Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 00:06
Behavioral task
behavioral1
Sample
72d4c31025ba421c938a4da30ab727f25e7d8718ca2ec4b06ab14d32ff7d0789.exe
Resource
win7-20240419-en
6 signatures
150 seconds
General
- Target 72d4c31025ba421c938a4da30ab727f25e7d8718ca2ec4b06ab14d32ff7d0789.exe
- Size 537KB
- Sample240614-ad71qa1ajm
- SHA256 72d4c31025ba421c938a4da30ab727f25e7d8718ca2ec4b06ab14d32ff7d0789
- MD5 110a3547e0c4e72ddc16fca7134ef73b
- SHA1 83ed9ffbc6aa5a5bcb8300250e8d56596a0f098e
- SHA512 ea787fa619bb59811ed961d225a20e3c57768c06c86e74b31cf3265e25dd5bff1207157d732201266477bfb314683dc3cb007be6ee5e21634a95609c1d90dd1e
- SSDEEP 12288:y4wFHoS3eFp3IDvSbh5nP+UbGTHoSouKs8N0u/D6vIZH:HFp3lzZbGa5soH
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2136-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3792-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2696-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/928-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4772-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4800-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3912-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4348-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3100-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3268-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/380-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4844-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3288-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1468-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4440-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2584-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2584-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3612-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2292-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4740-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1532-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1068-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2424-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3056-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4064-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/568-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2428-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1924-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2572-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3856-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4124-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4752-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1252-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/768-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3732-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4164-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4296-535-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-609-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-616-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-716-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1388-1106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1808-1231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2612-1353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/2136-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000f0000000234de-4.dat UPX behavioral2/memory/2136-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0008000000023568-9.dat UPX behavioral2/memory/3792-12-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023569-13.dat UPX behavioral2/files/0x000700000002356a-22.dat