Analysis
- max time kernel
150s - max time network
99s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 00:04
Behavioral task
behavioral1
Sample
7fd549ac6524ec5921223c9ba6039860fa5d749060f6cb096f89df43e95c8343.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target 7fd549ac6524ec5921223c9ba6039860fa5d749060f6cb096f89df43e95c8343.exe
- Size 274KB
- Sample240612-ackh2aweqa
- SHA256 7fd549ac6524ec5921223c9ba6039860fa5d749060f6cb096f89df43e95c8343
- MD5 0df772e1aaa2e39867501ebb10b33503
- SHA1 0408031303cb00ce3f18af2970536a20340ba678
- SHA512 8a52c27580e4fc74ffadc2131d15e24b4360527448ad7ad9a1b71ca2b2c192801d109474052d521b7d10866450bacff20c70f2a0ad26b1e17558de7a89b9860b
- SSDEEP 3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBuItR8pTsg8QO6GIouixsp+CvM56ATgLl:9cm4FmowdHoS4BftapTs8Hoo+6MjTVVk
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4440-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1188-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3692-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3640-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/64-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4136-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1252-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2680-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2748-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2120-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/408-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/916-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/776-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4272-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4288-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2152-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1280-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1904-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2832-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1568-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2468-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2064-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3108-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1064-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1172-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5072-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4100-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1836-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-554-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/560-695-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1164-712-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3372-828-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2832-843-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-850-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-1055-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3076-1233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3412-1525-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3492-1534-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3044-1541-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/4440-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023276-5.dat UPX behavioral2/memory/4440-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00080000000233e8-10.dat UPX behavioral2/memory/1444-12-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1444-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4272-14-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ec-15.dat UPX