Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
16/06/2024, 23:13
Behavioral task
behavioral1
Sample
81c96e3c15e9a95df77d695bf28d535ab07549d633a23f9bd6d309b7b86b1b97.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
- Target 81c96e3c15e9a95df77d695bf28d535ab07549d633a23f9bd6d309b7b86b1b97.exe
- Size 340KB
- Sample240616-27f8msxarj
- SHA256 81c96e3c15e9a95df77d695bf28d535ab07549d633a23f9bd6d309b7b86b1b97
- MD5 341ca223eb59aab0ade24be0b4660bd2
- SHA1 3ee43b525fdabc0a9ad2e4aaac5f66648f7ff85e
- SHA512 3a8a0738dd65e2a564e2058c20ece17339c764f0f6e448d828dcdae60a3656a062712c52d1fd0bedbfb3d7718beda814def83cee7d59ebd06fa1d142deea1dde
- SSDEEP 3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBHNgu5ex1B2OkEv0KvmhNi+:9cm4FmowdHoS4BtguSPKyH+
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1152-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/992-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/668-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/264-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4168-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2108-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2196-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3152-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3028-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3312-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3308-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/804-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4652-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2572-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/400-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/628-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3792-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/616-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4620-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3280-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/336-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1188-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/992-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1996-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3068-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3068-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4228-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3284-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2412-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2696-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4040-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3704-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1472-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1472-496-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/412-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3060-573-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-631-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1476-714-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-781-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3704-1170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/1152-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0008000000022f51-3.dat UPX behavioral2/memory/1152-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/992-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023401-22.dat UPX behavioral2/memory/668-25-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4592-20-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023400-18.dat UPX behavioral2/files/0x00070000000233ff-10.dat