Analysis
- max time kernel
150s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/06/2024, 01:06
Behavioral task
behavioral1
Sample
a69d9f32cf4cdd6214132e63ebe28cb84558ea7071bbc2de6a40e9dcbd9ab719.exe
Resource
win7-20240508-en
7 signatures
150 seconds
General
- Target a69d9f32cf4cdd6214132e63ebe28cb84558ea7071bbc2de6a40e9dcbd9ab719.exe
- Size 3.7MB
- Sample240619-bgbmcsverk
- SHA256 a69d9f32cf4cdd6214132e63ebe28cb84558ea7071bbc2de6a40e9dcbd9ab719
- MD5 f145e5eea880420557311e9915d5fac8
- SHA1 38534fef2adcaaf09880fd2f6ef76d19290aad5a
- SHA512 f73ad7e2a95d7939988df32e0dc975c5ec7d74a0bd1ab9391c687f04749acea04052f9dabdbfcfce85d21ee579541e8377ab42ed2da885714e57ae55db68d26c
- SSDEEP 49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98Y:U6XLq/qPPslzKx/dJg1ErmNZ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4308-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3796-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2972-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1344-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3752-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2716-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3044-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3920-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3224-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/860-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2976-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2628-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2104-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2832-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/956-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/956-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2940-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3860-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2624-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3796-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4240-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4448-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4232-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/820-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3920-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3580-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2780-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3324-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1976-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1432-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3828-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2752-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2396-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4240-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2164-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3752-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3768-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4076-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3744-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2648-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1320-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1812-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2672-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2696-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-578-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/972-603-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-610-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2488-620-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-660-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1792-676-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1600-689-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-724-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/4308-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00090000000233ea-3.dat UPX behavioral2/memory/4308-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3796-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341d-10.dat UPX