Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
15/06/2024, 04:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe
- Size 487KB
- Sample240615-enpdkssdlp
- SHA256 fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef
- MD5 1343d523f630e275656f1cbbb2396c82
- SHA1 17f10e0f77576f39a592d63a1bd013783d844626
- SHA512 3d5c8270120136d6cfcf5ea3988584a1c41537210409cfd0bef44aff859c8b99633582762800ed726022fd3f67b6df1d0a19494dfaf5926124bebdaf429cd6a2
- SSDEEP 6144:8cm7ImGddXmNt251UriZFwu1b26X1wjdgyPPBA:q7Tc2NYHUrAwqzQ7PPu
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1072-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4140-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3344-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-702-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-1076-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/1072-1-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1120-6-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4304-13-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2796-18-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3260-31-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3404-25-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4972-37-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1892-46-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3680-54-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/380-61-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4748-66-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2144-77-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2076-80-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/864-90-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4808-102-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2000-100-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4576-113-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1964-118-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1964-122-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4256-127-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2968-134-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1560-139-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3568-148-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1548-161-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1544-172-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3796-175-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1040-189-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1232-191-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4368-200-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4072-202-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3100-206-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1652-215-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2740-229-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4816-244-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4140-248-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4672-255-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2412-257-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4808-261-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4364-264-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4364-268-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4576-273-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