UPX behavioral2/memory/264-15-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023402-28.dat UPX behavioral2/memory/4168-32-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023403-34.dat UPX behavioral2/files/0x0007000000023404-40.dat UPX behavioral2/memory/3808-43-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3352-37-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023405-46.dat UPX behavioral2/memory/1608-50-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023406-52.dat UPX behavioral2/memory/2108-54-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023407-58.dat UPX behavioral2/memory/2108-60-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023408-64.dat UPX behavioral2/memory/2196-66-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023409-70.dat UPX behavioral2/memory/4088-72-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002340a-76.dat UPX behavioral2/memory/2532-79-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002340b-82.dat UPX behavioral2/files/0x000700000002340c-87.dat UPX behavioral2/files/0x000700000002340d-92.dat UPX behavioral2/files/0x000700000002340e-98.dat UPX behavioral2/memory/2288-101-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002340f-103.dat UPX behavioral2/files/0x0007000000023410-108.dat UPX behavioral2/memory/4792-110-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023411-114.dat UPX behavioral2/memory/3152-117-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3028-118-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00080000000233fc-123.dat UPX behavioral2/memory/3312-127-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023412-126.dat UPX behavioral2/files/0x0007000000023413-131.dat UPX behavioral2/memory/2020-133-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3308-135-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023414-139.dat UPX behavioral2/files/0x0007000000023415-144.dat UPX behavioral2/files/0x0007000000023416-148.dat UPX behavioral2/memory/804-150-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023417-155.dat UPX behavioral2/memory/4652-158-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023418-162.dat UPX behavioral2/files/0x0007000000023419-167.dat UPX behavioral2/memory/2572-169-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/400-164-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341a-174.dat UPX behavioral2/files/0x000700000002341b-177.dat UPX behavioral2/files/0x000700000002341c-182.dat UPX behavioral2/memory/4860-186-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/628-196-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3792-202-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/616-207-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4620-213-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5084-214-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 992 nttbnn.exe 264 vjjdd.exe 4592 jvvvj.exe 668 xrlllll.exe 4168 thttnt.exe 3352 pdjjd.exe 3808 ddjjd.exe 1608 vjvpp.exe 2108 djddd.exe 2196 tbbbbb.exe 4088 ppppp.exe 1900 flxllfr.exe 2532 hhhhnn.exe 4512 pjvvv.exe 5044 xfffrfr.exe 3292 fffffll.exe 2288 1tntbh.exe 4792 dvvvp.exe 3152 llfffxx.exe 3028 5jvvp.exe 3312 xfffrxl.exe 2020 hnhhbt.exe 3308 flfffff.exe 4960 bhnhbb.exe 804 pvjjd.exe 2448 nbbhhn.exe 4652 dvppd.exe 400 djvvv.exe 2572 lrrrrrx.exe 2032 jjddp.exe 3320 xrxfrlx.exe 4860 flfllll.exe 4660 7nnnhn.exe 3740 3jdvv.exe 628 lflfffl.exe 3792 xrllllr.exe 3856 3ntttb.exe 616 pdjjv.exe 4620 vvjjv.exe 5084 xxllfff.exe 1992 tnbbtb.exe 3280 bbbtbb.exe 336 ddddd.exe 4468 rrfffll.exe 640 5hnhbb.exe 1188 jdjdd.exe 4712 ppvvv.exe 992 rrffllr.exe 208 9bhtnt.exe 1996 hnhbtb.exe 768 pdppp.exe 2844 lfrlllx.exe 4540 rxffxxf.exe 3980 hhnnnn.exe 3328 jpvjv.exe 3068 vvvvp.exe 932 rlxllrr.exe 4228 btbhnt.exe 1908 jvddd.exe 3284 fllllll.exe 2164 nbhhhh.exe 4836 nhnhhh.exe 4776 ddjjj.exe 2568 lxrrlrr.exe -
