Analysis
- max time kernel
150s - max time network
52s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 19:39
Behavioral task
behavioral1
Sample
235899b5d6e13f76a08e09c093cca10433f9eb7614af033844e366db110c8add.exe
Resource
win7-20240611-en
6 signatures
150 seconds
General
- Target 235899b5d6e13f76a08e09c093cca10433f9eb7614af033844e366db110c8add.exe
- Size 354KB
- Sample240614-yc3xdatalc
- SHA256 235899b5d6e13f76a08e09c093cca10433f9eb7614af033844e366db110c8add
- MD5 2808f8d72f2c098d5c82ff3ed45519c4
- SHA1 673480401a11caf78063f0bcb6d6f375054a0614
- SHA512 03d099cff16d8b5b15098926b93c2bd26e079adc98b1e2fc2fe63705549b9429b0375ff1e4b82f372de0abeb2db8f340fc2c49173d871af365443f93063d65e5
- SSDEEP 6144:bcm4FmowdHoSgWrXD486jCpoAhlq1mEjBqLyOSlhNFF23y2:h4wFHoSgWj168w1VjsyvhNFF2i2
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1700-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1540-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3512-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/316-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1452-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2824-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5008-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1032-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3888-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/988-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1312-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2880-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2060-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4652-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3444-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1544-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1720-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1004-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2600-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3484-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4492-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2544-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2136-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2656-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2776-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3896-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2536-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1452-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4272-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2716-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2228-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/796-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2024-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2060-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1584-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1720-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4240-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3028-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3160-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4272-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2712-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/820-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4868-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4532-551-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2736-577-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-600-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-715-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2084-730-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1188-740-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-861-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/1540-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00090000000233c1-3.dat