Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 04:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fe3b1f627f27e57b58b10387cfe4b29e83e90fcc2ce186f59210064d010bc020.exe
Resource
win7-20240611-en
6 signatures
150 seconds
General
-
Target
fe3b1f627f27e57b58b10387cfe4b29e83e90fcc2ce186f59210064d010bc020.exe
-
Size
450KB
-
MD5
fa8c987f1f61637ac15719730afab03f
-
SHA1
e4d676a2fd546a30d3b214fd461d1f4c35fcd65f
-
SHA256
fe3b1f627f27e57b58b10387cfe4b29e83e90fcc2ce186f59210064d010bc020
-
SHA512
faf229b6dab2e31f1e7c188e335c057a9e8d8d80f304468347126b6d5cb83479e7c58cbd56ce58d18f30f03b41efbf6d9b848e0774dbb3dd5e60eb036d33036b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/1848-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/564-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-222-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2332-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-646-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2076-680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-699-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-953-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-1277-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/1848-0-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2848-19-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1644-31-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1840-29-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1644-40-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2800-58-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2504-57-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2800-67-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2568-76-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2436-78-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2456-96-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1600-114-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1772-113-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1600-122-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1896-131-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2600-151-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2600-158-0x0000000000220000-0x000000000024A000-memory.dmp UPX behavioral1/memory/1364-169-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2740-178-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2884-187-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2940-203-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/564-206-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2332-237-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1900-254-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2344-271-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1948-279-0x00000000003D0000-0x00000000003FA000-memory.dmp UPX