Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 23:00
Behavioral task
behavioral1
Sample
6993c8678c542fc9be9d99254e015c31d04e1d736159ab3c3ceb10d04bf9ec4d.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target 6993c8678c542fc9be9d99254e015c31d04e1d736159ab3c3ceb10d04bf9ec4d.exe
- Size 91KB
- Sample240611-2zed3svglj
- SHA256 6993c8678c542fc9be9d99254e015c31d04e1d736159ab3c3ceb10d04bf9ec4d
- MD5 32722ffe20426b3b180394b3fe397141
- SHA1 481b5fcf6b5e382f5160c37d171cebc7f9208ba2
- SHA512 94978294db83848e250950ce236fceb119b2fca967748cf89c4b06abb545c7cc5a926d809badf7cef93e9873b50fa074a6f501412da839296245de7dfb4b7512
- SSDEEP 1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWpS:8hOmTsF93UYfwC6GIout0fmCiiiXA6mg
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4004-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1760-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/112-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1596-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2768-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/372-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4028-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3044-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/808-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2716-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2940-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2964-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4060-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2676-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3876-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3348-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/512-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2172-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3488-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2732-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2136-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3560-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3168-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/668-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2504-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2712-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3132-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2216-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3568-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3044-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/468-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5008-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1936-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/332-609-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-627-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1240-630-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3480-697-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3812-859-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-999-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/4004-1-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000500000002326f-3.dat UPX behavioral2/memory/3044-4-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233e4-11.dat UPX behavioral2/memory/4852-12-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233e5-19.dat UPX behavioral2/files/0x00070000000233e8-28.dat UPX behavioral2/memory/1760-32-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233e9-35.dat UPX behavioral2/memory/112-31-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233e7-25.dat