UPX behavioral2/memory/1700-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00080000000233dd-9.dat UPX behavioral2/files/0x00070000000233e1-11.dat UPX behavioral2/memory/4496-12-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1540-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3512-16-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233e2-19.dat UPX behavioral2/memory/3512-21-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/316-23-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233e3-26.dat UPX behavioral2/memory/1452-28-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233e4-31.dat UPX behavioral2/memory/4780-32-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233e5-35.dat UPX behavioral2/files/0x00070000000233e7-40.dat UPX behavioral2/files/0x00070000000233e8-45.dat UPX behavioral2/memory/2824-46-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3276-42-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233e9-49.dat UPX behavioral2/memory/2012-52-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ea-54.dat UPX behavioral2/files/0x00070000000233eb-59.dat UPX behavioral2/memory/5008-57-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1032-61-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ec-64.dat UPX behavioral2/files/0x00070000000233ed-68.dat UPX behavioral2/memory/5080-71-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ee-74.dat UPX behavioral2/memory/3888-76-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233ef-78.dat UPX behavioral2/files/0x00070000000233f0-82.dat UPX behavioral2/files/0x00070000000233f1-87.dat UPX behavioral2/memory/988-90-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1312-85-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233f2-93.dat UPX behavioral2/memory/2880-95-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0005000000022970-97.dat UPX behavioral2/files/0x00080000000233de-101.dat UPX behavioral2/memory/2060-103-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0006000000022974-108.dat UPX behavioral2/files/0x00070000000233f3-112.dat UPX behavioral2/memory/4652-106-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3444-114-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233f4-116.dat UPX behavioral2/memory/1544-120-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233f5-121.dat UPX behavioral2/files/0x00070000000233f6-125.dat UPX behavioral2/files/0x00070000000233f7-129.dat UPX behavioral2/files/0x00070000000233f8-135.dat UPX behavioral2/memory/1004-136-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1720-131-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233f9-139.dat UPX behavioral2/memory/1004-140-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233fa-145.dat UPX behavioral2/memory/2600-146-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233fb-149.dat UPX behavioral2/memory/2600-150-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00070000000233fc-155.dat UPX behavioral2/memory/3484-154-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4492-160-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2544-165-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2136-169-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 1700 3frlllx.exe 4496 nttbbh.exe 3512 hnbttt.exe 316 ntbttn.exe 1452 jjjjj.exe 4780 9lrxxfl.exe 3576 5xxrllf.exe 3276 hhhbbt.exe 2824 dvjdd.exe 2012 pjppd.exe 5008 lflllff.exe 1032 nthhbh.exe 852 xffxlfr.exe 5080 1jjdd.exe 3888 dvvpp.exe 3560 xrrllff.exe 1312 jpvvv.exe 988 