Analysis
- max time kernel
150s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/06/2024, 22:40
Behavioral task
behavioral1
Sample
6fb1483b4f94aabf952dd6a9e9f97a40b9ae50bae1d9e1b7def62112d69afec3.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target 6fb1483b4f94aabf952dd6a9e9f97a40b9ae50bae1d9e1b7def62112d69afec3.exe
- Size 68KB
- Sample240618-2lsdsasepq
- SHA256 6fb1483b4f94aabf952dd6a9e9f97a40b9ae50bae1d9e1b7def62112d69afec3
- MD5 a917cd14b4e4eb529537273d43d0b58c
- SHA1 d3443ce0ca77b168283091d3b9eff1f05c9843c6
- SHA512 7c1ba4fc841c8328cec325a4a918d19b7270a745bdea520ebb1845eb27d96acdbb1d00d79bc6848a5753531563e99c6ebf83011787391911ff73a591f3e6df7d
- SSDEEP 1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNYLIALUmYgPT:khOmTsF93UYfwC6GIoutpY4ALUmVT
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4280-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2564-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1448-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3000-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/976-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3256-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1236-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2312-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3176-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2296-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1064-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1452-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/616-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1752-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1072-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3736-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2040-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1080-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3772-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1868-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3416-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3248-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/388-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4516-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3224-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1064-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2104-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4184-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3324-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1476-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4632-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1364-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2624-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1652-516-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-533-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-574-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4108-585-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2448-628-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/764-650-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/764-653-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-678-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2908-763-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-788-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3224-956-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1520-993-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4108-1051-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-1058-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/4280-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00050000000232a4-3.dat