Analysis
- max time kernel
150s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
15/06/2024, 20:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
31c429daaae246db0b84ccf5b588f5e130992f9f7f8d8ced3fc0a9946a5e8aaa.exe
Resource
win7-20240611-en
6 signatures
150 seconds
General
- Target 31c429daaae246db0b84ccf5b588f5e130992f9f7f8d8ced3fc0a9946a5e8aaa.exe
- Size 487KB
- Sample240615-yzajcaxamn
- SHA256 31c429daaae246db0b84ccf5b588f5e130992f9f7f8d8ced3fc0a9946a5e8aaa
- MD5 a538187eb81e21c75cfb3a844ad4878d
- SHA1 e038636d6e338a8fe6c63fdec81f90fc006bc027
- SHA512 f017e643890f94e0125ba46b75feb805c1816a37bc35c3ca5b245397c32478a9262492a16689135976136e572326699b0efe724cd4c95ce78b212267ee98a6f1
- SSDEEP 6144:8cm7ImGddXmNt251UriZFwu1b26X1wjdgyPPBM:q7Tc2NYHUrAwqzQ7PP+
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3688-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3420-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2492-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/824-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1428-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3336-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-891-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-955-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-1153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-1230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/3688-0-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4628-5-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4628-13-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1332-18-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2088-14-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1332-25-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3332-26-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3936-36-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3472-42-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3772-48-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3420-53-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/60-55-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/60-61-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1360-62-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3840-78-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4644-89-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3448-100-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2992-104-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1892-108-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1728-118-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4760-124-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2492-129-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2608-136-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3356-142-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/912-145-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2620-151-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4752-157-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4876-171-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4260-179-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4324-190-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2084-199-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2156-209-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/5072-213-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3896-217-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3376-221-