UPX behavioral2/memory/1596-23-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2768-37-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/372-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ea-39.dat UPX behavioral2/memory/4028-41-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3044-10-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00080000000233e0-9.dat UPX behavioral2/files/0x00070000000233eb-45.dat UPX behavioral2/memory/808-48-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ec-49.dat UPX behavioral2/memory/2664-52-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ed-55.dat UPX behavioral2/files/0x00070000000233ee-58.dat UPX behavioral2/memory/2716-62-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ef-64.dat UPX behavioral2/memory/2940-61-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233f0-67.dat UPX behavioral2/files/0x00070000000233f1-72.dat UPX behavioral2/files/0x00070000000233f2-76.dat UPX behavioral2/files/0x00070000000233f3-80.dat UPX behavioral2/memory/2076-82-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233f4-85.dat UPX behavioral2/memory/2076-86-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233f5-90.dat UPX behavioral2/memory/2964-91-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233f6-95.dat UPX behavioral2/memory/4060-97-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233f7-100.dat UPX behavioral2/memory/2676-101-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233f8-105.dat UPX behavioral2/memory/3036-106-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233f9-111.dat UPX behavioral2/memory/4968-114-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3876-112-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233fa-116.dat UPX behavioral2/memory/5068-118-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233fb-121.dat UPX behavioral2/memory/5068-123-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3020-127-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233fc-126.dat UPX behavioral2/files/0x00070000000233fd-131.dat UPX behavioral2/files/0x00070000000233fe-135.dat UPX behavioral2/memory/4888-139-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00080000000233e1-140.dat UPX behavioral2/memory/4388-143-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ff-145.dat UPX behavioral2/files/0x0007000000023400-150.dat UPX behavioral2/files/0x0007000000023401-153.dat UPX behavioral2/memory/3348-154-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4476-159-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/512-162-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2172-171-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3488-174-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 3044 pddvv.exe 4852 vpvpp.exe 372 fllllff.exe 1596 rxfxffx.exe 112 tbhhbb.exe 1760 nhnhbb.exe 2768 bnnnhh.exe 4028 flffrrl.exe 808 5tnhhb.exe 2664 hnhbbh.exe 2716 3jvpj.exe 2940 jppjd.exe 4856 lffxlll.exe 3980 1hnhnt.exe 3748 3ttnbb.exe 1392 ppvpj.exe 2076 btthbn.exe 2964 thhbnn.exe 4060 vjppp.exe 2676 xxlffll.exe 3036 htbnhh.exe 3876 pvpjd.exe 4968 jdddj.exe 5068 lflxxff.exe 3020 nthbbb.exe 4800 xlrrlll.exe 4820 lllfflr.exe 4888 tbbbtn.exe 4388 httnbb.exe 1460 djjjv.exe 3348 vvjjj.exe 4476 rxffxfx.exe 4484 hhbbnh.exe 512 jppjp.exe 3972 lrrrllf.exe 460 fxlfxxr.exe 4724 7lxrxxf.exe 2172 9rxfxlf.exe 3488 htnttt.exe 2872 3vppv.exe 1800 1dvjd.exe 2732 lfxxllf.exe 3312 7bnntt.exe 3012 htbbtn.exe 3500 ppdvd.exe 3976 vjddv.exe 2136 1lllffx.exe 5024 btttnn.exe 3560 bnthtt.exe 3700 dpdvv.exe 1492 3xrxrrr.exe 4404 lfrrxlf.exe 920 nthhht.exe 1724 htbbtt.exe 2440 djppj.exe 4576 ppjjv.exe 1512 ffffxxx.exe 3168 ntnnnn.exe 3540 htbnhn.exe 2316 jpjjd.exe 668 rlffrfx.exe 2924 fflllff.exe 5100 nbbbtt.exe 4284 tnhnnt.exe -