behavioral2/memory/3976-21-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ed-24.dat UPX behavioral2/memory/1188-26-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ee-31.dat UPX behavioral2/memory/4700-33-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3692-39-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233f0-42.dat UPX behavioral2/files/0x00070000000233f1-48.dat UPX behavioral2/files/0x00070000000233f4-58.dat UPX behavioral2/files/0x00070000000233f2-54.dat UPX behavioral2/files/0x00070000000233f5-63.dat UPX behavioral2/memory/3640-67-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3600-65-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233f6-70.dat UPX behavioral2/files/0x00070000000233f7-78.dat UPX behavioral2/memory/64-77-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4136-85-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4944-84-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233f8-82.dat UPX behavioral2/files/0x00070000000233f9-90.dat UPX behavioral2/memory/1252-91-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233fa-96.dat UPX behavioral2/files/0x00070000000233fb-99.dat UPX behavioral2/files/0x00070000000233fd-110.dat UPX behavioral2/memory/4484-108-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233fc-105.dat UPX behavioral2/files/0x00070000000233fe-118.dat UPX behavioral2/files/0x00070000000233ff-121.dat UPX behavioral2/files/0x0009000000023363-126.dat UPX behavioral2/memory/2680-117-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1604-129-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3064-136-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023401-139.dat UPX behavioral2/files/0x0007000000023400-135.dat UPX behavioral2/memory/2748-134-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00080000000233e9-144.dat UPX behavioral2/files/0x0007000000023402-150.dat UPX behavioral2/memory/2120-147-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023403-156.dat UPX behavioral2/files/0x0007000000023404-160.dat UPX behavioral2/memory/408-163-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000a000000023364-167.dat UPX behavioral2/files/0x0007000000023406-177.dat UPX behavioral2/files/0x0007000000023407-182.dat UPX behavioral2/memory/916-180-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023405-173.dat UPX behavioral2/memory/2392-189-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3172-198-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/776-46-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ef-37.dat UPX behavioral2/memory/5032-203-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4376-202-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5032-206-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4272-20-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4288-210-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4468-217-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 1444 pjpjd.exe 4272 9fllxrl.exe 3976 pppdv.exe 1188 9flfrxr.exe 4700 tnthnn.exe 3692 hbnhhb.exe 776 ppdvp.exe 2224 rlrxrrr.exe 2184 lfflllf.exe 3600 thbbtb.exe 3640 dppdd.exe 64 lffffrr.exe 4944 bttnnn.exe 4136 pjjdv.exe 1252 rrlfxxx.exe 4804 nhbbtt.exe 3852 ddjdj.exe 4484 7lxrrxf.exe 2680 fxllrrx.exe 1532 nnhbtn.exe 1604 5xlllrl.exe 2748 btbtnn.exe 3064 jpddp.exe 2120 xflffxx.exe 4712 5tnhbb.exe 2696 3vdpj.exe 1816 fxfxrlx.exe 408 rxfxrrr.exe 628 3nnhbb.exe 5064 ddjdd.exe 916 jdvjd.exe 60 3rllfxx.exe 2392 xrrrlll.exe 1632 hbhhnn.exe 3172 djjjp.exe 4376 vvpjj.exe 5032 rxlfllf.exe 3460 xxfxxxr.exe 4288 nnbttn.exe 4468 djpjj.exe 3744 7ppjd.exe 4324 7rrxrrf.exe 1204 7tbbbb.exe 2152 ntnnnh.exe 1280 5jjdv.exe 4872 lxrlffx.exe 2764 xxrxxxx.exe 184 thnntt.exe 1188 1nbhtt.exe 3916 dvvpj.exe 4284 flffxxr.exe 2744 9ffrrff.exe 3608 bnbnnt.exe 4784 vvvpp.exe 436 dpdvd.exe 4696 rflrlff.exe 1904 7tttnn.exe 3532 dvppj.exe 2832 pjvpp.exe 4176 fxxrlfx.exe 1568 tnnhhh.exe 4976 nhbttt.exe 2468 jvdvv.exe 4136 lllfxxr.exe -
