Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 03:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f08ef9686e48e3bfb22b056007f53af9272e378058a4eb75f7c6b5464a465a65.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
f08ef9686e48e3bfb22b056007f53af9272e378058a4eb75f7c6b5464a465a65.exe
-
Size
450KB
-
MD5
ff6d2a93864df7183f543e233bd9125d
-
SHA1
a18702deec00e7fc0159a7fcd76d1ab08173eaf3
-
SHA256
f08ef9686e48e3bfb22b056007f53af9272e378058a4eb75f7c6b5464a465a65
-
SHA512
266990c47839d9044f97e7dab5a9e6eda5fe9660a4dd972eaf745b478947cc35c641c2fa96ad3f809692a1b68ac943500b101882614af310fd20f836c841ebab
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
Processes:
resource yara_rule behavioral1/memory/1280-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1180-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-275-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2724-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/672-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-630-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2544-647-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-1078-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-1156-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/1280-7-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2112-20-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/3020-31-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2860-41-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2640-40-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2860-50-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1152-59-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2756-60-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2408-72-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2756-68-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1808-89-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2920-121-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2016-122-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1984-139-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1060-143-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1092-153-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2584-170-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2244-187-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2260-196-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1180-206-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1780-215-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2116-231-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2724-277-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1548-306-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2128-313-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2652-326-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2648-333