1228-279-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/216-287-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1380-305-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3968-312-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/920-325-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4428-329-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2816-345-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2716-352-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4132-350-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3532-369-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3344-377-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2476-386-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4872-396-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3292-400-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3564-401-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2288-420-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/536-469-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4864-500-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4712-513-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2472-514-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3864-518-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4672-522-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2356-529-0x0000000000400000-0x000000000042A000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 1120 tthnbb.exe 4304 bhnnnn.exe 2796 hbtnhn.exe 3404 9jjjj.exe 3260 rllllll.exe 4972 hhhhbb.exe 1892 lrffxxx.exe 3680 5htnhh.exe 2328 xllfxxx.exe 380 1ttnhh.exe 4748 vdjvj.exe 2076 7xxlfrr.exe 2144 hbnhhb.exe 2416 thtnhh.exe 864 pjpjd.exe 2000 vvpjj.exe 4808 7xxxffl.exe 1904 thnhbh.exe 4576 tttttb.exe 1964 3pdvv.exe 4256 vpdvd.exe 2968 nhnhbt.exe 1560 dvjdd.exe 3988 lllfxxx.exe 3568 jdjdv.exe 1380 5lrlfff.exe 1548 pjjdd.exe 4896 xxxrrrl.exe 1544 lffffff.exe 3796 jjvvd.exe 3800 lfllflr.exe 1040 hthbbb.exe 1232 ffrrrrx.exe 2720 9nhbbb.exe 4368 bhttbh.exe 4072 vvvvp.exe 3100 llxrllf.exe 4656 bbttnt.exe 2944 hhnntt.exe 1652 jddvp.exe 852 rlxxfff.exe 2328 hnhhbb.exe 3620 tbtnnn.exe 2740 vvvvp.exe 4864 ffrlfxr.exe 2352 tntbtt.exe 2756 7btnhn.exe 4820 jdddv.exe 4816 3xxxrrx.exe 4140 xrxrrlf.exe 4672 9tbnnt.exe 2412 dpvpp.exe 4808 djvpd.exe 4364 rrfxrrl.exe 1904 nhhbtt.exe 4576 3ppjv.exe 4280 djppj.exe 1228 fxfxxxr.exe 2876 tnnhbb.exe 216 7vpjd.exe 1264 3ppjj.exe 660 5xxrrrl.exe 4892 7bhbtt.exe 4584 9tbbhn.exe -
resource yara_rule behavioral2/memory/1072-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4140-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3344-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-529-0x0000000000400000-0x000000000042A000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1072 wrote to memory of 1120 1072 fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe 89 PID 1072 wrote to memory of 1120 1072 fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe 89 PID 1072 wrote to memory of 1120 1072 fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe 89 PID 1120 wrote to memory of 4304 1120 tthnbb.exe 90 PID 1120 wrote to memory of 4304 1120 tthnbb.exe 90 PID 1120 wrote to memory of 4304 1120 tthnbb.exe 90 PID 4304 wrote to memory of 2796 4304 bhnnnn.exe 91 PID 4304 wrote to memory of 2796 4304 bhnnnn.exe 91 PID 4304 wrote to memory of 2796 4304 bhnnnn.exe 91 PID 