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4528-225-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2592-231-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4044-235-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1132-242-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1584-250-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/5044-251-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1836-261-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/824-268-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2820-275-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2820-279-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/916-286-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1428-290-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/1972-293-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3976-300-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4328-313-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/368-323-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2136-333-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3904-334-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2556-341-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3944-348-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3732-361-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2500-374-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/532-378-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3840-382-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4820-386-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/912-433-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/2972-437-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/4292-480-0x0000000000400000-0x000000000042A000-memory.dmp UPX behavioral2/memory/3336-508-0x0000000000400000-0x000000000042A000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 4628 hhbtbh.exe 2088 nttbtt.exe 1332 vpppj.exe 3332 tttthh.exe 3936 xlrlxfx.exe 3472 vjpvp.exe 3772 ttbbbb.exe 3420 9jpjd.exe 60 9jvvd.exe 1360 bttnnh.exe 4748 vjpjj.exe 3288 xrrlfxr.exe 3840 vvddd.exe 3336 3thhht.exe 4644 9htnhn.exe 3448 pvjjd.exe 2992 ppjvp.exe 1892 tthhtt.exe 1728 vpdvd.exe 4760 ffrlxxf.exe 2492 vvdjv.exe 2608 5bbhbb.exe 3356 9djvv.exe 912 bbbnhn.exe 2620 vvvvp.exe 4752 rrxrrrl.exe 3316 bbtttt.exe 4876 xrfrrxr.exe 3320 1vppp.exe 4260 xflfxxf.exe 2216 3flffll.exe 4324 5xrrlrf.exe 3036 htnnnb.exe 712 hbtnhn.exe 2084 1fxrxxl.exe 1420 nhnnnh.exe 2156 hbnhnh.exe 5072 vpvvp.exe 3896 1xxrllf.exe 3376 9hhbth.exe 4528 pjddd.exe 1904 ffxlxfx.exe 2592 bbnhbb.exe 4044 1vdpj.exe 4040 3dppv.exe 3300 lxrrxff.exe 1132 ttbbbb.exe 1584 dddvp.exe 5044 fxfxlrl.exe 4808 nnhnhn.exe 1836 pjppj.exe 5012 rffllxf.exe 824 bnbttt.exe 2308 dvvvp.exe 2272 vpvpj.exe 2820 frffrrr.exe 1588 thtnnh.exe 916 jdjdv.exe 1428 lrfrrfl.exe 1972 tbhbtt.exe 1796 vjpjd.exe 3976 ffrrlxx.exe 2692 nnntnn.exe 2888 3nnhbb.exe -
resource yara_rule behavioral2/memory/3688-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2492-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/824-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1428-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3336-508-0x0000000000400000-0x000000000042A000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3688 wrote to memory of 4628 3688 31c429daaae246db0b84ccf5b588f5e130992f9f7f8d8ced3fc0a9946a5e8aaa.exe 89 PID 3688 wrote to memory of 4628 3688 31c429daaae246db0b84ccf5b588f5e130992f9f7f8d8ced3fc0a9946a5e8aaa.exe 89 PID 3688 