fflfffl.exe 2880 llllffx.exe 4652 pjpdd.exe 2060 bnthtt.exe 4428 vjpjv.exe 3444 xfrlxrf.exe 1544 pvjdd.exe 2972 7rlxlfx.exe 4012 bhnhhb.exe 1720 vpvvv.exe 1004 jvvjj.exe 4604 nhbnhb.exe 2600 dvvpj.exe 3484 hbbtnn.exe 640 3ppdp.exe 4492 frflflf.exe 2292 tnntnn.exe 2544 7jjdp.exe 2136 xrxrxlr.exe 4680 lllfxrf.exe 4820 hhhhhb.exe 3220 vpvdd.exe 4524 vjpjd.exe 1308 xflxrlf.exe 4380 3tbtnh.exe 4988 pjvjp.exe 4312 dpvvv.exe 2656 xlxrrrr.exe 2776 nbthhb.exe 3112 vvjjp.exe 2628 vppjd.exe 4320 frxrlfx.exe 4316 nhhbtn.exe 876 7tnhbh.exe 3012 jvdvv.exe 3896 frfxrlf.exe 2536 1nhbnh.exe 2408 dvpjj.exe 3496 3xxlxxl.exe 1452 nnbnhb.exe 4512 dpdpp.exe 380 1vvpd.exe 3068 7rlxlfx.exe 3760 1htnnh.exe 4272 hbbtnh.exe 2716 9djdv.exe 2104 lxfxxrf.exe -
resource yara_rule behavioral2/memory/1540-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233c1-3.dat upx behavioral2/memory/1700-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233dd-9.dat upx behavioral2/files/0x00070000000233e1-11.dat upx behavioral2/memory/4496-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1540-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3512-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e2-19.dat upx behavioral2/memory/3512-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/316-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e3-26.dat upx behavioral2/memory/1452-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e4-31.dat upx behavioral2/memory/4780-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e5-35.dat upx behavioral2/files/0x00070000000233e7-40.dat upx behavioral2/files/0x00070000000233e8-45.dat upx behavioral2/memory/2824-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3276-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e9-49.dat upx behavioral2/memory/2012-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ea-54.dat upx behavioral2/files/0x00070000000233eb-59.dat upx behavioral2/memory/5008-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1032-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ec-64.dat upx behavioral2/files/0x00070000000233ed-68.dat upx behavioral2/memory/5080-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ee-74.dat upx behavioral2/memory/3888-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ef-78.dat upx behavioral2/files/0x00070000000233f0-82.dat upx behavioral2/files/0x00070000000233f1-87.dat upx behavioral2/memory/988-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1312-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f2-93.dat upx behavioral2/memory/2880-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0005000000022970-97.dat upx behavioral2/files/0x00080000000233de-101.dat upx behavioral2/memory/2060-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000022974-108.dat upx behavioral2/files/0x00070000000233f3-112.dat upx behavioral2/memory/4652-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3444-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f4-116.dat upx behavioral2/memory/1544-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f5-121.dat upx behavioral2/files/0x00070000000233f6-125.dat upx behavioral2/files/0x00070000000233f7-129.dat upx behavioral2/files/0x00070000000233f8-135.dat upx behavioral2/memory/1004-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1720-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f9-139.dat upx behavioral2/memory/1004-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fa-145.dat upx behavioral2/memory/2600-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fb-149.dat upx behavioral2/memory/2600-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fc-155.dat upx