resource yara_rule behavioral2/memory/4004-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000500000002326f-3.dat upx behavioral2/memory/3044-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e4-11.dat upx behavioral2/memory/4852-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e5-19.dat upx behavioral2/files/0x00070000000233e8-28.dat upx behavioral2/memory/1760-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e9-35.dat upx behavioral2/memory/112-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e7-25.dat upx behavioral2/memory/1596-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2768-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/372-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ea-39.dat upx behavioral2/memory/4028-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3044-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233e0-9.dat upx behavioral2/files/0x00070000000233eb-45.dat upx behavioral2/memory/808-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ec-49.dat upx behavioral2/memory/2664-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ed-55.dat upx behavioral2/files/0x00070000000233ee-58.dat upx behavioral2/memory/2716-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ef-64.dat upx behavioral2/memory/2940-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f0-67.dat upx behavioral2/files/0x00070000000233f1-72.dat upx behavioral2/files/0x00070000000233f2-76.dat upx behavioral2/files/0x00070000000233f3-80.dat upx behavioral2/memory/2076-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f4-85.dat upx behavioral2/memory/2076-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f5-90.dat upx behavioral2/memory/2964-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f6-95.dat upx behavioral2/memory/4060-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f7-100.dat upx behavioral2/memory/2676-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f8-105.dat upx behavioral2/memory/3036-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f9-111.dat upx behavioral2/memory/4968-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3876-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fa-116.dat upx behavioral2/memory/5068-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fb-121.dat upx behavioral2/memory/5068-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3020-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fc-126.dat upx behavioral2/files/0x00070000000233fd-131.dat upx behavioral2/files/0x00070000000233fe-135.dat upx behavioral2/memory/4888-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233e1-140.dat upx behavioral2/memory/4388-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ff-145.dat upx behavioral2/files/0x0007000000023400-150.dat upx behavioral2/files/0x0007000000023401-153.dat upx behavioral2/memory/3348-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4476-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/512-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2172-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3488-174-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4004 wrote to memory of 3044 4004 6993c8678c542fc9be9d99254e015c31d04e1d736159ab3c3ceb10d04bf9ec4d.exe 81 PID 4004 wrote to memory of 3044 4004 6993c8678c542fc9be9d99254e015c31d04e1d736159ab3c3ceb10d04bf9ec4d.exe 