wrote to memory of 4628 3688 31c429daaae246db0b84ccf5b588f5e130992f9f7f8d8ced3fc0a9946a5e8aaa.exe 89 PID 4628 wrote to memory of 2088 4628 hhbtbh.exe 90 PID 4628 wrote to memory of 2088 4628 hhbtbh.exe 90 PID 4628 wrote to memory of 2088 4628 hhbtbh.exe 90 PID 2088 wrote to memory of 1332 2088 nttbtt.exe 91 PID 2088 wrote to memory of 1332 2088 nttbtt.exe 91 PID 2088 wrote to memory of 1332 2088 nttbtt.exe 91 PID 1332 wrote to memory of 3332 1332 vpppj.exe 92 PID 1332 wrote to memory of 3332 1332 vpppj.exe 92 PID 1332 wrote to memory of 3332 1332 vpppj.exe 92 PID 3332 wrote to memory of 3936 3332 tttthh.exe 93 PID 3332 wrote to memory of 3936 3332 tttthh.exe 93 PID 3332 wrote to memory of 3936 3332 tttthh.exe 93 PID 3936 wrote to memory of 3472 3936 xlrlxfx.exe 94 PID 3936 wrote to memory of 3472 3936 xlrlxfx.exe 94 PID 3936 wrote to memory of 3472 3936 xlrlxfx.exe 94 PID 3472 wrote to memory of 3772 3472 vjpvp.exe 95 PID 3472 wrote to memory of 3772 3472 vjpvp.exe 95 PID 3472 wrote to memory of 3772 3472 vjpvp.exe 95 PID 3772 wrote to memory of 3420 3772 ttbbbb.exe 96 PID 3772 wrote to memory of 3420 3772 ttbbbb.exe 96 PID 3772 wrote to memory of 3420 3772 ttbbbb.exe 96 PID 3420 wrote to memory of 60 3420 9jpjd.exe 98 PID 3420 wrote to memory of 60 3420 9jpjd.exe 98 PID 3420 wrote to memory of 60 3420 9jpjd.exe 98 PID 60 wrote to memory of 1360 60 9jvvd.exe 100 PID 60 wrote to memory of 1360 60 9jvvd.exe 100 PID 60 wrote to memory of 1360 60 9jvvd.exe 100 PID 1360 wrote to memory of 4748 1360 bttnnh.exe 101 PID 1360 wrote to memory of 4748 1360 bttnnh.exe 101 PID 1360 wrote to memory of 4748 1360 bttnnh.exe 101 PID 4748 wrote to memory of 3288 4748 vjpjj.exe 102 PID 4748 wrote to memory of 3288 4748 vjpjj.exe 102 PID 4748 wrote to memory of 3288 4748 vjpjj.exe 102 PID 3288 wrote to memory of 3840 3288 xrrlfxr.exe 103 PID 3288 wrote to memory of 3840 3288 xrrlfxr.exe 103 PID 3288 wrote to memory of 3840 3288 xrrlfxr.exe 103 PID 3840 wrote to memory of 3336 3840 vvddd.exe 104 PID 3840 wrote to memory of 3336 3840 vvddd.exe 104 PID 3840 wrote to memory of 3336 3840 vvddd.exe 104 PID 3336 wrote to memory of 4644 3336 3thhht.exe 106 PID 3336 wrote to memory of 4644 3336 3thhht.exe 106 PID 3336 wrote to memory of 4644 3336 3thhht.exe 106 PID 4644 wrote to memory of 3448 4644 9htnhn.exe 107 PID 4644 wrote to memory of 3448 4644 9htnhn.exe 107 PID 4644 wrote to memory of 3448 4644 9htnhn.exe 107 PID 3448 wrote to memory of 2992 3448 pvjjd.exe 108 PID 3448 wrote to memory of 2992 3448 pvjjd.exe 108 PID 3448 wrote to memory of 2992 3448 pvjjd.exe 108 PID 2992 wrote to memory of 1892 2992 ppjvp.exe 109 PID 2992 wrote to memory of 1892 2992 ppjvp.exe 109 PID 2992 wrote to memory of 1892 2992 ppjvp.exe 109 PID 1892 wrote to memory of 1728 1892 tthhtt.exe 110 PID 1892 wrote to memory of 1728 1892 tthhtt.exe 110 PID 1892 wrote to memory of 1728 1892 tthhtt.exe 110 PID 1728 wrote to memory of 4760 1728 vpdvd.exe 111 PID 1728 wrote to memory of 4760 1728 vpdvd.exe 111 PID 1728 wrote to memory of 4760 1728 vpdvd.exe 111 PID 4760 wrote to memory of 2492 4760 ffrlxxf.exe 112 PID 4760 wrote to memory of 2492 4760 ffrlxxf.exe 112 PID 4760 wrote to memory of 2492 4760 ffrlxxf.exe 112 PID 2492 wrote to memory of 2608 2492 vvdjv.