-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2768-346-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2796-354-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2536-411-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2040-430-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/768-449-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1744-464-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/236-471-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/672-496-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/3064-515-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2580-546-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2368-559-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1620-566-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2716-611-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2716-618-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2708-619-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2708-626-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2844-627-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2544-647-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2016-702-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/3040-709-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1256-728-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2244-753-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2108-772-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/536-779-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1956-793-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1564-800-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2220-825-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2104-850-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/3024-869-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2832-882-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2140-896-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2520-916-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/3008-937-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2960-962-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2428-1011-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1956-1078-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2888-1111-0x0000000000400000-0x000000000042A000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
vvvdj.exetntbhn.exexxrrffr.exe7nbhnt.exerrllxfr.exevpdjv.exelfxlrxr.exe5hnnbt.exelfxxlxf.exehbtnnt.exe3xlrflx.exexrflrlr.exe3ddjp.exerlffxff.exe7pdjj.exevpdjv.exetnbntb.exe7vjpv.exettnhhh.exevpvjv.exelflrflx.exe3nbbnh.exelllxffr.exe9btttb.exepdvvd.exehbtbnt.exejdppd.exe7rllxxf.exedvppv.exeflxrflx.exetttbbh.exevpjdv.exefxxfxxl.exe7djvd.exeffxfrxr.exelxrfflx.exehbttbn.exedddpj.exe5rrrflr.exelxllxfl.exenbtbnb.exe7pjjv.exefflxfrf.exehnnthn.exejdpdv.exevvppd.exerlfrffx.exethntnb.exe7jddd.exejdvvj.exerlfxffl.exebtnthh.exetnhtbn.exe5dppv.exe5frfrfl.exellfrfrf.exe9nbttt.exe3jpvv.exelffrfrl.exebbtnbh.exejjdpd.exe9rllllr.exe1lrxflx.exehbtbbh.exepid