81 PID 4004 wrote to memory of 3044 4004 6993c8678c542fc9be9d99254e015c31d04e1d736159ab3c3ceb10d04bf9ec4d.exe 81 PID 3044 wrote to memory of 4852 3044 pddvv.exe 82 PID 3044 wrote to memory of 4852 3044 pddvv.exe 82 PID 3044 wrote to memory of 4852 3044 pddvv.exe 82 PID 4852 wrote to memory of 372 4852 vpvpp.exe 83 PID 4852 wrote to memory of 372 4852 vpvpp.exe 83 PID 4852 wrote to memory of 372 4852 vpvpp.exe 83 PID 372 wrote to memory of 1596 372 fllllff.exe 84 PID 372 wrote to memory of 1596 372 fllllff.exe 84 PID 372 wrote to memory of 1596 372 fllllff.exe 84 PID 1596 wrote to memory of 112 1596 rxfxffx.exe 85 PID 1596 wrote to memory of 112 1596 rxfxffx.exe 85 PID 1596 wrote to memory of 112 1596 rxfxffx.exe 85 PID 112 wrote to memory of 1760 112 tbhhbb.exe 86 PID 112 wrote to memory of 1760 112 tbhhbb.exe 86 PID 112 wrote to memory of 1760 112 tbhhbb.exe 86 PID 1760 wrote to memory of 2768 1760 nhnhbb.exe 87 PID 1760 wrote to memory of 2768 1760 nhnhbb.exe 87 PID 1760 wrote to memory of 2768 1760 nhnhbb.exe 87 PID 2768 wrote to memory of 4028 2768 bnnnhh.exe 88 PID 2768 wrote to memory of 4028 2768 bnnnhh.exe 88 PID 2768 wrote to memory of 4028 2768 bnnnhh.exe 88 PID 4028 wrote to memory of 808 4028 flffrrl.exe 89 PID 4028 wrote to memory of 808 4028 flffrrl.exe 89 PID 4028 wrote to memory of 808 4028 flffrrl.exe 89 PID 808 wrote to memory of 2664 808 5tnhhb.exe 90 PID 808 wrote to memory of 2664 808 5tnhhb.exe 90 PID 808 wrote to memory of 2664 808 5tnhhb.exe 90 PID 2664 wrote to memory of 2716 2664 hnhbbh.exe 91 PID 2664 wrote to memory of 2716 2664 hnhbbh.exe 91 PID 2664 wrote to memory of 2716 2664 hnhbbh.exe 91 PID 2716 wrote to memory of 2940 2716 3jvpj.exe 92 PID 2716 wrote to memory of 2940 2716 3jvpj.exe 92 PID 2716 wrote to memory of 2940 2716 3jvpj.exe 92 PID 2940 wrote to memory of 4856 2940 jppjd.exe 93 PID 2940 wrote to memory of 4856 2940 jppjd.exe 93 PID 2940 wrote to memory of 4856 2940 jppjd.exe 93 PID 4856 wrote to memory of 3980 4856 lffxlll.exe 94 PID 4856 wrote to memory of 3980 4856 lffxlll.exe 94 PID 4856 wrote to memory of 3980 4856 lffxlll.exe 94 PID 3980 wrote to memory of 3748 3980 1hnhnt.exe 95 PID 3980 wrote to memory of 3748 3980 1hnhnt.exe 95 PID 3980 wrote to memory of 3748 3980 1hnhnt.exe 95 PID 3748 wrote to memory of 1392 3748 3ttnbb.exe 96 PID 3748 wrote to memory of 1392 3748 3ttnbb.exe 96 PID 3748 wrote to memory of 1392 3748 3ttnbb.exe 96 PID 1392 wrote to memory of 2076 1392 ppvpj.exe 97 PID 1392 wrote to memory of 2076 1392 ppvpj.exe 97 PID 1392 wrote to memory of 2076 1392 ppvpj.exe 97 PID 2076 wrote to memory of 2964 2076 btthbn.exe 98 PID 2076 wrote to memory of 2964 2076 btthbn.exe 98 PID 2076 wrote to memory of 2964 2076 btthbn.exe 98 PID 2964 wrote to memory of 4060 2964 thhbnn.exe 99 PID 2964 wrote to memory of 4060 2964 thhbnn.exe 99 PID 2964 wrote to memory of 4060 2964 thhbnn.exe 99 PID 4060 wrote to memory of 2676 4060 vjppp.exe 100 PID 4060 wrote to memory of 2676 4060 vjppp.exe 100 PID 4060 wrote to memory of 2676 4060 vjppp.exe 100 PID 2676 wrote to memory of 3036 2676 xxlffll.exe 101 PID 2676 wrote to memory of 3036 2676 xxlffll.exe 101 PID 2676 wrote to memory of 3036 2676 xxlffll.exe 101 PID 3036 wrote to memory of 3876 3036 htbnhh.