Analysis
- max time kernel
150s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 03:48
Behavioral task
behavioral1
Sample
c090cdac4593daf19c8a68a7d7d396bc8f1ee8ed88ce44acfbcc240db31b6946.exe
Resource
win7-20240611-en
windows7-x64
6 signatures
150 seconds
General
- Target c090cdac4593daf19c8a68a7d7d396bc8f1ee8ed88ce44acfbcc240db31b6946.exe
- Size 184KB
- Sample240612-ecttxszfmn
- SHA256 c090cdac4593daf19c8a68a7d7d396bc8f1ee8ed88ce44acfbcc240db31b6946
- MD5 aa368c5423db0527242bba288e446e08
- SHA1 af28880d4d3114e873bbf2c5c8a3e74625abe408
- SHA512 e422d0462bade6aa67dfb0c8f5fdd4bb200963fcb70f40e6b4704fd109f5b02349a18d23ff907c740a90fce1ab363f6f0075374f42e290c68ba50b9f85e5b88f
- SSDEEP 3072:chOmTsF93UYfwC6GIout5pi8rY9AABa1U+a88Xu3VodyikZfhnJtJI+f:ccm4FmowdHoS5ddWX+afdlkpPtJIW
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2860-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4156-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4156-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/748-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/892-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1368-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3784-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3648-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2680-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2416-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/720-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/920-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4464-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3520-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3148-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3836-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1792-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1520-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2384-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2708-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3896-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3092-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/644-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/888-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4220-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2308-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2116-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1020-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4104-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3148-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/840-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3896-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1856-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1992-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4212-488-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3144-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-564-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-586-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-593-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1144-597-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-643-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-665-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-693-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2852-789-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1512-1221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/2860-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233d6-3.dat UPX