resource yara_rule behavioral2/memory/4440-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023276-5.dat upx behavioral2/memory/4440-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233e8-10.dat upx behavioral2/memory/1444-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1444-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4272-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ec-15.dat upx behavioral2/memory/3976-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ed-24.dat upx behavioral2/memory/1188-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ee-31.dat upx behavioral2/memory/4700-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3692-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f0-42.dat upx behavioral2/files/0x00070000000233f1-48.dat upx behavioral2/files/0x00070000000233f4-58.dat upx behavioral2/files/0x00070000000233f2-54.dat upx behavioral2/files/0x00070000000233f5-63.dat upx behavioral2/memory/3640-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3600-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f6-70.dat upx behavioral2/files/0x00070000000233f7-78.dat upx behavioral2/memory/64-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4136-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4944-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f8-82.dat upx behavioral2/files/0x00070000000233f9-90.dat upx behavioral2/memory/1252-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fa-96.dat upx behavioral2/files/0x00070000000233fb-99.dat upx behavioral2/files/0x00070000000233fd-110.dat upx behavioral2/memory/4484-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fc-105.dat upx behavioral2/files/0x00070000000233fe-118.dat upx behavioral2/files/0x00070000000233ff-121.dat upx behavioral2/files/0x0009000000023363-126.dat upx behavioral2/memory/2680-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1604-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3064-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023401-139.dat upx behavioral2/files/0x0007000000023400-135.dat upx behavioral2/memory/2748-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233e9-144.dat upx behavioral2/files/0x0007000000023402-150.dat upx behavioral2/memory/2120-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023403-156.dat upx behavioral2/files/0x0007000000023404-160.dat upx behavioral2/memory/408-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023364-167.dat upx behavioral2/files/0x0007000000023406-177.dat upx behavioral2/files/0x0007000000023407-182.dat upx behavioral2/memory/916-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023405-173.dat upx behavioral2/memory/2392-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3172-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/776-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ef-37.dat upx behavioral2/memory/5032-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4376-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5032-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4272-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4288-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4468-217-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4440 wrote to memory of 1444 4440 