behavioral2/memory/3484-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4492-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2544-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2136-169-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1540 wrote to memory of 1700 1540 235899b5d6e13f76a08e09c093cca10433f9eb7614af033844e366db110c8add.exe 81 PID 1540 wrote to memory of 1700 1540 235899b5d6e13f76a08e09c093cca10433f9eb7614af033844e366db110c8add.exe 81 PID 1540 wrote to memory of 1700 1540 235899b5d6e13f76a08e09c093cca10433f9eb7614af033844e366db110c8add.exe 81 PID 1700 wrote to memory of 4496 1700 3frlllx.exe 82 PID 1700 wrote to memory of 4496 1700 3frlllx.exe 82 PID 1700 wrote to memory of 4496 1700 3frlllx.exe 82 PID 4496 wrote to memory of 3512 4496 nttbbh.exe 83 PID 4496 wrote to memory of 3512 4496 nttbbh.exe 83 PID 4496 wrote to memory of 3512 4496 nttbbh.exe 83 PID 3512 wrote to memory of 316 3512 hnbttt.exe 84 PID 3512 wrote to memory of 316 3512 hnbttt.exe 84 PID 3512 wrote to memory of 316 3512 hnbttt.exe 84 PID 316 wrote to memory of 1452 316 ntbttn.exe 86 PID 316 wrote to memory of 1452 316 ntbttn.exe 86 PID 316 wrote to memory of 1452 316 ntbttn.exe 86 PID 1452 wrote to memory of 4780 1452 jjjjj.exe 87 PID 1452 wrote to memory of 4780 1452 jjjjj.exe 87 PID 1452 wrote to memory of 4780 1452 jjjjj.exe 87 PID 4780 wrote to memory of 3576 4780 9lrxxfl.exe 88 PID 4780 wrote to memory of 3576 4780 9lrxxfl.exe 88 PID 4780 wrote to memory of 3576 4780 9lrxxfl.exe 88 PID 3576 wrote to memory of 3276 3576 5xxrllf.exe 89 PID 3576 wrote to memory of 3276 3576 5xxrllf.exe 89 PID 3576 wrote to memory of 3276 3576 5xxrllf.exe 89 PID 3276 wrote to memory of 2824 3276 hhhbbt.exe 90 PID 3276 wrote to memory of 2824 3276 hhhbbt.exe 90 PID 3276 wrote to memory of 2824 3276 hhhbbt.exe 90 PID 2824 wrote to memory of 2012 2824 dvjdd.exe 93 PID 2824 wrote to memory of 2012 2824 dvjdd.exe 93 PID 2824 wrote to memory of 2012 2824 dvjdd.exe 93 PID 2012 wrote to memory of 5008 2012 pjppd.exe 94 PID 2012 wrote to memory of 5008 2012 pjppd.exe 94 PID 2012 wrote to memory of 5008 2012 pjppd.exe 94 PID 5008 wrote to memory of 1032 5008 lflllff.exe 95 PID 5008 wrote to memory of 1032 5008 lflllff.exe 95 PID 5008 wrote to memory of 1032 5008 lflllff.exe 95 PID 1032 wrote to memory of 852 1032 nthhbh.exe 96 PID 1032 wrote to memory of 852 1032 nthhbh.exe 96 PID 1032 wrote to memory of 852 1032 nthhbh.exe 96 PID 852 wrote to memory of 5080 852 xffxlfr.exe 97 PID 852 wrote to memory of 5080 852 xffxlfr.exe 97 PID 852 wrote to memory of 5080 852 xffxlfr.exe 97 PID 5080 wrote to memory of 3888 5080 1jjdd.exe 98 PID 5080 wrote to memory of 3888 5080 1jjdd.exe 98 PID 5080 wrote to memory of 3888 5080 1jjdd.exe 98 PID 3888 wrote to memory of 3560 3888 dvvpp.exe 99 PID 3888 wrote to memory of 3560 3888 dvvpp.exe 99 PID 3888 wrote to memory of 3560 3888 dvvpp.exe 99 PID 3560 wrote to memory of 1312 3560 xrrllff.exe 100 PID 3560 wrote to memory of 1312 3560 xrrllff.exe 100 PID 3560 wrote to memory of 1312 3560 xrrllff.exe 100 PID 1312 wrote to memory of 988 1312 jpvvv.exe 101 PID 1312 wrote to memory of 988 1312 jpvvv.exe 101 PID 1312 wrote to memory of 988 1312 jpvvv.exe 101 PID 988 wrote to memory of 2880 988 fflfffl.exe 102 PID 988 wrote to memory of 2880 988 fflfffl.exe 102 PID 988 wrote to memory of 2880 988 fflfffl.exe 102 PID 2880 wrote to memory of 4652 2880 llllffx.exe 103 PID 2880 wrote to memory of 4652 2880 llllffx.exe 103 PID 2880 wrote to memory of 4652 2880 llllffx.exe 103 PID 4652 wrote to memory of 2060 4652 pjpdd.exe 104 PID 4652 wrote to memory of 2060 4652 pjpdd.exe 104 PID 4652 wrote to memory of 2060 4652 pjpdd.exe 104 PID 2060 wrote to memory of 4428 2060 bnthtt.