process 2112 vvvdj.exe 3020 tntbhn.exe 2640 xxrrffr.exe 2860 7nbhnt.exe 1152 rrllxfr.exe 2756 vpdjv.exe 2408 lfxlrxr.exe 2548 5hnnbt.exe 1808 lfxxlxf.exe 1996 hbtnnt.exe 2748 3xlrflx.exe 2920 xrflrlr.exe 2016 3ddjp.exe 1984 rlffxff.exe 1060 7pdjj.exe 1092 vpdjv.exe 1812 tnbntb.exe 2584 7vjpv.exe 1748 ttnhhh.exe 2244 vpvjv.exe 2260 lflrflx.exe 1180 3nbbnh.exe 1780 lllxffr.exe 1848 9btttb.exe 2116 pdvvd.exe 1760 hbtbnt.exe 1856 jdppd.exe 1952 7rllxxf.exe 560 dvppv.exe 2724 flxrflx.exe 2000 tttbbh.exe 1920 vpjdv.exe 3000 fxxfxxl.exe 1548 7djvd.exe 2128 ffxfrxr.exe 2832 lxrfflx.exe 3028 hbttbn.exe 2652 dddpj.exe 2648 5rrrflr.exe 2768 lxllxfl.exe 2784 nbtbnb.exe 2796 7pjjv.exe 2812 fflxfrf.exe 2572 hnnthn.exe 2204 jdpdv.exe 2548 vvppd.exe 2320 rlfrffx.exe 2804 thntnb.exe 2808 7jddd.exe 2536 jdvvj.exe 1588 rlfxffl.exe 2432 btnthh.exe 1908 tnhtbn.exe 2040 5dppv.exe 2300 5frfrfl.exe 2160 llfrfrf.exe 768 9nbttt.exe 1744 3jpvv.exe 308 lffrfrl.exe 236 bbtnbh.exe 628 jjdpd.exe 2676 9rllllr.exe 2232 1lrxflx.exe 672 hbtbbh.exe -
Processes:
resource yara_rule behavioral1/memory/1280-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-779-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-800-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-825-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-850-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-869-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-882-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-896-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-916-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-937-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-962-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-1011-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-1078-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f08ef9686e48e3bfb22b056007f53af9272e378058a4eb75f7c6b5464a465a65.exevvvdj.exetntbhn.exexxrrffr.exe7nbhnt.exerrllxfr.exevpdjv.exelfxlrxr.exe5hnnbt.exelfxxlxf.exehbtnnt.exe3xlrflx.exexrflrlr.exe3ddjp.exerlffxff.exe7pdjj.exedescription pid process target process PID 1280 wrote to memory of 2112 1280 f08ef9686e48e3bfb22b056007f53af9272e378058a4eb75f7c6b5464a465a65.exe vvvdj.exe PID 1280 wrote to memory of 2112 1280 f08ef9686e48e3bfb22b056007f53af9272e378058a4eb75f7c6b5464a465a65.exe vvvdj.exe PID 1280 wrote to memory of 2112 1280 f08ef9686e48e3bfb22b056007f53af9272e378058a4eb75f7c6b5464a465a65.exe vvvdj.exe PID 1280 wrote to memory of 2112 1280 f08ef9686e48e3bfb22b056007f53af9272e378058a4eb75f7c6b5464a465a65.exe vvvdj.exe PID 2112 wrote to memory of 3020 2112 vvvdj.exe tntbhn.exe PID 2112 wrote to memory of 3020 2112 