behavioral2/memory/2860-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4156-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4156-12-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0008000000023572-10.dat UPX behavioral2/files/0x0008000000023575-16.dat UPX behavioral2/memory/4496-19-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/748-21-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023576-23.dat UPX behavioral2/memory/892-27-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023577-29.dat UPX behavioral2/memory/4920-32-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023578-35.dat UPX behavioral2/files/0x0007000000023579-40.dat UPX behavioral2/memory/1368-41-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3784-43-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002357a-46.dat UPX behavioral2/memory/3648-50-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002357b-52.dat UPX behavioral2/files/0x000700000002357c-57.dat UPX behavioral2/memory/2680-59-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2416-61-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2416-65-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002357d-66.dat UPX behavioral2/memory/4884-71-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002357e-72.dat UPX behavioral2/memory/720-75-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002357f-79.dat UPX behavioral2/files/0x0007000000023580-84.dat UPX behavioral2/memory/920-87-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4464-85-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023581-89.dat UPX behavioral2/files/0x0007000000023582-94.dat UPX behavioral2/files/0x0007000000023583-99.dat UPX behavioral2/memory/5048-100-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023584-104.dat UPX behavioral2/memory/3520-108-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023585-110.dat UPX behavioral2/files/0x0007000000023586-116.dat UPX behavioral2/files/0x0007000000023587-120.dat UPX behavioral2/memory/3148-122-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3836-124-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023588-127.dat UPX behavioral2/memory/3708-130-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023589-133.dat UPX behavioral2/memory/2540-136-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002358a-139.dat UPX behavioral2/files/0x000700000002358b-145.dat UPX behavioral2/files/0x0008000000023573-151.dat UPX behavioral2/memory/1792-149-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1520-154-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2384-143-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002358c-157.dat UPX behavioral2/memory/2708-161-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002358d-163.dat UPX behavioral2/files/0x000700000002358e-169.dat UPX behavioral2/files/0x000700000002358f-173.dat UPX behavioral2/memory/4072-175-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023590-179.dat UPX behavioral2/files/0x0007000000023591-184.dat UPX behavioral2/memory/3600-191-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3896-206-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3092-208-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 4156 bbbhnt.exe 4496 1dppp.exe 748 btnntt.exe 892 bhtttb.exe 4920 9jddp.exe 1368 rlrfxxr.exe 3784 vvdpp.exe 3648 lrxrrrr.exe 2680 bbhbbb.exe 2416 3jppj.exe 4884 xrxrllx.exe 720 tnbhhn.exe 4464 pdppp.exe 920 lflfffx.exe 3408 lllllrr.exe 5048 9hhhhb.exe 4420 ddjdd.exe 3520 rrfxxff.exe 2424 flxxxll.exe 3148 hhnhtb.exe 3836 jdjdv.exe 3708 9xrlflf.exe 2540 hbhhhh.exe 2384 7hnthn.exe 1792 7jjdv.exe 1520 xlxlfff.exe 2708 rrrfxxl.exe 4396 nnnhhh.exe 4072 pdjvv.exe 3232 5ffxrrl.exe 2500 htnbnh.exe 3404 tbhbtt.exe 3600 9djpd.exe 3128 9lxrrrr.exe 4864 xrxxllf.exe 4560 hbntnn.exe 3896 hthhtt.exe 3092 ddppp.exe 4792 1djdv.exe 4368 rlrfffx.exe 644 lfrrrrr.exe 3832 htbbbb.exe 1788 hhntbb.exe 4496 7djjd.exe 3216 vpddd.exe 1796 rrfffll.exe 3460 9flfllr.exe 888 9ttnnn.exe 4220 pdjdd.exe 2308 pdjjv.exe 4808 fffxlll.exe 1992 fllrrrl.exe 4048 vdpdp.exe 4932 frflxxx.exe 4032 fxxrrrl.exe 4604 tbhnhh.exe 4884 ttnhhb.exe 2116 vpvjj.exe 1912 xfrlfff.exe 3400 llrrllf.exe 780 ttnntt.exe 4180 pjpjd.exe 4840 vjppj.exe 5048 1xxrffx.exe -