resource yara_rule behavioral2/memory/1152-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022f51-3.dat upx behavioral2/memory/1152-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/992-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023401-22.dat upx behavioral2/memory/668-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4592-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023400-18.dat upx behavioral2/files/0x00070000000233ff-10.dat upx behavioral2/memory/264-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023402-28.dat upx behavioral2/memory/4168-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023403-34.dat upx behavioral2/files/0x0007000000023404-40.dat upx behavioral2/memory/3808-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3352-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023405-46.dat upx behavioral2/memory/1608-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023406-52.dat upx behavioral2/memory/2108-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023407-58.dat upx behavioral2/memory/2108-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023408-64.dat upx behavioral2/memory/2196-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023409-70.dat upx behavioral2/memory/4088-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340a-76.dat upx behavioral2/memory/2532-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340b-82.dat upx behavioral2/files/0x000700000002340c-87.dat upx behavioral2/files/0x000700000002340d-92.dat upx behavioral2/files/0x000700000002340e-98.dat upx behavioral2/memory/2288-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340f-103.dat upx behavioral2/files/0x0007000000023410-108.dat upx behavioral2/memory/4792-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023411-114.dat upx behavioral2/memory/3152-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3028-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233fc-123.dat upx behavioral2/memory/3312-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023412-126.dat upx behavioral2/files/0x0007000000023413-131.dat upx behavioral2/memory/2020-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3308-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023414-139.dat upx behavioral2/files/0x0007000000023415-144.dat upx behavioral2/files/0x0007000000023416-148.dat upx behavioral2/memory/804-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023417-155.dat upx behavioral2/memory/4652-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023418-162.dat upx behavioral2/files/0x0007000000023419-167.dat upx behavioral2/memory/2572-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/400-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341a-174.dat upx behavioral2/files/0x000700000002341b-177.dat upx behavioral2/files/0x000700000002341c-182.dat upx behavioral2/memory/4860-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/628-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3792-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/616-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4620-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5084-214-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1152 wrote to memory of 992 1152 