behavioral1/memory/2308-290-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2660-338-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2672-345-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2664-358-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2976-365-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/836-390-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/872-439-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2368-446-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1484-453-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2744-466-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/676-491-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1580-522-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1500-529-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2208-549-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2208-556-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1640-557-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2836-588-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2288-598-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/3000-611-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2720-624-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2712-631-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2712-638-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2656-639-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2656-646-0x00000000003A0000-0x00000000003CA000-memory.dmp UPX behavioral1/memory/2576-653-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2404-660-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2304-667-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2076-680-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1600-699-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2724-754-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2768-761-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/660-774-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/400-787-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/768-800-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1776-819-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/1544-832-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/2000-851-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral1/memory/868-864-0x0000000000400000-0x000000000042A000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
bhtbbt.exefxllxfx.exenbntbb.exe1xrflrr.exetbnttn.exerflrrff.exefxxfrfr.exevpvvv.exe3lxfxlf.exe3jdjj.exerllfrll.exe3tbhtt.exevvpvd.exefrfxrrr.exenbhntt.exefxxfrrl.exehtthht.exe5dpdd.exe7xlfflr.exenbnnnn.exejjdpv.exe3btbnt.exevvddj.exethtbnn.exenhtttt.exe3jdvv.exelrfxxxl.exe9pdjd.exexxlxlrf.exehthntb.exerlrrrrx.exebhbbnn.exepjpjj.exexxrxlrf.exe5rllffl.exehttbhn.exethbhhn.exedpjdj.exefxlxffx.exenhbbnt.exetnbhtt.exe9ddpd.exe9xrfrxr.exelfrrffl.exebtttbh.exejdpvj.exefxllxrx.exe9llrffr.exebhnhnt.exebnhntn.exedjddj.exerrlrxxf.exexxrlrrl.exehbnntb.exevpdvj.exexlflllx.exelrfrfxf.exetnhbnn.exeddjjd.exe3lxxrrf.exeffrxllx.exe1nhtnn.exepjpvj.exe5jjpd.exepid process 2848 bhtbbt.exe 1840 fxllxfx.exe 1644 nbntbb.exe 2656 1xrflrr.exe 2504 tbnttn.exe 2800 rflrrff.exe 2568 fxxfrfr.exe 2436 vpvvv.exe 2456 3lxfxlf.exe 3024 3jdjj.exe 1772 rllfrll.exe 1600 3tbhtt.exe 1896 vvpvd.exe 1916 frfxrrr.exe 2324 nbhntt.exe 2600 fxxfrrl.exe 1436 htthht.exe 1364 5dpdd.exe 2740 7xlfflr.exe 2884 nbnnnn.exe 2940 jjdpv.exe 564 3btbnt.exe 1396 vvddj.exe 768 thtbnn.exe 2332 nhtttt.exe 1460 3jdvv.exe 1900 lrfxxxl.exe 112 9pdjd.exe 2344 xxlxlrf.exe 1948 hthntb.exe 2308 rlrrrrx.exe 2032 bhbbnn.exe 1608 pjpjj.exe 2124 xxrxlrf.exe 2460 5rllffl.exe 840 httbhn.exe 2720 thbhhn.exe 2520 dpjdj.exe 2660 fxlxffx.exe 2672 nhbbnt.exe 2628 tnbhtt.exe 2664 9ddpd.exe 2976 9xrfrxr.exe 2676 lfrrffl.exe 2412 btttbh.exe 2140 jdpvj.exe 836 fxllxrx.exe 2952 9llrffr.exe 316 bhnhnt.exe 2160 bnhntn.exe 1880 djddj.exe 1864 rrlrxxf.exe 1896 xxrlrrl.exe 872 hbnntb.exe 2368 vpdvj.exe 2264 xlflllx.exe 1484 lrfrfxf.exe 2744 tnhbnn.exe 2776 ddjjd.exe 2892 3lxxrrf.exe 2884 ffrxllx.exe 2780 1nhtnn.exe 676 pjpvj.exe 564 5jjpd.exe -
Processes:
resource yara_rule behavioral1/memory/1848-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-536-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2208-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/660-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/400-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-800-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-819-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-851-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-864-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-889-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-920-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fe3b1f627f27e57b58b10387cfe4b29e83e90fcc2ce186f59210064d010bc020.exebhtbbt.exefxllxfx.exenbntbb.exe1xrflrr.exetbnttn.exerflrrff.exefxxfrfr.exevpvvv.exe3lxfxlf.exe3jdjj.exerllfrll.exe3tbhtt.exevvpvd.exefrfxrrr.exenbhntt.exedescription pid process target process PID 1848 wrote to memory of 2848 1848 fe3b1f627f27e57b58b10387cfe4b29e83e90fcc2ce186f59210064d010bc020.exe bhtbbt.exe PID 1848 wrote to memory of 2848 1848 fe3b1f627f27e57b58b10387cfe4b29e83e90fcc2ce186f59210064d010bc020.exe bhtbbt.exe PID 1848 wrote to memory of 2848 1848 fe3b1f627f27e57b58b10387cfe4b29e83e90fcc2ce186f59210064d010bc020.exe bhtbbt.exe PID 1848 wrote to memory of 2848 1848 fe3b1f627f27e57b58b10387cfe4b29e83e90fcc2ce186f59210064d010bc020.exe bhtbbt.exe PID 2848 wrote to memory of 1840 2848 bhtbbt.exe fxllxfx.exe PID 2848 wrote to memory of 1840 2848 bhtbbt.exe fxllxfx.exe PID 2848 wrote to memory of 