resource yara_rule behavioral2/memory/2860-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d6-3.dat upx behavioral2/memory/2860-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4156-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4156-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023572-10.dat upx behavioral2/files/0x0008000000023575-16.dat upx behavioral2/memory/4496-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/748-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023576-23.dat upx behavioral2/memory/892-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023577-29.dat upx behavioral2/memory/4920-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023578-35.dat upx behavioral2/files/0x0007000000023579-40.dat upx behavioral2/memory/1368-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3784-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002357a-46.dat upx behavioral2/memory/3648-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002357b-52.dat upx behavioral2/files/0x000700000002357c-57.dat upx behavioral2/memory/2680-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2416-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2416-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002357d-66.dat upx behavioral2/memory/4884-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002357e-72.dat upx behavioral2/memory/720-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002357f-79.dat upx behavioral2/files/0x0007000000023580-84.dat upx behavioral2/memory/920-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4464-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023581-89.dat upx behavioral2/files/0x0007000000023582-94.dat upx behavioral2/files/0x0007000000023583-99.dat upx behavioral2/memory/5048-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023584-104.dat upx behavioral2/memory/3520-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023585-110.dat upx behavioral2/files/0x0007000000023586-116.dat upx behavioral2/files/0x0007000000023587-120.dat upx behavioral2/memory/3148-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3836-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023588-127.dat upx behavioral2/memory/3708-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023589-133.dat upx behavioral2/memory/2540-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002358a-139.dat upx behavioral2/files/0x000700000002358b-145.dat upx behavioral2/files/0x0008000000023573-151.dat upx behavioral2/memory/1792-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1520-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2384-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002358c-157.dat upx behavioral2/memory/2708-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002358d-163.dat upx behavioral2/files/0x000700000002358e-169.dat upx behavioral2/files/0x000700000002358f-173.dat upx behavioral2/memory/4072-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023590-179.dat upx behavioral2/files/0x0007000000023591-184.dat upx