Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
17/06/2024, 01:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9f012cfcf7775fb1d894ef74675ca3f95b80029bbc62b470e2fc567bff9dfd0.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
b9f012cfcf7775fb1d894ef74675ca3f95b80029bbc62b470e2fc567bff9dfd0.exe
-
Size
341KB
-
MD5
4c3cc2f31ba695dcadd8c6294c09b196
-
SHA1
d8bfcb1ce535b26505d4b6ba8393efb523302c8b
-
SHA256
b9f012cfcf7775fb1d894ef74675ca3f95b80029bbc62b470e2fc567bff9dfd0
-
SHA512
7458a2a6d0c9a9bf79942d9b03a87334055f4e409a6f4ce81316d2edaa56ee33a5dece0cab57b8a0d894f4f448162844923c9a2e8e590de4282c4306be02f31c
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYA+:l7TcbWXZshJX2VGd+
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2760-6-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3048-14-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4304-19-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4980-26-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2224-30-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3140-36-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2536-42-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2756-54-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2272-65-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3396-72-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3936-75-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3600-88-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/936-96-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3816-98-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4092-104-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3188-110-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3560-121-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/536-127-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2776-136-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4116-144-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/516-153-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4784-160-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1340-171-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2000-182-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4076-195-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4400-201-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2264-202-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2948-209-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3356-211-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2528-220-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4376-227-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4376-231-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/860-238-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4888-242-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4780-243-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/880-256-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5012-260-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3052-264-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/472-265-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3612-272-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3416-280-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2880-288-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4176-291-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4576-298-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2804-309-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4912-316-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2000-329-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4872-342-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5056-367-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2996-392-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2836-413-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/536-420-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4688-427-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5024-431-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1672-454-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2220-464-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5036-504-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4980-579-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4420-683-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2804-699-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3232-787-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/600-938-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/60-1084-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2712-1336-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/3048-7-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/2760-6-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/3048-14-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/4304-19-