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\31c429daaae246db0b84ccf5b588f5e130992f9f7f8d8ced3fc0a9946a5e8aaa.exe"C:\Users\Admin\AppData\Local\Temp\31c429daaae246db0b84ccf5b588f5e130992f9f7f8d8ced3fc0a9946a5e8aaa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\hhbtbh.exec:\hhbtbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\nttbtt.exec:\nttbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\vpppj.exec:\vpppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\tttthh.exec:\tttthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\xlrlxfx.exec:\xlrlxfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\vjpvp.exec:\vjpvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\ttbbbb.exec:\ttbbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\9jpjd.exec:\9jpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\9jvvd.exec:\9jvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\bttnnh.exec:\bttnnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\vjpjj.exec:\vjpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\vvddd.exec:\vvddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\3thhht.exec:\3thhht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\9htnhn.exec:\9htnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\pvjjd.exec:\pvjjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\ppjvp.exec:\ppjvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\tthhtt.exec:\tthhtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\vpdvd.exec:\vpdvd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\ffrlxxf.exec:\ffrlxxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\vvdjv.exec:\vvdjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\5bbhbb.exec:\5bbhbb.exe23⤵
- Executes dropped EXE
PID:2608 -
\??\c:\9djvv.exec:\9djvv.exe24⤵
- Executes dropped EXE
PID:3356 -
\??\c:\bbbnhn.exec:\bbbnhn.exe25⤵
- Executes dropped EXE
PID:912 -
\??\c:\vvvvp.exec:\vvvvp.exe26⤵
- Executes dropped EXE
PID:2620 -
\??\c:\rrxrrrl.exec:\rrxrrrl.exe27⤵
- Executes dropped EXE
PID:4752 -
\??\c:\bbtttt.exec:\bbtttt.exe28⤵
- Executes dropped EXE
PID:3316 -
\??\c:\xrfrrxr.exec:\xrfrrxr.exe29⤵
- Executes dropped EXE
PID:4876 -
\??\c:\1vppp.exec:\1vppp.exe30⤵
- Executes dropped EXE
PID:3320 -
\??\c:\xflfxxf.exec:\xflfxxf.exe31⤵
- Executes dropped EXE
PID:4260 -
\??\c:\3flffll.exec:\3flffll.exe32⤵
- Executes dropped EXE
PID:2216 -
\??\c:\5xrrlrf.exec:\5xrrlrf.exe33⤵
- Executes dropped EXE
PID:4324 -
\??\c:\htnnnb.exec:\htnnnb.exe34⤵
- Executes dropped EXE
PID:3036 -
\??\c:\hbtnhn.exec:\hbtnhn.exe35⤵
- Executes dropped EXE
PID:712 -
\??\c:\1fxrxxl.exec:\1fxrxxl.exe36⤵
- Executes dropped EXE
PID:2084 -
\??\c:\nhnnnh.exec:\nhnnnh.exe37⤵
- Executes dropped EXE
PID:1420 -
\??\c:\hbnhnh.exec:\hbnhnh.exe38⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vpvvp.exec:\vpvvp.exe39⤵
- Executes dropped EXE
PID:5072 -
\??\c:\1xxrllf.exec:\1xxrllf.exe40⤵
- Executes dropped EXE
PID:3896 -
\??\c:\9hhbth.exec:\9hhbth.exe41⤵
- Executes dropped EXE
PID:3376 -
\??\c:\pjddd.exec:\pjddd.exe42⤵
- Executes dropped EXE
PID:4528 -
\??\c:\ffxlxfx.exec:\ffxlxfx.exe43⤵
- Executes dropped EXE
PID:1904 -
\??\c:\bbnhbb.exec:\bbnhbb.exe44⤵
- Executes dropped EXE
PID:2592 -
\??\c:\1vdpj.exec:\1vdpj.exe45⤵
- Executes dropped EXE
PID:4044 -
\??\c:\3dppv.exec:\3dppv.exe46⤵
- Executes dropped EXE
PID:4040 -
\??\c:\lxrrxff.exec:\lxrrxff.exe47⤵
- Executes dropped EXE
PID:3300 -
\??\c:\ttbbbb.exec:\ttbbbb.exe48⤵
- Executes dropped EXE
PID:1132 -
\??\c:\dddvp.exec:\dddvp.exe49⤵
- Executes dropped EXE
PID:1584 -
\??\c:\fxfxlrl.exec:\fxfxlrl.exe50⤵
- Executes dropped EXE
PID:5044 -
\??\c:\nnhnhn.exec:\nnhnhn.exe51⤵
- Executes dropped EXE
PID:4808 -
\??\c:\pjppj.exec:\pjppj.exe52⤵
- Executes dropped EXE
PID:1836 -