vvvdj.exe tntbhn.exe PID 2112 wrote to memory of 3020 2112 vvvdj.exe tntbhn.exe PID 2112 wrote to memory of 3020 2112 vvvdj.exe tntbhn.exe PID 3020 wrote to memory of 2640 3020 tntbhn.exe xxrrffr.exe PID 3020 wrote to memory of 2640 3020 tntbhn.exe xxrrffr.exe PID 3020 wrote to memory of 2640 3020 tntbhn.exe xxrrffr.exe PID 3020 wrote to memory of 2640 3020 tntbhn.exe xxrrffr.exe PID 2640 wrote to memory of 2860 2640 xxrrffr.exe 7nbhnt.exe PID 2640 wrote to memory of 2860 2640 xxrrffr.exe 7nbhnt.exe PID 2640 wrote to memory of 2860 2640 xxrrffr.exe 7nbhnt.exe PID 2640 wrote to memory of 2860 2640 xxrrffr.exe 7nbhnt.exe PID 2860 wrote to memory of 1152 2860 7nbhnt.exe rrllxfr.exe PID 2860 wrote to memory of 1152 2860 7nbhnt.exe rrllxfr.exe PID 2860 wrote to memory of 1152 2860 7nbhnt.exe rrllxfr.exe PID 2860 wrote to memory of 1152 2860 7nbhnt.exe rrllxfr.exe PID 1152 wrote to memory of 2756 1152 rrllxfr.exe vpdjv.exe PID 1152 wrote to memory of 2756 1152 rrllxfr.exe vpdjv.exe PID 1152 wrote to memory of 2756 1152 rrllxfr.exe vpdjv.exe PID 1152 wrote to memory of 2756 1152 rrllxfr.exe vpdjv.exe PID 2756 wrote to memory of 2408 2756 vpdjv.exe lfxlrxr.exe PID 2756 wrote to memory of 2408 2756 vpdjv.exe lfxlrxr.exe PID 2756 wrote to memory of 2408 2756 vpdjv.exe lfxlrxr.exe PID 2756 wrote to memory of 2408 2756 vpdjv.exe lfxlrxr.exe PID 2408 wrote to memory of 2548 2408 lfxlrxr.exe 5hnnbt.exe PID 2408 wrote to memory of 2548 2408 lfxlrxr.exe 5hnnbt.exe PID 2408 wrote to memory of 2548 2408 lfxlrxr.exe 5hnnbt.exe PID 2408 wrote to memory of 2548 2408 lfxlrxr.exe 5hnnbt.exe PID 2548 wrote to memory of 1808 2548 5hnnbt.exe lfxxlxf.exe PID 2548 wrote to memory of 1808 2548 5hnnbt.exe lfxxlxf.exe PID 2548 wrote to memory of 1808 2548 5hnnbt.exe lfxxlxf.exe PID 2548 wrote to memory of 1808 2548 5hnnbt.exe lfxxlxf.exe PID 1808 wrote to memory of 1996 1808 lfxxlxf.exe hbtnnt.exe PID 1808 wrote to memory of 1996 1808 lfxxlxf.exe hbtnnt.exe PID 1808 wrote to memory of 1996 1808 lfxxlxf.exe hbtnnt.exe PID 1808 wrote to memory of 1996 1808 lfxxlxf.exe hbtnnt.exe PID 1996 wrote to memory of 2748 1996 hbtnnt.exe 3xlrflx.exe PID 1996 wrote to memory of 2748 1996 hbtnnt.exe 3xlrflx.exe PID 1996 wrote to memory of 2748 1996 hbtnnt.exe 3xlrflx.exe PID 1996 wrote to memory of 2748 1996 hbtnnt.exe 3xlrflx.exe PID 2748 wrote to memory of 2920 2748 3xlrflx.exe xrflrlr.exe PID 2748 wrote to memory of 2920 2748 3xlrflx.exe xrflrlr.exe PID 2748 wrote to memory of 2920 2748 3xlrflx.exe xrflrlr.exe PID 2748 wrote to memory of 2920 2748 3xlrflx.exe xrflrlr.exe PID 2920 wrote to memory of 2016 2920 xrflrlr.exe 3ddjp.exe PID 2920 wrote to memory of 2016 2920 xrflrlr.exe 3ddjp.exe PID 2920 wrote to memory of 2016 2920 xrflrlr.exe 3ddjp.exe PID 2920 wrote to memory of 2016 2920 xrflrlr.exe 3ddjp.exe PID 2016 wrote to memory of 1984 2016 