2796 wrote to memory of 3404 2796 hbtnhn.exe 93 PID 2796 wrote to memory of 3404 2796 hbtnhn.exe 93 PID 2796 wrote to memory of 3404 2796 hbtnhn.exe 93 PID 3404 wrote to memory of 3260 3404 9jjjj.exe 95 PID 3404 wrote to memory of 3260 3404 9jjjj.exe 95 PID 3404 wrote to memory of 3260 3404 9jjjj.exe 95 PID 3260 wrote to memory of 4972 3260 rllllll.exe 96 PID 3260 wrote to memory of 4972 3260 rllllll.exe 96 PID 3260 wrote to memory of 4972 3260 rllllll.exe 96 PID 4972 wrote to memory of 1892 4972 hhhhbb.exe 97 PID 4972 wrote to memory of 1892 4972 hhhhbb.exe 97 PID 4972 wrote to memory of 1892 4972 hhhhbb.exe 97 PID 1892 wrote to memory of 3680 1892 lrffxxx.exe 98 PID 1892 wrote to memory of 3680 1892 lrffxxx.exe 98 PID 1892 wrote to memory of 3680 1892 lrffxxx.exe 98 PID 3680 wrote to memory of 2328 3680 5htnhh.exe 99 PID 3680 wrote to memory of 2328 3680 5htnhh.exe 99 PID 3680 wrote to memory of 2328 3680 5htnhh.exe 99 PID 2328 wrote to memory of 380 2328 xllfxxx.exe 101 PID 2328 wrote to memory of 380 2328 xllfxxx.exe 101 PID 2328 wrote to memory of 380 2328 xllfxxx.exe 101 PID 380 wrote to memory of 4748 380 1ttnhh.exe 102 PID 380 wrote to memory of 4748 380 1ttnhh.exe 102 PID 380 wrote to memory of 4748 380 1ttnhh.exe 102 PID 4748 wrote to memory of 2076 4748 vdjvj.exe 103 PID 4748 wrote to memory of 2076 4748 vdjvj.exe 103 PID 4748 wrote to memory of 2076 4748 vdjvj.exe 103 PID 2076 wrote to memory of 2144 2076 7xxlfrr.exe 104 PID 2076 wrote to memory of 2144 2076 7xxlfrr.exe 104 PID 2076 wrote to memory of 2144 2076 7xxlfrr.exe 104 PID 2144 wrote to memory of 2416 2144 hbnhhb.exe 105 PID 2144 wrote to memory of 2416 2144 hbnhhb.exe 105 PID 2144 wrote to memory of 2416 2144 hbnhhb.exe 105 PID 2416 wrote to memory of 864 2416 thtnhh.exe 106 PID 2416 wrote to memory of 864 2416 thtnhh.exe 106 PID 2416 wrote to memory of 864 2416 thtnhh.exe 106 PID 864 wrote to memory of 2000 864 pjpjd.exe 107 PID 864 wrote to memory of 2000 864 pjpjd.exe 107 PID 864 wrote to memory of 2000 864 pjpjd.exe 107 PID 2000 wrote to memory of 4808 2000 vvpjj.exe 108 PID 2000 wrote to memory of 4808 2000 vvpjj.exe 108 PID 2000 wrote to memory of 4808 2000 vvpjj.exe 108 PID 4808 wrote to memory of 1904 4808 7xxxffl.exe 109 PID 4808 wrote to memory of 1904 4808 7xxxffl.exe 109 PID 4808 wrote to memory of 1904 4808 7xxxffl.exe 109 PID 1904 wrote to memory of 4576 1904 thnhbh.exe 110 PID 1904 wrote to memory of 4576 1904 thnhbh.exe 110 PID 1904 wrote to memory of 4576 1904 thnhbh.exe 110 PID 4576 wrote to memory of 1964 4576 tttttb.exe 111 PID 4576 wrote to memory of 1964 4576 tttttb.exe 111 PID 4576 wrote to memory of 1964 4576 tttttb.exe 111 PID 1964 wrote to memory of 4256 1964 3pdvv.exe 112 PID 1964 wrote to memory of 4256 1964 3pdvv.exe 112 PID 1964 wrote to memory of 4256 1964 3pdvv.exe 112 PID 4256 wrote to memory of 2968 4256 vpdvd.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe"C:\Users\Admin\AppData\Local\Temp\fb262566d8dafb1e5ba6941c1b371f6486c8fd554838dc555d0d110d9a2487ef.