1840 2848 bhtbbt.exe fxllxfx.exe PID 2848 wrote to memory of 1840 2848 bhtbbt.exe fxllxfx.exe PID 1840 wrote to memory of 1644 1840 fxllxfx.exe nbntbb.exe PID 1840 wrote to memory of 1644 1840 fxllxfx.exe nbntbb.exe PID 1840 wrote to memory of 1644 1840 fxllxfx.exe nbntbb.exe PID 1840 wrote to memory of 1644 1840 fxllxfx.exe nbntbb.exe PID 1644 wrote to memory of 2656 1644 nbntbb.exe 1xrflrr.exe PID 1644 wrote to memory of 2656 1644 nbntbb.exe 1xrflrr.exe PID 1644 wrote to memory of 2656 1644 nbntbb.exe 1xrflrr.exe PID 1644 wrote to memory of 2656 1644 nbntbb.exe 1xrflrr.exe PID 2656 wrote to memory of 2504 2656 1xrflrr.exe tbnttn.exe PID 2656 wrote to memory of 2504 2656 1xrflrr.exe tbnttn.exe PID 2656 wrote to memory of 2504 2656 1xrflrr.exe tbnttn.exe PID 2656 wrote to memory of 2504 2656 1xrflrr.exe tbnttn.exe PID 2504 wrote to memory of 2800 2504 tbnttn.exe rflrrff.exe PID 2504 wrote to memory of 2800 2504 tbnttn.exe rflrrff.exe PID 2504 wrote to memory of 2800 2504 tbnttn.exe rflrrff.exe PID 2504 wrote to memory of 2800 2504 tbnttn.exe rflrrff.exe PID 2800 wrote to memory of 2568 2800 rflrrff.exe fxxfrfr.exe PID 2800 wrote to memory of 2568 2800 rflrrff.exe fxxfrfr.exe PID 2800 wrote to memory of 2568 2800 rflrrff.exe fxxfrfr.exe PID 2800 wrote to memory of 2568 2800 rflrrff.exe fxxfrfr.exe PID 2568 wrote to memory of 2436 2568 fxxfrfr.exe vpvvv.exe PID 2568 wrote to memory of 2436 2568 fxxfrfr.exe vpvvv.exe PID 2568 wrote to memory of 2436 2568 fxxfrfr.exe vpvvv.exe PID 2568 wrote to memory of 2436 2568 fxxfrfr.exe vpvvv.exe PID 2436 wrote to memory of 2456 2436 vpvvv.exe 3lxfxlf.exe PID 2436 wrote to memory of 2456 2436 vpvvv.exe 3lxfxlf.exe PID 2436 wrote to memory of 2456 2436 vpvvv.exe 3lxfxlf.exe PID 2436 wrote to memory of 2456 2436 vpvvv.exe 3lxfxlf.exe PID 2456 wrote to memory of 3024 2456 3lxfxlf.exe 3jdjj.exe PID 2456 wrote to memory of 3024 2456 3lxfxlf.exe 3jdjj.exe PID 2456 wrote to memory of 3024 2456 3lxfxlf.exe 3jdjj.exe PID 2456 wrote to memory of 3024 2456 3lxfxlf.exe 3jdjj.exe PID 3024 wrote to memory of 1772 3024 3jdjj.exe rllfrll.exe PID 3024 wrote to memory of 1772 3024 3jdjj.exe rllfrll.exe PID 3024 wrote to memory of 1772 3024 3jdjj.exe rllfrll.exe PID 3024 wrote to memory of 1772 3024 3jdjj.exe rllfrll.exe PID 1772 wrote to memory of 1600 1772 rllfrll.exe 3tbhtt.exe PID 1772 wrote to memory of 1600 1772 rllfrll.exe 3tbhtt.exe PID 1772 wrote to memory of 1600 1772 rllfrll.exe 3tbhtt.exe PID 1772 wrote to memory of 1600 1772 rllfrll.exe 3tbhtt.exe PID 1600 wrote to memory of 1896 1600 3tbhtt.exe vvpvd.exe PID 1600 wrote to memory of 1896 1600 3tbhtt.exe vvpvd.exe PID 1600 wrote to memory of 1896 1600 3tbhtt.exe vvpvd.exe PID 1600 wrote to memory of 1896 1600 3tbhtt.exe vvpvd.exe PID 1896 wrote to memory of 1916 1896 vvpvd.exe frfxrrr.exe PID 1896 wrote to memory