7fd549ac6524ec5921223c9ba6039860fa5d749060f6cb096f89df43e95c8343.exe 82 PID 4440 wrote to memory of 1444 4440 7fd549ac6524ec5921223c9ba6039860fa5d749060f6cb096f89df43e95c8343.exe 82 PID 4440 wrote to memory of 1444 4440 7fd549ac6524ec5921223c9ba6039860fa5d749060f6cb096f89df43e95c8343.exe 82 PID 1444 wrote to memory of 4272 1444 pjpjd.exe 83 PID 1444 wrote to memory of 4272 1444 pjpjd.exe 83 PID 1444 wrote to memory of 4272 1444 pjpjd.exe 83 PID 4272 wrote to memory of 3976 4272 9fllxrl.exe 84 PID 4272 wrote to memory of 3976 4272 9fllxrl.exe 84 PID 4272 wrote to memory of 3976 4272 9fllxrl.exe 84 PID 3976 wrote to memory of 1188 3976 pppdv.exe 133 PID 3976 wrote to memory of 1188 3976 pppdv.exe 133 PID 3976 wrote to memory of 1188 3976 pppdv.exe 133 PID 1188 wrote to memory of 4700 1188 9flfrxr.exe 87 PID 1188 wrote to memory of 4700 1188 9flfrxr.exe 87 PID 1188 wrote to memory of 4700 1188 9flfrxr.exe 87 PID 4700 wrote to memory of 3692 4700 tnthnn.exe 88 PID 4700 wrote to memory of 3692 4700 tnthnn.exe 88 PID 4700 wrote to memory of 3692 4700 tnthnn.exe 88 PID 3692 wrote to memory of 776 3692 hbnhhb.exe 89 PID 3692 wrote to memory of 776 3692 hbnhhb.exe 89 PID 3692 wrote to memory of 776 3692 hbnhhb.exe 89 PID 776 wrote to memory of 2224 776 ppdvp.exe 90 PID 776 wrote to memory of 2224 776 ppdvp.exe 90 PID 776 wrote to memory of 2224 776 ppdvp.exe 90 PID 2224 wrote to memory of 2184 2224 rlrxrrr.exe 91 PID 2224 wrote to memory of 2184 2224 rlrxrrr.exe 91 PID 2224 wrote to memory of 2184 2224 rlrxrrr.exe 91 PID 2184 wrote to memory of 3600 2184 lfflllf.exe 92 PID 2184 wrote to memory of 3600 2184 lfflllf.exe 92 PID 2184 wrote to memory of 3600 2184 lfflllf.exe 92 PID 3600 wrote to memory of 3640 3600 thbbtb.exe 94 PID 3600 wrote to memory of 3640 3600 thbbtb.exe 94 PID 3600 wrote to memory of 3640 3600 thbbtb.exe 94 PID 3640 wrote to memory of 64 3640 dppdd.exe 95 PID 3640 wrote to memory of 64 3640 dppdd.exe 95 PID 3640 wrote to memory of 64 3640 dppdd.exe 95 PID 64 wrote to memory of 4944 64 lffffrr.exe 96 PID 64 wrote to memory of 4944 64 lffffrr.exe 96 PID 64 wrote to memory of 4944 64 lffffrr.exe 96 PID 4944 wrote to memory of 4136 4944 bttnnn.exe 148 PID 4944 wrote to memory of 4136 4944 bttnnn.exe 148 PID 4944 wrote to memory of 4136 4944 bttnnn.exe 148 PID 4136 wrote to memory of 1252 4136 pjjdv.exe 99 PID 4136 wrote to memory of 1252 4136 pjjdv.exe 99 PID 4136 wrote to memory of 1252 4136 pjjdv.exe 99 PID 1252 wrote to memory of 4804 1252 rrlfxxx.exe 100 PID 1252 wrote to memory of 4804 1252 rrlfxxx.exe 100 PID 1252 wrote to memory of 4804 1252 rrlfxxx.exe 100 PID 4804 wrote to memory of 3852 4804 nhbbtt.exe 101 PID 4804 wrote to memory of 3852 4804 nhbbtt.exe 101 PID 4804 wrote to memory of 3852 4804 nhbbtt.exe 101 PID 3852 wrote to memory of 4484 3852 ddjdj.exe 102 PID 3852 wrote to memory of 4484 3852 ddjdj.exe 102 PID 3852 wrote to memory of 4484 3852 ddjdj.exe 102 PID 4484 wrote to memory of 2680 4484 7lxrrxf.exe 103 PID 4484 wrote to memory of 2680 4484 7lxrrxf.exe 103 PID 4484 wrote to memory of 2680 4484 7lxrrxf.exe 103 PID 2680 wrote to memory of 1532 2680 fxllrrx.exe 104 PID 2680 wrote to memory of 1532 2680 fxllrrx.exe 104 PID 2680 wrote to memory of 1532 2680 fxllrrx.exe 104 PID 1532 wrote to memory of 1604 1532 nnhbtn.exe 105 PID 1532 wrote to memory of 1604 1532 nnhbtn.exe 105 PID 1532 wrote to memory of 1604 1532 nnhbtn.exe 105 PID 1604 wrote to memory of 2748 1604 5xlllrl.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fd549ac6524ec5921223c9ba6039860fa5d749060f6cb096f89df43e95c8343.exe"C:\Users\Admin\AppData\Local\Temp\7fd549ac6524ec5921223c9ba6039860fa5d749060f6cb096f89df43e95c8343.