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\tthnbb.exec:\tthnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\bhnnnn.exec:\bhnnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\hbtnhn.exec:\hbtnhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\9jjjj.exec:\9jjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\rllllll.exec:\rllllll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\hhhhbb.exec:\hhhhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\lrffxxx.exec:\lrffxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\5htnhh.exec:\5htnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\xllfxxx.exec:\xllfxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\1ttnhh.exec:\1ttnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\vdjvj.exec:\vdjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\7xxlfrr.exec:\7xxlfrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\hbnhhb.exec:\hbnhhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\thtnhh.exec:\thtnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\pjpjd.exec:\pjpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\vvpjj.exec:\vvpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\7xxxffl.exec:\7xxxffl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\thnhbh.exec:\thnhbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\tttttb.exec:\tttttb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\3pdvv.exec:\3pdvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\vpdvd.exec:\vpdvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\nhnhbt.exec:\nhnhbt.exe23⤵
- Executes dropped EXE
PID:2968 -
\??\c:\dvjdd.exec:\dvjdd.exe24⤵
- Executes dropped EXE
PID:1560 -
\??\c:\lllfxxx.exec:\lllfxxx.exe25⤵
- Executes dropped EXE
PID:3988 -
\??\c:\jdjdv.exec:\jdjdv.exe26⤵
- Executes dropped EXE
PID:3568 -
\??\c:\5lrlfff.exec:\5lrlfff.exe27⤵
- Executes dropped EXE
PID:1380 -
\??\c:\pjjdd.exec:\pjjdd.exe28⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xxxrrrl.exec:\xxxrrrl.exe29⤵
- Executes dropped EXE
PID:4896 -
\??\c:\lffffff.exec:\lffffff.exe30⤵
- Executes dropped EXE
PID:1544 -
\??\c:\jjvvd.exec:\jjvvd.exe31⤵
- Executes dropped EXE
PID:3796 -
\??\c:\lfllflr.exec:\lfllflr.exe32⤵
- Executes dropped EXE
PID:3800 -
\??\c:\hthbbb.exec:\hthbbb.exe33⤵
- Executes dropped EXE
PID:1040 -
\??\c:\ffrrrrx.exec:\ffrrrrx.exe34⤵
- Executes dropped EXE
PID:1232 -
\??\c:\9nhbbb.exec:\9nhbbb.exe35⤵
- Executes dropped EXE
PID:2720 -
\??\c:\bhttbh.exec:\bhttbh.exe36⤵
- Executes dropped EXE
PID:4368 -
\??\c:\vvvvp.exec:\vvvvp.exe37⤵
- Executes dropped EXE
PID:4072 -
\??\c:\llxrllf.exec:\llxrllf.exe38⤵
- Executes dropped EXE
PID:3100 -
\??\c:\bbttnt.exec:\bbttnt.exe39⤵
- Executes dropped EXE
PID:4656 -
\??\c:\hhnntt.exec:\hhnntt.exe40⤵
- Executes dropped EXE
PID:2944 -
\??\c:\jddvp.exec:\jddvp.exe41⤵
- Executes dropped EXE
PID:1652 -
\??\c:\rlxxfff.exec:\rlxxfff.exe42⤵
- Executes dropped EXE
PID:852 -
\??\c:\hnhhbb.exec:\hnhhbb.exe43⤵
- Executes dropped EXE
PID:2328 -
\??\c:\tbtnnn.exec:\tbtnnn.exe44⤵
- Executes dropped EXE
PID:3620 -
\??\c:\vvvvp.exec:\vvvvp.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\ffrlfxr.exec:\ffrlfxr.exe46⤵
- Executes dropped EXE
PID:4864 -
\??\c:\tntbtt.exec:\tntbtt.exe47⤵
- Executes dropped EXE
PID:2352 -
\??\c:\7btnhn.exec:\7btnhn.exe48⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jdddv.exec:\jdddv.exe49⤵
- Executes dropped EXE
PID:4820 -
\??\c:\3xxxrrx.exec:\3xxxrrx.exe50⤵
- Executes dropped EXE
PID:4816 -
\??\c:\xrxrrlf.exec:\xrxrrlf.exe51⤵
- Executes dropped EXE
PID:4140 -
\??\c:\9tbnnt.exec:\9tbnnt.exe52⤵
- Executes dropped EXE
PID:4672 -
\??\c:\dpvpp.exec:\dpvpp.exe53⤵
- Executes dropped EXE
PID:2412 -
\??\c:\djvpd.exec:\djvpd.exe54⤵
- Executes dropped EXE
PID:4808 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe55⤵