UPX behavioral2/memory/2564-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2564-11-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0009000000023419-9.dat UPX behavioral2/memory/1448-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023421-14.dat UPX behavioral2/files/0x00050000000232a4-23.dat UPX behavioral2/memory/4336-21-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1448-20-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3196-27-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4700-33-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023423-36.dat UPX behavioral2/memory/3000-39-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023424-42.dat UPX behavioral2/files/0x0007000000023425-47.dat UPX behavioral2/memory/640-49-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023426-52.dat UPX behavioral2/files/0x0007000000023422-31.dat UPX behavioral2/files/0x0007000000023427-60.dat UPX behavioral2/memory/976-58-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023428-64.dat UPX behavioral2/memory/3256-66-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023429-69.dat UPX behavioral2/files/0x000700000002342a-74.dat UPX behavioral2/memory/1236-76-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2312-83-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342b-82.dat UPX behavioral2/memory/3176-88-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342c-89.dat UPX behavioral2/files/0x000700000002342d-92.dat UPX behavioral2/memory/2296-95-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1064-97-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342e-99.dat UPX behavioral2/memory/1452-103-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342f-105.dat UPX behavioral2/files/0x0007000000023430-111.dat UPX behavioral2/memory/1356-112-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023431-116.dat UPX behavioral2/files/0x0007000000023432-121.dat UPX behavioral2/memory/4520-122-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023433-127.dat UPX behavioral2/files/0x0007000000023434-134.dat UPX behavioral2/memory/616-133-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023435-138.dat UPX behavioral2/memory/4032-140-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4032-135-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023437-144.dat UPX behavioral2/memory/1752-145-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023438-150.dat UPX behavioral2/files/0x0007000000023439-155.dat UPX behavioral2/files/0x000700000002343a-160.dat UPX behavioral2/files/0x000700000002343b-166.dat UPX behavioral2/memory/1072-165-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002343c-171.dat UPX behavioral2/memory/3736-176-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000900000002341d-177.dat UPX behavioral2/files/0x000700000002343d-181.dat UPX behavioral2/memory/2040-189-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1080-203-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3772-207-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3328-230-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1868-234-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3416-228-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 2564 vvvpj.exe 1448 rxxxxxf.exe 4336 hnttbb.exe 3196 vvvpj.exe 4700 dvppd.exe 3000 fxlfxff.exe 640 xfrxxxx.exe 4948 nhbbtt.exe 976 tnnntt.exe 3256 9dddp.exe 1792 xxxrrrl.exe 1236 3nnnhh.exe 2312 bnnnnn.exe 3176 vvdvv.exe 2296 rlxxxrr.exe 1064 nhnnhh.exe 1452 pjpjd.exe 1356 jvvpj.exe 1800 hnhhtb.exe 4520 ppppp.exe 4436 dvvdd.exe 616 xrlfxrl.exe 4032 hbhhhh.exe 1752 dvvpj.exe 3584 