3ddjp.exe rlffxff.exe PID 2016 wrote to memory of 1984 2016 3ddjp.exe rlffxff.exe PID 2016 wrote to memory of 1984 2016 3ddjp.exe rlffxff.exe PID 2016 wrote to memory of 1984 2016 3ddjp.exe rlffxff.exe PID 1984 wrote to memory of 1060 1984 rlffxff.exe 7pdjj.exe PID 1984 wrote to memory of 1060 1984 rlffxff.exe 7pdjj.exe PID 1984 wrote to memory of 1060 1984 rlffxff.exe 7pdjj.exe PID 1984 wrote to memory of 1060 1984 rlffxff.exe 7pdjj.exe PID 1060 wrote to memory of 1092 1060 7pdjj.exe vpdjv.exe PID 1060 wrote to memory of 1092 1060 7pdjj.exe vpdjv.exe PID 1060 wrote to memory of 1092 1060 7pdjj.exe vpdjv.exe PID 1060 wrote to memory of 1092 1060 7pdjj.exe vpdjv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f08ef9686e48e3bfb22b056007f53af9272e378058a4eb75f7c6b5464a465a65.exe"C:\Users\Admin\AppData\Local\Temp\f08ef9686e48e3bfb22b056007f53af9272e378058a4eb75f7c6b5464a465a65.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vvvdj.exec:\vvvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tntbhn.exec:\tntbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxrrffr.exec:\xxrrffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7nbhnt.exec:\7nbhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrllxfr.exec:\rrllxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpdjv.exec:\vpdjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxlrxr.exec:\lfxlrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5hnnbt.exec:\5hnnbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lfxxlxf.exec:\lfxxlxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbtnnt.exec:\hbtnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3xlrflx.exec:\3xlrflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrflrlr.exec:\xrflrlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3ddjp.exec:\3ddjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlffxff.exec:\rlffxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7pdjj.exec:\7pdjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpdjv.exec:\vpdjv.exe17⤵
- Executes dropped EXE
-
\??\c:\tnbntb.exec:\tnbntb.exe18⤵
- Executes dropped EXE
-
\??\c:\7vjpv.exec:\7vjpv.exe19⤵
- Executes dropped EXE
-
\??\c:\ttnhhh.exec:\ttnhhh.exe20⤵
- Executes dropped EXE
-
\??\c:\vpvjv.exec:\vpvjv.exe21⤵
- Executes dropped EXE
-
\??\c:\lflrflx.exec:\lflrflx.exe22⤵
- Executes dropped EXE
-
\??\c:\3nbbnh.exec:\3nbbnh.exe23⤵
- Executes dropped EXE
-
\??\c:\lllxffr.exec:\lllxffr.exe24⤵
- Executes dropped EXE
-
\??\c:\9btttb.exec:\9btttb.exe25⤵
- Executes dropped EXE
-
\??\c:\pdvvd.exec:\pdvvd.exe26⤵
- Executes dropped EXE
-
\??\c:\hbtbnt.exec:\hbtbnt.exe27⤵
- Executes dropped EXE
-
\??\c:\jdppd.exec:\jdppd.exe28⤵
- Executes dropped EXE
-
\??\c:\7rllxxf.exec:\7rllxxf.exe29⤵
- Executes dropped EXE
-
\??\c:\dvppv.exec:\dvppv.exe30⤵
- Executes dropped EXE
-
\??\c:\flxrflx.exec:\flxrflx.exe31⤵