81c96e3c15e9a95df77d695bf28d535ab07549d633a23f9bd6d309b7b86b1b97.exe 82 PID 1152 wrote to memory of 992 1152 81c96e3c15e9a95df77d695bf28d535ab07549d633a23f9bd6d309b7b86b1b97.exe 82 PID 1152 wrote to memory of 992 1152 81c96e3c15e9a95df77d695bf28d535ab07549d633a23f9bd6d309b7b86b1b97.exe 82 PID 992 wrote to memory of 264 992 nttbnn.exe 83 PID 992 wrote to memory of 264 992 nttbnn.exe 83 PID 992 wrote to memory of 264 992 nttbnn.exe 83 PID 264 wrote to memory of 4592 264 vjjdd.exe 84 PID 264 wrote to memory of 4592 264 vjjdd.exe 84 PID 264 wrote to memory of 4592 264 vjjdd.exe 84 PID 4592 wrote to memory of 668 4592 jvvvj.exe 85 PID 4592 wrote to memory of 668 4592 jvvvj.exe 85 PID 4592 wrote to memory of 668 4592 jvvvj.exe 85 PID 668 wrote to memory of 4168 668 xrlllll.exe 86 PID 668 wrote to memory of 4168 668 xrlllll.exe 86 PID 668 wrote to memory of 4168 668 xrlllll.exe 86 PID 4168 wrote to memory of 3352 4168 thttnt.exe 87 PID 4168 wrote to memory of 3352 4168 thttnt.exe 87 PID 4168 wrote to memory of 3352 4168 thttnt.exe 87 PID 3352 wrote to memory of 3808 3352 pdjjd.exe 88 PID 3352 wrote to memory of 3808 3352 pdjjd.exe 88 PID 3352 wrote to memory of 3808 3352 pdjjd.exe 88 PID 3808 wrote to memory of 1608 3808 ddjjd.exe 89 PID 3808 wrote to memory of 1608 3808 ddjjd.exe 89 PID 3808 wrote to memory of 1608 3808 ddjjd.exe 89 PID 1608 wrote to memory of 2108 1608 vjvpp.exe 90 PID 1608 wrote to memory of 2108 1608 vjvpp.exe 90 PID 1608 wrote to memory of 2108 1608 vjvpp.exe 90 PID 2108 wrote to memory of 2196 2108 djddd.exe 93 PID 2108 wrote to memory of 2196 2108 djddd.exe 93 PID 2108 wrote to memory of 2196 2108 djddd.exe 93 PID 2196 wrote to memory of 4088 2196 tbbbbb.exe 94 PID 2196 wrote to memory of 4088 2196 tbbbbb.exe 94 PID 2196 wrote to memory of 4088 2196 tbbbbb.exe 94 PID 4088 wrote to memory of 1900 4088 ppppp.exe 95 PID 4088 wrote to memory of 1900 4088 ppppp.exe 95 PID 4088 wrote to memory of 1900 4088 ppppp.exe 95 PID 1900 wrote to memory of 2532 1900 flxllfr.exe 96 PID 1900 wrote to memory of 2532 1900 flxllfr.exe 96 PID 1900 wrote to memory of 2532 1900 flxllfr.exe 96 PID 2532 wrote to memory of 4512 2532 hhhhnn.exe 97 PID 2532 wrote to memory of 4512 2532 hhhhnn.exe 97 PID 2532 wrote to memory of 4512 2532 hhhhnn.exe 97 PID 4512 wrote to memory of 5044 4512 pjvvv.exe 98 PID 4512 wrote to memory of 5044 4512 pjvvv.exe 98 PID 4512 wrote to memory of 5044 4512 pjvvv.exe 98 PID 5044 wrote to memory of 3292 5044 xfffrfr.exe 99 PID 5044 wrote to memory of 3292 5044 xfffrfr.exe 99 PID 5044 wrote to memory of 3292 5044 xfffrfr.exe 99 PID 3292 wrote to memory of 2288 3292 fffffll.exe 100 PID 3292 wrote to memory of 2288 3292 fffffll.exe 100 PID 3292 wrote to memory of 2288 3292 fffffll.exe 100 PID 2288 wrote to memory of 4792 2288 1tntbh.exe 101 PID 2288 wrote to memory of 4792 2288 1tntbh.exe 101 PID 2288 wrote to memory of 4792 2288 1tntbh.exe 101 PID 4792 wrote to memory of 3152 4792 dvvvp.exe 103 PID 4792 wrote to memory of 3152 4792 dvvvp.exe 103 PID 4792 wrote to memory of 3152 4792 dvvvp.exe 103 PID 3152 wrote to memory of 3028 3152 llfffxx.exe 104 PID 3152 wrote to memory of 3028 3152 llfffxx.exe 104 PID 3152 wrote to memory of 3028 3152 llfffxx.exe 104 PID 3028 wrote to memory of 3312 3028 5jvvp.exe 105 PID 3028 wrote to memory of 3312 3028 5jvvp.exe 105 PID 3028 wrote to memory of 3312 3028 5jvvp.exe 105 PID 3312 wrote to memory of 2020 3312 xfffrxl.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\81c96e3c15e9a95df77d695bf28d535ab07549d633a23f9bd6d309b7b86b1b97.exe"C:\Users\Admin\AppData\Local\Temp\81c96e3c15e9a95df77d695bf28d535ab07549d633a23f9bd6d309b7b86b1b97.