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/4980-26-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/2224-27-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/2224-30-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/3140-36-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/2536-42-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/2756-49-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/2756-54-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/2272-65-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/3396-67-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/3396-72-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/3936-75-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/3600-88-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/936-96-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/3816-98-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/4092-104-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/3188-110-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/3560-121-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/536-127-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/2776-132-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/2776-136-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/4116-144-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/516-153-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/4784-160-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/1340-171-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/2000-182-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/4076-195-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/4400-201-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/2264-202-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/2948-209-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/3356-211-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/2528-220-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/4376-227-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/4376-231-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/860-238-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/4888-242-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/4780-243-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/880-256-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/5012-260-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/3052-264-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/472-265-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/3612-272-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/4608-273-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/3416-280-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/2880-288-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/4176-291-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/4576-298-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/3956-302-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/2804-309-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/4912-316-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/2000-329-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/4872-342-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/5056-367-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/2996-392-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/4900-405-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/2836-409-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/2836-413-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/536-420-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/4688-427-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/5024-431-0x0000000000400000-0x0000000000428000-memory.dmp UPX behavioral2/memory/4848-438-0x0000000000400000-0x0000000000428000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3048 9hbnbh.exe 4304 lxrlffx.exe 4980 7pvpp.exe 2224 jdpdj.exe 3140 rxxrfxr.exe 2536 hnbhtb.exe 3356 xxxrrrr.exe 2756 nnbnnt.exe 4284 3vpjv.exe 2272 hnnhtt.exe 3396 jvpjv.exe 3936 9jdvp.exe 2092 1ddpv.exe 3600 hhtthn.exe 936 flrxffx.exe 3816 hnttnn.exe 4092 jpdpj.exe 3188 fxrlrlf.exe 3560 3rlxrlx.exe 4168 vjpjv.exe 536 vddpd.exe 2776 btttnh.exe 1824 9pvpd.exe 4116 xffrffr.exe 516 pvdvj.exe 4784 3rfffxr.exe 1540 jdvjd.exe 1340 rxrxfxl.exe 1860 ntthbt.exe 2000 jvpjv.exe 1176 lxxrlxl.exe 4604 jddvp.exe 4076 lrllfxr.exe 1092 thnbtt.exe 4400 1vdpj.exe 2264 jdvpp.exe 2948 lxxrffx.exe 3356 hhhnhh.exe 4404 tnhbnh.exe 2528 jjjvj.exe 3832 9fffrxf.exe 1076 thhtnh.exe 4376 dvvdp.exe 4112 fffrfxr.exe 860 bbnhnh.exe 4888 vddvp.exe 4780 vpdvv.exe 4584 xflfrlf.exe 2996 bhnhtn.exe 880 5ddvp.exe 5012 vjjvd.exe 3052 rxxlxrr.exe 472 hbhtnn.exe 3612 thbnbt.exe 4608 dppdp.exe 2232 fflxllf.exe 3416 nhhtbt.exe 1084 3nbbhb.exe 2880 pdvvj.exe 4176 lxfxflx.exe 1816 rllfrlx.exe 4576 tbbthb.exe 3956 vjdvj.exe 4784 pvdvp.exe -