- Executes dropped EXE
-
\??\c:\tttbbh.exec:\tttbbh.exe32⤵
- Executes dropped EXE
-
\??\c:\vpjdv.exec:\vpjdv.exe33⤵
- Executes dropped EXE
-
\??\c:\fxxfxxl.exec:\fxxfxxl.exe34⤵
- Executes dropped EXE
-
\??\c:\7djvd.exec:\7djvd.exe35⤵
- Executes dropped EXE
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe36⤵
- Executes dropped EXE
-
\??\c:\lxrfflx.exec:\lxrfflx.exe37⤵
- Executes dropped EXE
-
\??\c:\hbttbn.exec:\hbttbn.exe38⤵
- Executes dropped EXE
-
\??\c:\dddpj.exec:\dddpj.exe39⤵
- Executes dropped EXE
-
\??\c:\5rrrflr.exec:\5rrrflr.exe40⤵
- Executes dropped EXE
-
\??\c:\lxllxfl.exec:\lxllxfl.exe41⤵
- Executes dropped EXE
-
\??\c:\nbtbnb.exec:\nbtbnb.exe42⤵
- Executes dropped EXE
-
\??\c:\7pjjv.exec:\7pjjv.exe43⤵
- Executes dropped EXE
-
\??\c:\fflxfrf.exec:\fflxfrf.exe44⤵
- Executes dropped EXE
-
\??\c:\hnnthn.exec:\hnnthn.exe45⤵
- Executes dropped EXE
-
\??\c:\jdpdv.exec:\jdpdv.exe46⤵
- Executes dropped EXE
-
\??\c:\vvppd.exec:\vvppd.exe47⤵
- Executes dropped EXE
-
\??\c:\rlfrffx.exec:\rlfrffx.exe48⤵
- Executes dropped EXE
-
\??\c:\thntnb.exec:\thntnb.exe49⤵
- Executes dropped EXE
-
\??\c:\7jddd.exec:\7jddd.exe50⤵
- Executes dropped EXE
-
\??\c:\jdvvj.exec:\jdvvj.exe51⤵
- Executes dropped EXE
-
\??\c:\rlfxffl.exec:\rlfxffl.exe52⤵
- Executes dropped EXE
-
\??\c:\btnthh.exec:\btnthh.exe53⤵
- Executes dropped EXE
-
\??\c:\tnhtbn.exec:\tnhtbn.exe54⤵
- Executes dropped EXE
-
\??\c:\5dppv.exec:\5dppv.exe55⤵
- Executes dropped EXE
-
\??\c:\5frfrfl.exec:\5frfrfl.exe56⤵
- Executes dropped EXE
-
\??\c:\llfrfrf.exec:\llfrfrf.exe57⤵
- Executes dropped EXE
-
\??\c:\9nbttt.exec:\9nbttt.exe58⤵
- Executes dropped EXE
-
\??\c:\3jpvv.exec:\3jpvv.exe59⤵
- Executes dropped EXE
-
\??\c:\lffrfrl.exec:\lffrfrl.exe60⤵
- Executes dropped EXE
-
\??\c:\bbtnbh.exec:\bbtnbh.exe61⤵
- Executes dropped EXE
-
\??\c:\jjdpd.exec:\jjdpd.exe62⤵
- Executes dropped EXE
-
\??\c:\9rllllr.exec:\9rllllr.exe63⤵
- Executes dropped EXE
-
\??\c:\1lrxflx.exec:\1lrxflx.exe64⤵
- Executes dropped EXE
-
\??\c:\hbtbbh.exec:\hbtbbh.exe65⤵
- Executes dropped EXE
-
\??\c:\vpjvd.exec:\vpjvd.exe66⤵
-
\??\c:\vvjdj.exec:\vvjdj.exe67⤵
-
\??\c:\fxlrlrr.exec:\fxlrlrr.exe68⤵
-
\??\c:\hbnttt.exec:\hbnttt.exe69⤵
-
\??\c:\dvjvd.exec:\dvjvd.exe70⤵
-
\??\c:\7pjjp.exec:\7pjjp.exe71⤵
-
\??\c:\xrrrxxf.exec:\xrrrxxf.exe72⤵
-
\??\c:\bttbhn.exec:\bttbhn.exe73⤵
-
\??\c:\tththh.exec:\tththh.exe74⤵
-
\??\c:\pjdpp.exec:\pjdpp.exe75⤵
-
\??\c:\lrrflxr.exec:\lrrflxr.exe76⤵
-
\??\c:\hnhthh.exec:\hnhthh.exe77⤵
-
\??\c:\7jvdd.exec:\7jvdd.exe78⤵
-
\??\c:\dvpdj.exec:\dvpdj.exe79⤵
-
\??\c:\rxrlrxl.exec:\rxrlrxl.exe80⤵
-
\??\c:\nnhhhh.exec:\nnhhhh.exe81⤵
-
\??\c:\bbthhn.exec:\bbthhn.exe82⤵
-
\??\c:\9vppv.exec:\9vppv.exe83⤵
-
\??\c:\flllrxl.exec:\flllrxl.exe84⤵
-
\??\c:\hbbhbh.exec:\hbbhbh.exe85⤵
-
\??\c:\5dvdp.exec:\5dvdp.exe86⤵
-
\??\c:\vvpvd.exec:\vvpvd.exe87⤵
-
\??\c:\rrrfrxr.exec:\rrrfrxr.exe88⤵