behavioral2/memory/2972-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341e-14.dat UPX behavioral2/memory/2972-18-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341f-23.dat UPX behavioral2/memory/2552-25-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2996-26-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3752-32-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023420-31.dat UPX behavioral2/files/0x0007000000023422-36.dat UPX behavioral2/memory/1344-39-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3752-38-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023423-43.dat UPX behavioral2/memory/2716-45-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4000-56-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023424-55.dat UPX behavioral2/files/0x000800000002341a-49.dat UPX behavioral2/memory/3044-51-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3920-63-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023425-62.dat UPX behavioral2/files/0x000c0000000229d4-67.dat UPX behavioral2/memory/3224-69-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0005000000022ae3-74.dat UPX behavioral2/files/0x0005000000022ae4-78.dat UPX behavioral2/memory/860-81-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2440-80-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023426-86.dat UPX behavioral2/files/0x0007000000023427-91.dat UPX behavioral2/files/0x0007000000023428-96.dat UPX behavioral2/memory/2976-97-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2628-102-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023429-101.dat UPX behavioral2/files/0x000700000002342a-107.dat UPX behavioral2/memory/2104-109-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2832-115-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342b-113.dat UPX behavioral2/files/0x000700000002342c-120.dat UPX behavioral2/files/0x000700000002342d-124.dat UPX behavioral2/memory/1524-126-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342e-129.dat UPX behavioral2/files/0x0007000000023430-134.dat UPX behavioral2/memory/956-137-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023431-141.dat UPX behavioral2/memory/956-144-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2940-142-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023432-147.dat UPX behavioral2/files/0x0007000000023433-153.dat UPX behavioral2/files/0x0007000000023434-159.dat UPX behavioral2/memory/3860-165-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023435-163.dat UPX behavioral2/files/0x0007000000023436-170.dat UPX behavioral2/memory/2624-171-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023437-175.dat UPX behavioral2/memory/4372-182-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023438-180.dat UPX behavioral2/files/0x0007000000023439-187.dat UPX behavioral2/memory/3796-191-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4240-195-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2644-199-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4448-203-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 3796 btbnhh.exe 2972 ddddv.exe 2552 bttbbn.exe 2996 7nhnhn.exe 3752 bhhbtt.exe 1344 thhhbt.exe 2716 hbhbhb.exe 3044 htbtnn.exe 4000 jpppd.exe 3920 bbhhhb.exe 3224 vpjjd.exe 2440 hhbtbb.exe 860 httnnh.exe 876 pvddv.exe 2208 9frlflf.exe 2976 xrrlllf.exe 2628 1frfllf.exe 2104 xrxrxrx.exe 2832 9xflfxx.exe 2920 lxlrrrr.exe 1524 nbnhhb.exe 4676 9djvv.exe 956 xflfxrl.exe 2940 rlrlfxr.exe 4692 jdppv.exe 4848 pvddp.exe 3860 rrfffff.exe 2080 5vjjd.exe 2624 ddjdv.exe 4668 fxffxxr.exe 4372 vvvvp.exe 3796 vjddp.exe 4240 ffrflll.exe 2644 nntthh.exe 4448 xlllffx.exe 3264 dvddd.exe 4232 jjvpj.exe 5072 llrlfff.exe 820 hnnhtt.exe 2320 1lrlffx.exe 1776 7xffxxf.exe 4000 rrfxrrl.exe 3920 jpvpp.exe 3580 rlrrlrl.exe 1484 9rfxxrr.exe 1348 rrlfxxx.exe 2780 rrrrlff.exe 3324 pppjj.exe 1976 vpppj.exe 1432 dvddj.exe 3828 5pjdv.exe 2792 pvddp.exe 4292 3thntt.exe 4900 bntnhh.exe 1736 nbtnhb.exe 2752 frxrrrl.exe 2844 lrxrxfl.exe 2396 1fffxfx.exe 4064 5pjdd.exe 1532 jdpvp.exe 1656 pdjjd.exe 1320 nhnhbt.exe 2080 tnhhhb.exe 4364 tnbhnh.exe -