of 1916 1896 vvpvd.exe frfxrrr.exe PID 1896 wrote to memory of 1916 1896 vvpvd.exe frfxrrr.exe PID 1896 wrote to memory of 1916 1896 vvpvd.exe frfxrrr.exe PID 1916 wrote to memory of 2324 1916 frfxrrr.exe nbhntt.exe PID 1916 wrote to memory of 2324 1916 frfxrrr.exe nbhntt.exe PID 1916 wrote to memory of 2324 1916 frfxrrr.exe nbhntt.exe PID 1916 wrote to memory of 2324 1916 frfxrrr.exe nbhntt.exe PID 2324 wrote to memory of 2600 2324 nbhntt.exe fxxfrrl.exe PID 2324 wrote to memory of 2600 2324 nbhntt.exe fxxfrrl.exe PID 2324 wrote to memory of 2600 2324 nbhntt.exe fxxfrrl.exe PID 2324 wrote to memory of 2600 2324 nbhntt.exe fxxfrrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe3b1f627f27e57b58b10387cfe4b29e83e90fcc2ce186f59210064d010bc020.exe"C:\Users\Admin\AppData\Local\Temp\fe3b1f627f27e57b58b10387cfe4b29e83e90fcc2ce186f59210064d010bc020.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\bhtbbt.exec:\bhtbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxllxfx.exec:\fxllxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbntbb.exec:\nbntbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1xrflrr.exec:\1xrflrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbnttn.exec:\tbnttn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rflrrff.exec:\rflrrff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxxfrfr.exec:\fxxfrfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpvvv.exec:\vpvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3lxfxlf.exec:\3lxfxlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3jdjj.exec:\3jdjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rllfrll.exec:\rllfrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3tbhtt.exec:\3tbhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvpvd.exec:\vvpvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frfxrrr.exec:\frfxrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbhntt.exec:\nbhntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxxfrrl.exec:\fxxfrrl.exe17⤵
- Executes dropped EXE
-
\??\c:\htthht.exec:\htthht.exe18⤵
- Executes dropped EXE
-
\??\c:\5dpdd.exec:\5dpdd.exe19⤵
- Executes dropped EXE
-
\??\c:\7xlfflr.exec:\7xlfflr.exe20⤵
- Executes dropped EXE
-
\??\c:\nbnnnn.exec:\nbnnnn.exe21⤵
- Executes dropped EXE
-
\??\c:\jjdpv.exec:\jjdpv.exe22⤵
- Executes dropped EXE
-
\??\c:\3btbnt.exec:\3btbnt.exe23⤵
- Executes dropped EXE
-
\??\c:\vvddj.exec:\vvddj.exe24⤵
- Executes dropped EXE
-
\??\c:\thtbnn.exec:\thtbnn.exe25⤵
- Executes dropped EXE
-
\??\c:\nhtttt.exec:\nhtttt.exe26⤵
- Executes dropped EXE
-
\??\c:\3jdvv.exec:\3jdvv.exe27⤵
- Executes dropped EXE
-
\??\c:\lrfxxxl.exec:\lrfxxxl.exe28⤵
- Executes dropped EXE
-
\??\c:\9pdjd.exec:\9pdjd.exe29⤵
- Executes dropped EXE
-
\??\c:\xxlxlrf.exec:\xxlxlrf.exe30⤵
- Executes dropped EXE
-
\??\c:\hthntb.exec:\hthntb.exe31⤵
- Executes dropped EXE