UPX behavioral2/files/0x000700000002356b-25.dat UPX behavioral2/memory/2604-28-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002356c-31.dat UPX behavioral2/memory/2696-34-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002356d-37.dat UPX behavioral2/memory/2276-39-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002356e-43.dat UPX behavioral2/memory/928-46-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4772-47-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002356f-50.dat UPX behavioral2/files/0x0007000000023570-58.dat UPX behavioral2/memory/4800-60-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3912-57-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023571-63.dat UPX behavioral2/memory/1388-64-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023572-70.dat UPX behavioral2/files/0x0007000000023573-73.dat UPX behavioral2/memory/4348-77-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4556-76-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023574-81.dat UPX behavioral2/memory/4088-84-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023575-88.dat UPX behavioral2/memory/2764-90-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0008000000023566-93.dat UPX behavioral2/files/0x0007000000023576-97.dat UPX behavioral2/memory/3100-99-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023577-105.dat UPX behavioral2/memory/5020-106-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023578-110.dat UPX behavioral2/memory/3268-113-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023579-115.dat UPX behavioral2/memory/3228-118-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002357a-121.dat UPX behavioral2/files/0x000700000002357b-127.dat UPX behavioral2/files/0x000700000002357c-133.dat UPX behavioral2/memory/380-132-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002357d-138.dat UPX behavioral2/memory/884-135-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002357e-143.dat UPX behavioral2/memory/4356-147-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002357f-149.dat UPX behavioral2/memory/4844-152-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023580-155.dat UPX behavioral2/files/0x00090000000234c3-160.dat UPX behavioral2/memory/220-163-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00080000000234e1-168.dat UPX behavioral2/memory/3288-174-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5092-177-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00080000000234e3-179.dat UPX behavioral2/memory/1468-181-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00080000000234e2-173.dat UPX behavioral2/memory/1468-186-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000d0000000006c5-184.dat UPX behavioral2/memory/4440-194-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2300-197-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2584-205-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2584-209-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 936 nbbttt.exe 3792 vpjvd.exe 4100 djpvp.exe 2604 9bnntt.exe 2696 pjpjd.exe 2276 1tbbbb.exe 928 5jddv.exe 4772 1bbtnt.exe 3912 jpddp.exe 4800 3ntnnn.exe 1388 dpppj.exe 4556 3nnhbt.exe 4348 vvvjj.exe 4088 lfflffr.exe 2764 lfrxxxr.exe 3100 llrxfxf.exe 3552 vjvpj.exe 5020 tnttbb.exe 3268 pdjdd.exe 3228 fflxxrx.exe 4836 3bnhbb.exe 380 pvjpj.exe 884 1xrlffx.exe 496 7tbtbb.exe 4356 dvddd.exe 4844 1jpjj.exe 2924 9jdvd.exe 220 ttnnhh.exe 3288 btthnh.exe 5092 5hnbtt.exe 1468 9httnt.exe 2404 bttttt.exe 4440 9tntnt.exe 2300 jjjjd.exe 4312 lflrllf.exe 4424 hthbtn.exe 2584 jdjdv.exe 3612 xrllffx.exe 556 htbbhh.exe 2292 vpddv.exe 4740 dvdvv.exe 1940 xxxrlrl.exe 1532 nhnhnh.exe 2424 dvvpj.exe 1068 jvppj.exe 1936 fxxrllf.exe 3912 ttbbtt.exe 3056 nntnhh.exe 2372 9pvvp.exe 3584 9fxrllf.exe 4064 7ntttb.exe 4556 jdvpv.exe 5024 xxxflll.exe 568 fflfrrf.exe 4088 nhnhhh.exe 1904 vpdvp.exe 2428 7lrfffx.exe 1528 9lxrrrl.exe 3552 9nhhbh.exe 3144 vpvvp.exe 1820 lllfxrl.exe 1924 3xxxrrl.exe 3528 3hhbtt.exe 4420 hbbtnn.exe -