behavioral2/memory/3600-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3896-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3092-208-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2860 wrote to memory of 4156 2860 c090cdac4593daf19c8a68a7d7d396bc8f1ee8ed88ce44acfbcc240db31b6946.exe 80 PID 2860 wrote to memory of 4156 2860 c090cdac4593daf19c8a68a7d7d396bc8f1ee8ed88ce44acfbcc240db31b6946.exe 80 PID 2860 wrote to memory of 4156 2860 c090cdac4593daf19c8a68a7d7d396bc8f1ee8ed88ce44acfbcc240db31b6946.exe 80 PID 4156 wrote to memory of 4496 4156 bbbhnt.exe 81 PID 4156 wrote to memory of 4496 4156 bbbhnt.exe 81 PID 4156 wrote to memory of 4496 4156 bbbhnt.exe 81 PID 4496 wrote to memory of 748 4496 1dppp.exe 82 PID 4496 wrote to memory of 748 4496 1dppp.exe 82 PID 4496 wrote to memory of 748 4496 1dppp.exe 82 PID 748 wrote to memory of 892 748 btnntt.exe 83 PID 748 wrote to memory of 892 748 btnntt.exe 83 PID 748 wrote to memory of 892 748 btnntt.exe 83 PID 892 wrote to memory of 4920 892 bhtttb.exe 84 PID 892 wrote to memory of 4920 892 bhtttb.exe 84 PID 892 wrote to memory of 4920 892 bhtttb.exe 84 PID 4920 wrote to memory of 1368 4920 9jddp.exe 86 PID 4920 wrote to memory of 1368 4920 9jddp.exe 86 PID 4920 wrote to memory of 1368 4920 9jddp.exe 86 PID 1368 wrote to memory of 3784 1368 rlrfxxr.exe 87 PID 1368 wrote to memory of 3784 1368 rlrfxxr.exe 87 PID 1368 wrote to memory of 3784 1368 rlrfxxr.exe 87 PID 3784 wrote to memory of 3648 3784 vvdpp.exe 88 PID 3784 wrote to memory of 3648 3784 vvdpp.exe 88 PID 3784 wrote to memory of 3648 3784 vvdpp.exe 88 PID 3648 wrote to memory of 2680 3648 lrxrrrr.exe 90 PID 3648 wrote to memory of 2680 3648 lrxrrrr.exe 90 PID 3648 wrote to memory of 2680 3648 lrxrrrr.exe 90 PID 2680 wrote to memory of 2416 2680 bbhbbb.exe 91 PID 2680 wrote to memory of 2416 2680 bbhbbb.exe 91 PID 2680 wrote to memory of 2416 2680 bbhbbb.exe 91 PID 2416 wrote to memory of 4884 2416 3jppj.exe 92 PID 2416 wrote to memory of 4884 2416 3jppj.exe 92 PID 2416 wrote to memory of 4884 2416 3jppj.exe 92 PID 4884 wrote to memory of 720 4884 xrxrllx.exe 94 PID 4884 wrote to memory of 720 4884 xrxrllx.exe 94 PID 4884 wrote to memory of 720 4884 xrxrllx.exe 94 PID 720 wrote to memory of 4464 720 tnbhhn.exe 95 PID 720 wrote to memory of 4464 720 tnbhhn.exe 95 PID 720 wrote to memory of 4464 720 tnbhhn.exe 95 PID 4464 wrote to memory of 920 4464 pdppp.exe 96 PID 4464 wrote to memory of 920 4464 pdppp.exe 96 PID 4464 wrote to memory of 920 4464 pdppp.exe 96 PID 920 wrote to memory of 3408 920 lflfffx.exe 97 PID 920 wrote to memory of 3408 920 lflfffx.exe 97 PID 920 wrote to memory of 3408 920 lflfffx.exe 97 PID 3408 wrote to memory of 5048 3408 lllllrr.exe 98 PID 3408 wrote to memory of 5048 3408 lllllrr.exe 98 PID 3408 wrote to memory of 5048 3408 lllllrr.exe 98 PID 5048 wrote to memory of 4420 5048 9hhhhb.exe 99 PID 5048 wrote to memory of 4420 5048 9hhhhb.exe 99 PID 5048 wrote to memory of 4420 5048 9hhhhb.exe 99 PID 4420 wrote to memory of 3520 4420 ddjdd.exe 100 PID 4420 wrote to memory of 3520 4420 ddjdd.exe 100 PID 4420 wrote to memory of 3520 4420 ddjdd.exe 100 PID 3520 wrote to memory of 2424 3520 rrfxxff.exe 101 PID 3520 wrote to memory of 2424 3520 rrfxxff.exe 101 PID 3520 wrote to memory of 2424 3520 rrfxxff.exe 101 PID 2424 wrote to memory of 3148 2424 flxxxll.exe 102 PID 2424 wrote to memory of 3148 2424 flxxxll.exe 102 PID 2424 wrote to memory of 3148 2424 flxxxll.exe 102 PID 3148 wrote to memory of 3836 3148 hhnhtb.exe 103 PID 3148 wrote to memory of 3836 3148 hhnhtb.exe 103 PID 3148 wrote to memory of 3836 3148 hhnhtb.exe 103 PID 3836 wrote to memory of 3708 3836 jdjdv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\c090cdac4593daf19c8a68a7d7d396bc8f1ee8ed88ce44acfbcc240db31b6946.exe"C:\Users\Admin\AppData\Local\Temp\c090cdac4593daf19c8a68a7d7d396bc8f1ee8ed88ce44acfbcc240db31b6946.