Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 04:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe
-
Size
487KB
-
MD5
1343d523f630e275656f1cbbb2396c82
-
SHA1
17f10e0f77576f39a592d63a1bd013783d844626
-
SHA256
fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef
-
SHA512
3d5c8270120136d6cfcf5ea3988584a1c41537210409cfd0bef44aff859c8b99633582762800ed726022fd3f67b6df1d0a19494dfaf5926124bebdaf429cd6a2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwu1b26X1wjdgyPPBA:q7Tc2NYHUrAwqzQ7PPu
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/1632-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/428-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-752-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-779-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-866-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/360-949-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1280-1014-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1000-1180-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2856-1191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/1632-0-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1632-8-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2224-18-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1680-27-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2516-35-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2628-45-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2580-46-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2724-64-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2616-74-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2480-83-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2468-99-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1104-118-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1724-115-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1956-127-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2256-142-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1036-152-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2768-178-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2768-186-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/584-221-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1364-257-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2956-282-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2956-289-0x0000000000220000-0x000000000024A000-memory.dmp UPX behavioral1/memory/3000-298-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2508-305-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1788-330-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2224-337-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2516-344-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2624-357-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2432-358-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2656-367-0x0000000000220000-0x000000000024A000-memory.dmp UPX behavioral1/memory/2656-372-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1724-428-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2344-429-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1644-448-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/324-455-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2920-462-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1624-476-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/688-495-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2060-521-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/428-528-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1660-547-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2840-602-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2632-636-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2528-643-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2624-650-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2680-657-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2424-670-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2152-695-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1600-727-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2888-752-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/620-759-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1740-766-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2112-779-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1388-846-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1992-853-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/580-879-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/3016-946-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2184-978-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1280-1014-0x0000000000230000-0x000000000025A000-memory.dmp UPX behavioral1/memory/2352-1017-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1812-1054-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/768-1061-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/792-1086-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1984-1153-0x0000000000400000-0x000000000042A000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
9lxlrrx.exevvvvp.exe2026828.exepdppp.exedpjjp.exehbnthb.exe86824.exe486688.exe40286.exes6068.exehnhhnn.exe424404.exevvpdv.exefxllrrf.exe6002068.exe3frrfff.exenhtbhn.exe8688440.exepdpdp.exefxfxxxl.exe60280.exedvppp.exedvdjj.exennbbth.exefxrrxlr.exetnbbhh.exetnbbnt.exe0846284.exelfxxfrf.exefxxrllr.exe208408.exe68668.exe868400.exe5vpvj.exe4020884.exejdpvv.exebhthhh.exetnbbhh.exerlfxffr.exe080682.exe86806.exelfrrxxl.exe42884.exexrllrrf.exedvjjp.exe08846.exe4048608.exes8006.exexfffxxl.exea2444.exe820404.exe3xxrrrr.exe04008.exellxxlll.exe1frrrlr.exew20660.exerfflrxl.exerrrxllr.exe2682240.exe04848.exe642288.exe0480668.exes6462.exelxrlrlx.exepid process 2224 9lxlrrx.exe 1680 vvvvp.exe 2516 2026828.exe 2628 pdppp.exe 2580 dpjjp.exe 2724 hbnthb.exe 2608 86824.exe 2616 486688.exe 2480 40286.exe 2468 s6068.exe 1952 hnhhnn.exe 1724 424404.exe 1104 vvpdv.exe 1956 fxllrrf.exe 2256 6002068.exe 1036 3frrfff.exe 2916 nhtbhn.exe 768 8688440.exe 2464 pdpdp.exe 2768 fxfxxxl.exe 2812 60280.exe 540 dvppp.exe 596 dvdjj.exe 584 nnbbth.exe 1776 fxrrxlr.exe 448 tnbbhh.exe 1756 tnbbnt.exe 1340 0846284.exe 1364 lfxxfrf.exe 2000 fxxrllr.exe 3040 208408.exe 2956 68668.exe 2980 868400.exe 3000 5vpvj.exe 2508 4020884.exe 1588 jdpvv.exe 1256 bhthhh.exe 1788 tnbbhh.exe 2224 rlfxffr.exe 1680 080682.exe 2516 86806.exe 2624 lfrrxxl.exe 2432 42884.exe 2656 xrllrrf.exe 2724 dvjjp.exe 2644 08846.exe 2440 4048608.exe 2904 s8006.exe 1808 xfffxxl.exe 1440 a2444.exe 2744 820404.exe 1944 3xxrrrr.exe 1724 04008.exe 2344 llxxlll.exe 2216 1frrrlr.exe 1268 w20660.exe 1644 rfflrxl.exe 324 rrrxllr.exe 2920 2682240.exe 2520 04848.exe 1624 642288.exe 2280 0480668.exe 2092 s6462.exe 688 lxrlrlx.exe -