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\nttbnn.exec:\nttbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\vjjdd.exec:\vjjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\jvvvj.exec:\jvvvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\xrlllll.exec:\xrlllll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\thttnt.exec:\thttnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\pdjjd.exec:\pdjjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\ddjjd.exec:\ddjjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\vjvpp.exec:\vjvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\djddd.exec:\djddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\tbbbbb.exec:\tbbbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\ppppp.exec:\ppppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\flxllfr.exec:\flxllfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\hhhhnn.exec:\hhhhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\pjvvv.exec:\pjvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\xfffrfr.exec:\xfffrfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\fffffll.exec:\fffffll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\1tntbh.exec:\1tntbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\dvvvp.exec:\dvvvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\llfffxx.exec:\llfffxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\5jvvp.exec:\5jvvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\xfffrxl.exec:\xfffrxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\hnhhbt.exec:\hnhhbt.exe23⤵
- Executes dropped EXE
PID:2020 -
\??\c:\flfffff.exec:\flfffff.exe24⤵
- Executes dropped EXE
PID:3308 -
\??\c:\bhnhbb.exec:\bhnhbb.exe25⤵
- Executes dropped EXE
PID:4960 -
\??\c:\pvjjd.exec:\pvjjd.exe26⤵
- Executes dropped EXE
PID:804 -
\??\c:\nbbhhn.exec:\nbbhhn.exe27⤵
- Executes dropped EXE
PID:2448 -
\??\c:\dvppd.exec:\dvppd.exe28⤵
- Executes dropped EXE
PID:4652 -
\??\c:\djvvv.exec:\djvvv.exe29⤵
- Executes dropped EXE
PID:400 -
\??\c:\lrrrrrx.exec:\lrrrrrx.exe30⤵
- Executes dropped EXE
PID:2572 -
\??\c:\jjddp.exec:\jjddp.exe31⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xrxfrlx.exec:\xrxfrlx.exe32⤵
- Executes dropped EXE
PID:3320 -
\??\c:\flfllll.exec:\flfllll.exe33⤵
- Executes dropped EXE
PID:4860 -
\??\c:\7nnnhn.exec:\7nnnhn.exe34⤵
- Executes dropped EXE
PID:4660 -
\??\c:\3jdvv.exec:\3jdvv.exe35⤵
- Executes dropped EXE
PID:3740 -
\??\c:\lflfffl.exec:\lflfffl.exe36⤵
- Executes dropped EXE
PID:628 -
\??\c:\xrllllr.exec:\xrllllr.exe37⤵
- Executes dropped EXE
PID:3792 -
\??\c:\3ntttb.exec:\3ntttb.exe38⤵
- Executes dropped EXE
PID:3856 -
\??\c:\pdjjv.exec:\pdjjv.exe39⤵
- Executes dropped EXE
PID:616 -
\??\c:\vvjjv.exec:\vvjjv.exe40⤵
- Executes dropped EXE
PID:4620 -
\??\c:\xxllfff.exec:\xxllfff.exe41⤵
- Executes dropped EXE
PID:5084 -
\??\c:\tnbbtb.exec:\tnbbtb.exe42⤵
- Executes dropped EXE
PID:1992 -
\??\c:\bbbtbb.exec:\bbbtbb.exe43⤵
- Executes dropped EXE
PID:3280 -
\??\c:\ddddd.exec:\ddddd.exe44⤵
- Executes dropped EXE
PID:336 -
\??\c:\rrfffll.exec:\rrfffll.exe45⤵
- Executes dropped EXE
PID:4468 -
\??\c:\5hnhbb.exec:\5hnhbb.exe46⤵
- Executes dropped EXE
PID:640 -
\??\c:\jdjdd.exec:\jdjdd.exe47⤵
- Executes dropped EXE
PID:1188 -
\??\c:\ppvvv.exec:\ppvvv.exe48⤵
- Executes dropped EXE
PID:4712 -
\??\c:\rrffllr.exec:\rrffllr.exe49⤵
- Executes dropped EXE
PID:992 -
\??\c:\9bhtnt.exec:\9bhtnt.exe50⤵
- Executes dropped EXE
PID:208 -
\??\c:\hnhbtb.exec:\hnhbtb.exe51⤵
- Executes dropped EXE
PID:1996 -