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\pjpjd.exec:\pjpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\9fllxrl.exec:\9fllxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\pppdv.exec:\pppdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\9flfrxr.exec:\9flfrxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\tnthnn.exec:\tnthnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\hbnhhb.exec:\hbnhhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\ppdvp.exec:\ppdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\rlrxrrr.exec:\rlrxrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\lfflllf.exec:\lfflllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\thbbtb.exec:\thbbtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\dppdd.exec:\dppdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\lffffrr.exec:\lffffrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\bttnnn.exec:\bttnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\pjjdv.exec:\pjjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\rrlfxxx.exec:\rrlfxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\nhbbtt.exec:\nhbbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\ddjdj.exec:\ddjdj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\7lxrrxf.exec:\7lxrrxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\fxllrrx.exec:\fxllrrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\nnhbtn.exec:\nnhbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\5xlllrl.exec:\5xlllrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\btbtnn.exec:\btbtnn.exe23⤵
- Executes dropped EXE
PID:2748 -
\??\c:\jpddp.exec:\jpddp.exe24⤵
- Executes dropped EXE
PID:3064 -
\??\c:\xflffxx.exec:\xflffxx.exe25⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5tnhbb.exec:\5tnhbb.exe26⤵
- Executes dropped EXE
PID:4712 -
\??\c:\3vdpj.exec:\3vdpj.exe27⤵
- Executes dropped EXE
PID:2696 -
\??\c:\fxfxrlx.exec:\fxfxrlx.exe28⤵
- Executes dropped EXE
PID:1816 -
\??\c:\rxfxrrr.exec:\rxfxrrr.exe29⤵
- Executes dropped EXE
PID:408 -
\??\c:\3nnhbb.exec:\3nnhbb.exe30⤵
- Executes dropped EXE
PID:628 -
\??\c:\ddjdd.exec:\ddjdd.exe31⤵
- Executes dropped EXE
PID:5064 -
\??\c:\jdvjd.exec:\jdvjd.exe32⤵
- Executes dropped EXE
PID:916 -
\??\c:\3rllfxx.exec:\3rllfxx.exe33⤵
- Executes dropped EXE
PID:60 -
\??\c:\xrrrlll.exec:\xrrrlll.exe34⤵
- Executes dropped EXE
PID:2392 -
\??\c:\hbhhnn.exec:\hbhhnn.exe35⤵
- Executes dropped EXE
PID:1632 -
\??\c:\djjjp.exec:\djjjp.exe36⤵
- Executes dropped EXE
PID:3172 -
\??\c:\vvpjj.exec:\vvpjj.exe37⤵
- Executes dropped EXE
PID:4376 -
\??\c:\rxlfllf.exec:\rxlfllf.exe38⤵
- Executes dropped EXE
PID:5032 -
\??\c:\xxfxxxr.exec:\xxfxxxr.exe39⤵
- Executes dropped EXE
PID:3460 -
\??\c:\nnbttn.exec:\nnbttn.exe40⤵
- Executes dropped EXE
PID:4288 -
\??\c:\djpjj.exec:\djpjj.exe41⤵
- Executes dropped EXE
PID:4468 -
\??\c:\7ppjd.exec:\7ppjd.exe42⤵
- Executes dropped EXE
PID:3744 -
\??\c:\7rrxrrf.exec:\7rrxrrf.exe43⤵
- Executes dropped EXE
PID:4324 -
\??\c:\7tbbbb.exec:\7tbbbb.exe44⤵
- Executes dropped EXE
PID:1204 -
\??\c:\ntnnnh.exec:\ntnnnh.exe45⤵
- Executes dropped EXE
PID:2152 -
\??\c:\5jjdv.exec:\5jjdv.exe46⤵
- Executes dropped EXE
PID:1280 -
\??\c:\lxrlffx.exec:\lxrlffx.exe47⤵
- Executes dropped EXE
PID:4872 -
\??\c:\xxrxxxx.exec:\xxrxxxx.exe48⤵
- Executes dropped EXE
PID:2764 -
\??\c:\thnntt.exec:\thnntt.exe49⤵
- Executes dropped EXE
PID:184 -
\??\c:\1nbhtt.exec:\1nbhtt.exe50⤵
- Executes dropped EXE
PID:1188 -
\??\c:\dvvpj.exec:\dvvpj.exe51⤵
- Executes dropped EXE