Processes:
resource yara_rule behavioral1/memory/1632-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/428-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-759-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-779-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-846-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-853-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-879-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-946-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-978-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-1014-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2352-1017-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-1054-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-1061-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/792-1086-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-1153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-1191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-1222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-1325-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe9lxlrrx.exevvvvp.exe2026828.exepdppp.exedpjjp.exehbnthb.exe86824.exe486688.exe40286.exes6068.exehnhhnn.exe424404.exevvpdv.exefxllrrf.exe6002068.exedescription pid process target process PID 1632 wrote to memory of 2224 1632 fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe 9lxlrrx.exe PID 1632 wrote to memory of 2224 1632 fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe 9lxlrrx.exe PID 1632 wrote to memory of 2224 1632 fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe 9lxlrrx.exe PID 1632 wrote to memory of 2224 1632 fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe 9lxlrrx.exe PID 2224 wrote to memory of 1680 2224 9lxlrrx.exe vvvvp.exe PID 2224 wrote to memory of 1680 2224 9lxlrrx.exe vvvvp.exe PID 2224 wrote to memory of 1680 2224 9lxlrrx.exe vvvvp.exe PID 2224 wrote to memory of 1680 2224 9lxlrrx.exe vvvvp.exe PID 1680 wrote to memory of 2516 1680 vvvvp.exe 2026828.exe PID 1680 wrote to memory of 2516 1680 vvvvp.exe 2026828.exe PID 1680 wrote to memory of 2516 1680 vvvvp.exe 2026828.exe PID 1680 wrote to memory of 2516 1680 vvvvp.exe 2026828.exe PID 2516 wrote to memory of 2628 2516 2026828.exe pdppp.exe PID 2516 wrote to memory of 2628 2516 2026828.exe pdppp.exe PID 2516 wrote to memory of 2628 2516 2026828.exe pdppp.exe PID 2516 wrote to memory of 2628 2516 2026828.exe pdppp.exe PID 2628 wrote to memory of 2580 2628 pdppp.exe dpjjp.exe PID 2628 wrote to memory of 2580 2628 pdppp.exe dpjjp.exe PID 2628 wrote to memory of 2580 2628 pdppp.exe dpjjp.exe PID 2628 wrote to memory of 2580 2628 pdppp.exe dpjjp.exe PID 2580 wrote to memory of 2724 2580 dpjjp.exe hbnthb.exe PID 2580 wrote to memory of 2724 2580 dpjjp.exe hbnthb.exe PID 2580 wrote to memory of 2724 2580 dpjjp.exe hbnthb.exe PID 2580 wrote to memory of 2724 2580 dpjjp.exe hbnthb.exe