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\235899b5d6e13f76a08e09c093cca10433f9eb7614af033844e366db110c8add.exe"C:\Users\Admin\AppData\Local\Temp\235899b5d6e13f76a08e09c093cca10433f9eb7614af033844e366db110c8add.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\3frlllx.exec:\3frlllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\nttbbh.exec:\nttbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\hnbttt.exec:\hnbttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\ntbttn.exec:\ntbttn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\jjjjj.exec:\jjjjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\9lrxxfl.exec:\9lrxxfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\5xxrllf.exec:\5xxrllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\hhhbbt.exec:\hhhbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\dvjdd.exec:\dvjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\pjppd.exec:\pjppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\lflllff.exec:\lflllff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\nthhbh.exec:\nthhbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\xffxlfr.exec:\xffxlfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\1jjdd.exec:\1jjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\dvvpp.exec:\dvvpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\xrrllff.exec:\xrrllff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\jpvvv.exec:\jpvvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\fflfffl.exec:\fflfffl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\llllffx.exec:\llllffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\pjpdd.exec:\pjpdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\bnthtt.exec:\bnthtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\vjpjv.exec:\vjpjv.exe23⤵
- Executes dropped EXE
PID:4428 -
\??\c:\xfrlxrf.exec:\xfrlxrf.exe24⤵
- Executes dropped EXE
PID:3444 -
\??\c:\pvjdd.exec:\pvjdd.exe25⤵
- Executes dropped EXE
PID:1544 -
\??\c:\7rlxlfx.exec:\7rlxlfx.exe26⤵
- Executes dropped EXE
PID:2972 -
\??\c:\bhnhhb.exec:\bhnhhb.exe27⤵
- Executes dropped EXE
PID:4012 -
\??\c:\vpvvv.exec:\vpvvv.exe28⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jvvjj.exec:\jvvjj.exe29⤵
- Executes dropped EXE
PID:1004 -
\??\c:\nhbnhb.exec:\nhbnhb.exe30⤵
- Executes dropped EXE
PID:4604 -
\??\c:\dvvpj.exec:\dvvpj.exe31⤵
- Executes dropped EXE
PID:2600 -
\??\c:\hbbtnn.exec:\hbbtnn.exe32⤵
- Executes dropped EXE
PID:3484 -
\??\c:\3ppdp.exec:\3ppdp.exe33⤵
- Executes dropped EXE
PID:640 -
\??\c:\frflflf.exec:\frflflf.exe34⤵
- Executes dropped EXE
PID:4492 -
\??\c:\tnntnn.exec:\tnntnn.exe35⤵
- Executes dropped EXE
PID:2292 -
\??\c:\7jjdp.exec:\7jjdp.exe36⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xrxrxlr.exec:\xrxrxlr.exe37⤵
- Executes dropped EXE
PID:2136 -
\??\c:\lllfxrf.exec:\lllfxrf.exe38⤵
- Executes dropped EXE
PID:4680 -
\??\c:\hhhhhb.exec:\hhhhhb.exe39⤵
- Executes dropped EXE
PID:4820 -
\??\c:\vpvdd.exec:\vpvdd.exe40⤵
- Executes dropped EXE
PID:3220 -
\??\c:\vjpjd.exec:\vjpjd.exe41⤵
- Executes dropped EXE
PID:4524 -
\??\c:\xflxrlf.exec:\xflxrlf.exe42⤵
- Executes dropped EXE
PID:1308 -
\??\c:\3tbtnh.exec:\3tbtnh.exe43⤵
- Executes dropped EXE
PID:4380 -
\??\c:\pjvjp.exec:\pjvjp.exe44⤵
- Executes dropped EXE
PID:4988 -
\??\c:\dpvvv.exec:\dpvvv.exe45⤵
- Executes dropped EXE
PID:4312 -
\??\c:\xlxrrrr.exec:\xlxrrrr.exe46⤵
- Executes dropped EXE
PID:2656 -
\??\c:\nbthhb.exec:\nbthhb.exe47⤵
- Executes dropped EXE
PID:2776 -
\??\c:\vvjjp.exec:\vvjjp.exe48⤵
- Executes dropped EXE
PID:3112 -
\??\c:\vppjd.exec:\vppjd.exe49⤵
- Executes dropped EXE