xlflrxr.exe 1620 llxlrlf.exe 3560 bnbbbb.exe 1072 nbbhbh.exe 2244 jjppv.exe 3736 3lrlffx.exe 1476 jvvdd.exe 2632 xrflxlf.exe 2040 nbhbbb.exe 3760 ttbtnh.exe 2180 tnnhbb.exe 4632 vpvjj.exe 2984 vpvpp.exe 1080 lfffffx.exe 3772 fxxxrrl.exe 4384 7tbbhh.exe 4252 3nhhbb.exe 3588 pvdvp.exe 2564 jdjdd.exe 2016 fxfflrx.exe 3328 lflfllr.exe 3416 hhnttb.exe 1868 httnnh.exe 3248 1nthbt.exe 4852 vdvpj.exe 1208 pjvpd.exe 2004 xxxrlll.exe 388 lxrxlll.exe 3300 nhhbhh.exe 1384 jvvvp.exe 4124 jvdvp.exe 1888 jpvvp.exe 4404 fxrrlll.exe 704 7llrrfx.exe 3168 nhnnnn.exe 4516 1hnnnt.exe 4208 dppjd.exe 4056 jjdvv.exe 208 xlllffx.exe 216 1xrxxff.exe -
resource yara_rule behavioral2/memory/4280-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00050000000232a4-3.dat upx behavioral2/memory/2564-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2564-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023419-9.dat upx behavioral2/memory/1448-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-14.dat upx behavioral2/files/0x00050000000232a4-23.dat upx behavioral2/memory/4336-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1448-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3196-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4700-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-36.dat upx behavioral2/memory/3000-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-42.dat upx behavioral2/files/0x0007000000023425-47.dat upx behavioral2/memory/640-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-52.dat upx behavioral2/files/0x0007000000023422-31.dat upx behavioral2/files/0x0007000000023427-60.dat upx behavioral2/memory/976-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-64.dat upx behavioral2/memory/3256-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023429-69.dat upx behavioral2/files/0x000700000002342a-74.dat upx behavioral2/memory/1236-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2312-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342b-82.dat upx behavioral2/memory/3176-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342c-89.dat upx behavioral2/files/0x000700000002342d-92.dat upx behavioral2/memory/2296-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1064-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342e-99.dat upx behavioral2/memory/1452-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342f-105.dat upx behavioral2/files/0x0007000000023430-111.dat upx behavioral2/memory/1356-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023431-116.dat upx behavioral2/files/0x0007000000023432-121.dat upx behavioral2/memory/4520-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023433-127.dat upx behavioral2/files/0x0007000000023434-134.dat upx behavioral2/memory/616-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023435-138.dat upx behavioral2/memory/4032-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4032-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023437-144.dat upx behavioral2/memory/1752-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023438-150.dat upx behavioral2/files/0x0007000000023439-155.dat upx behavioral2/files/0x000700000002343a-160.dat upx behavioral2/files/0x000700000002343b-166.dat upx behavioral2/memory/1072-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343c-171.dat upx behavioral2/memory/3736-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000900000002341d-177.dat upx behavioral2/files/0x000700000002343d-181.dat upx