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\6993c8678c542fc9be9d99254e015c31d04e1d736159ab3c3ceb10d04bf9ec4d.exe"C:\Users\Admin\AppData\Local\Temp\6993c8678c542fc9be9d99254e015c31d04e1d736159ab3c3ceb10d04bf9ec4d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\pddvv.exec:\pddvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\vpvpp.exec:\vpvpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\fllllff.exec:\fllllff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\rxfxffx.exec:\rxfxffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\tbhhbb.exec:\tbhhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\nhnhbb.exec:\nhnhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\bnnnhh.exec:\bnnnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\flffrrl.exec:\flffrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\5tnhhb.exec:\5tnhhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\hnhbbh.exec:\hnhbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\3jvpj.exec:\3jvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\jppjd.exec:\jppjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\lffxlll.exec:\lffxlll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\1hnhnt.exec:\1hnhnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\3ttnbb.exec:\3ttnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\ppvpj.exec:\ppvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\btthbn.exec:\btthbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\thhbnn.exec:\thhbnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\vjppp.exec:\vjppp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\xxlffll.exec:\xxlffll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\htbnhh.exec:\htbnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\pvpjd.exec:\pvpjd.exe23⤵
- Executes dropped EXE
PID:3876 -
\??\c:\jdddj.exec:\jdddj.exe24⤵
- Executes dropped EXE
PID:4968 -
\??\c:\lflxxff.exec:\lflxxff.exe25⤵
- Executes dropped EXE
PID:5068 -
\??\c:\nthbbb.exec:\nthbbb.exe26⤵
- Executes dropped EXE
PID:3020 -
\??\c:\xlrrlll.exec:\xlrrlll.exe27⤵
- Executes dropped EXE
PID:4800 -
\??\c:\lllfflr.exec:\lllfflr.exe28⤵
- Executes dropped EXE
PID:4820 -
\??\c:\tbbbtn.exec:\tbbbtn.exe29⤵
- Executes dropped EXE
PID:4888 -
\??\c:\httnbb.exec:\httnbb.exe30⤵
- Executes dropped EXE
PID:4388 -
\??\c:\djjjv.exec:\djjjv.exe31⤵
- Executes dropped EXE
PID:1460 -
\??\c:\vvjjj.exec:\vvjjj.exe32⤵
- Executes dropped EXE
PID:3348 -
\??\c:\rxffxfx.exec:\rxffxfx.exe33⤵
- Executes dropped EXE
PID:4476 -
\??\c:\hhbbnh.exec:\hhbbnh.exe34⤵
- Executes dropped EXE
PID:4484 -
\??\c:\jppjp.exec:\jppjp.exe35⤵
- Executes dropped EXE
PID:512 -
\??\c:\lrrrllf.exec:\lrrrllf.exe36⤵
- Executes dropped EXE
PID:3972 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe37⤵
- Executes dropped EXE
PID:460 -
\??\c:\7lxrxxf.exec:\7lxrxxf.exe38⤵
- Executes dropped EXE
PID:4724 -
\??\c:\9rxfxlf.exec:\9rxfxlf.exe39⤵
- Executes dropped EXE
PID:2172 -
\??\c:\htnttt.exec:\htnttt.exe40⤵
- Executes dropped EXE
PID:3488 -
\??\c:\3vppv.exec:\3vppv.exe41⤵
- Executes dropped EXE
PID:2872 -
\??\c:\1dvjd.exec:\1dvjd.exe42⤵
- Executes dropped EXE
PID:1800 -
\??\c:\lfxxllf.exec:\lfxxllf.exe43⤵
- Executes dropped EXE
PID:2732 -
\??\c:\7bnntt.exec:\7bnntt.exe44⤵
- Executes dropped EXE
PID:3312 -
\??\c:\htbbtn.exec:\htbbtn.exe45⤵
- Executes dropped EXE
PID:3012 -
\??\c:\ppdvd.exec:\ppdvd.exe46⤵
- Executes dropped EXE
PID:3500 -
\??\c:\vjddv.exec:\vjddv.exe47⤵
- Executes dropped EXE
PID:3976 -
\??\c:\1lllffx.exec:\1lllffx.exe48⤵
- Executes dropped EXE
PID:2136 -
\??\c:\btttnn.exec:\btttnn.exe49⤵
- Executes dropped EXE
PID:5024 -
\??\c:\bnthtt.exec:\bnthtt.exe50⤵
- Executes dropped EXE
PID:3560 -
\??\c:\dpdvv.exec:\dpdvv.exe51⤵
- Executes dropped EXE
PID:3700 -
\??\c:\3xrxrrr.exec:\3xrxrrr.exe52⤵
- Executes dropped EXE