PID 2724 wrote to memory of 2608 2724 hbnthb.exe 86824.exe PID 2724 wrote to memory of 2608 2724 hbnthb.exe 86824.exe PID 2724 wrote to memory of 2608 2724 hbnthb.exe 86824.exe PID 2724 wrote to memory of 2608 2724 hbnthb.exe 86824.exe PID 2608 wrote to memory of 2616 2608 86824.exe 486688.exe PID 2608 wrote to memory of 2616 2608 86824.exe 486688.exe PID 2608 wrote to memory of 2616 2608 86824.exe 486688.exe PID 2608 wrote to memory of 2616 2608 86824.exe 486688.exe PID 2616 wrote to memory of 2480 2616 486688.exe 40286.exe PID 2616 wrote to memory of 2480 2616 486688.exe 40286.exe PID 2616 wrote to memory of 2480 2616 486688.exe 40286.exe PID 2616 wrote to memory of 2480 2616 486688.exe 40286.exe PID 2480 wrote to memory of 2468 2480 40286.exe s6068.exe PID 2480 wrote to memory of 2468 2480 40286.exe s6068.exe PID 2480 wrote to memory of 2468 2480 40286.exe s6068.exe PID 2480 wrote to memory of 2468 2480 40286.exe s6068.exe PID 2468 wrote to memory of 1952 2468 s6068.exe hnhhnn.exe PID 2468 wrote to memory of 1952 2468 s6068.exe hnhhnn.exe PID 2468 wrote to memory of 1952 2468 s6068.exe hnhhnn.exe PID 2468 wrote to memory of 1952 2468 s6068.exe hnhhnn.exe PID 1952 wrote to memory of 1724 1952 hnhhnn.exe 424404.exe PID 1952 wrote to memory of 1724 1952 hnhhnn.exe 424404.exe PID 1952 wrote to memory of 1724 1952 hnhhnn.exe 424404.exe PID 1952 wrote to memory of 1724 1952 hnhhnn.exe 424404.exe PID 1724 wrote to memory of 1104 1724 424404.exe vvpdv.exe PID 1724 wrote to memory of 1104 1724 424404.exe vvpdv.exe PID 1724 wrote to memory of 1104 1724 424404.exe vvpdv.exe PID 1724 wrote to memory of 1104 1724 424404.exe vvpdv.exe PID 1104 wrote to memory of 1956 1104 vvpdv.exe fxllrrf.exe PID 1104 wrote to memory of 1956 1104 vvpdv.exe fxllrrf.exe PID 1104 wrote to memory of 1956 1104 vvpdv.exe fxllrrf.exe PID 1104 wrote to memory of 1956 1104 vvpdv.exe fxllrrf.exe PID 1956 wrote to memory of 2256 1956 fxllrrf.exe 6002068.exe PID 1956 wrote to memory of 2256 1956 fxllrrf.exe 6002068.exe PID 1956 wrote to memory of 2256 1956 fxllrrf.exe 6002068.exe PID 1956 wrote to memory of 2256 1956 fxllrrf.exe 6002068.exe PID 2256 wrote to memory of 1036 2256 6002068.exe 3frrfff.exe PID 2256 wrote to memory of 1036 2256 6002068.exe 3frrfff.exe PID 2256 wrote to memory of 1036 2256 6002068.exe 3frrfff.exe PID 2256 wrote to memory of 1036 2256 6002068.exe 3frrfff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe"C:\Users\Admin\AppData\Local\Temp\fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\9lxlrrx.exec:\9lxlrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvvvp.exec:\vvvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\2026828.exec:\2026828.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdppp.exec:\pdppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpjjp.exec:\dpjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbnthb.exec:\hbnthb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\86824.exec:\86824.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\486688.exec:\486688.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\40286.exec:\40286.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\s6068.exec:\s6068.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnhhnn.exec:\hnhhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\424404.exec:\424404.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvpdv.exec:\vvpdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxllrrf.exec:\fxllrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\6002068.exec:\6002068.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3frrfff.exec:\3frrfff.exe17⤵
