl.exe93⤵PID:3284
-
\??\c:\lxfxlfx.exec:\lxfxlfx.exe94⤵PID:1404
-
\??\c:\1hbtth.exec:\1hbtth.exe95⤵PID:1332
-
\??\c:\pvvpd.exec:\pvvpd.exe96⤵PID:3256
-
\??\c:\xffrrlx.exec:\xffrrlx.exe97⤵PID:4040
-
\??\c:\5ffrffx.exec:\5ffrffx.exe98⤵PID:5012
-
\??\c:\btnhtn.exec:\btnhtn.exe99⤵PID:540
-
\??\c:\hbtbnh.exec:\hbtbnh.exe100⤵PID:4028
-
\??\c:\vpppv.exec:\vpppv.exe101⤵PID:4132
-
\??\c:\1ddpd.exec:\1ddpd.exe102⤵PID:3992
-
\??\c:\3lfxlfr.exec:\3lfxlfr.exe103⤵PID:2088
-
\??\c:\bnnbnh.exec:\bnnbnh.exe104⤵PID:3600
-
\??\c:\hbnnhh.exec:\hbnnhh.exe105⤵PID:2948
-
\??\c:\lrrlxxr.exec:\lrrlxxr.exe106⤵PID:1396
-
\??\c:\btnnhb.exec:\btnnhb.exe107⤵PID:2680
-
\??\c:\7hbtht.exec:\7hbtht.exe108⤵PID:4296
-
\??\c:\jdpdp.exec:\jdpdp.exe109⤵PID:3088
-
\??\c:\pvjdv.exec:\pvjdv.exe110⤵PID:944
-
\??\c:\rlfxlff.exec:\rlfxlff.exe111⤵PID:1924
-
\??\c:\thhtht.exec:\thhtht.exe112⤵PID:220
-
\??\c:\httnbb.exec:\httnbb.exe113⤵PID:2412
-
\??\c:\vjdpj.exec:\vjdpj.exe114⤵PID:3580
-
\??\c:\jddpj.exec:\jddpj.exe115⤵PID:5088
-
\??\c:\llrfrrl.exec:\llrfrrl.exe116⤵PID:5104
-
\??\c:\nbthtn.exec:\nbthtn.exe117⤵PID:4396
-
\??\c:\pjpjd.exec:\pjpjd.exe118⤵PID:2276
-
\??\c:\pjpjd.exec:\pjpjd.exe119⤵PID:2452
-
\??\c:\frrllff.exec:\frrllff.exe120⤵PID:3008
-
\??\c:\xfrlxxx.exec:\xfrlxxx.exe121⤵PID:2792
-
\??\c:\bbhhbb.exec:\bbhhbb.exe122⤵PID:4876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-