resource yara_rule behavioral2/memory/3048-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2760-6-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3048-14-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4304-19-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4980-26-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2224-27-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2224-30-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3140-36-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2536-42-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2756-49-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2756-54-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2272-65-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3396-67-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3396-72-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3936-75-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3600-88-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/936-96-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3816-98-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4092-104-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3188-110-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3560-121-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/536-127-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2776-132-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2776-136-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4116-144-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/516-153-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4784-160-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1340-171-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2000-182-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4076-195-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4400-201-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2264-202-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2948-209-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3356-211-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2528-220-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4376-227-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4376-231-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/860-238-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4888-242-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4780-243-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/880-256-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5012-260-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3052-264-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/472-265-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3612-272-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4608-273-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3416-280-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2880-288-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4176-291-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4576-298-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3956-302-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2804-309-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4912-316-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2000-329-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4872-342-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5056-367-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2996-392-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4900-405-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2836-409-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2836-413-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/536-420-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4688-427-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5024-431-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4848-438-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2760 wrote to memory of 3048 2760 b9f012cfcf7775fb1d894ef74675ca3f95b80029bbc62b470e2fc567bff9dfd0.exe 89 PID 2760 wrote to memory of 3048 2760 b9f012cfcf7775fb1d894ef74675ca3f95b80029bbc62b470e2fc567bff9dfd0.exe 89 PID 2760 wrote to memory of 3048 2760 b9f012cfcf7775fb1d894ef74675ca3f95b80029bbc62b470e2fc567bff9dfd0.exe 89 PID 3048 wrote to memory of 4304 3048 9hbnbh.exe 90 PID 3048 wrote to memory of 4304 3048 9hbnbh.exe 90 PID 3048 wrote to memory of 4304 3048 9hbnbh.exe 90 PID 4304 wrote to memory of 4980 4304 lxrlffx.exe 91 PID 4304 wrote to memory of 4980 4304 lxrlffx.exe 91 PID 4304 wrote to memory of 4980 4304 lxrlffx.exe 91 PID 4980 wrote to memory of 2224 4980 7pvpp.exe 92 PID 4980 wrote to memory of 2224 4980 7pvpp.exe 92 PID 4980 wrote to memory of 2224 4980 7pvpp.exe 92 PID 2224 wrote to memory of 3140 2224 jdpdj.exe 93 PID 2224 wrote to memory of 3140 2224 jdpdj.exe 93 PID 2224 wrote to memory of 3140 2224 jdpdj.exe 93 PID 3140 