- Executes dropped EXE
-
\??\c:\nhtbhn.exec:\nhtbhn.exe18⤵
- Executes dropped EXE
-
\??\c:\8688440.exec:\8688440.exe19⤵
- Executes dropped EXE
-
\??\c:\pdpdp.exec:\pdpdp.exe20⤵
- Executes dropped EXE
-
\??\c:\fxfxxxl.exec:\fxfxxxl.exe21⤵
- Executes dropped EXE
-
\??\c:\60280.exec:\60280.exe22⤵
- Executes dropped EXE
-
\??\c:\dvppp.exec:\dvppp.exe23⤵
- Executes dropped EXE
-
\??\c:\dvdjj.exec:\dvdjj.exe24⤵
- Executes dropped EXE
-
\??\c:\nnbbth.exec:\nnbbth.exe25⤵
- Executes dropped EXE
-
\??\c:\fxrrxlr.exec:\fxrrxlr.exe26⤵
- Executes dropped EXE
-
\??\c:\tnbbhh.exec:\tnbbhh.exe27⤵
- Executes dropped EXE
-
\??\c:\tnbbnt.exec:\tnbbnt.exe28⤵
- Executes dropped EXE
-
\??\c:\0846284.exec:\0846284.exe29⤵
- Executes dropped EXE
-
\??\c:\lfxxfrf.exec:\lfxxfrf.exe30⤵
- Executes dropped EXE
-
\??\c:\fxxrllr.exec:\fxxrllr.exe31⤵
- Executes dropped EXE
-
\??\c:\208408.exec:\208408.exe32⤵
- Executes dropped EXE
-
\??\c:\68668.exec:\68668.exe33⤵
- Executes dropped EXE
-
\??\c:\868400.exec:\868400.exe34⤵
- Executes dropped EXE
-
\??\c:\5vpvj.exec:\5vpvj.exe35⤵
- Executes dropped EXE
-
\??\c:\4020884.exec:\4020884.exe36⤵
- Executes dropped EXE
-
\??\c:\jdpvv.exec:\jdpvv.exe37⤵
- Executes dropped EXE
-
\??\c:\bhthhh.exec:\bhthhh.exe38⤵
- Executes dropped EXE
-
\??\c:\tnbbhh.exec:\tnbbhh.exe39⤵
- Executes dropped EXE
-
\??\c:\rlfxffr.exec:\rlfxffr.exe40⤵
- Executes dropped EXE
-
\??\c:\080682.exec:\080682.exe41⤵
- Executes dropped EXE
-
\??\c:\86806.exec:\86806.exe42⤵
- Executes dropped EXE
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe43⤵
- Executes dropped EXE
-
\??\c:\42884.exec:\42884.exe44⤵
- Executes dropped EXE
-
\??\c:\xrllrrf.exec:\xrllrrf.exe45⤵
- Executes dropped EXE
-
\??\c:\dvjjp.exec:\dvjjp.exe46⤵
- Executes dropped EXE
-
\??\c:\08846.exec:\08846.exe47⤵
- Executes dropped EXE
-
\??\c:\4048608.exec:\4048608.exe48⤵
- Executes dropped EXE
-
\??\c:\s8006.exec:\s8006.exe49⤵
- Executes dropped EXE
-
\??\c:\xfffxxl.exec:\xfffxxl.exe50⤵
- Executes dropped EXE
-
\??\c:\a2444.exec:\a2444.exe51⤵
- Executes dropped EXE
-
\??\c:\820404.exec:\820404.exe52⤵
- Executes dropped EXE
-
\??\c:\3xxrrrr.exec:\3xxrrrr.exe53⤵
- Executes dropped EXE
-
\??\c:\04008.exec:\04008.exe54⤵
- Executes dropped EXE
-
\??\c:\llxxlll.exec:\llxxlll.exe55⤵
- Executes dropped EXE
-
\??\c:\1frrrlr.exec:\1frrrlr.exe56⤵
- Executes dropped EXE
-
\??\c:\w20660.exec:\w20660.exe57⤵
- Executes dropped EXE
-
\??\c:\rfflrxl.exec:\rfflrxl.exe58⤵
- Executes dropped EXE
-
\??\c:\rrrxllr.exec:\rrrxllr.exe59⤵
- Executes dropped EXE
-
\??\c:\2682240.exec:\2682240.exe60⤵
- Executes dropped EXE
-
\??\c:\04848.exec:\04848.exe61⤵
- Executes dropped EXE
-
\??\c:\642288.exec:\642288.exe62⤵
- Executes dropped EXE
-
\??\c:\0480668.exec:\0480668.exe63⤵
- Executes dropped EXE
-
\??\c:\s6462.exec:\s6462.exe64⤵
- Executes dropped EXE
-
\??\c:\lxrlrlx.exec:\lxrlrlx.exe65⤵