\??\c:\pdppp.exec:\pdppp.exe52⤵
- Executes dropped EXE
PID:768 -
\??\c:\lfrlllx.exec:\lfrlllx.exe53⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rxffxxf.exec:\rxffxxf.exe54⤵
- Executes dropped EXE
PID:4540 -
\??\c:\hhnnnn.exec:\hhnnnn.exe55⤵
- Executes dropped EXE
PID:3980 -
\??\c:\jpvjv.exec:\jpvjv.exe56⤵
- Executes dropped EXE
PID:3328 -
\??\c:\vvvvp.exec:\vvvvp.exe57⤵
- Executes dropped EXE
PID:3068 -
\??\c:\rlxllrr.exec:\rlxllrr.exe58⤵
- Executes dropped EXE
PID:932 -
\??\c:\btbhnt.exec:\btbhnt.exe59⤵
- Executes dropped EXE
PID:4228 -
\??\c:\jvddd.exec:\jvddd.exe60⤵
- Executes dropped EXE
PID:1908 -
\??\c:\fllllll.exec:\fllllll.exe61⤵
- Executes dropped EXE
PID:3284 -
\??\c:\nbhhhh.exec:\nbhhhh.exe62⤵
- Executes dropped EXE
PID:2164 -
\??\c:\nhnhhh.exec:\nhnhhh.exe63⤵
- Executes dropped EXE
PID:4836 -
\??\c:\ddjjj.exec:\ddjjj.exe64⤵
- Executes dropped EXE
PID:4776 -
\??\c:\lxrrlrr.exec:\lxrrlrr.exe65⤵
- Executes dropped EXE
PID:2568 -
\??\c:\fxfffll.exec:\fxfffll.exe66⤵PID:2412
-
\??\c:\bthnhh.exec:\bthnhh.exe67⤵PID:2012
-
\??\c:\dddvv.exec:\dddvv.exe68⤵PID:4368
-
\??\c:\vpppj.exec:\vpppj.exe69⤵PID:5060
-
\??\c:\rrrrxxl.exec:\rrrrxxl.exe70⤵PID:2808
-
\??\c:\tbhhhh.exec:\tbhhhh.exe71⤵PID:2696
-
\??\c:\1jjjj.exec:\1jjjj.exe72⤵PID:4040
-
\??\c:\xfllxfr.exec:\xfllxfr.exe73⤵PID:3400
-
\??\c:\tbtttb.exec:\tbtttb.exe74⤵PID:3120
-
\??\c:\tntttt.exec:\tntttt.exe75⤵PID:1948
-
\??\c:\vvjdp.exec:\vvjdp.exe76⤵PID:4760
-
\??\c:\xxllfff.exec:\xxllfff.exe77⤵PID:3712
-
\??\c:\xxxfflr.exec:\xxxfflr.exe78⤵PID:1184
-
\??\c:\nhbbbb.exec:\nhbbbb.exe79⤵PID:380
-
\??\c:\ppjdd.exec:\ppjdd.exe80⤵PID:4108
-
\??\c:\pjvpj.exec:\pjvpj.exe81⤵PID:3116
-
\??\c:\1xfxlrl.exec:\1xfxlrl.exe82⤵PID:1404
-
\??\c:\rxllfll.exec:\rxllfll.exe83⤵PID:4812
-
\??\c:\hbbbtt.exec:\hbbbtt.exe84⤵PID:3520
-
\??\c:\dpvdd.exec:\dpvdd.exe85⤵PID:2616
-
\??\c:\ddjjj.exec:\ddjjj.exe86⤵PID:4652
-
\??\c:\lrlllff.exec:\lrlllff.exe87⤵PID:532
-
\??\c:\9xrrlll.exec:\9xrrlll.exe88⤵PID:3752
-
\??\c:\bbnhhh.exec:\bbnhhh.exe89⤵PID:1528
-
\??\c:\bthhhh.exec:\bthhhh.exe90⤵PID:5068
-
\??\c:\vjdpp.exec:\vjdpp.exe91⤵PID:3020
-
\??\c:\vjjvd.exec:\vjjvd.exe92⤵PID:2484
-
\??\c:\1flllll.exec:\1flllll.exe93⤵PID:844
-
\??\c:\lxxffxx.exec:\lxxffxx.exe94⤵PID:3000
-
\??\c:\bbbtnt.exec:\bbbtnt.exe95⤵PID:4628
-
\??\c:\vdvvp.exec:\vdvvp.exe96⤵PID:3544
-
\??\c:\jdjdp.exec:\jdjdp.exe97⤵PID:3704
-
\??\c:\xrllrxl.exec:\xrllrxl.exe98⤵PID:3272
-
\??\c:\fflllrr.exec:\fflllrr.exe99⤵PID:3612
-
\??\c:\3ntttt.exec:\3ntttt.exe100⤵PID:2120
-
\??\c:\vjddd.exec:\vjddd.exe101⤵PID:2492
-
\??\c:\rrxxxfl.exec:\rrxxxfl.exe102⤵PID:4084
-
\??\c:\lrxxlxl.exec:\lrxxlxl.exe103⤵PID:4656
-
\??\c:\hhhhnn.exec:\hhhhnn.exe104⤵PID:2496
-
\??\c:\5dddd.exec:\5dddd.exe105⤵PID:4316
-
\??\c:\ffxlllx.exec:\ffxlllx.exe106⤵PID:860
-
\??\c:\nbbbbb.exec:\nbbbbb.exe107⤵PID:4528
-
\??\c:\ddvvp.exec:\ddvvp.exe108⤵PID:724
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe109⤵PID:732
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe110⤵PID:992
-
\??\c:\jjvdd.exec:\jjvdd.exe111⤵PID:208
-
\??\c:\lrrrrrx.exec:\lrrrrrx.exe112⤵PID:668
-
\??\c:\1lllxfr.exec:\1lllxfr.exe113⤵PID:2948
-
\??\c:\tbntnn.exec:\tbntnn.exe114⤵PID:3720
-
\??\c:\1vppp.exec:\1vppp.exe115⤵PID:3352
-
\??\c:\nhtnhn.exec:\nhtnhn.exe116⤵PID:216
-
\??\c:\hbtttb.exec:\hbtttb.exe117⤵PID:3324
-
\??\c:\7jjvv.exec:\7jjvv.exe118⤵PID:4356
-
\??\c:\tbhhhh.exec:\tbhhhh.exe119⤵PID:2340
-
\??\c:\5pddv.exec:\5pddv.exe120⤵PID:1644
-
\??\c:\1rxxrxr.exec:\1rxxrxr.exe121⤵PID:4264
-
\??\c:\frffflr.exec:\frffflr.exe122⤵PID:2176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-