resource yara_rule behavioral2/memory/2136-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000f0000000234de-4.dat upx behavioral2/memory/2136-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023568-9.dat upx behavioral2/memory/3792-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023569-13.dat upx behavioral2/files/0x000700000002356a-22.dat upx behavioral2/files/0x000700000002356b-25.dat upx behavioral2/memory/2604-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002356c-31.dat upx behavioral2/memory/2696-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002356d-37.dat upx behavioral2/memory/2276-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002356e-43.dat upx behavioral2/memory/928-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4772-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002356f-50.dat upx behavioral2/files/0x0007000000023570-58.dat upx behavioral2/memory/4800-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3912-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023571-63.dat upx behavioral2/memory/1388-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023572-70.dat upx behavioral2/files/0x0007000000023573-73.dat upx behavioral2/memory/4348-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4556-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023574-81.dat upx behavioral2/memory/4088-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023575-88.dat upx behavioral2/memory/2764-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023566-93.dat upx behavioral2/files/0x0007000000023576-97.dat upx behavioral2/memory/3100-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023577-105.dat upx behavioral2/memory/5020-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023578-110.dat upx behavioral2/memory/3268-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023579-115.dat upx behavioral2/memory/3228-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002357a-121.dat upx behavioral2/files/0x000700000002357b-127.dat upx behavioral2/files/0x000700000002357c-133.dat upx behavioral2/memory/380-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002357d-138.dat upx behavioral2/memory/884-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002357e-143.dat upx behavioral2/memory/4356-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002357f-149.dat upx behavioral2/memory/4844-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023580-155.dat upx behavioral2/files/0x00090000000234c3-160.dat upx behavioral2/memory/220-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234e1-168.dat upx behavioral2/memory/3288-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5092-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234e3-179.dat upx behavioral2/memory/1468-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234e2-173.dat upx behavioral2/memory/1468-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000d0000000006c5-184.dat upx behavioral2/memory/4440-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2300-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2584-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2584-209-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2136 