behavioral2/memory/2040-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1080-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3772-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3328-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1868-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3416-228-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4280 wrote to memory of 2564 4280 6fb1483b4f94aabf952dd6a9e9f97a40b9ae50bae1d9e1b7def62112d69afec3.exe 82 PID 4280 wrote to memory of 2564 4280 6fb1483b4f94aabf952dd6a9e9f97a40b9ae50bae1d9e1b7def62112d69afec3.exe 82 PID 4280 wrote to memory of 2564 4280 6fb1483b4f94aabf952dd6a9e9f97a40b9ae50bae1d9e1b7def62112d69afec3.exe 82 PID 2564 wrote to memory of 1448 2564 vvvpj.exe 83 PID 2564 wrote to memory of 1448 2564 vvvpj.exe 83 PID 2564 wrote to memory of 1448 2564 vvvpj.exe 83 PID 1448 wrote to memory of 4336 1448 rxxxxxf.exe 84 PID 1448 wrote to memory of 4336 1448 rxxxxxf.exe 84 PID 1448 wrote to memory of 4336 1448 rxxxxxf.exe 84 PID 4336 wrote to memory of 3196 4336 hnttbb.exe 85 PID 4336 wrote to memory of 3196 4336 hnttbb.exe 85 PID 4336 wrote to memory of 3196 4336 hnttbb.exe 85 PID 3196 wrote to memory of 4700 3196 vvvpj.exe 86 PID 3196 wrote to memory of 4700 3196 vvvpj.exe 86 PID 3196 wrote to memory of 4700 3196 vvvpj.exe 86 PID 4700 wrote to memory of 3000 4700 dvppd.exe 87 PID 4700 wrote to memory of 3000 4700 dvppd.exe 87 PID 4700 wrote to memory of 3000 4700 dvppd.exe 87 PID 3000 wrote to memory of 640 3000 fxlfxff.exe 88 PID 3000 wrote to memory of 640 3000 fxlfxff.exe 88 PID 3000 wrote to memory of 640 3000 fxlfxff.exe 88 PID 640 wrote to memory of 4948 640 xfrxxxx.exe 89 PID 640 wrote to memory of 4948 640 xfrxxxx.exe 89 PID 640 wrote to memory of 4948 640 xfrxxxx.exe 89 PID 4948 wrote to memory of 976 4948 nhbbtt.exe 90 PID 4948 wrote to memory of 976 4948 nhbbtt.exe 90 PID 4948 wrote to memory of 976 4948 nhbbtt.exe 90 PID 976 wrote to memory of 3256 976 tnnntt.exe 91 PID 976 wrote to memory of 3256 976 tnnntt.exe 91 PID 976 wrote to memory of 3256 976 tnnntt.exe 91 PID 3256 wrote to memory of 1792 3256 9dddp.exe 92 PID 3256 wrote to memory of 1792 3256 9dddp.exe 92 PID 3256 wrote to memory of 1792 3256 9dddp.exe 92 PID 1792 wrote to memory of 1236 1792 xxxrrrl.exe 94 PID 1792 wrote to memory of 1236 1792 xxxrrrl.exe 94 PID 1792 wrote to memory of 1236 1792 xxxrrrl.exe 94 PID 1236 wrote to memory of 2312 1236 3nnnhh.exe 95 PID 1236 wrote to memory of 2312 1236 3nnnhh.exe 95 PID 1236 wrote to memory of 2312 1236 3nnnhh.exe 95 PID 2312 wrote to memory of 3176 2312 bnnnnn.exe 96 PID 2312 wrote to memory of 3176 2312 bnnnnn.exe 96 PID 2312 wrote to memory of 3176 2312 bnnnnn.exe 96 PID 3176 wrote to memory of 2296 3176 vvdvv.exe 97 PID 3176 wrote to memory of 2296 3176 vvdvv.exe 97 PID 3176 wrote to memory of 2296 3176 vvdvv.exe 97 PID 2296 wrote to memory of 1064 2296 rlxxxrr.exe 98 PID 2296 wrote to memory of 1064 2296 rlxxxrr.exe 98 PID 2296 wrote to memory of 1064 2296 rlxxxrr.exe 98 PID 1064 wrote to memory of 1452 1064 nhnnhh.exe 99 PID 1064 wrote to memory of 1452 1064 nhnnhh.exe 99 PID 1064 wrote to memory of 1452 1064 nhnnhh.exe 99 PID 1452 wrote to memory of 1356 1452 pjpjd.exe 100 PID 1452 wrote to memory of 1356 1452 pjpjd.exe 100 PID 1452 wrote to memory of 1356 1452 pjpjd.exe 100 PID 1356 wrote to memory of 1800 1356 jvvpj.exe 101 PID 1356 wrote to memory of 1800 1356 jvvpj.exe 101 PID 1356 wrote to memory of 1800 1356 jvvpj.exe 101 PID 1800 wrote to memory of 4520 1800 hnhhtb.exe 103 PID 1800 wrote to memory of 4520 1800 hnhhtb.exe 103 PID 1800 wrote to memory of 4520 1800 hnhhtb.exe 103 PID 4520 wrote to memory of 4436 4520 ppppp.exe 104 PID 4520 wrote to memory of 4436 4520 ppppp.exe 104 PID 4520 wrote to memory of 4436 4520 ppppp.exe 104 PID 4436 