resource yara_rule behavioral2/memory/4308-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233ea-3.dat upx behavioral2/memory/4308-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3796-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341d-10.dat upx behavioral2/memory/2972-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341e-14.dat upx behavioral2/memory/2972-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341f-23.dat upx behavioral2/memory/2552-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2996-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3752-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-31.dat upx behavioral2/files/0x0007000000023422-36.dat upx behavioral2/memory/1344-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3752-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-43.dat upx behavioral2/memory/2716-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4000-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-55.dat upx behavioral2/files/0x000800000002341a-49.dat upx behavioral2/memory/3044-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3920-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-62.dat upx behavioral2/files/0x000c0000000229d4-67.dat upx behavioral2/memory/3224-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0005000000022ae3-74.dat upx behavioral2/files/0x0005000000022ae4-78.dat upx behavioral2/memory/860-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2440-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-86.dat upx behavioral2/files/0x0007000000023427-91.dat upx behavioral2/files/0x0007000000023428-96.dat upx behavioral2/memory/2976-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2628-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023429-101.dat upx behavioral2/files/0x000700000002342a-107.dat upx behavioral2/memory/2104-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2832-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342b-113.dat upx behavioral2/files/0x000700000002342c-120.dat upx behavioral2/files/0x000700000002342d-124.dat upx behavioral2/memory/1524-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342e-129.dat upx behavioral2/files/0x0007000000023430-134.dat upx behavioral2/memory/956-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023431-141.dat upx behavioral2/memory/956-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2940-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023432-147.dat upx behavioral2/files/0x0007000000023433-153.dat upx behavioral2/files/0x0007000000023434-159.dat upx behavioral2/memory/3860-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023435-163.dat upx behavioral2/files/0x0007000000023436-170.dat upx behavioral2/memory/2624-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023437-175.dat upx behavioral2/memory/4372-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023438-180.dat upx behavioral2/files/0x0007000000023439-187.dat upx behavioral2/memory/3796-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4240-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2644-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4448-203-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4308 wrote to memory of 3796 4308 a69d9f32cf4cdd6214132e63ebe28cb84558ea7071bbc2de6a40e9dcbd9ab719.exe 83 PID 4308 wrote to memory of 3796 4308 a69d9f32cf4cdd6214132e63ebe28cb84558ea7071bbc2de6a40e9dcbd9ab719.exe 83 PID 4308 wrote to memory of 3796 4308 a69d9f32cf4cdd6214132e63ebe28cb84558ea7071bbc2de6a40e9dcbd9ab719.exe 83 PID 3796 wrote to memory of 2972 3796 btbnhh.exe 85 PID 3796 wrote to memory of 2972 3796 btbnhh.exe 85 PID 3796 wrote to memory of 2972 3796 btbnhh.exe 85 PID 2972 wrote to memory of 2552 2972 ddddv.exe 88 PID 2972 wrote to memory of 2552 2972 ddddv.exe 88 PID 2972 wrote to memory of 2552 2972 ddddv.exe 88 PID 2552 wrote to memory of 2996 2552 bttbbn.exe 89 PID 2552 wrote to memory of 2996 2552 bttbbn.exe 89 PID 2552 wrote to memory of 2996 2552 bttbbn.exe 89 PID 2996 wrote to memory of 3752 2996 7nhnhn.exe 166 PID 2996 wrote to memory of 3752 2996 7nhnhn.exe 166 PID 2996 wrote to memory of 3752 2996 7nhnhn.exe 166 PID 3752 wrote to memory of 1344 3752 bhhbtt.exe 