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe32⤵
- Executes dropped EXE
-
\??\c:\bhbbnn.exec:\bhbbnn.exe33⤵
- Executes dropped EXE
-
\??\c:\pjpjj.exec:\pjpjj.exe34⤵
- Executes dropped EXE
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe35⤵
- Executes dropped EXE
-
\??\c:\hnhhbb.exec:\hnhhbb.exe36⤵
-
\??\c:\5rllffl.exec:\5rllffl.exe37⤵
- Executes dropped EXE
-
\??\c:\httbhn.exec:\httbhn.exe38⤵
- Executes dropped EXE
-
\??\c:\thbhhn.exec:\thbhhn.exe39⤵
- Executes dropped EXE
-
\??\c:\dpjdj.exec:\dpjdj.exe40⤵
- Executes dropped EXE
-
\??\c:\fxlxffx.exec:\fxlxffx.exe41⤵
- Executes dropped EXE
-
\??\c:\nhbbnt.exec:\nhbbnt.exe42⤵
- Executes dropped EXE
-
\??\c:\tnbhtt.exec:\tnbhtt.exe43⤵
- Executes dropped EXE
-
\??\c:\9ddpd.exec:\9ddpd.exe44⤵
- Executes dropped EXE
-
\??\c:\9xrfrxr.exec:\9xrfrxr.exe45⤵
- Executes dropped EXE
-
\??\c:\lfrrffl.exec:\lfrrffl.exe46⤵
- Executes dropped EXE
-
\??\c:\btttbh.exec:\btttbh.exe47⤵
- Executes dropped EXE
-
\??\c:\jdpvj.exec:\jdpvj.exe48⤵
- Executes dropped EXE
-
\??\c:\fxllxrx.exec:\fxllxrx.exe49⤵
- Executes dropped EXE
-
\??\c:\9llrffr.exec:\9llrffr.exe50⤵
- Executes dropped EXE
-
\??\c:\bhnhnt.exec:\bhnhnt.exe51⤵
- Executes dropped EXE
-
\??\c:\bnhntn.exec:\bnhntn.exe52⤵
- Executes dropped EXE
-
\??\c:\djddj.exec:\djddj.exe53⤵
- Executes dropped EXE
-
\??\c:\rrlrxxf.exec:\rrlrxxf.exe54⤵
- Executes dropped EXE
-
\??\c:\xxrlrrl.exec:\xxrlrrl.exe55⤵
- Executes dropped EXE
-
\??\c:\hbnntb.exec:\hbnntb.exe56⤵
- Executes dropped EXE
-
\??\c:\vpdvj.exec:\vpdvj.exe57⤵
- Executes dropped EXE
-
\??\c:\xlflllx.exec:\xlflllx.exe58⤵
- Executes dropped EXE
-
\??\c:\lrfrfxf.exec:\lrfrfxf.exe59⤵
- Executes dropped EXE
-
\??\c:\tnhbnn.exec:\tnhbnn.exe60⤵
- Executes dropped EXE
-
\??\c:\ddjjd.exec:\ddjjd.exe61⤵
- Executes dropped EXE
-
\??\c:\3lxxrrf.exec:\3lxxrrf.exe62⤵
- Executes dropped EXE
-
\??\c:\ffrxllx.exec:\ffrxllx.exe63⤵
- Executes dropped EXE
-
\??\c:\1nhtnn.exec:\1nhtnn.exe64⤵
- Executes dropped EXE
-
\??\c:\pjpvj.exec:\pjpvj.exe65⤵
- Executes dropped EXE
-
\??\c:\5jjpd.exec:\5jjpd.exe66⤵
- Executes dropped EXE
-
\??\c:\lfrrxlx.exec:\lfrrxlx.exe67⤵
-
\??\c:\3bbntb.exec:\3bbntb.exe68⤵
-
\??\c:\dvjjp.exec:\dvjjp.exe69⤵
-
\??\c:\jjdjd.exec:\jjdjd.exe70⤵
-
\??\c:\xrxxxfl.exec:\xrxxxfl.exe71⤵
-
\??\c:\hhtthh.exec:\hhtthh.exe72⤵
-
\??\c:\3nhhth.exec:\3nhhth.exe73⤵
-
\??\c:\pdpjp.exec:\pdpjp.exe74⤵
-
\??\c:\xrfxffr.exec:\xrfxffr.exe75⤵
-
\??\c:\3rlrxfx.exec:\3rlrxfx.exe76⤵
-
\??\c:\hbbhnt.exec:\hbbhnt.exe77⤵
-
\??\c:\jvvdp.exec:\jvvdp.exe78⤵
-
\??\c:\dvddp.exec:\dvddp.exe79⤵
-
\??\c:\xffxfrf.exec:\xffxfrf.exe80⤵
-
\??\c:\3hbhhh.exec:\3hbhhh.exe81⤵
-
\??\c:\bbbhht.exec:\bbbhht.exe82⤵
-
\??\c:\dvvjj.exec:\dvvjj.exe83⤵
-
\??\c:\1xrfrrx.exec:\1xrfrrx.exe84⤵
-
\??\c:\lxlxlxf.exec:\lxlxlxf.exe85⤵
-
\??\c:\7nbhhb.exec:\7nbhhb.exe86⤵
-
\??\c:\vpdjv.exec:\vpdjv.exe87⤵