\??\c:\rffllxf.exec:\rffllxf.exe53⤵
- Executes dropped EXE
PID:5012 -
\??\c:\bnbttt.exec:\bnbttt.exe54⤵
- Executes dropped EXE
PID:824 -
\??\c:\dvvvp.exec:\dvvvp.exe55⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vpvpj.exec:\vpvpj.exe56⤵
- Executes dropped EXE
PID:2272 -
\??\c:\frffrrr.exec:\frffrrr.exe57⤵
- Executes dropped EXE
PID:2820 -
\??\c:\thtnnh.exec:\thtnnh.exe58⤵
- Executes dropped EXE
PID:1588 -
\??\c:\jdjdv.exec:\jdjdv.exe59⤵
- Executes dropped EXE
PID:916 -
\??\c:\lrfrrfl.exec:\lrfrrfl.exe60⤵
- Executes dropped EXE
PID:1428 -
\??\c:\tbhbtt.exec:\tbhbtt.exe61⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vjpjd.exec:\vjpjd.exe62⤵
- Executes dropped EXE
PID:1796 -
\??\c:\ffrrlxx.exec:\ffrrlxx.exe63⤵
- Executes dropped EXE
PID:3976 -
\??\c:\nnntnn.exec:\nnntnn.exe64⤵
- Executes dropped EXE
PID:2692 -
\??\c:\3nnhbb.exec:\3nnhbb.exe65⤵
- Executes dropped EXE
PID:2888 -
\??\c:\pvvjd.exec:\pvvjd.exe66⤵PID:2436
-
\??\c:\lrllllr.exec:\lrllllr.exe67⤵PID:4328
-
\??\c:\nbnnnn.exec:\nbnnnn.exe68⤵PID:4320
-
\??\c:\pjvvp.exec:\pjvvp.exe69⤵PID:2256
-
\??\c:\flxrrrx.exec:\flxrrrx.exe70⤵PID:368
-
\??\c:\lrxxrrr.exec:\lrxxrrr.exe71⤵PID:2236
-
\??\c:\hbhhbb.exec:\hbhhbb.exe72⤵PID:384
-
\??\c:\pvvpp.exec:\pvvpp.exe73⤵PID:2136
-
\??\c:\7jvvp.exec:\7jvvp.exe74⤵PID:3904
-
\??\c:\1fffxff.exec:\1fffxff.exe75⤵PID:2556
-
\??\c:\nhbbbb.exec:\nhbbbb.exe76⤵PID:2484
-
\??\c:\pppjd.exec:\pppjd.exe77⤵PID:3944
-
\??\c:\rrxrfrr.exec:\rrxrfrr.exe78⤵PID:2688
-
\??\c:\nhttnt.exec:\nhttnt.exe79⤵PID:1604
-
\??\c:\ddpdp.exec:\ddpdp.exe80⤵PID:1576
-
\??\c:\frxxlll.exec:\frxxlll.exe81⤵PID:3732
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe82⤵PID:2712
-
\??\c:\hnttnn.exec:\hnttnn.exe83⤵PID:940
-
\??\c:\dppdv.exec:\dppdv.exe84⤵PID:3348
-
\??\c:\rlllffl.exec:\rlllffl.exe85⤵PID:2500
-
\??\c:\nntttt.exec:\nntttt.exe86⤵PID:532
-
\??\c:\tttnhb.exec:\tttnhb.exe87⤵PID:1680
-
\??\c:\jjjpj.exec:\jjjpj.exe88⤵PID:3840
-
\??\c:\rllxrfr.exec:\rllxrfr.exe89⤵PID:4820
-
\??\c:\frlfflf.exec:\frlfflf.exe90⤵PID:2744
-
\??\c:\1bnhbb.exec:\1bnhbb.exe91⤵PID:3428
-
\??\c:\pdjdp.exec:\pdjdp.exe92⤵PID:4124
-
\??\c:\llxxflr.exec:\llxxflr.exe93⤵PID:4032
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe94⤵PID:456
-
\??\c:\nbnnhn.exec:\nbnnhn.exe95⤵PID:1160
-
\??\c:\djjpp.exec:\djjpp.exe96⤵PID:448
-
\??\c:\lffffff.exec:\lffffff.exe97⤵PID:1728
-
\??\c:\bbtttt.exec:\bbtttt.exe98⤵PID:1228
-
\??\c:\ffrrxxl.exec:\ffrrxxl.exe99⤵PID:4796
-
\??\c:\nbtnnn.exec:\nbtnnn.exe100⤵PID:3216
-
\??\c:\hhtttt.exec:\hhtttt.exe101⤵PID:3356
-
\??\c:\vpppp.exec:\vpppp.exe102⤵PID:3464
-
\??\c:\rxrrrrr.exec:\rxrrrrr.exe103⤵PID:912
-
\??\c:\hbnhhh.exec:\hbnhhh.exe104⤵PID:2972
-
\??\c:\7ddvv.exec:\7ddvv.exe105⤵PID:5008
-
\??\c:\5rrfrrl.exec:\5rrfrrl.exe106⤵PID:4328
-
\??\c:\xlxxrxx.exec:\xlxxrxx.exe107⤵PID:4916
-
\??\c:\nthbtt.exec:\nthbtt.exe108⤵PID:4596
-
\??\c:\7pppj.exec:\7pppj.exe109⤵PID:3220
-
\??\c:\llfxrfl.exec:\llfxrfl.exe110⤵PID:2216
-
\??\c:\flxxxxx.exec:\flxxxxx.exe111⤵PID:2184
-
\??\c:\hnbbth.exec:\hnbbth.exe112⤵PID:2980
-
\??\c:\5vvpj.exec:\5vvpj.exe113⤵PID:1908
-
\??\c:\frlfffl.exec:\frlfffl.exe114⤵PID:2556
-
\??\c:\3tnnnn.exec:\3tnnnn.exe115⤵PID:2484
-
\??\c:\pjppp.exec:\pjppp.exe116⤵PID:2012
-
\??\c:\dvpdd.exec:\dvpdd.exe117⤵PID:2688
-
\??\c:\rflllfl.exec:\rflllfl.exe118⤵PID:4292
-
\??\c:\ttbtnn.exec:\ttbtnn.exe119⤵PID:996
-
\??\c:\pdjjp.exec:\pdjjp.exe120⤵PID:3376
-
\??\c:\lfrfxll.exec:\lfrfxll.exe121⤵PID:1360
-
\??\c:\nthhhh.exec:\nthhhh.exe122⤵PID:4748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-