91 PID 3752 wrote to memory of 1344 3752 bhhbtt.exe 91 PID 3752 wrote to memory of 1344 3752 bhhbtt.exe 91 PID 1344 wrote to memory of 2716 1344 thhhbt.exe 92 PID 1344 wrote to memory of 2716 1344 thhhbt.exe 92 PID 1344 wrote to memory of 2716 1344 thhhbt.exe 92 PID 2716 wrote to memory of 3044 2716 hbhbhb.exe 93 PID 2716 wrote to memory of 3044 2716 hbhbhb.exe 93 PID 2716 wrote to memory of 3044 2716 hbhbhb.exe 93 PID 3044 wrote to memory of 4000 3044 htbtnn.exe 132 PID 3044 wrote to memory of 4000 3044 htbtnn.exe 132 PID 3044 wrote to memory of 4000 3044 htbtnn.exe 132 PID 4000 wrote to memory of 3920 4000 jpppd.exe 173 PID 4000 wrote to memory of 3920 4000 jpppd.exe 173 PID 4000 wrote to memory of 3920 4000 jpppd.exe 173 PID 3920 wrote to memory of 3224 3920 bbhhhb.exe 96 PID 3920 wrote to memory of 3224 3920 bbhhhb.exe 96 PID 3920 wrote to memory of 3224 3920 bbhhhb.exe 96 PID 3224 wrote to memory of 2440 3224 vpjjd.exe 97 PID 3224 wrote to memory of 2440 3224 vpjjd.exe 97 PID 3224 wrote to memory of 2440 3224 vpjjd.exe 97 PID 2440 wrote to memory of 860 2440 hhbtbb.exe 98 PID 2440 wrote to memory of 860 2440 hhbtbb.exe 98 PID 2440 wrote to memory of 860 2440 hhbtbb.exe 98 PID 860 wrote to memory of 876 860 httnnh.exe 99 PID 860 wrote to memory of 876 860 httnnh.exe 99 PID 860 wrote to memory of 876 860 httnnh.exe 99 PID 876 wrote to memory of 2208 876 pvddv.exe 179 PID 876 wrote to memory of 2208 876 pvddv.exe 179 PID 876 wrote to memory of 2208 876 pvddv.exe 179 PID 2208 wrote to memory of 2976 2208 9frlflf.exe 103 PID 2208 wrote to memory of 2976 2208 9frlflf.exe 103 PID 2208 wrote to memory of 2976 2208 9frlflf.exe 103 PID 2976 wrote to memory of 2628 2976 xrrlllf.exe 104 PID 2976 wrote to memory of 2628 2976 xrrlllf.exe 104 PID 2976 wrote to memory of 2628 2976 xrrlllf.exe 104 PID 2628 wrote to memory of 2104 2628 1frfllf.exe 105 PID 2628 wrote to memory of 2104 2628 1frfllf.exe 105 PID 2628 wrote to memory of 2104 2628 1frfllf.exe 105 PID 2104 wrote to memory of 2832 2104 xrxrxrx.exe 106 PID 2104 wrote to memory of 2832 2104 xrxrxrx.exe 106 PID 2104 wrote to memory of 2832 2104 xrxrxrx.exe 106 PID 2832 wrote to memory of 2920 2832 9xflfxx.exe 107 PID 2832 wrote to memory of 2920 2832 9xflfxx.exe 107 PID 2832 wrote to memory of 2920 2832 9xflfxx.exe 107 PID 2920 wrote to memory of 1524 2920 lxlrrrr.exe 108 PID 2920 wrote to memory of 1524 2920 lxlrrrr.exe 108 PID 2920 wrote to memory of 1524 2920 lxlrrrr.exe 108 PID 1524 wrote to memory of 4676 1524 nbnhhb.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\a69d9f32cf4cdd6214132e63ebe28cb84558ea7071bbc2de6a40e9dcbd9ab719.exe"C:\Users\Admin\AppData\Local\Temp\a69d9f32cf4cdd6214132e63ebe28cb84558ea7071bbc2de6a40e9dcbd9ab719.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\btbnhh.exec:\btbnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\ddddv.exec:\ddddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\bttbbn.exec:\bttbbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\7nhnhn.exec:\7nhnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\bhhbtt.exec:\bhhbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\thhhbt.exec:\thhhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\hbhbhb.exec:\hbhbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\htbtnn.exec:\htbtnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\jpppd.exec:\jpppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\bbhhhb.exec:\bbhhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\vpjjd.exec:\vpjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\hhbtbb.exec:\hhbtbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\httnnh.exec:\httnnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\pvddv.exec:\pvddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\9frlflf.exec:\9frlflf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\xrrlllf.exec:\xrrlllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\1frfllf.exec:\1frfllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\xrxrxrx.exec:\xrxrxrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\9xflfxx.exec:\9xflfxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\lxlrrrr.exec:\lxlrrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\nbnhhb.exec:\nbnhhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\9djvv.exec:\9djvv.exe23⤵