- Executes dropped EXE
-
\??\c:\q80660.exec:\q80660.exe66⤵
-
\??\c:\q04604.exec:\q04604.exe67⤵
-
\??\c:\666004.exec:\666004.exe68⤵
-
\??\c:\lfrlxxf.exec:\lfrlxxf.exe69⤵
-
\??\c:\2028068.exec:\2028068.exe70⤵
-
\??\c:\u640284.exec:\u640284.exe71⤵
-
\??\c:\42406.exec:\42406.exe72⤵
-
\??\c:\a8662.exec:\a8662.exe73⤵
-
\??\c:\5xrrlll.exec:\5xrrlll.exe74⤵
-
\??\c:\jdvdd.exec:\jdvdd.exe75⤵
-
\??\c:\7bhhhh.exec:\7bhhhh.exe76⤵
-
\??\c:\hbhbhb.exec:\hbhbhb.exe77⤵
-
\??\c:\u082020.exec:\u082020.exe78⤵
-
\??\c:\424466.exec:\424466.exe79⤵
-
\??\c:\m0480.exec:\m0480.exe80⤵
-
\??\c:\22660.exec:\22660.exe81⤵
-
\??\c:\rrfffrr.exec:\rrfffrr.exe82⤵
-
\??\c:\i426842.exec:\i426842.exe83⤵
-
\??\c:\7pjvj.exec:\7pjvj.exe84⤵
-
\??\c:\6084668.exec:\6084668.exe85⤵
-
\??\c:\0484224.exec:\0484224.exe86⤵
-
\??\c:\dvdvd.exec:\dvdvd.exe87⤵
-
\??\c:\ttnbtn.exec:\ttnbtn.exe88⤵
-
\??\c:\ppjjv.exec:\ppjjv.exe89⤵
-
\??\c:\5bthhh.exec:\5bthhh.exe90⤵
-
\??\c:\hhbtnh.exec:\hhbtnh.exe91⤵
-
\??\c:\48402.exec:\48402.exe92⤵
-
\??\c:\rfrlxxl.exec:\rfrlxxl.exe93⤵
-
\??\c:\jdpjv.exec:\jdpjv.exe94⤵
-
\??\c:\thbbbb.exec:\thbbbb.exe95⤵
-
\??\c:\6422828.exec:\6422828.exe96⤵
-
\??\c:\480022.exec:\480022.exe97⤵
-
\??\c:\hbtthn.exec:\hbtthn.exe98⤵
-
\??\c:\4484008.exec:\4484008.exe99⤵
-
\??\c:\rlflffl.exec:\rlflffl.exe100⤵
-
\??\c:\6040228.exec:\6040228.exe101⤵
-
\??\c:\2428224.exec:\2428224.exe102⤵
-
\??\c:\httbnt.exec:\httbnt.exe103⤵
-
\??\c:\20624.exec:\20624.exe104⤵
-
\??\c:\6882244.exec:\6882244.exe105⤵
-
\??\c:\jvjdd.exec:\jvjdd.exe106⤵
-
\??\c:\e42860.exec:\e42860.exe107⤵
-
\??\c:\rflflxx.exec:\rflflxx.exe108⤵
-
\??\c:\048068.exec:\048068.exe109⤵
-
\??\c:\bthbbt.exec:\bthbbt.exe110⤵
-
\??\c:\268800.exec:\268800.exe111⤵
-
\??\c:\g2062.exec:\g2062.exe112⤵
-
\??\c:\042200.exec:\042200.exe113⤵
-
\??\c:\ddpdj.exec:\ddpdj.exe114⤵
-
\??\c:\pjpvd.exec:\pjpvd.exe115⤵
-
\??\c:\5rrrffl.exec:\5rrrffl.exe116⤵
-
\??\c:\k64684.exec:\k64684.exe117⤵
-
\??\c:\u606880.exec:\u606880.exe118⤵
-
\??\c:\26442.exec:\26442.exe119⤵
-
\??\c:\8688006.exec:\8688006.exe120⤵
-
\??\c:\dvppd.exec:\dvppd.exe121⤵
-
\??\c:\7lxxfxf.exec:\7lxxfxf.exe122⤵
-
\??\c:\pdvdj.exec:\pdvdj.exe123⤵
-
\??\c:\0000264.exec:\0000264.exe124⤵
-
\??\c:\1vjpd.exec:\1vjpd.exe125⤵
-
\??\c:\8600620.exec:\8600620.exe126⤵
-
\??\c:\646666.exec:\646666.exe127⤵
-
\??\c:\42000.exec:\42000.exe128⤵
-
\??\c:\20880.exec:\20880.exe129⤵
-
\??\c:\pjvdv.exec:\pjvdv.exe130⤵
-
\??\c:\4824008.exec:\4824008.exe131⤵
-
\??\c:\vvjvp.exec:\vvjvp.exe132⤵
-
\??\c:\hbbhnn.exec:\hbbhnn.exe133⤵
-
\??\c:\280288.exec:\280288.exe134⤵
-
\??\c:\868800.exec:\868800.exe135⤵
-
\??\c:\6062446.exec:\6062446.exe136⤵
-
\??\c:\dvvdp.exec:\dvvdp.exe137⤵
-
\??\c:\djddp.exec:\djddp.exe138⤵
-
\??\c:\208244.exec:\208244.exe139⤵
-
\??\c:\jddjd.exec:\jddjd.exe140⤵
-
\??\c:\4868062.exec:\4868062.exe141⤵
-
\??\c:\hbttbn.exec:\hbttbn.exe142⤵
-
\??\c:\04680.exec:\04680.exe143⤵
-
\??\c:\m8284.exec:\m8284.exe144⤵
-
\??\c:\hbnhbh.exec:\hbnhbh.exe145⤵
-
\??\c:\pvjvd.exec:\pvjvd.exe146⤵
-
\??\c:\8644668.exec:\8644668.exe147⤵
-
\??\c:\420688.exec:\420688.exe148⤵
-
\??\c:\86884.exec:\86884.exe149⤵
-
\??\c:\thttnh.exec:\thttnh.exe150⤵
-
\??\c:\bnbhbn.exec:\bnbhbn.exe151⤵
-
\??\c:\5tnthb.exec:\5tnthb.exe152⤵
-
\??\c:\646288.exec:\646288.exe153⤵
-