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\bbbhnt.exec:\bbbhnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\1dppp.exec:\1dppp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\btnntt.exec:\btnntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\bhtttb.exec:\bhtttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\9jddp.exec:\9jddp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\rlrfxxr.exec:\rlrfxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\vvdpp.exec:\vvdpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\lrxrrrr.exec:\lrxrrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\bbhbbb.exec:\bbhbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\3jppj.exec:\3jppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\xrxrllx.exec:\xrxrllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\tnbhhn.exec:\tnbhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\pdppp.exec:\pdppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\lflfffx.exec:\lflfffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\lllllrr.exec:\lllllrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\9hhhhb.exec:\9hhhhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\ddjdd.exec:\ddjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\rrfxxff.exec:\rrfxxff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\flxxxll.exec:\flxxxll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\hhnhtb.exec:\hhnhtb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\jdjdv.exec:\jdjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\9xrlflf.exec:\9xrlflf.exe23⤵
- Executes dropped EXE
PID:3708 -
\??\c:\hbhhhh.exec:\hbhhhh.exe24⤵
- Executes dropped EXE
PID:2540 -
\??\c:\7hnthn.exec:\7hnthn.exe25⤵
- Executes dropped EXE
PID:2384 -
\??\c:\7jjdv.exec:\7jjdv.exe26⤵
- Executes dropped EXE
PID:1792 -
\??\c:\xlxlfff.exec:\xlxlfff.exe27⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rrrfxxl.exec:\rrrfxxl.exe28⤵
- Executes dropped EXE
PID:2708 -
\??\c:\nnnhhh.exec:\nnnhhh.exe29⤵
- Executes dropped EXE
PID:4396 -
\??\c:\pdjvv.exec:\pdjvv.exe30⤵
- Executes dropped EXE
PID:4072 -
\??\c:\5ffxrrl.exec:\5ffxrrl.exe31⤵
- Executes dropped EXE
PID:3232 -
\??\c:\htnbnh.exec:\htnbnh.exe32⤵
- Executes dropped EXE
PID:2500 -
\??\c:\tbhbtt.exec:\tbhbtt.exe33⤵
- Executes dropped EXE
PID:3404 -
\??\c:\9djpd.exec:\9djpd.exe34⤵
- Executes dropped EXE
PID:3600 -
\??\c:\9lxrrrr.exec:\9lxrrrr.exe35⤵
- Executes dropped EXE
PID:3128 -
\??\c:\xrxxllf.exec:\xrxxllf.exe36⤵
- Executes dropped EXE
PID:4864 -
\??\c:\hbntnn.exec:\hbntnn.exe37⤵
- Executes dropped EXE
PID:4560 -
\??\c:\hthhtt.exec:\hthhtt.exe38⤵
- Executes dropped EXE
PID:3896 -
\??\c:\ddppp.exec:\ddppp.exe39⤵
- Executes dropped EXE
PID:3092 -
\??\c:\1djdv.exec:\1djdv.exe40⤵
- Executes dropped EXE
PID:4792 -
\??\c:\rlrfffx.exec:\rlrfffx.exe41⤵
- Executes dropped EXE
PID:4368 -
\??\c:\lfrrrrr.exec:\lfrrrrr.exe42⤵
- Executes dropped EXE
PID:644 -
\??\c:\htbbbb.exec:\htbbbb.exe43⤵
- Executes dropped EXE
PID:3832 -
\??\c:\hhntbb.exec:\hhntbb.exe44⤵
- Executes dropped EXE
PID:1788 -
\??\c:\7djjd.exec:\7djjd.exe45⤵
- Executes dropped EXE
PID:4496 -
\??\c:\vpddd.exec:\vpddd.exe46⤵
- Executes dropped EXE
PID:3216 -
\??\c:\rrfffll.exec:\rrfffll.exe47⤵
- Executes dropped EXE
PID:1796 -
\??\c:\9flfllr.exec:\9flfllr.exe48⤵
- Executes dropped EXE
PID:3460 -
\??\c:\9ttnnn.exec:\9ttnnn.exe49⤵
- Executes dropped EXE
PID:888 -