-
\??\c:\vpjpv.exec:\vpjpv.exe88⤵
-
\??\c:\3xlrrlx.exec:\3xlrrlx.exe89⤵
-
\??\c:\thbthb.exec:\thbthb.exe90⤵
-
\??\c:\pjddj.exec:\pjddj.exe91⤵
-
\??\c:\vvjpv.exec:\vvjpv.exe92⤵
-
\??\c:\rfrrrxr.exec:\rfrrrxr.exe93⤵
-
\??\c:\bthnbh.exec:\bthnbh.exe94⤵
-
\??\c:\ddvjd.exec:\ddvjd.exe95⤵
-
\??\c:\frllxxf.exec:\frllxxf.exe96⤵
-
\??\c:\lxrflfl.exec:\lxrflfl.exe97⤵
-
\??\c:\7tbbbh.exec:\7tbbbh.exe98⤵
-
\??\c:\1pjpp.exec:\1pjpp.exe99⤵
-
\??\c:\9dppp.exec:\9dppp.exe100⤵
-
\??\c:\xxrrxxr.exec:\xxrrxxr.exe101⤵
-
\??\c:\7nbbbb.exec:\7nbbbb.exe102⤵
-
\??\c:\hbntnt.exec:\hbntnt.exe103⤵
-
\??\c:\pdddd.exec:\pdddd.exe104⤵
-
\??\c:\ffxfxxx.exec:\ffxfxxx.exe105⤵
-
\??\c:\1lxrrll.exec:\1lxrrll.exe106⤵
-
\??\c:\9nhhnh.exec:\9nhhnh.exe107⤵
-
\??\c:\ttnthh.exec:\ttnthh.exe108⤵
-
\??\c:\dvpjj.exec:\dvpjj.exe109⤵
-
\??\c:\flxfxlf.exec:\flxfxlf.exe110⤵
-
\??\c:\nntbhn.exec:\nntbhn.exe111⤵
-
\??\c:\btttnt.exec:\btttnt.exe112⤵
-
\??\c:\vpjjp.exec:\vpjjp.exe113⤵
-
\??\c:\llfflfl.exec:\llfflfl.exe114⤵
-
\??\c:\ttnntn.exec:\ttnntn.exe115⤵
-
\??\c:\bbttnn.exec:\bbttnn.exe116⤵
-
\??\c:\jdvdj.exec:\jdvdj.exe117⤵
-
\??\c:\lfxflrf.exec:\lfxflrf.exe118⤵
-
\??\c:\llflllf.exec:\llflllf.exe119⤵
-
\??\c:\pjjjp.exec:\pjjjp.exe120⤵
-
\??\c:\djvvj.exec:\djvvj.exe121⤵
-
\??\c:\fxllxxl.exec:\fxllxxl.exe122⤵
-
\??\c:\nbnbhn.exec:\nbnbhn.exe123⤵
-
\??\c:\5hhntb.exec:\5hhntb.exe124⤵
-
\??\c:\ddvjp.exec:\ddvjp.exe125⤵
-
\??\c:\3lxlrrr.exec:\3lxlrrr.exe126⤵
-
\??\c:\3lrrrrx.exec:\3lrrrrx.exe127⤵
-
\??\c:\jdvdp.exec:\jdvdp.exe128⤵
-
\??\c:\rlxlrxl.exec:\rlxlrxl.exe129⤵
-
\??\c:\hbtbhn.exec:\hbtbhn.exe130⤵
-
\??\c:\nhhbhn.exec:\nhhbhn.exe131⤵
-
\??\c:\ppjjp.exec:\ppjjp.exe132⤵
-
\??\c:\ddjvp.exec:\ddjvp.exe133⤵
-
\??\c:\frffrrx.exec:\frffrrx.exe134⤵
-
\??\c:\tnbtbn.exec:\tnbtbn.exe135⤵
-
\??\c:\tnnntt.exec:\tnnntt.exe136⤵
-
\??\c:\dvvpd.exec:\dvvpd.exe137⤵
-
\??\c:\xrrxxfr.exec:\xrrxxfr.exe138⤵
-
\??\c:\nhntnn.exec:\nhntnn.exe139⤵
-
\??\c:\jdjpv.exec:\jdjpv.exe140⤵
-
\??\c:\3dpjp.exec:\3dpjp.exe141⤵
-
\??\c:\ffffrxl.exec:\ffffrxl.exe142⤵
-
\??\c:\tthnnn.exec:\tthnnn.exe143⤵
-
\??\c:\jjppd.exec:\jjppd.exe144⤵
-
\??\c:\9dpjd.exec:\9dpjd.exe145⤵
-
\??\c:\xxlxxfl.exec:\xxlxxfl.exe146⤵
-
\??\c:\hthhnn.exec:\hthhnn.exe147⤵
-
\??\c:\tnhntt.exec:\tnhntt.exe148⤵
-
\??\c:\pdvdj.exec:\pdvdj.exe149⤵
-
\??\c:\5lxfrrx.exec:\5lxfrrx.exe150⤵
-
\??\c:\fxrrffl.exec:\fxrrffl.exe151⤵
-
\??\c:\tntbhn.exec:\tntbhn.exe152⤵
-
\??\c:\pjddp.exec:\pjddp.exe153⤵
-
\??\c:\5jvdv.exec:\5jvdv.exe154⤵
-
\??\c:\lfxxflx.exec:\lfxxflx.exe155⤵
-
\??\c:\bthhtb.exec:\bthhtb.exe156⤵
-
\??\c:\hnhnbb.exec:\hnhnbb.exe157⤵
-
\??\c:\3pjpj.exec:\3pjpj.exe158⤵
-
\??\c:\rrrfrrf.exec:\rrrfrrf.exe159⤵
-
\??\c:\rrrxlrf.exec:\rrrxlrf.exe160⤵
-
\??\c:\7nntbh.exec:\7nntbh.exe161⤵
-
\??\c:\pjddj.exec:\pjddj.exe162⤵
-
\??\c:\pvjpv.exec:\pvjpv.exe163⤵
-
\??\c:\xfflrxr.exec:\xfflrxr.exe164⤵
-