\??\c:\8266884.exec:\8266884.exe154⤵
-
\??\c:\208844.exec:\208844.exe155⤵
-
\??\c:\dvvdp.exec:\dvvdp.exe156⤵
-
\??\c:\3lrrlfl.exec:\3lrrlfl.exe157⤵
-
\??\c:\nhbthn.exec:\nhbthn.exe158⤵
-
\??\c:\vjdpv.exec:\vjdpv.exe159⤵
-
\??\c:\fxxfrxf.exec:\fxxfrxf.exe160⤵
-
\??\c:\86842.exec:\86842.exe161⤵
-
\??\c:\204622.exec:\204622.exe162⤵
-
\??\c:\868848.exec:\868848.exe163⤵
-
\??\c:\0424246.exec:\0424246.exe164⤵
-
\??\c:\i484624.exec:\i484624.exe165⤵
-
\??\c:\pjdpd.exec:\pjdpd.exe166⤵
-
\??\c:\pdvvv.exec:\pdvvv.exe167⤵
-
\??\c:\lxllxxf.exec:\lxllxxf.exe168⤵
-
\??\c:\a8282.exec:\a8282.exe169⤵
-
\??\c:\9pjjp.exec:\9pjjp.exe170⤵
-
\??\c:\c644624.exec:\c644624.exe171⤵
-
\??\c:\2202060.exec:\2202060.exe172⤵
-
\??\c:\nbnntt.exec:\nbnntt.exe173⤵
-
\??\c:\9fxxfxl.exec:\9fxxfxl.exe174⤵
-
\??\c:\0424668.exec:\0424668.exe175⤵
-
\??\c:\86006.exec:\86006.exe176⤵
-
\??\c:\6488008.exec:\6488008.exe177⤵
-
\??\c:\s4240.exec:\s4240.exe178⤵
-
\??\c:\xxffrrx.exec:\xxffrrx.exe179⤵
-
\??\c:\3fxlflr.exec:\3fxlflr.exe180⤵
-
\??\c:\bnbnbh.exec:\bnbnbh.exe181⤵
-
\??\c:\000662.exec:\000662.exe182⤵
-
\??\c:\82284.exec:\82284.exe183⤵
-
\??\c:\266640.exec:\266640.exe184⤵
-
\??\c:\jpjvj.exec:\jpjvj.exe185⤵
-
\??\c:\040688.exec:\040688.exe186⤵
-
\??\c:\008406.exec:\008406.exe187⤵
-
\??\c:\q42848.exec:\q42848.exe188⤵
-
\??\c:\k00446.exec:\k00446.exe189⤵
-
\??\c:\0808668.exec:\0808668.exe190⤵
-
\??\c:\ppjjv.exec:\ppjjv.exe191⤵
-
\??\c:\04280.exec:\04280.exe192⤵
-
\??\c:\w42846.exec:\w42846.exe193⤵
-
\??\c:\xfxflrx.exec:\xfxflrx.exe194⤵
-
\??\c:\5vppv.exec:\5vppv.exe195⤵
-
\??\c:\7ttbhn.exec:\7ttbhn.exe196⤵
-
\??\c:\fflllfl.exec:\fflllfl.exe197⤵
-
\??\c:\26402.exec:\26402.exe198⤵
-
\??\c:\hthntt.exec:\hthntt.exe199⤵
-
\??\c:\3rffflf.exec:\3rffflf.exe200⤵
-
\??\c:\hnhntt.exec:\hnhntt.exe201⤵
-
\??\c:\9nthtt.exec:\9nthtt.exe202⤵
-
\??\c:\a8284.exec:\a8284.exe203⤵
-
\??\c:\80222.exec:\80222.exe204⤵
-
\??\c:\7djdd.exec:\7djdd.exe205⤵
-
\??\c:\4206880.exec:\4206880.exe206⤵
-
\??\c:\486628.exec:\486628.exe207⤵
-
\??\c:\26842.exec:\26842.exe208⤵
-
\??\c:\42440.exec:\42440.exe209⤵
-
\??\c:\5jjjd.exec:\5jjjd.exe210⤵
-
\??\c:\m2844.exec:\m2844.exe211⤵
-
\??\c:\8640604.exec:\8640604.exe212⤵
-
\??\c:\frfxrlr.exec:\frfxrlr.exe213⤵
-
\??\c:\tbthtb.exec:\tbthtb.exe214⤵
-
\??\c:\dvjpv.exec:\dvjpv.exe215⤵
-
\??\c:\200444.exec:\200444.exe216⤵
-
\??\c:\808222.exec:\808222.exe217⤵
-
\??\c:\rlflxfl.exec:\rlflxfl.exe218⤵
-
\??\c:\w46626.exec:\w46626.exe219⤵
-
\??\c:\i640808.exec:\i640808.exe220⤵
-
\??\c:\1xlfllr.exec:\1xlfllr.exe221⤵
-
\??\c:\a0822.exec:\a0822.exe222⤵
-
\??\c:\5lffrxl.exec:\5lffrxl.exe223⤵
-
\??\c:\lxrlffl.exec:\lxrlffl.exe224⤵
-
\??\c:\464444.exec:\464444.exe225⤵
-
\??\c:\8640602.exec:\8640602.exe226⤵
-
\??\c:\5ffrffl.exec:\5ffrffl.exe227⤵
-
\??\c:\1fflfxr.exec:\1fflfxr.exe228⤵
-
\??\c:\086848.exec:\086848.exe229⤵
-
\??\c:\ppjvv.exec:\ppjvv.exe230⤵
-
\??\c:\7lffllr.exec:\7lffllr.exe231⤵
-
\??\c:\dpdjd.exec:\dpdjd.exe232⤵
-
\??\c:\nbhbnh.exec:\nbhbnh.exe233⤵
-
\??\c:\08668.exec:\08668.exe234⤵
-
\??\c:\64622.exec:\64622.exe235⤵
-
\??\c:\1jjdj.exec:\1jjdj.exe236⤵
-
\??\c:\s0040.exec:\s0040.exe237⤵
-
\??\c:\5nbttt.exec:\5nbttt.exe238⤵
-
\??\c:\2088446.exec:\2088446.exe239⤵
-
\??\c:\s6446.exec:\s6446.exe240⤵
-
\??\c:\e88426.exec:\e88426.exe241⤵