wrote to memory of 616 4436 dvvdd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fb1483b4f94aabf952dd6a9e9f97a40b9ae50bae1d9e1b7def62112d69afec3.exe"C:\Users\Admin\AppData\Local\Temp\6fb1483b4f94aabf952dd6a9e9f97a40b9ae50bae1d9e1b7def62112d69afec3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\vvvpj.exec:\vvvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\rxxxxxf.exec:\rxxxxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\hnttbb.exec:\hnttbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\vvvpj.exec:\vvvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\dvppd.exec:\dvppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\fxlfxff.exec:\fxlfxff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\xfrxxxx.exec:\xfrxxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\nhbbtt.exec:\nhbbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\tnnntt.exec:\tnnntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\9dddp.exec:\9dddp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\xxxrrrl.exec:\xxxrrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\3nnnhh.exec:\3nnnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\bnnnnn.exec:\bnnnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\vvdvv.exec:\vvdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\rlxxxrr.exec:\rlxxxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\nhnnhh.exec:\nhnnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\pjpjd.exec:\pjpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\jvvpj.exec:\jvvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\hnhhtb.exec:\hnhhtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\ppppp.exec:\ppppp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\dvvdd.exec:\dvvdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe23⤵
- Executes dropped EXE
PID:616 -
\??\c:\hbhhhh.exec:\hbhhhh.exe24⤵
- Executes dropped EXE
PID:4032 -
\??\c:\dvvpj.exec:\dvvpj.exe25⤵
- Executes dropped EXE
PID:1752 -
\??\c:\xlflrxr.exec:\xlflrxr.exe26⤵
- Executes dropped EXE
PID:3584 -
\??\c:\llxlrlf.exec:\llxlrlf.exe27⤵
- Executes dropped EXE
PID:1620 -
\??\c:\bnbbbb.exec:\bnbbbb.exe28⤵
- Executes dropped EXE
PID:3560 -
\??\c:\nbbhbh.exec:\nbbhbh.exe29⤵
- Executes dropped EXE
PID:1072 -
\??\c:\jjppv.exec:\jjppv.exe30⤵
- Executes dropped EXE
PID:2244 -
\??\c:\3lrlffx.exec:\3lrlffx.exe31⤵
- Executes dropped EXE
PID:3736 -
\??\c:\jvvdd.exec:\jvvdd.exe32⤵
- Executes dropped EXE
PID:1476 -
\??\c:\xrflxlf.exec:\xrflxlf.exe33⤵
- Executes dropped EXE
PID:2632 -
\??\c:\nbhbbb.exec:\nbhbbb.exe34⤵
- Executes dropped EXE
PID:2040 -
\??\c:\ttbtnh.exec:\ttbtnh.exe35⤵
- Executes dropped EXE
PID:3760 -
\??\c:\tnnhbb.exec:\tnnhbb.exe36⤵
- Executes dropped EXE
PID:2180 -
\??\c:\vpvjj.exec:\vpvjj.exe37⤵
- Executes dropped EXE
PID:4632 -
\??\c:\vpvpp.exec:\vpvpp.exe38⤵
- Executes dropped EXE
PID:2984 -
\??\c:\lfffffx.exec:\lfffffx.exe39⤵
- Executes dropped EXE
PID:1080 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe40⤵
- Executes dropped EXE
PID:3772 -
\??\c:\7tbbhh.exec:\7tbbhh.exe41⤵
- Executes dropped EXE
PID:4384 -
\??\c:\3nhhbb.exec:\3nhhbb.exe42⤵
- Executes dropped EXE
PID:4252 -
\??\c:\pvdvp.exec:\pvdvp.exe43⤵
- Executes dropped EXE
PID:3588 -
\??\c:\jdjdd.exec:\jdjdd.exe44⤵
- Executes dropped EXE
PID:2564 -
\??\c:\fxfflrx.exec:\fxfflrx.exe45⤵
- Executes dropped EXE
PID:2016 -
\??\c:\lflfllr.exec:\lflfllr.exe46⤵
- Executes dropped EXE
PID:3328 -
\??\c:\hhnttb.exec:\hhnttb.exe47⤵
- Executes dropped EXE
PID:3416 -
\??\c:\httnnh.exec:\httnnh.exe48⤵
- Executes dropped EXE
PID:1868 -
\??\c:\1nthbt.exec:\1nthbt.exe49⤵
- Executes dropped EXE
PID:3248 -
\??\c:\vdvpj.exec:\vdvpj.exe50⤵