wrote to memory of 936 2136 72d4c31025ba421c938a4da30ab727f25e7d8718ca2ec4b06ab14d32ff7d0789.exe 81 PID 2136 wrote to memory of 936 2136 72d4c31025ba421c938a4da30ab727f25e7d8718ca2ec4b06ab14d32ff7d0789.exe 81 PID 2136 wrote to memory of 936 2136 72d4c31025ba421c938a4da30ab727f25e7d8718ca2ec4b06ab14d32ff7d0789.exe 81 PID 936 wrote to memory of 3792 936 nbbttt.exe 82 PID 936 wrote to memory of 3792 936 nbbttt.exe 82 PID 936 wrote to memory of 3792 936 nbbttt.exe 82 PID 3792 wrote to memory of 4100 3792 vpjvd.exe 83 PID 3792 wrote to memory of 4100 3792 vpjvd.exe 83 PID 3792 wrote to memory of 4100 3792 vpjvd.exe 83 PID 4100 wrote to memory of 2604 4100 djpvp.exe 84 PID 4100 wrote to memory of 2604 4100 djpvp.exe 84 PID 4100 wrote to memory of 2604 4100 djpvp.exe 84 PID 2604 wrote to memory of 2696 2604 9bnntt.exe 85 PID 2604 wrote to memory of 2696 2604 9bnntt.exe 85 PID 2604 wrote to memory of 2696 2604 9bnntt.exe 85 PID 2696 wrote to memory of 2276 2696 pjpjd.exe 86 PID 2696 wrote to memory of 2276 2696 pjpjd.exe 86 PID 2696 wrote to memory of 2276 2696 pjpjd.exe 86 PID 2276 wrote to memory of 928 2276 1tbbbb.exe 88 PID 2276 wrote to memory of 928 2276 1tbbbb.exe 88 PID 2276 wrote to memory of 928 2276 1tbbbb.exe 88 PID 928 wrote to memory of 4772 928 5jddv.exe 89 PID 928 wrote to memory of 4772 928 5jddv.exe 89 PID 928 wrote to memory of 4772 928 5jddv.exe 89 PID 4772 wrote to memory of 3912 4772 1bbtnt.exe 91 PID 4772 wrote to memory of 3912 4772 1bbtnt.exe 91 PID 4772 wrote to memory of 3912 4772 1bbtnt.exe 91 PID 3912 wrote to memory of 4800 3912 jpddp.exe 92 PID 3912 wrote to memory of 4800 3912 jpddp.exe 92 PID 3912 wrote to memory of 4800 3912 jpddp.exe 92 PID 4800 wrote to memory of 1388 4800 3ntnnn.exe 93 PID 4800 wrote to memory of 1388 4800 3ntnnn.exe 93 PID 4800 wrote to memory of 1388 4800 3ntnnn.exe 93 PID 1388 wrote to memory of 4556 1388 dpppj.exe 95 PID 1388 wrote to memory of 4556 1388 dpppj.exe 95 PID 1388 wrote to memory of 4556 1388 dpppj.exe 95 PID 4556 wrote to memory of 4348 4556 3nnhbt.exe 96 PID 4556 wrote to memory of 4348 4556 3nnhbt.exe 96 PID 4556 wrote to memory of 4348 4556 3nnhbt.exe 96 PID 4348 wrote to memory of 4088 4348 vvvjj.exe 97 PID 4348 wrote to memory of 4088 4348 vvvjj.exe 97 PID 4348 wrote to memory of 4088 4348 vvvjj.exe 97 PID 4088 wrote to memory of 2764 4088 lfflffr.exe 98 PID 4088 wrote to memory of 2764 4088 lfflffr.exe 98 PID 4088 wrote to memory of 2764 4088 lfflffr.exe 98 PID 2764 wrote to memory of 3100 2764 lfrxxxr.exe 99 PID 2764 wrote to memory of 3100 2764 lfrxxxr.exe 99 PID 2764 wrote to memory of 3100 2764 lfrxxxr.exe 99 PID 3100 wrote to memory of 3552 3100 llrxfxf.exe 100 PID 3100 wrote to memory of 3552 3100 llrxfxf.exe 100 PID 3100 wrote to memory of 3552 3100 llrxfxf.exe 100 PID 3552 wrote to memory of 5020 3552 vjvpj.exe 101 PID 3552 wrote to memory of 5020 3552 vjvpj.exe 101 PID 3552 wrote to memory of 5020 3552 vjvpj.exe 101 PID 5020 wrote to memory of 3268 5020 tnttbb.exe 103 PID 5020 wrote to memory of 3268 5020 tnttbb.exe 103 PID 5020 wrote to memory of 3268 5020 tnttbb.exe 103 PID 3268 wrote to memory of 3228 3268 pdjdd.exe 104 PID 3268 wrote to memory of 3228 3268 pdjdd.exe 104 PID 3268 wrote to memory of 3228 3268 pdjdd.exe 104 PID 3228 wrote to memory of 4836 3228 fflxxrx.exe 105 PID 3228 wrote to memory of 4836 3228 fflxxrx.exe 105 PID 3228 wrote to memory of 4836 3228 fflxxrx.exe 105 PID 4836 wrote to memory of 380 4836 3bnhbb.