PID:3916 -
\??\c:\flffxxr.exec:\flffxxr.exe52⤵
- Executes dropped EXE
PID:4284 -
\??\c:\9ffrrff.exec:\9ffrrff.exe53⤵
- Executes dropped EXE
PID:2744 -
\??\c:\bnbnnt.exec:\bnbnnt.exe54⤵
- Executes dropped EXE
PID:3608 -
\??\c:\vvvpp.exec:\vvvpp.exe55⤵
- Executes dropped EXE
PID:4784 -
\??\c:\dpdvd.exec:\dpdvd.exe56⤵
- Executes dropped EXE
PID:436 -
\??\c:\rflrlff.exec:\rflrlff.exe57⤵
- Executes dropped EXE
PID:4696 -
\??\c:\7tttnn.exec:\7tttnn.exe58⤵
- Executes dropped EXE
PID:1904 -
\??\c:\dvppj.exec:\dvppj.exe59⤵
- Executes dropped EXE
PID:3532 -
\??\c:\pjvpp.exec:\pjvpp.exe60⤵
- Executes dropped EXE
PID:2832 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe61⤵
- Executes dropped EXE
PID:4176 -
\??\c:\tnnhhh.exec:\tnnhhh.exe62⤵
- Executes dropped EXE
PID:1568 -
\??\c:\nhbttt.exec:\nhbttt.exe63⤵
- Executes dropped EXE
PID:4976 -
\??\c:\jvdvv.exec:\jvdvv.exe64⤵
- Executes dropped EXE
PID:2468 -
\??\c:\lllfxxr.exec:\lllfxxr.exe65⤵
- Executes dropped EXE
PID:4136 -
\??\c:\vjvdv.exec:\vjvdv.exe66⤵PID:2064
-
\??\c:\lflfrrr.exec:\lflfrrr.exe67⤵PID:808
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe68⤵PID:3076
-
\??\c:\djjjd.exec:\djjjd.exe69⤵PID:1960
-
\??\c:\lxfxfxx.exec:\lxfxfxx.exe70⤵PID:4564
-
\??\c:\pjjdd.exec:\pjjdd.exe71⤵PID:4672
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe72⤵PID:3648
-
\??\c:\9tbtnh.exec:\9tbtnh.exe73⤵PID:1004
-
\??\c:\9hbnhh.exec:\9hbnhh.exe74⤵PID:4472
-
\??\c:\9ddpd.exec:\9ddpd.exe75⤵PID:4480
-
\??\c:\nnhhnb.exec:\nnhhnb.exe76⤵PID:2932
-
\??\c:\ttthbb.exec:\ttthbb.exe77⤵PID:4900
-
\??\c:\xlxrfxf.exec:\xlxrfxf.exe78⤵PID:4600
-
\??\c:\tthtnh.exec:\tthtnh.exe79⤵PID:4064
-
\??\c:\fflrfrr.exec:\fflrfrr.exe80⤵PID:2120
-
\??\c:\hhbbbt.exec:\hhbbbt.exe81⤵PID:3868
-
\??\c:\5vpjv.exec:\5vpjv.exe82⤵PID:3596
-
\??\c:\rrllfxr.exec:\rrllfxr.exe83⤵PID:3980
-
\??\c:\hbhbhb.exec:\hbhbhb.exe84⤵PID:1316
-
\??\c:\pvdjj.exec:\pvdjj.exe85⤵PID:3036
-
\??\c:\lllxrlx.exec:\lllxrlx.exe86⤵PID:1800
-
\??\c:\fxxlllf.exec:\fxxlllf.exe87⤵PID:4668
-
\??\c:\pvvvv.exec:\pvvvv.exe88⤵PID:3108
-
\??\c:\9frrfff.exec:\9frrfff.exe89⤵PID:1988
-
\??\c:\7ntttt.exec:\7ntttt.exe90⤵PID:3188
-
\??\c:\7ppdp.exec:\7ppdp.exe91⤵PID:1064
-
\??\c:\djpjd.exec:\djpjd.exe92⤵PID:2704
-
\??\c:\hnnnhn.exec:\hnnnhn.exe93⤵PID:3172
-
\??\c:\pjpjj.exec:\pjpjj.exe94⤵PID:1700
-
\??\c:\1hbtnh.exec:\1hbtnh.exe95⤵PID:1172
-
\??\c:\hntnnn.exec:\hntnnn.exe96⤵PID:4012
-
\??\c:\jjddv.exec:\jjddv.exe97⤵PID:3460
-
\??\c:\vvjdj.exec:\vvjdj.exe98⤵PID:4288
-
\??\c:\lrfxrrx.exec:\lrfxrrx.exe99⤵PID:4468
-
\??\c:\3bnnht.exec:\3bnnht.exe100⤵PID:3060
-
\??\c:\pjjjj.exec:\pjjjj.exe101⤵PID:1628
-
\??\c:\1lrrllf.exec:\1lrrllf.exe102⤵PID:4368
-
\??\c:\tbthnb.exec:\tbthnb.exe103⤵PID:1548
-
\??\c:\7jvpj.exec:\7jvpj.exe104⤵PID:1952
-
\??\c:\rlrffxf.exec:\rlrffxf.exe105⤵PID:4588
-
\??\c:\lrxfffx.exec:\lrxfffx.exe106⤵PID:224
-
\??\c:\hnbnhb.exec:\hnbnhb.exe107⤵PID:2964
-
\??\c:\7jpjd.exec:\7jpjd.exe108⤵PID:1748
-
\??\c:\xrfllfl.exec:\xrfllfl.exe109⤵PID:3692
-
\??\c:\bthbtb.exec:\bthbtb.exe110⤵PID:5048
-
\??\c:\hnnnnh.exec:\hnnnnh.exe111⤵PID:4820
-
\??\c:\vpdjj.exec:\vpdjj.exe112⤵PID:5072
-
\??\c:\frxlfxr.exec:\frxlfxr.exe113⤵PID:2184
-
\??\c:\rfrllfl.exec:\rfrllfl.exe114⤵PID:2604
-
\??\c:\hhhbbt.exec:\hhhbbt.exe115⤵PID:980
-
\??\c:\1ntnhb.exec:\1ntnhb.exe116⤵PID:3316
-
\??\c:\dvpjv.exec:\dvpjv.exe117⤵PID:2640
-
\??\c:\7llflxr.exec:\7llflxr.exe118⤵PID:3728
-
\??\c:\rrxrffr.exec:\rrxrffr.exe119⤵PID:1872
-
\??\c:\hnbnnh.exec:\hnbnnh.exe120⤵PID:2940
-
\??\c:\tbhtnh.exec:\tbhtnh.exe121⤵PID:2844
-
\??\c:\dpvjv.exec:\dpvjv.exe122⤵PID:3124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-