PID:2628 -
\??\c:\frxrlfx.exec:\frxrlfx.exe50⤵
- Executes dropped EXE
PID:4320 -
\??\c:\nhhbtn.exec:\nhhbtn.exe51⤵
- Executes dropped EXE
PID:4316 -
\??\c:\7tnhbh.exec:\7tnhbh.exe52⤵
- Executes dropped EXE
PID:876 -
\??\c:\jvdvv.exec:\jvdvv.exe53⤵
- Executes dropped EXE
PID:3012 -
\??\c:\frfxrlf.exec:\frfxrlf.exe54⤵
- Executes dropped EXE
PID:3896 -
\??\c:\1nhbnh.exec:\1nhbnh.exe55⤵
- Executes dropped EXE
PID:2536 -
\??\c:\dvpjj.exec:\dvpjj.exe56⤵
- Executes dropped EXE
PID:2408 -
\??\c:\3xxlxxl.exec:\3xxlxxl.exe57⤵
- Executes dropped EXE
PID:3496 -
\??\c:\nnbnhb.exec:\nnbnhb.exe58⤵
- Executes dropped EXE
PID:1452 -
\??\c:\dpdpp.exec:\dpdpp.exe59⤵
- Executes dropped EXE
PID:4512 -
\??\c:\1vvpd.exec:\1vvpd.exe60⤵
- Executes dropped EXE
PID:380 -
\??\c:\7rlxlfx.exec:\7rlxlfx.exe61⤵
- Executes dropped EXE
PID:3068 -
\??\c:\1htnnh.exec:\1htnnh.exe62⤵
- Executes dropped EXE
PID:3760 -
\??\c:\hbbtnh.exec:\hbbtnh.exe63⤵
- Executes dropped EXE
PID:4272 -
\??\c:\9djdv.exec:\9djdv.exe64⤵
- Executes dropped EXE
PID:2716 -
\??\c:\lxfxxrf.exec:\lxfxxrf.exe65⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hbhhbh.exec:\hbhhbh.exe66⤵PID:3132
-
\??\c:\pjpjd.exec:\pjpjd.exe67⤵PID:1216
-
\??\c:\djpjj.exec:\djpjj.exe68⤵PID:3580
-
\??\c:\rflfxrl.exec:\rflfxrl.exe69⤵PID:4592
-
\??\c:\htbtnh.exec:\htbtnh.exe70⤵PID:2112
-
\??\c:\nnbtnb.exec:\nnbtnb.exe71⤵PID:3328
-
\??\c:\5vpjv.exec:\5vpjv.exe72⤵PID:3196
-
\??\c:\xflffxr.exec:\xflffxr.exe73⤵PID:1352
-
\??\c:\httttt.exec:\httttt.exe74⤵PID:2296
-
\??\c:\1hnbnh.exec:\1hnbnh.exe75⤵PID:2228
-
\??\c:\frrffxl.exec:\frrffxl.exe76⤵PID:5104
-
\??\c:\hnnnnn.exec:\hnnnnn.exe77⤵PID:2020
-
\??\c:\jjpjp.exec:\jjpjp.exe78⤵PID:3560
-
\??\c:\lfxrfxx.exec:\lfxrfxx.exe79⤵PID:1312
-
\??\c:\tnnnhh.exec:\tnnnhh.exe80⤵PID:1496
-
\??\c:\3pvvj.exec:\3pvvj.exe81⤵PID:4400
-
\??\c:\vpddd.exec:\vpddd.exe82⤵PID:796
-
\??\c:\xxxrlll.exec:\xxxrlll.exe83⤵PID:4340
-
\??\c:\nnnhhh.exec:\nnnhhh.exe84⤵PID:2024
-
\??\c:\9vpjd.exec:\9vpjd.exe85⤵PID:916
-
\??\c:\lllfllf.exec:\lllfllf.exe86⤵PID:2060
-
\??\c:\xrxrfxl.exec:\xrxrfxl.exe87⤵PID:1420
-
\??\c:\5nntnt.exec:\5nntnt.exe88⤵PID:1584
-
\??\c:\vpjdj.exec:\vpjdj.exe89⤵PID:1872
-
\??\c:\7thbbb.exec:\7thbbb.exe90⤵PID:3556
-
\??\c:\pdvpj.exec:\pdvpj.exe91⤵PID:1364
-
\??\c:\vjpjp.exec:\vjpjp.exe92⤵PID:3236
-
\??\c:\xflrlfx.exec:\xflrlfx.exe93⤵PID:1720
-
\??\c:\tttnhh.exec:\tttnhh.exe94⤵PID:4632
-
\??\c:\vdjjd.exec:\vdjjd.exe95⤵PID:2568
-
\??\c:\jjjjj.exec:\jjjjj.exe96⤵PID:4684
-
\??\c:\5xrxrll.exec:\5xrxrll.exe97⤵PID:2304
-
\??\c:\bbbttn.exec:\bbbttn.exe98⤵PID:2088
-
\??\c:\nhhbtn.exec:\nhhbtn.exe99⤵PID:1956
-
\??\c:\7dppd.exec:\7dppd.exe100⤵PID:4952
-
\??\c:\xxlrllf.exec:\xxlrllf.exe101⤵PID:4240
-
\??\c:\hhbbnh.exec:\hhbbnh.exe102⤵PID:2560
-
\??\c:\hntnhh.exec:\hntnhh.exe103⤵PID:3028
-
\??\c:\dvjjd.exec:\dvjjd.exe104⤵PID:2532
-
\??\c:\lxlxffx.exec:\lxlxffx.exe105⤵PID:4844
-
\??\c:\ttthbh.exec:\ttthbh.exe106⤵PID:5020
-
\??\c:\thbnhh.exec:\thbnhh.exe107⤵PID:3884
-
\??\c:\jjdvj.exec:\jjdvj.exe108⤵PID:4456
-
\??\c:\5pjvp.exec:\5pjvp.exe109⤵PID:1948
-
\??\c:\frxrlfr.exec:\frxrlfr.exe110⤵PID:2000
-
\??\c:\btnhhb.exec:\btnhhb.exe111⤵PID:4268
-
\??\c:\tnbtbb.exec:\tnbtbb.exe112⤵PID:4776
-
\??\c:\dpvvj.exec:\dpvvj.exe113⤵PID:4040
-
\??\c:\pdjvp.exec:\pdjvp.exe114⤵PID:3564
-
\??\c:\llllrrx.exec:\llllrrx.exe115⤵PID:4796
-
\??\c:\ttbtbb.exec:\ttbtbb.exe116⤵PID:4900
-
\??\c:\vdjpd.exec:\vdjpd.exe117⤵PID:2352
-
\??\c:\dvjdv.exec:\dvjdv.exe118⤵PID:4332
-
\??\c:\7rxlrrr.exec:\7rxlrrr.exe119⤵PID:1628
-
\??\c:\nnhbtt.exec:\nnhbtt.exe120⤵PID:384
-
\??\c:\nnthtt.exec:\nnthtt.exe121⤵PID:4296
-
\??\c:\vpjjd.exec:\vpjjd.exe122⤵PID:5028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-