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\72d4c31025ba421c938a4da30ab727f25e7d8718ca2ec4b06ab14d32ff7d0789.exe"C:\Users\Admin\AppData\Local\Temp\72d4c31025ba421c938a4da30ab727f25e7d8718ca2ec4b06ab14d32ff7d0789.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\nbbttt.exec:\nbbttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\vpjvd.exec:\vpjvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\djpvp.exec:\djpvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\9bnntt.exec:\9bnntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\pjpjd.exec:\pjpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\1tbbbb.exec:\1tbbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\5jddv.exec:\5jddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\1bbtnt.exec:\1bbtnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\jpddp.exec:\jpddp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\3ntnnn.exec:\3ntnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\dpppj.exec:\dpppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\3nnhbt.exec:\3nnhbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\vvvjj.exec:\vvvjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\lfflffr.exec:\lfflffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\lfrxxxr.exec:\lfrxxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\llrxfxf.exec:\llrxfxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\vjvpj.exec:\vjvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\tnttbb.exec:\tnttbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\pdjdd.exec:\pdjdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\fflxxrx.exec:\fflxxrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\3bnhbb.exec:\3bnhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\pvjpj.exec:\pvjpj.exe23⤵
- Executes dropped EXE
PID:380 -
\??\c:\1xrlffx.exec:\1xrlffx.exe24⤵
- Executes dropped EXE
PID:884 -
\??\c:\7tbtbb.exec:\7tbtbb.exe25⤵
- Executes dropped EXE
PID:496 -
\??\c:\dvddd.exec:\dvddd.exe26⤵
- Executes dropped EXE
PID:4356 -
\??\c:\1jpjj.exec:\1jpjj.exe27⤵
- Executes dropped EXE
PID:4844 -
\??\c:\9jdvd.exec:\9jdvd.exe28⤵
- Executes dropped EXE
PID:2924 -
\??\c:\ttnnhh.exec:\ttnnhh.exe29⤵
- Executes dropped EXE
PID:220 -
\??\c:\btthnh.exec:\btthnh.exe30⤵
- Executes dropped EXE
PID:3288 -
\??\c:\5hnbtt.exec:\5hnbtt.exe31⤵
- Executes dropped EXE
PID:5092 -
\??\c:\9httnt.exec:\9httnt.exe32⤵
- Executes dropped EXE
PID:1468 -
\??\c:\bttttt.exec:\bttttt.exe33⤵
- Executes dropped EXE
PID:2404 -
\??\c:\9tntnt.exec:\9tntnt.exe34⤵
- Executes dropped EXE
PID:4440 -
\??\c:\jjjjd.exec:\jjjjd.exe35⤵
- Executes dropped EXE
PID:2300 -
\??\c:\lflrllf.exec:\lflrllf.exe36⤵
- Executes dropped EXE
PID:4312 -
\??\c:\hthbtn.exec:\hthbtn.exe37⤵
- Executes dropped EXE
PID:4424 -
\??\c:\jdjdv.exec:\jdjdv.exe38⤵
- Executes dropped EXE
PID:2584 -
\??\c:\xrllffx.exec:\xrllffx.exe39⤵
- Executes dropped EXE
PID:3612 -
\??\c:\htbbhh.exec:\htbbhh.exe40⤵
- Executes dropped EXE
PID:556 -
\??\c:\vpddv.exec:\vpddv.exe41⤵
- Executes dropped EXE
PID:2292 -
\??\c:\dvdvv.exec:\dvdvv.exe42⤵
- Executes dropped EXE
PID:4740 -
\??\c:\xxxrlrl.exec:\xxxrlrl.exe43⤵
- Executes dropped EXE
PID:1940 -
\??\c:\nhnhnh.exec:\nhnhnh.exe44⤵
- Executes dropped EXE
PID:1532 -
\??\c:\dvvpj.exec:\dvvpj.exe45⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jvppj.exec:\jvppj.exe46⤵
- Executes dropped EXE
PID:1068 -
\??\c:\fxxrllf.exec:\fxxrllf.exe47⤵
- Executes dropped EXE
PID:1936 -
\??\c:\ttbbtt.exec:\ttbbtt.exe48⤵
- Executes dropped EXE
PID:3912 -
\??\c:\nntnhh.exec:\nntnhh.exe49⤵
- Executes dropped EXE
PID:3056 -
\??\c:\9pvvp.exec:\9pvvp.exe50⤵
- Executes dropped EXE
PID:2372 -
\??\c:\9fxrllf.exec:\9fxrllf.exe51⤵