-
\??\c:\ntnhbh.exec:\ntnhbh.exe89⤵
-
\??\c:\7hbbtt.exec:\7hbbtt.exe90⤵
-
\??\c:\jjvvj.exec:\jjvvj.exe91⤵
-
\??\c:\lfxfrrl.exec:\lfxfrrl.exe92⤵
-
\??\c:\7xxxllx.exec:\7xxxllx.exe93⤵
-
\??\c:\hbnbnt.exec:\hbnbnt.exe94⤵
-
\??\c:\jdddj.exec:\jdddj.exe95⤵
-
\??\c:\vddpv.exec:\vddpv.exe96⤵
-
\??\c:\ffxlrfr.exec:\ffxlrfr.exe97⤵
-
\??\c:\nhnntt.exec:\nhnntt.exe98⤵
-
\??\c:\hbnttt.exec:\hbnttt.exe99⤵
-
\??\c:\ppjpd.exec:\ppjpd.exe100⤵
-
\??\c:\7xrxlrf.exec:\7xrxlrf.exe101⤵
-
\??\c:\bthhbh.exec:\bthhbh.exe102⤵
-
\??\c:\bhtntt.exec:\bhtntt.exe103⤵
-
\??\c:\5vvdj.exec:\5vvdj.exe104⤵
-
\??\c:\3lfrfxf.exec:\3lfrfxf.exe105⤵
-
\??\c:\fxlfllr.exec:\fxlfllr.exe106⤵
-
\??\c:\bbtbnb.exec:\bbtbnb.exe107⤵
-
\??\c:\pjddp.exec:\pjddp.exe108⤵
-
\??\c:\ddddv.exec:\ddddv.exe109⤵
-
\??\c:\7lfrxrx.exec:\7lfrxrx.exe110⤵
-
\??\c:\hnhnbh.exec:\hnhnbh.exe111⤵
-
\??\c:\ddjpv.exec:\ddjpv.exe112⤵
-
\??\c:\pppdp.exec:\pppdp.exe113⤵
-
\??\c:\llxlxxl.exec:\llxlxxl.exe114⤵
-
\??\c:\hbtbhh.exec:\hbtbhh.exe115⤵
-
\??\c:\hhbbhn.exec:\hhbbhn.exe116⤵
-
\??\c:\pvjvv.exec:\pvjvv.exe117⤵
-
\??\c:\1rlrxfr.exec:\1rlrxfr.exe118⤵
-
\??\c:\bhtthh.exec:\bhtthh.exe119⤵
-
\??\c:\nnbhnt.exec:\nnbhnt.exe120⤵
-
\??\c:\lfrrrrf.exec:\lfrrrrf.exe121⤵
-
\??\c:\nhbbbb.exec:\nhbbbb.exe122⤵
-
\??\c:\vdvdv.exec:\vdvdv.exe123⤵
-
\??\c:\xrrflrl.exec:\xrrflrl.exe124⤵
-
\??\c:\lffrrrr.exec:\lffrrrr.exe125⤵
-
\??\c:\vpjpv.exec:\vpjpv.exe126⤵
-
\??\c:\flffxxl.exec:\flffxxl.exe127⤵
-
\??\c:\btbnhb.exec:\btbnhb.exe128⤵
-
\??\c:\9btbnn.exec:\9btbnn.exe129⤵
-
\??\c:\9vppv.exec:\9vppv.exe130⤵
-
\??\c:\rlxfllr.exec:\rlxfllr.exe131⤵
-
\??\c:\xrxfrrx.exec:\xrxfrrx.exe132⤵
-
\??\c:\1nbbbh.exec:\1nbbbh.exe133⤵
-
\??\c:\vdpdj.exec:\vdpdj.exe134⤵
-
\??\c:\7frrrrf.exec:\7frrrrf.exe135⤵
-
\??\c:\nthhnn.exec:\nthhnn.exe136⤵
-
\??\c:\nhtthn.exec:\nhtthn.exe137⤵
-
\??\c:\jdpjp.exec:\jdpjp.exe138⤵
-
\??\c:\3frrrxx.exec:\3frrrxx.exe139⤵
-
\??\c:\rxrxlrf.exec:\rxrxlrf.exe140⤵
-
\??\c:\ttnttb.exec:\ttnttb.exe141⤵
-
\??\c:\3tnntb.exec:\3tnntb.exe142⤵
-
\??\c:\pjjjv.exec:\pjjjv.exe143⤵
-
\??\c:\lrrrflr.exec:\lrrrflr.exe144⤵
-
\??\c:\fxffllr.exec:\fxffllr.exe145⤵
-
\??\c:\hhthnb.exec:\hhthnb.exe146⤵
-
\??\c:\ddjvd.exec:\ddjvd.exe147⤵
-
\??\c:\3vjvd.exec:\3vjvd.exe148⤵
-
\??\c:\3lflfll.exec:\3lflfll.exe149⤵
-
\??\c:\1hbbbb.exec:\1hbbbb.exe150⤵
-
\??\c:\7btbbh.exec:\7btbbh.exe151⤵
-
\??\c:\pdddj.exec:\pdddj.exe152⤵
-
\??\c:\rlflrrf.exec:\rlflrrf.exe153⤵
-
\??\c:\nhbhnn.exec:\nhbhnn.exe154⤵
-
\??\c:\btntbn.exec:\btntbn.exe155⤵
-
\??\c:\dddjv.exec:\dddjv.exe156⤵
-
\??\c:\fffxffr.exec:\fffxffr.exe157⤵
-
\??\c:\flxflrx.exec:\flxflrx.exe158⤵
-
\??\c:\btttnh.exec:\btttnh.exe159⤵
-
\??\c:\3jjjd.exec:\3jjjd.exe160⤵
-
\??\c:\jvjpp.exec:\jvjpp.exe161⤵
-
\??\c:\xrflllx.exec:\xrflllx.exe162⤵
-
\??\c:\nhthnt.exec:\nhthnt.exe163⤵
-
\??\c:\bbntbn.exec:\bbntbn.exe164⤵
-
\??\c:\ddvdj.exec:\ddvdj.exe165⤵