- Executes dropped EXE
PID:4364 -
\??\c:\nhhbtt.exec:\nhhbtt.exe56⤵
- Executes dropped EXE
PID:1904 -
\??\c:\3ppjv.exec:\3ppjv.exe57⤵
- Executes dropped EXE
PID:4576 -
\??\c:\djppj.exec:\djppj.exe58⤵
- Executes dropped EXE
PID:4280 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe59⤵
- Executes dropped EXE
PID:1228 -
\??\c:\tnnhbb.exec:\tnnhbb.exe60⤵
- Executes dropped EXE
PID:2876 -
\??\c:\7vpjd.exec:\7vpjd.exe61⤵
- Executes dropped EXE
PID:216 -
\??\c:\3ppjj.exec:\3ppjj.exe62⤵
- Executes dropped EXE
PID:1264 -
\??\c:\5xxrrrl.exec:\5xxrrrl.exe63⤵
- Executes dropped EXE
PID:660 -
\??\c:\7bhbtt.exec:\7bhbtt.exe64⤵
- Executes dropped EXE
PID:4892 -
\??\c:\9tbbhn.exec:\9tbbhn.exe65⤵
- Executes dropped EXE
PID:4584 -
\??\c:\jdjdj.exec:\jdjdj.exe66⤵PID:1380
-
\??\c:\rfllffx.exec:\rfllffx.exe67⤵PID:2660
-
\??\c:\xxlfffx.exec:\xxlfffx.exe68⤵PID:2084
-
\??\c:\nhnhhb.exec:\nhnhhb.exe69⤵PID:3968
-
\??\c:\3jvdd.exec:\3jvdd.exe70⤵PID:3456
-
\??\c:\1vppp.exec:\1vppp.exe71⤵PID:3796
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe72⤵PID:920
-
\??\c:\5btttt.exec:\5btttt.exe73⤵PID:4428
-
\??\c:\5pvpp.exec:\5pvpp.exe74⤵PID:3168
-
\??\c:\xxffllx.exec:\xxffllx.exe75⤵PID:3260
-
\??\c:\tnnhbb.exec:\tnnhbb.exe76⤵PID:3848
-
\??\c:\nthhnt.exec:\nthhnt.exe77⤵PID:4536
-
\??\c:\jdvjd.exec:\jdvjd.exe78⤵PID:2816
-
\??\c:\rffxxxr.exec:\rffxxxr.exe79⤵PID:2716
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe80⤵PID:4132
-
\??\c:\nhhbtn.exec:\nhhbtn.exe81⤵PID:2944
-
\??\c:\ddvpj.exec:\ddvpj.exe82⤵PID:2700
-
\??\c:\lllfxxr.exec:\lllfxxr.exe83⤵PID:3832
-
\??\c:\nhthbt.exec:\nhthbt.exe84⤵PID:2936
-
\??\c:\7nhbnn.exec:\7nhbnn.exe85⤵PID:3532
-
\??\c:\vjvjd.exec:\vjvjd.exe86⤵PID:3772
-
\??\c:\lflxrxr.exec:\lflxrxr.exe87⤵PID:2016
-
\??\c:\thhtnt.exec:\thhtnt.exe88⤵PID:3344
-
\??\c:\3bbnnb.exec:\3bbnnb.exe89⤵PID:3516
-
\??\c:\ddddv.exec:\ddddv.exe90⤵PID:2476
-
\??\c:\frrlxrl.exec:\frrlxrl.exe91⤵PID:1516
-
\??\c:\btbhtn.exec:\btbhtn.exe92⤵PID:1396
-
\??\c:\vjjdv.exec:\vjjdv.exe93⤵PID:4872
-
\??\c:\lxxxlfx.exec:\lxxxlfx.exe94⤵PID:3292
-
\??\c:\7thbnh.exec:\7thbnh.exe95⤵PID:3564
-
\??\c:\5pjjd.exec:\5pjjd.exe96⤵PID:1472
-
\??\c:\xrrrxxr.exec:\xrrrxxr.exe97⤵PID:3312
-
\??\c:\9tttnn.exec:\9tttnn.exe98⤵PID:4576
-
\??\c:\tnbthh.exec:\tnbthh.exe99⤵PID:1604
-
\??\c:\1ddvp.exec:\1ddvp.exe100⤵PID:2288
-
\??\c:\xxxlrfx.exec:\xxxlrfx.exe101⤵PID:2264
-
\??\c:\htthbb.exec:\htthbb.exe102⤵PID:216
-
\??\c:\hhntnb.exec:\hhntnb.exe103⤵PID:3988
-
\??\c:\9pjdv.exec:\9pjdv.exe104⤵PID:4200
-
\??\c:\xllrfll.exec:\xllrfll.exe105⤵PID:3500
-
\??\c:\hbnhtn.exec:\hbnhtn.exe106⤵PID:3964
-
\??\c:\vpvvv.exec:\vpvvv.exe107⤵PID:4588
-
\??\c:\1vpjd.exec:\1vpjd.exe108⤵PID:436
-
\??\c:\7xfrlll.exec:\7xfrlll.exe109⤵PID:3740
-
\??\c:\hthnnt.exec:\hthnnt.exe110⤵PID:2960
-
\??\c:\vdjvp.exec:\vdjvp.exe111⤵PID:1720
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe112⤵PID:1108
-
\??\c:\thnnhh.exec:\thnnhh.exe113⤵PID:4048
-
\??\c:\tnnhtn.exec:\tnnhtn.exe114⤵PID:1040
-
\??\c:\vjjvp.exec:\vjjvp.exe115⤵PID:672
-
\??\c:\xrlfxxl.exec:\xrlfxxl.exe116⤵PID:1196
-
\??\c:\lxrfrll.exec:\lxrfrll.exe117⤵PID:536
-
\??\c:\hnhbtn.exec:\hnhbtn.exe118⤵PID:3400
-
\??\c:\pjjpj.exec:\pjjpj.exe119⤵PID:3868
-
\??\c:\vpddv.exec:\vpddv.exe120⤵PID:3680
-
\??\c:\xlxlrlx.exec:\xlxlrlx.exe121⤵PID:2096
-
\??\c:\tntbtt.exec:\tntbtt.exe122⤵PID:3648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-