- Executes dropped EXE
PID:4852 -
\??\c:\pjvpd.exec:\pjvpd.exe51⤵
- Executes dropped EXE
PID:1208 -
\??\c:\xxxrlll.exec:\xxxrlll.exe52⤵
- Executes dropped EXE
PID:2004 -
\??\c:\lxrxlll.exec:\lxrxlll.exe53⤵
- Executes dropped EXE
PID:388 -
\??\c:\nhhbhh.exec:\nhhbhh.exe54⤵
- Executes dropped EXE
PID:3300 -
\??\c:\jvvvp.exec:\jvvvp.exe55⤵
- Executes dropped EXE
PID:1384 -
\??\c:\jvdvp.exec:\jvdvp.exe56⤵
- Executes dropped EXE
PID:4124 -
\??\c:\jpvvp.exec:\jpvvp.exe57⤵
- Executes dropped EXE
PID:1888 -
\??\c:\fxrrlll.exec:\fxrrlll.exe58⤵
- Executes dropped EXE
PID:4404 -
\??\c:\7llrrfx.exec:\7llrrfx.exe59⤵
- Executes dropped EXE
PID:704 -
\??\c:\nhnnnn.exec:\nhnnnn.exe60⤵
- Executes dropped EXE
PID:3168 -
\??\c:\1hnnnt.exec:\1hnnnt.exe61⤵
- Executes dropped EXE
PID:4516 -
\??\c:\dppjd.exec:\dppjd.exe62⤵
- Executes dropped EXE
PID:4208 -
\??\c:\jjdvv.exec:\jjdvv.exe63⤵
- Executes dropped EXE
PID:4056 -
\??\c:\xlllffx.exec:\xlllffx.exe64⤵
- Executes dropped EXE
PID:208 -
\??\c:\1xrxxff.exec:\1xrxxff.exe65⤵
- Executes dropped EXE
PID:216 -
\??\c:\hbntbb.exec:\hbntbb.exe66⤵PID:4472
-
\??\c:\thnnhn.exec:\thnnhn.exe67⤵PID:3224
-
\??\c:\5djjd.exec:\5djjd.exe68⤵PID:1064
-
\??\c:\rlxxrlf.exec:\rlxxrlf.exe69⤵PID:2104
-
\??\c:\9ffffrr.exec:\9ffffrr.exe70⤵PID:1928
-
\??\c:\fffxfrl.exec:\fffxfrl.exe71⤵PID:4428
-
\??\c:\thhhbb.exec:\thhhbb.exe72⤵PID:3440
-
\??\c:\9ntttb.exec:\9ntttb.exe73⤵PID:4664
-
\??\c:\3dddv.exec:\3dddv.exe74⤵PID:4184
-
\??\c:\dppjv.exec:\dppjv.exe75⤵PID:2184
-
\??\c:\xlllxxx.exec:\xlllxxx.exe76⤵PID:4888
-
\??\c:\bnnttt.exec:\bnnttt.exe77⤵PID:2408
-
\??\c:\btbthh.exec:\btbthh.exe78⤵PID:1052
-
\??\c:\vvjpd.exec:\vvjpd.exe79⤵PID:3608
-
\??\c:\dpvpd.exec:\dpvpd.exe80⤵PID:2888
-
\??\c:\rrrrrrl.exec:\rrrrrrl.exe81⤵PID:4940
-
\??\c:\llxxxxx.exec:\llxxxxx.exe82⤵PID:4388
-
\??\c:\rlllfff.exec:\rlllfff.exe83⤵PID:3444
-
\??\c:\bnnttb.exec:\bnnttb.exe84⤵PID:1380
-
\??\c:\bbhbhh.exec:\bbhbhh.exe85⤵PID:1072
-
\??\c:\ddpjj.exec:\ddpjj.exe86⤵PID:3324
-
\??\c:\dvjjp.exec:\dvjjp.exe87⤵PID:2612
-
\??\c:\9vpjj.exec:\9vpjj.exe88⤵PID:2452
-
\??\c:\5lrlxxx.exec:\5lrlxxx.exe89⤵PID:4708
-
\??\c:\rflllll.exec:\rflllll.exe90⤵PID:1476
-
\??\c:\tbhhnn.exec:\tbhhnn.exe91⤵PID:4484
-
\??\c:\bbtnbb.exec:\bbtnbb.exe92⤵PID:4120
-
\??\c:\hnhhht.exec:\hnhhht.exe93⤵PID:3268
-
\??\c:\vvvpv.exec:\vvvpv.exe94⤵PID:2180
-
\??\c:\pdjjj.exec:\pdjjj.exe95⤵PID:4632
-
\??\c:\nhtbhh.exec:\nhtbhh.exe96⤵PID:2984
-
\??\c:\btnnhh.exec:\btnnhh.exe97⤵PID:3980
-
\??\c:\jvddv.exec:\jvddv.exe98⤵PID:1068
-
\??\c:\lllxrff.exec:\lllxrff.exe99⤵PID:4384
-
\??\c:\7rrrllf.exec:\7rrrllf.exe100⤵PID:4252
-
\??\c:\nnnhbb.exec:\nnnhbb.exe101⤵PID:4088
-
\??\c:\hbnnhh.exec:\hbnnhh.exe102⤵PID:1220
-
\??\c:\vdjdp.exec:\vdjdp.exe103⤵PID:4432
-
\??\c:\xlfffff.exec:\xlfffff.exe104⤵PID:3136
-
\??\c:\5rrlfff.exec:\5rrlfff.exe105⤵PID:4700
-
\??\c:\hbtttn.exec:\hbtttn.exe106⤵PID:1364
-
\??\c:\tbbbbb.exec:\tbbbbb.exe107⤵PID:5064
-
\??\c:\vpppj.exec:\vpppj.exe108⤵PID:1208
-
\??\c:\3rxxrfl.exec:\3rxxrfl.exe109⤵PID:2004
-
\??\c:\rfffffx.exec:\rfffffx.exe110⤵PID:3724
-
\??\c:\htbttn.exec:\htbttn.exe111⤵PID:2384
-
\??\c:\1hnhbb.exec:\1hnhbb.exe112⤵PID:2712
-
\??\c:\tbhbth.exec:\tbhbth.exe113⤵PID:1236
-
\??\c:\pjjjj.exec:\pjjjj.exe114⤵PID:2600
-
\??\c:\jjddv.exec:\jjddv.exe115⤵PID:4188
-
\??\c:\7rrlffx.exec:\7rrlffx.exe116⤵PID:704
-
\??\c:\rlrllll.exec:\rlrllll.exe117⤵PID:2624
-
\??\c:\nnttnn.exec:\nnttnn.exe118⤵PID:1848
-
\??\c:\ththbb.exec:\ththbb.exe119⤵PID:2300
-
\??\c:\jvvvv.exec:\jvvvv.exe120⤵PID:916
-
\??\c:\vpvvv.exec:\vpvvv.exe121⤵PID:5100
-
\??\c:\9rxffxx.exec:\9rxffxx.exe122⤵PID:4640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-