\??\c:\tnhtbb.exec:\tnhtbb.exe165⤵
-
\??\c:\dvpjp.exec:\dvpjp.exe166⤵
-
\??\c:\xrxrxrx.exec:\xrxrxrx.exe167⤵
-
\??\c:\frxlxfx.exec:\frxlxfx.exe168⤵
-
\??\c:\5hbbbb.exec:\5hbbbb.exe169⤵
-
\??\c:\hnhhnh.exec:\hnhhnh.exe170⤵
-
\??\c:\vvvpd.exec:\vvvpd.exe171⤵
-
\??\c:\5lrllxx.exec:\5lrllxx.exe172⤵
-
\??\c:\rrlfxfr.exec:\rrlfxfr.exe173⤵
-
\??\c:\hhbbnt.exec:\hhbbnt.exe174⤵
-
\??\c:\3pppd.exec:\3pppd.exe175⤵
-
\??\c:\7dvvj.exec:\7dvvj.exe176⤵
-
\??\c:\fxfllrf.exec:\fxfllrf.exe177⤵
-
\??\c:\tnbhnn.exec:\tnbhnn.exe178⤵
-
\??\c:\vvpvj.exec:\vvpvj.exe179⤵
-
\??\c:\rxfxrlr.exec:\rxfxrlr.exe180⤵
-
\??\c:\lrfxxff.exec:\lrfxxff.exe181⤵
-
\??\c:\9httbb.exec:\9httbb.exe182⤵
-
\??\c:\pdppv.exec:\pdppv.exe183⤵
-
\??\c:\vvjjj.exec:\vvjjj.exe184⤵
-
\??\c:\rrrxlrx.exec:\rrrxlrx.exe185⤵
-
\??\c:\hhbnhn.exec:\hhbnhn.exe186⤵
-
\??\c:\bbtbnt.exec:\bbtbnt.exe187⤵
-
\??\c:\vjvvj.exec:\vjvvj.exe188⤵
-
\??\c:\lfxxrrf.exec:\lfxxrrf.exe189⤵
-
\??\c:\lfrfrrf.exec:\lfrfrrf.exe190⤵
-
\??\c:\hhbhnn.exec:\hhbhnn.exe191⤵
-
\??\c:\3vjdj.exec:\3vjdj.exe192⤵
-
\??\c:\vpjjd.exec:\vpjjd.exe193⤵
-
\??\c:\xlllxxf.exec:\xlllxxf.exe194⤵
-
\??\c:\1nhbhn.exec:\1nhbhn.exe195⤵
-
\??\c:\5bbbhn.exec:\5bbbhn.exe196⤵
-
\??\c:\5pvdv.exec:\5pvdv.exe197⤵
-
\??\c:\rfflrfx.exec:\rfflrfx.exe198⤵
-
\??\c:\3hbnhn.exec:\3hbnhn.exe199⤵
-
\??\c:\btbbht.exec:\btbbht.exe200⤵
-
\??\c:\jvdjp.exec:\jvdjp.exe201⤵
-
\??\c:\frllfrf.exec:\frllfrf.exe202⤵
-
\??\c:\xrffffl.exec:\xrffffl.exe203⤵
-
\??\c:\tnhtnh.exec:\tnhtnh.exe204⤵
-
\??\c:\dvjpp.exec:\dvjpp.exe205⤵
-
\??\c:\xffrlxr.exec:\xffrlxr.exe206⤵
-
\??\c:\xrflrxx.exec:\xrflrxx.exe207⤵
-
\??\c:\ntnbbb.exec:\ntnbbb.exe208⤵
-
\??\c:\1dppj.exec:\1dppj.exe209⤵
-
\??\c:\ffflfff.exec:\ffflfff.exe210⤵
-
\??\c:\xlffllr.exec:\xlffllr.exe211⤵
-
\??\c:\nhhnnn.exec:\nhhnnn.exe212⤵
-
\??\c:\jdpvd.exec:\jdpvd.exe213⤵
-
\??\c:\ffxfffx.exec:\ffxfffx.exe214⤵
-
\??\c:\xrfrlll.exec:\xrfrlll.exe215⤵
-
\??\c:\7ppvd.exec:\7ppvd.exe216⤵
-
\??\c:\1pdjp.exec:\1pdjp.exe217⤵
-
\??\c:\flrxxff.exec:\flrxxff.exe218⤵
-
\??\c:\hntnnh.exec:\hntnnh.exe219⤵
-
\??\c:\vdpvp.exec:\vdpvp.exe220⤵
-
\??\c:\jdjdv.exec:\jdjdv.exe221⤵
-
\??\c:\lflflff.exec:\lflflff.exe222⤵
-
\??\c:\hbnnhb.exec:\hbnnhb.exe223⤵
-
\??\c:\vppvp.exec:\vppvp.exe224⤵
-
\??\c:\vvpjp.exec:\vvpjp.exe225⤵
-
\??\c:\lxrllrx.exec:\lxrllrx.exe226⤵
-
\??\c:\hbbhth.exec:\hbbhth.exe227⤵
-
\??\c:\djjvp.exec:\djjvp.exe228⤵
-
\??\c:\dpddj.exec:\dpddj.exe229⤵
-
\??\c:\xlrlllr.exec:\xlrlllr.exe230⤵
-
\??\c:\nnhbhh.exec:\nnhbhh.exe231⤵
-
\??\c:\dvvpd.exec:\dvvpd.exe232⤵
-
\??\c:\jdjdp.exec:\jdjdp.exe233⤵
-
\??\c:\lfrxxxf.exec:\lfrxxxf.exe234⤵
-
\??\c:\ttbbnn.exec:\ttbbnn.exe235⤵
-
\??\c:\thbnnb.exec:\thbnnb.exe236⤵
-
\??\c:\dvvdp.exec:\dvvdp.exe237⤵
-
\??\c:\xxrxllx.exec:\xxrxllx.exe238⤵
-
\??\c:\hbbhnt.exec:\hbbhnt.exe239⤵
-
\??\c:\1tbbhn.exec:\1tbbhn.exe240⤵
-
\??\c:\5jjpv.exec:\5jjpv.exe241⤵