wrote to memory of 2536 3140 rxxrfxr.exe 94 PID 3140 wrote to memory of 2536 3140 rxxrfxr.exe 94 PID 3140 wrote to memory of 2536 3140 rxxrfxr.exe 94 PID 2536 wrote to memory of 3356 2536 hnbhtb.exe 95 PID 2536 wrote to memory of 3356 2536 hnbhtb.exe 95 PID 2536 wrote to memory of 3356 2536 hnbhtb.exe 95 PID 3356 wrote to memory of 2756 3356 xxxrrrr.exe 96 PID 3356 wrote to memory of 2756 3356 xxxrrrr.exe 96 PID 3356 wrote to memory of 2756 3356 xxxrrrr.exe 96 PID 2756 wrote to memory of 4284 2756 nnbnnt.exe 97 PID 2756 wrote to memory of 4284 2756 nnbnnt.exe 97 PID 2756 wrote to memory of 4284 2756 nnbnnt.exe 97 PID 4284 wrote to memory of 2272 4284 3vpjv.exe 99 PID 4284 wrote to memory of 2272 4284 3vpjv.exe 99 PID 4284 wrote to memory of 2272 4284 3vpjv.exe 99 PID 2272 wrote to memory of 3396 2272 hnnhtt.exe 100 PID 2272 wrote to memory of 3396 2272 hnnhtt.exe 100 PID 2272 wrote to memory of 3396 2272 hnnhtt.exe 100 PID 3396 wrote to memory of 3936 3396 jvpjv.exe 102 PID 3396 wrote to memory of 3936 3396 jvpjv.exe 102 PID 3396 wrote to memory of 3936 3396 jvpjv.exe 102 PID 3936 wrote to memory of 2092 3936 9jdvp.exe 103 PID 3936 wrote to memory of 2092 3936 9jdvp.exe 103 PID 3936 wrote to memory of 2092 3936 9jdvp.exe 103 PID 2092 wrote to memory of 3600 2092 1ddpv.exe 104 PID 2092 wrote to memory of 3600 2092 1ddpv.exe 104 PID 2092 wrote to memory of 3600 2092 1ddpv.exe 104 PID 3600 wrote to memory of 936 3600 hhtthn.exe 105 PID 3600 wrote to memory of 936 3600 hhtthn.exe 105 PID 3600 wrote to memory of 936 3600 hhtthn.exe 105 PID 936 wrote to memory of 3816 936 flrxffx.exe 106 PID 936 wrote to memory of 3816 936 flrxffx.exe 106 PID 936 wrote to memory of 3816 936 flrxffx.exe 106 PID 3816 wrote to memory of 4092 3816 hnttnn.exe 108 PID 3816 wrote to memory of 4092 3816 hnttnn.exe 108 PID 3816 wrote to memory of 4092 3816 hnttnn.exe 108 PID 4092 wrote to memory of 3188 4092 jpdpj.exe 109 PID 4092 wrote to memory of 3188 4092 jpdpj.exe 109 PID 4092 wrote to memory of 3188 4092 jpdpj.exe 109 PID 3188 wrote to memory of 3560 3188 fxrlrlf.exe 110 PID 3188 wrote to memory of 3560 3188 fxrlrlf.exe 110 PID 3188 wrote to memory of 3560 3188 fxrlrlf.exe 110 PID 3560 wrote to memory of 4168 3560 3rlxrlx.exe 111 PID 3560 wrote to memory of 4168 3560 3rlxrlx.exe 111 PID 3560 wrote to memory of 4168 3560 3rlxrlx.exe 111 PID 4168 wrote to memory of 536 4168 vjpjv.exe 112 PID 4168 wrote to memory of 536 4168 vjpjv.exe 112 PID 4168 wrote to memory of 536 4168 vjpjv.exe 112 PID 536 wrote to memory of 2776 536 vddpd.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9f012cfcf7775fb1d894ef74675ca3f95b80029bbc62b470e2fc567bff9dfd0.exe"C:\Users\Admin\AppData\Local\Temp\b9f012cfcf7775fb1d894ef74675ca3f95b80029bbc62b470e2fc567bff9dfd0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\9hbnbh.exec:\9hbnbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\lxrlffx.exec:\lxrlffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\7pvpp.exec:\7pvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\jdpdj.exec:\jdpdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\rxxrfxr.exec:\rxxrfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\hnbhtb.exec:\hnbhtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\xxxrrrr.exec:\xxxrrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\nnbnnt.exec:\nnbnnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\3vpjv.exec:\3vpjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\hnnhtt.exec:\hnnhtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\jvpjv.exec:\jvpjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\9jdvp.exec:\9jdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\1ddpv.exec:\1ddpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\hhtthn.exec:\hhtthn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\flrxffx.exec:\flrxffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\hnttnn.exec:\hnttnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\jpdpj.exec:\jpdpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\fxrlrlf.exec:\fxrlrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\3rlxrlx.exec:\3rlxrlx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\vjpjv.exec:\vjpjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\vddpd.exec:\vddpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\btttnh.exec:\btttnh.exe23⤵
- Executes dropped EXE
PID:2776 -
\??\c:\9pvpd.exec:\9pvpd.exe24⤵
- Executes dropped EXE
PID:1824 -
\??\c:\xffrffr.exec:\xffrffr.exe25⤵
- Executes dropped EXE
PID:4116 -
\??\c:\pvdvj.exec:\pvdvj.exe26⤵
- Executes dropped EXE
PID:516 -
\??\c:\3rfffxr.exec:\3rfffxr.exe27⤵
- Executes dropped EXE
PID:4784 -
\??\c:\jdvjd.exec:\jdvjd.exe28⤵
- Executes dropped EXE
PID:1540 -
\??\c:\rxrxfxl.exec:\rxrxfxl.exe29⤵
- Executes dropped EXE
PID:1340 -
\??\c:\ntthbt.exec:\ntthbt.exe30⤵
- Executes dropped EXE
PID:1860 -
\??\c:\jvpjv.exec:\jvpjv.exe31⤵
- Executes dropped EXE