- Executes dropped EXE
PID:3584 -
\??\c:\7ntttb.exec:\7ntttb.exe52⤵
- Executes dropped EXE
PID:4064 -
\??\c:\jdvpv.exec:\jdvpv.exe53⤵
- Executes dropped EXE
PID:4556 -
\??\c:\xxxflll.exec:\xxxflll.exe54⤵
- Executes dropped EXE
PID:5024 -
\??\c:\fflfrrf.exec:\fflfrrf.exe55⤵
- Executes dropped EXE
PID:568 -
\??\c:\nhnhhh.exec:\nhnhhh.exe56⤵
- Executes dropped EXE
PID:4088 -
\??\c:\vpdvp.exec:\vpdvp.exe57⤵
- Executes dropped EXE
PID:1904 -
\??\c:\7lrfffx.exec:\7lrfffx.exe58⤵
- Executes dropped EXE
PID:2428 -
\??\c:\9lxrrrl.exec:\9lxrrrl.exe59⤵
- Executes dropped EXE
PID:1528 -
\??\c:\9nhhbh.exec:\9nhhbh.exe60⤵
- Executes dropped EXE
PID:3552 -
\??\c:\vpvvp.exec:\vpvvp.exe61⤵
- Executes dropped EXE
PID:3144 -
\??\c:\lllfxrl.exec:\lllfxrl.exe62⤵
- Executes dropped EXE
PID:1820 -
\??\c:\3xxxrrl.exec:\3xxxrrl.exe63⤵
- Executes dropped EXE
PID:1924 -
\??\c:\3hhbtt.exec:\3hhbtt.exe64⤵
- Executes dropped EXE
PID:3528 -
\??\c:\hbbtnn.exec:\hbbtnn.exe65⤵
- Executes dropped EXE
PID:4420 -
\??\c:\vdddd.exec:\vdddd.exe66⤵PID:1900
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe67⤵PID:4344
-
\??\c:\nbhhhh.exec:\nbhhhh.exe68⤵PID:3872
-
\??\c:\jjjdv.exec:\jjjdv.exe69⤵PID:3232
-
\??\c:\xfrlrrf.exec:\xfrlrrf.exe70⤵PID:2572
-
\??\c:\7xxrllf.exec:\7xxrllf.exe71⤵PID:3856
-
\??\c:\hhhbbb.exec:\hhhbbb.exe72⤵PID:5032
-
\??\c:\djdjj.exec:\djdjj.exe73⤵PID:3688
-
\??\c:\rfrrllf.exec:\rfrrllf.exe74⤵PID:4124
-
\??\c:\3tttbb.exec:\3tttbb.exe75⤵PID:4020
-
\??\c:\vpvvp.exec:\vpvvp.exe76⤵PID:4928
-
\??\c:\lllffxl.exec:\lllffxl.exe77⤵PID:3088
-
\??\c:\7hnhbb.exec:\7hnhbb.exe78⤵PID:4640
-
\??\c:\1pvvp.exec:\1pvvp.exe79⤵PID:2532
-
\??\c:\djdvj.exec:\djdvj.exe80⤵PID:452
-
\??\c:\xrxlfxr.exec:\xrxlfxr.exe81⤵PID:5036
-
\??\c:\5btnhh.exec:\5btnhh.exe82⤵PID:2872
-
\??\c:\dpvpj.exec:\dpvpj.exe83⤵PID:1028
-
\??\c:\fflrlxr.exec:\fflrlxr.exe84⤵PID:2136
-
\??\c:\nhtbbb.exec:\nhtbbb.exe85⤵PID:3724
-
\??\c:\1vvpj.exec:\1vvpj.exe86⤵PID:4752
-
\??\c:\3jddd.exec:\3jddd.exe87⤵PID:1252
-
\??\c:\xxxxxxr.exec:\xxxxxxr.exe88⤵PID:768
-
\??\c:\hbbnht.exec:\hbbnht.exe89⤵PID:4116
-
\??\c:\pvvvp.exec:\pvvvp.exe90⤵PID:3436
-
\??\c:\rllfxxr.exec:\rllfxxr.exe91⤵PID:2696
-
\??\c:\hbhbtt.exec:\hbhbtt.exe92⤵PID:3988
-
\??\c:\vvdvp.exec:\vvdvp.exe93⤵PID:4612
-
\??\c:\rrfxrrr.exec:\rrfxrrr.exe94⤵PID:3732
-
\??\c:\xrflfll.exec:\xrflfll.exe95⤵PID:4772
-
\??\c:\tbbhhn.exec:\tbbhhn.exe96⤵PID:1716
-
\??\c:\pppjj.exec:\pppjj.exe97⤵PID:3700
-
\??\c:\rxrrxxx.exec:\rxrrxxx.exe98⤵PID:2132
-
\??\c:\frflflr.exec:\frflflr.exe99⤵PID:5116
-
\??\c:\9ntnnn.exec:\9ntnnn.exe100⤵PID:1164
-
\??\c:\djjjj.exec:\djjjj.exe101⤵PID:4776
-
\??\c:\rlllllr.exec:\rlllllr.exe102⤵PID:4496
-
\??\c:\1nntnt.exec:\1nntnt.exe103⤵PID:3676
-
\??\c:\ddjdv.exec:\ddjdv.exe104⤵PID:5100
-
\??\c:\1djdd.exec:\1djdd.exe105⤵PID:4556
-
\??\c:\lrxrlll.exec:\lrxrlll.exe106⤵PID:5024
-
\??\c:\thbbth.exec:\thbbth.exe107⤵PID:3240
-
\??\c:\ddvvj.exec:\ddvvj.exe108⤵PID:4088
-
\??\c:\xrffffx.exec:\xrffffx.exe109⤵PID:4824
-
\??\c:\nhbbbb.exec:\nhbbbb.exe110⤵PID:2428
-
\??\c:\5vddd.exec:\5vddd.exe111⤵PID:1320
-
\??\c:\xrrlffx.exec:\xrrlffx.exe112⤵PID:1960
-
\??\c:\llllflf.exec:\llllflf.exe113⤵PID:3864
-
\??\c:\hhhnhb.exec:\hhhnhb.exe114⤵PID:4804
-
\??\c:\pddvv.exec:\pddvv.exe115⤵PID:3228
-
\??\c:\rflfxxx.exec:\rflfxxx.exe116⤵PID:1260
-
\??\c:\1xrrrfx.exec:\1xrrrfx.exe117⤵PID:380
-
\??\c:\hhbbnn.exec:\hhbbnn.exe118⤵PID:3276
-
\??\c:\dvjdv.exec:\dvjdv.exe119⤵PID:884
-
\??\c:\fxffxxx.exec:\fxffxxx.exe120⤵PID:2512
-
\??\c:\xrrrlrr.exec:\xrrrlrr.exe121⤵PID:2460
-
\??\c:\dpdvv.exec:\dpdvv.exe122⤵PID:1788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-