PID:1492 -
\??\c:\lfrrxlf.exec:\lfrrxlf.exe53⤵
- Executes dropped EXE
PID:4404 -
\??\c:\nthhht.exec:\nthhht.exe54⤵
- Executes dropped EXE
PID:920 -
\??\c:\htbbtt.exec:\htbbtt.exe55⤵
- Executes dropped EXE
PID:1724 -
\??\c:\djppj.exec:\djppj.exe56⤵
- Executes dropped EXE
PID:2440 -
\??\c:\ppjjv.exec:\ppjjv.exe57⤵
- Executes dropped EXE
PID:4576 -
\??\c:\ffffxxx.exec:\ffffxxx.exe58⤵
- Executes dropped EXE
PID:1512 -
\??\c:\ntnnnn.exec:\ntnnnn.exe59⤵
- Executes dropped EXE
PID:3168 -
\??\c:\htbnhn.exec:\htbnhn.exe60⤵
- Executes dropped EXE
PID:3540 -
\??\c:\jpjjd.exec:\jpjjd.exe61⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rlffrfx.exec:\rlffrfx.exe62⤵
- Executes dropped EXE
PID:668 -
\??\c:\fflllff.exec:\fflllff.exe63⤵
- Executes dropped EXE
PID:2924 -
\??\c:\nbbbtt.exec:\nbbbtt.exe64⤵
- Executes dropped EXE
PID:5100 -
\??\c:\tnhnnt.exec:\tnhnnt.exe65⤵
- Executes dropped EXE
PID:4284 -
\??\c:\9dpjd.exec:\9dpjd.exe66⤵PID:2376
-
\??\c:\rrffxxx.exec:\rrffxxx.exe67⤵PID:4424
-
\??\c:\fxllffr.exec:\fxllffr.exe68⤵PID:1536
-
\??\c:\7nhbhb.exec:\7nhbhb.exe69⤵PID:2504
-
\??\c:\9jppd.exec:\9jppd.exe70⤵PID:1596
-
\??\c:\dvppd.exec:\dvppd.exe71⤵PID:2712
-
\??\c:\xfffrrr.exec:\xfffrrr.exe72⤵PID:4244
-
\??\c:\tntttt.exec:\tntttt.exe73⤵PID:212
-
\??\c:\3tttnh.exec:\3tttnh.exe74⤵PID:3412
-
\??\c:\vppjj.exec:\vppjj.exe75⤵PID:4436
-
\??\c:\vvvpv.exec:\vvvpv.exe76⤵PID:332
-
\??\c:\frrlflf.exec:\frrlflf.exe77⤵PID:3132
-
\??\c:\hntnhh.exec:\hntnhh.exe78⤵PID:4948
-
\??\c:\hthtnh.exec:\hthtnh.exe79⤵PID:3448
-
\??\c:\jjddd.exec:\jjddd.exe80⤵PID:2216
-
\??\c:\djdvp.exec:\djdvp.exe81⤵PID:4108
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe82⤵PID:2940
-
\??\c:\hhtthh.exec:\hhtthh.exe83⤵PID:3656
-
\??\c:\bhbbnn.exec:\bhbbnn.exe84⤵PID:1260
-
\??\c:\jdddv.exec:\jdddv.exe85⤵PID:1232
-
\??\c:\vpjvj.exec:\vpjvj.exe86⤵PID:1824
-
\??\c:\3xxrlfx.exec:\3xxrlfx.exe87⤵PID:3748
-
\??\c:\lflfxxr.exec:\lflfxxr.exe88⤵PID:5048
-
\??\c:\hbhbtt.exec:\hbhbtt.exe89⤵PID:1844
-
\??\c:\hnbbtt.exec:\hnbbtt.exe90⤵PID:2076
-
\??\c:\dvjdv.exec:\dvjdv.exe91⤵PID:3016
-
\??\c:\fxrfrrl.exec:\fxrfrrl.exe92⤵PID:4656
-
\??\c:\ffffxxr.exec:\ffffxxr.exe93⤵PID:5008
-
\??\c:\5nttbb.exec:\5nttbb.exe94⤵PID:3172
-
\??\c:\bnhhtt.exec:\bnhhtt.exe95⤵PID:4212
-
\??\c:\jjjvj.exec:\jjjvj.exe96⤵PID:2280
-
\??\c:\dpvpd.exec:\dpvpd.exe97⤵PID:4072
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe98⤵PID:2652
-
\??\c:\rrrlffx.exec:\rrrlffx.exe99⤵PID:3604
-
\??\c:\tttnnn.exec:\tttnnn.exe100⤵PID:4968
-
\??\c:\vvpjv.exec:\vvpjv.exe101⤵PID:3568
-
\??\c:\7dppj.exec:\7dppj.exe102⤵PID:5068
-
\??\c:\flrfxxr.exec:\flrfxxr.exe103⤵PID:4500
-
\??\c:\3hnnnh.exec:\3hnnnh.exe104⤵PID:2372
-
\??\c:\hhhhtt.exec:\hhhhtt.exe105⤵PID:4980
-
\??\c:\jjpjj.exec:\jjpjj.exe106⤵PID:3476
-
\??\c:\vvjdd.exec:\vvjdd.exe107⤵PID:4140
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe108⤵PID:3268
-
\??\c:\hhtbbh.exec:\hhtbbh.exe109⤵PID:2080
-
\??\c:\hbhnbb.exec:\hbhnbb.exe110⤵PID:1572
-
\??\c:\9nbbtt.exec:\9nbbtt.exe111⤵PID:1400
-
\??\c:\pdjjd.exec:\pdjjd.exe112⤵PID:4976
-
\??\c:\lffrlfx.exec:\lffrlfx.exe113⤵PID:3200
-
\??\c:\rxffxfx.exec:\rxffxfx.exe114⤵PID:2356
-
\??\c:\9nhbnn.exec:\9nhbnn.exe115⤵PID:5004
-
\??\c:\nbhbbb.exec:\nbhbbb.exe116⤵PID:644
-
\??\c:\jjpjd.exec:\jjpjd.exe117⤵PID:2392
-
\??\c:\xxxrllf.exec:\xxxrllf.exe118⤵PID:2016
-
\??\c:\3fxrffr.exec:\3fxrffr.exe119⤵PID:3480
-
\??\c:\nhbtnh.exec:\nhbtnh.exe120⤵PID:4848
-
\??\c:\5vddp.exec:\5vddp.exe121⤵PID:2876
-
\??\c:\ddjdp.exec:\ddjdp.exe122⤵PID:2872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-