PID:2000 -
\??\c:\lxxrlxl.exec:\lxxrlxl.exe32⤵
- Executes dropped EXE
PID:1176 -
\??\c:\jddvp.exec:\jddvp.exe33⤵
- Executes dropped EXE
PID:4604 -
\??\c:\lrllfxr.exec:\lrllfxr.exe34⤵
- Executes dropped EXE
PID:4076 -
\??\c:\thnbtt.exec:\thnbtt.exe35⤵
- Executes dropped EXE
PID:1092 -
\??\c:\1vdpj.exec:\1vdpj.exe36⤵
- Executes dropped EXE
PID:4400 -
\??\c:\jdvpp.exec:\jdvpp.exe37⤵
- Executes dropped EXE
PID:2264 -
\??\c:\lxxrffx.exec:\lxxrffx.exe38⤵
- Executes dropped EXE
PID:2948 -
\??\c:\hhhnhh.exec:\hhhnhh.exe39⤵
- Executes dropped EXE
PID:3356 -
\??\c:\tnhbnh.exec:\tnhbnh.exe40⤵
- Executes dropped EXE
PID:4404 -
\??\c:\jjjvj.exec:\jjjvj.exe41⤵
- Executes dropped EXE
PID:2528 -
\??\c:\9fffrxf.exec:\9fffrxf.exe42⤵
- Executes dropped EXE
PID:3832 -
\??\c:\thhtnh.exec:\thhtnh.exe43⤵
- Executes dropped EXE
PID:1076 -
\??\c:\dvvdp.exec:\dvvdp.exe44⤵
- Executes dropped EXE
PID:4376 -
\??\c:\fffrfxr.exec:\fffrfxr.exe45⤵
- Executes dropped EXE
PID:4112 -
\??\c:\bbnhnh.exec:\bbnhnh.exe46⤵
- Executes dropped EXE
PID:860 -
\??\c:\vddvp.exec:\vddvp.exe47⤵
- Executes dropped EXE
PID:4888 -
\??\c:\vpdvv.exec:\vpdvv.exe48⤵
- Executes dropped EXE
PID:4780 -
\??\c:\xflfrlf.exec:\xflfrlf.exe49⤵
- Executes dropped EXE
PID:4584 -
\??\c:\bhnhtn.exec:\bhnhtn.exe50⤵
- Executes dropped EXE
PID:2996 -
\??\c:\5ddvp.exec:\5ddvp.exe51⤵
- Executes dropped EXE
PID:880 -
\??\c:\vjjvd.exec:\vjjvd.exe52⤵
- Executes dropped EXE
PID:5012 -
\??\c:\rxxlxrr.exec:\rxxlxrr.exe53⤵
- Executes dropped EXE
PID:3052 -
\??\c:\hbhtnn.exec:\hbhtnn.exe54⤵
- Executes dropped EXE
PID:472 -
\??\c:\thbnbt.exec:\thbnbt.exe55⤵
- Executes dropped EXE
PID:3612 -
\??\c:\dppdp.exec:\dppdp.exe56⤵
- Executes dropped EXE
PID:4608 -
\??\c:\fflxllf.exec:\fflxllf.exe57⤵
- Executes dropped EXE
PID:2232 -
\??\c:\nhhtbt.exec:\nhhtbt.exe58⤵
- Executes dropped EXE
PID:3416 -
\??\c:\3nbbhb.exec:\3nbbhb.exe59⤵
- Executes dropped EXE
PID:1084 -
\??\c:\pdvvj.exec:\pdvvj.exe60⤵
- Executes dropped EXE
PID:2880 -
\??\c:\lxfxflx.exec:\lxfxflx.exe61⤵
- Executes dropped EXE
PID:4176 -
\??\c:\rllfrlx.exec:\rllfrlx.exe62⤵
- Executes dropped EXE
PID:1816 -
\??\c:\tbbthb.exec:\tbbthb.exe63⤵
- Executes dropped EXE
PID:4576 -
\??\c:\vjdvj.exec:\vjdvj.exe64⤵
- Executes dropped EXE
PID:3956 -
\??\c:\pvdvp.exec:\pvdvp.exe65⤵
- Executes dropped EXE
PID:4784 -
\??\c:\5rxxflr.exec:\5rxxflr.exe66⤵PID:2804
-
\??\c:\9nnhtn.exec:\9nnhtn.exe67⤵PID:4912
-
\??\c:\nnhtnh.exec:\nnhtnh.exe68⤵PID:4568
-
\??\c:\jvjvj.exec:\jvjvj.exe69⤵PID:2240
-
\??\c:\1vvjj.exec:\1vvjj.exe70⤵PID:208
-
\??\c:\lxlxrll.exec:\lxlxrll.exe71⤵PID:2000
-
\??\c:\thhthb.exec:\thhthb.exe72⤵PID:1176
-
\??\c:\7hbnbt.exec:\7hbnbt.exe73⤵PID:2928
-
\??\c:\vvvjv.exec:\vvvjv.exe74⤵PID:3116
-
\??\c:\5ppjv.exec:\5ppjv.exe75⤵PID:2256
-
\??\c:\5rrxlfr.exec:\5rrxlfr.exe76⤵PID:4872
-
\??\c:\9hbtnh.exec:\9hbtnh.exe77⤵PID:3308
-
\??\c:\nttnhb.exec:\nttnhb.exe78⤵PID:2948
-
\??\c:\vdvpd.exec:\vdvpd.exe79⤵PID:5080
-
\??\c:\fxxxllf.exec:\fxxxllf.exe80⤵PID:316
-
\??\c:\hhnhbt.exec:\hhnhbt.exe81⤵PID:3120
-
\??\c:\1tthtt.exec:\1tthtt.exe82⤵PID:4268
-
\??\c:\pppjd.exec:\pppjd.exe83⤵PID:5056
-
\??\c:\lllrlff.exec:\lllrlff.exe84⤵PID:3984
-
\??\c:\lxrfxxr.exec:\lxrfxxr.exe85⤵PID:5036
-
\??\c:\hbhbtn.exec:\hbhbtn.exe86⤵PID:2508
-
\??\c:\5jjdd.exec:\5jjdd.exe87⤵PID:3828
-
\??\c:\ffxfffx.exec:\ffxfffx.exe88⤵PID:2652
-
\??\c:\nhtnhb.exec:\nhtnhb.exe89⤵PID:3652
-
\??\c:\1vjpj.exec:\1vjpj.exe90⤵PID:4584
-
\??\c:\lrrllll.exec:\lrrllll.exe91⤵PID:2996
-
\??\c:\nnnhhn.exec:\nnnhhn.exe92⤵PID:880
-
\??\c:\tnhbnn.exec:\tnhbnn.exe93⤵PID:1744
-
\??\c:\ppvpp.exec:\ppvpp.exe94⤵PID:4092
-
\??\c:\1lfxlfx.exec:\1lfxlfx.exe95⤵PID:3188
-
\??\c:\9xlfxlx.exec:\9xlfxlx.exe96⤵PID:4900
-
\??\c:\btnttt.exec:\btnttt.exe97⤵PID:2836
-
\??\c:\jdpjd.exec:\jdpjd.exe98⤵PID:4128
-
\??\c:\rlrlxlx.exec:\rlrlxlx.exe99⤵PID:3460
-
\??\c:\xllfxrr.exec:\xllfxrr.exe100⤵PID:536
-
\??\c:\3ttnhh.exec:\3ttnhh.exe101⤵PID:4688
-
\??\c:\7nthtt.exec:\7nthtt.exe102⤵PID:5024
-
\??\c:\1jpjv.exec:\1jpjv.exe103⤵PID:2656
-
\??\c:\frxrlxr.exec:\frxrlxr.exe104⤵PID:516
-
\??\c:\rlrllfr.exec:\rlrllfr.exe105⤵PID:4848
-
\??\c:\htnhbh.exec:\htnhbh.exe106⤵PID:2156
-
\??\c:\jppjv.exec:\jppjv.exe107⤵PID:664
-
\??\c:\pvdpd.exec:\pvdpd.exe108⤵PID:1860
-
\??\c:\lfrffff.exec:\lfrffff.exe109⤵PID:1672
-
\??\c:\tnbtnh.exec:\tnbtnh.exe110⤵PID:3056
-
\??\c:\tbhbnn.exec:\tbhbnn.exe111⤵PID:1404
-
\??\c:\vdjdd.exec:\vdjdd.exe112⤵PID:2220
-
\??\c:\xfrrlfx.exec:\xfrrlfx.exe113⤵PID:2308
-
\??\c:\lrlxfrl.exec:\lrlxfrl.exe114⤵PID:4076
-
\??\c:\9tbtnh.exec:\9tbtnh.exe115⤵PID:1304
-
\??\c:\vvvpp.exec:\vvvpp.exe116⤵PID:2304
-
\??\c:\xfffrlr.exec:\xfffrlr.exe117⤵PID:4872
-
\??\c:\xffxrrl.exec:\xffxrrl.exe118⤵PID:3800
-
\??\c:\3nnbtt.exec:\3nnbtt.exe119⤵PID:4884
-
\??\c:\pjppd.exec:\pjppd.exe120⤵PID:756
-
\??\c:\vpvvv.exec:\vpvvv.exe121⤵PID:316
-
\??\c:\flrlxxr.exec:\flrlxxr.exe122⤵PID:5052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-