\??\c:\pdjdd.exec:\pdjdd.exe50⤵
- Executes dropped EXE
PID:4220 -
\??\c:\pdjjv.exec:\pdjjv.exe51⤵
- Executes dropped EXE
PID:2308 -
\??\c:\fffxlll.exec:\fffxlll.exe52⤵
- Executes dropped EXE
PID:4808 -
\??\c:\fllrrrl.exec:\fllrrrl.exe53⤵
- Executes dropped EXE
PID:1992 -
\??\c:\vdpdp.exec:\vdpdp.exe54⤵
- Executes dropped EXE
PID:4048 -
\??\c:\frflxxx.exec:\frflxxx.exe55⤵
- Executes dropped EXE
PID:4932 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe56⤵
- Executes dropped EXE
PID:4032 -
\??\c:\tbhnhh.exec:\tbhnhh.exe57⤵
- Executes dropped EXE
PID:4604 -
\??\c:\ttnhhb.exec:\ttnhhb.exe58⤵
- Executes dropped EXE
PID:4884 -
\??\c:\vpvjj.exec:\vpvjj.exe59⤵
- Executes dropped EXE
PID:2116 -
\??\c:\xfrlfff.exec:\xfrlfff.exe60⤵
- Executes dropped EXE
PID:1912 -
\??\c:\llrrllf.exec:\llrrllf.exe61⤵
- Executes dropped EXE
PID:3400 -
\??\c:\ttnntt.exec:\ttnntt.exe62⤵
- Executes dropped EXE
PID:780 -
\??\c:\pjpjd.exec:\pjpjd.exe63⤵
- Executes dropped EXE
PID:4180 -
\??\c:\vjppj.exec:\vjppj.exe64⤵
- Executes dropped EXE
PID:4840 -
\??\c:\1xxrffx.exec:\1xxrffx.exe65⤵
- Executes dropped EXE
PID:5048 -
\??\c:\lrfxxxr.exec:\lrfxxxr.exe66⤵PID:4420
-
\??\c:\bttbbb.exec:\bttbbb.exe67⤵PID:1020
-
\??\c:\3jvvp.exec:\3jvvp.exe68⤵PID:4104
-
\??\c:\fflxrff.exec:\fflxrff.exe69⤵PID:548
-
\??\c:\bhhbbb.exec:\bhhbbb.exe70⤵PID:3148
-
\??\c:\vjppj.exec:\vjppj.exe71⤵PID:3980
-
\??\c:\lrrxxff.exec:\lrrxxff.exe72⤵PID:640
-
\??\c:\9rxxxfx.exec:\9rxxxfx.exe73⤵PID:1036
-
\??\c:\3hhtnt.exec:\3hhtnt.exe74⤵PID:5104
-
\??\c:\ppvvv.exec:\ppvvv.exe75⤵PID:3088
-
\??\c:\9jdvp.exec:\9jdvp.exe76⤵PID:4428
-
\??\c:\xxfxffl.exec:\xxfxffl.exe77⤵PID:840
-
\??\c:\fxffffl.exec:\fxffffl.exe78⤵PID:2548
-
\??\c:\bhhbhb.exec:\bhhbhb.exe79⤵PID:1248
-
\??\c:\vdjjj.exec:\vdjjj.exe80⤵PID:4392
-
\??\c:\vvjjp.exec:\vvjjp.exe81⤵PID:4484
-
\??\c:\ffllxff.exec:\ffllxff.exe82⤵PID:3344
-
\??\c:\rxlxxff.exec:\rxlxxff.exe83⤵PID:4500
-
\??\c:\5bhnhh.exec:\5bhnhh.exe84⤵PID:1668
-
\??\c:\jdjpp.exec:\jdjpp.exe85⤵PID:3352
-
\??\c:\dpvvp.exec:\dpvvp.exe86⤵PID:4240
-
\??\c:\flrrlxx.exec:\flrrlxx.exe87⤵PID:2436
-
\??\c:\nhnbth.exec:\nhnbth.exe88⤵PID:3140
-
\??\c:\ntbbnt.exec:\ntbbnt.exe89⤵PID:3128
-
\??\c:\pdjjp.exec:\pdjjp.exe90⤵PID:4864
-
\??\c:\3vppd.exec:\3vppd.exe91⤵PID:3376
-
\??\c:\xxflxff.exec:\xxflxff.exe92⤵PID:3896
-
\??\c:\ffxxrxl.exec:\ffxxrxl.exe93⤵PID:4764
-
\??\c:\nntttn.exec:\nntttn.exe94⤵PID:4672
-
\??\c:\9jppd.exec:\9jppd.exe95⤵PID:1748
-
\??\c:\1pdpj.exec:\1pdpj.exe96⤵PID:1144
-
\??\c:\lrllxfx.exec:\lrllxfx.exe97⤵PID:1856
-
\??\c:\rrrlllf.exec:\rrrlllf.exe98⤵PID:3436
-
\??\c:\nntttt.exec:\nntttt.exe99⤵PID:4160
-
\??\c:\jppjp.exec:\jppjp.exe100⤵PID:1468
-
\??\c:\7pdjj.exec:\7pdjj.exe101⤵PID:3380
-
\??\c:\rlxrrxr.exec:\rlxrrxr.exe102⤵PID:3216
-
\??\c:\5frrffr.exec:\5frrffr.exe103⤵PID:1796
-
\??\c:\httnnn.exec:\httnnn.exe104⤵PID:3460
-
\??\c:\ddjjd.exec:\ddjjd.exe105⤵PID:888
-
\??\c:\rlrxfxr.exec:\rlrxfxr.exe106⤵PID:4292
-
\??\c:\lllllrl.exec:\lllllrl.exe107⤵PID:3736
-
\??\c:\bbhhbb.exec:\bbhhbb.exe108⤵PID:4948
-
\??\c:\jvvpj.exec:\jvvpj.exe109⤵PID:1992
-
\??\c:\pdjjd.exec:\pdjjd.exe110⤵PID:4224
-
\??\c:\vpppj.exec:\vpppj.exe111⤵PID:1072
-
\??\c:\9rxxrfl.exec:\9rxxrfl.exe112⤵PID:5052
-
\??\c:\tbhnhh.exec:\tbhnhh.exe113⤵PID:1956
-
\??\c:\hbbtnt.exec:\hbbtnt.exe114⤵PID:3892
-
\??\c:\ppvjj.exec:\ppvjj.exe115⤵PID:2364
-
\??\c:\1xfrrll.exec:\1xfrrll.exe116⤵PID:4316
-
\??\c:\rfrxlrl.exec:\rfrxlrl.exe117⤵PID:4000
-
\??\c:\btttnn.exec:\btttnn.exe118⤵PID:1400
-
\??\c:\tttttb.exec:\tttttb.exe119⤵PID:836
-
\??\c:\3vpjd.exec:\3vpjd.exe120⤵PID:2064
-
\??\c:\jjpjd.exec:\jjpjd.exe121⤵PID:4172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-