-
\??\c:\5xrrrlx.exec:\5xrrrlx.exe166⤵
-
\??\c:\fxllrrx.exec:\fxllrrx.exe167⤵
-
\??\c:\tnnhbh.exec:\tnnhbh.exe168⤵
-
\??\c:\nnttbh.exec:\nnttbh.exe169⤵
-
\??\c:\dddpp.exec:\dddpp.exe170⤵
-
\??\c:\lxlrxfl.exec:\lxlrxfl.exe171⤵
-
\??\c:\bbbnbb.exec:\bbbnbb.exe172⤵
-
\??\c:\thbhnb.exec:\thbhnb.exe173⤵
-
\??\c:\ppjjp.exec:\ppjjp.exe174⤵
-
\??\c:\fxrrfxf.exec:\fxrrfxf.exe175⤵
-
\??\c:\9rlrxlx.exec:\9rlrxlx.exe176⤵
-
\??\c:\tnhnhn.exec:\tnhnhn.exe177⤵
-
\??\c:\nhhtbh.exec:\nhhtbh.exe178⤵
-
\??\c:\vpdpd.exec:\vpdpd.exe179⤵
-
\??\c:\7rxxrxx.exec:\7rxxrxx.exe180⤵
-
\??\c:\fxffxxr.exec:\fxffxxr.exe181⤵
-
\??\c:\bthntb.exec:\bthntb.exe182⤵
-
\??\c:\jddvd.exec:\jddvd.exe183⤵
-
\??\c:\vppvd.exec:\vppvd.exe184⤵
-
\??\c:\3fxfllx.exec:\3fxfllx.exe185⤵
-
\??\c:\hnhbtt.exec:\hnhbtt.exe186⤵
-
\??\c:\ttbhnn.exec:\ttbhnn.exe187⤵
-
\??\c:\vpjvd.exec:\vpjvd.exe188⤵
-
\??\c:\9xllrrf.exec:\9xllrrf.exe189⤵
-
\??\c:\xrllflr.exec:\xrllflr.exe190⤵
-
\??\c:\tntttt.exec:\tntttt.exe191⤵
-
\??\c:\9jdjv.exec:\9jdjv.exe192⤵
-
\??\c:\vjjpv.exec:\vjjpv.exe193⤵
-
\??\c:\xrlrflr.exec:\xrlrflr.exe194⤵
-
\??\c:\5bbbhn.exec:\5bbbhn.exe195⤵
-
\??\c:\nhttnb.exec:\nhttnb.exe196⤵
-
\??\c:\3ddjp.exec:\3ddjp.exe197⤵
-
\??\c:\xlxffxl.exec:\xlxffxl.exe198⤵
-
\??\c:\ffxflrx.exec:\ffxflrx.exe199⤵
-
\??\c:\7thtbb.exec:\7thtbb.exe200⤵
-
\??\c:\1vppj.exec:\1vppj.exe201⤵
-
\??\c:\dppdd.exec:\dppdd.exe202⤵
-
\??\c:\9xlrrxf.exec:\9xlrrxf.exe203⤵
-
\??\c:\hnhthh.exec:\hnhthh.exe204⤵
-
\??\c:\5thnnt.exec:\5thnnt.exe205⤵
-
\??\c:\ddvpd.exec:\ddvpd.exe206⤵
-
\??\c:\lrflrxl.exec:\lrflrxl.exe207⤵
-
\??\c:\ffxfrfx.exec:\ffxfrfx.exe208⤵
-
\??\c:\7nhthn.exec:\7nhthn.exe209⤵
-
\??\c:\bbtbtb.exec:\bbtbtb.exe210⤵
-
\??\c:\1jvdd.exec:\1jvdd.exe211⤵
-
\??\c:\3rlxflx.exec:\3rlxflx.exe212⤵
-
\??\c:\rfrfllf.exec:\rfrfllf.exe213⤵
-
\??\c:\bbtbnt.exec:\bbtbnt.exe214⤵
-
\??\c:\jppdv.exec:\jppdv.exe215⤵
-
\??\c:\5pjpp.exec:\5pjpp.exe216⤵
-
\??\c:\xxrfrrl.exec:\xxrfrrl.exe217⤵
-
\??\c:\frxfllr.exec:\frxfllr.exe218⤵
-
\??\c:\tnbnbh.exec:\tnbnbh.exe219⤵
-
\??\c:\pjvjd.exec:\pjvjd.exe220⤵
-
\??\c:\9frxlrf.exec:\9frxlrf.exe221⤵
-
\??\c:\xxrxllx.exec:\xxrxllx.exe222⤵
-
\??\c:\hbhnnt.exec:\hbhnnt.exe223⤵
-
\??\c:\dvjdj.exec:\dvjdj.exe224⤵
-
\??\c:\jjddj.exec:\jjddj.exe225⤵
-
\??\c:\7flrlrx.exec:\7flrlrx.exe226⤵
-
\??\c:\3frrlrf.exec:\3frrlrf.exe227⤵
-
\??\c:\tthnhh.exec:\tthnhh.exe228⤵
-
\??\c:\pjdvd.exec:\pjdvd.exe229⤵
-
\??\c:\pjvvj.exec:\pjvvj.exe230⤵
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe231⤵
-
\??\c:\bnhtnh.exec:\bnhtnh.exe232⤵
-
\??\c:\tthhtb.exec:\tthhtb.exe233⤵
-
\??\c:\7vpdj.exec:\7vpdj.exe234⤵
-
\??\c:\xrffffl.exec:\xrffffl.exe235⤵
-
\??\c:\1rrxrfx.exec:\1rrxrfx.exe236⤵
-
\??\c:\3hbhbb.exec:\3hbhbb.exe237⤵
-
\??\c:\pjpjp.exec:\pjpjp.exe238⤵
-
\??\c:\pjjjd.exec:\pjjjd.exe239⤵
-
\??\c:\rfrrffr.exec:\rfrrffr.exe240⤵
-
\??\c:\rrflrxf.exec:\rrflrxf.exe241⤵