- Executes dropped EXE
PID:4676 -
\??\c:\xflfxrl.exec:\xflfxrl.exe24⤵
- Executes dropped EXE
PID:956 -
\??\c:\rlrlfxr.exec:\rlrlfxr.exe25⤵
- Executes dropped EXE
PID:2940 -
\??\c:\jdppv.exec:\jdppv.exe26⤵
- Executes dropped EXE
PID:4692 -
\??\c:\pvddp.exec:\pvddp.exe27⤵
- Executes dropped EXE
PID:4848 -
\??\c:\rrfffff.exec:\rrfffff.exe28⤵
- Executes dropped EXE
PID:3860 -
\??\c:\5vjjd.exec:\5vjjd.exe29⤵
- Executes dropped EXE
PID:2080 -
\??\c:\ddjdv.exec:\ddjdv.exe30⤵
- Executes dropped EXE
PID:2624 -
\??\c:\fxffxxr.exec:\fxffxxr.exe31⤵
- Executes dropped EXE
PID:4668 -
\??\c:\vvvvp.exec:\vvvvp.exe32⤵
- Executes dropped EXE
PID:4372 -
\??\c:\vjddp.exec:\vjddp.exe33⤵
- Executes dropped EXE
PID:3796 -
\??\c:\ffrflll.exec:\ffrflll.exe34⤵
- Executes dropped EXE
PID:4240 -
\??\c:\nntthh.exec:\nntthh.exe35⤵
- Executes dropped EXE
PID:2644 -
\??\c:\xlllffx.exec:\xlllffx.exe36⤵
- Executes dropped EXE
PID:4448 -
\??\c:\dvddd.exec:\dvddd.exe37⤵
- Executes dropped EXE
PID:3264 -
\??\c:\jjvpj.exec:\jjvpj.exe38⤵
- Executes dropped EXE
PID:4232 -
\??\c:\llrlfff.exec:\llrlfff.exe39⤵
- Executes dropped EXE
PID:5072 -
\??\c:\hnnhtt.exec:\hnnhtt.exe40⤵
- Executes dropped EXE
PID:820 -
\??\c:\1lrlffx.exec:\1lrlffx.exe41⤵
- Executes dropped EXE
PID:2320 -
\??\c:\7xffxxf.exec:\7xffxxf.exe42⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe43⤵
- Executes dropped EXE
PID:4000 -
\??\c:\jpvpp.exec:\jpvpp.exe44⤵
- Executes dropped EXE
PID:3920 -
\??\c:\rlrrlrl.exec:\rlrrlrl.exe45⤵
- Executes dropped EXE
PID:3580 -
\??\c:\9rfxxrr.exec:\9rfxxrr.exe46⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rrlfxxx.exec:\rrlfxxx.exe47⤵
- Executes dropped EXE
PID:1348 -
\??\c:\rrrrlff.exec:\rrrrlff.exe48⤵
- Executes dropped EXE
PID:2780 -
\??\c:\pppjj.exec:\pppjj.exe49⤵
- Executes dropped EXE
PID:3324 -
\??\c:\vpppj.exec:\vpppj.exe50⤵
- Executes dropped EXE
PID:1976 -
\??\c:\dvddj.exec:\dvddj.exe51⤵
- Executes dropped EXE
PID:1432 -
\??\c:\5pjdv.exec:\5pjdv.exe52⤵
- Executes dropped EXE
PID:3828 -
\??\c:\pvddp.exec:\pvddp.exe53⤵
- Executes dropped EXE
PID:2792 -
\??\c:\3thntt.exec:\3thntt.exe54⤵
- Executes dropped EXE
PID:4292 -
\??\c:\bntnhh.exec:\bntnhh.exe55⤵
- Executes dropped EXE
PID:4900 -
\??\c:\nbtnhb.exec:\nbtnhb.exe56⤵
- Executes dropped EXE
PID:1736 -
\??\c:\frxrrrl.exec:\frxrrrl.exe57⤵
- Executes dropped EXE
PID:2752 -
\??\c:\lrxrxfl.exec:\lrxrxfl.exe58⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1fffxfx.exec:\1fffxfx.exe59⤵
- Executes dropped EXE
PID:2396 -
\??\c:\5pjdd.exec:\5pjdd.exe60⤵
- Executes dropped EXE
PID:4064 -
\??\c:\jdpvp.exec:\jdpvp.exe61⤵
- Executes dropped EXE
PID:1532 -
\??\c:\pdjjd.exec:\pdjjd.exe62⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nhnhbt.exec:\nhnhbt.exe63⤵
- Executes dropped EXE
PID:1320 -
\??\c:\tnhhhb.exec:\tnhhhb.exe64⤵
- Executes dropped EXE
PID:2080 -
\??\c:\tnbhnh.exec:\tnbhnh.exe65⤵
- Executes dropped EXE
PID:4364 -
\??\c:\5hbbtn.exec:\5hbbtn.exe66⤵PID:2796
-
\??\c:\llrllll.exec:\llrllll.exe67⤵PID:2428
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe68⤵PID:224
-
\??\c:\3jpjd.exec:\3jpjd.exe69⤵PID:992
-
\??\c:\dppjp.exec:\dppjp.exe70⤵PID:3952
-
\??\c:\jjvvj.exec:\jjvvj.exe71⤵PID:4240
-
\??\c:\pjpjj.exec:\pjpjj.exe72⤵PID:2164
-
\??\c:\nttntn.exec:\nttntn.exe73⤵PID:3028
-
\??\c:\3tbtnh.exec:\3tbtnh.exe74⤵PID:3336
-
\??\c:\3tnhhh.exec:\3tnhhh.exe75⤵PID:3752
-
\??\c:\hhtnnn.exec:\hhtnnn.exe76⤵PID:624
-
\??\c:\1tnhbb.exec:\1tnhbb.exe77⤵PID:2004
-
\??\c:\hhtttt.exec:\hhtttt.exe78⤵PID:5044
-
\??\c:\rfrlrrl.exec:\rfrlrrl.exe79⤵PID:3340
-
\??\c:\lffxfxl.exec:\lffxfxl.exe80⤵PID:3232
-
\??\c:\vvvpp.exec:\vvvpp.exe81⤵PID:4004
-
\??\c:\9dvvv.exec:\9dvvv.exe82⤵PID:3920
-
\??\c:\5pjvd.exec:\5pjvd.exe83⤵PID:3768
-
\??\c:\tbhbhb.exec:\tbhbhb.exe84⤵PID:2376
-
\??\c:\nbhbtb.exec:\nbhbtb.exe85⤵PID:3724
-
\??\c:\1rxxrrr.exec:\1rxxrrr.exe86⤵PID:1300
-
\??\c:\rllfxfx.exec:\rllfxfx.exe87⤵PID:4352
-
\??\c:\5pjjd.exec:\5pjjd.exe88⤵PID:2208
-
\??\c:\ddppv.exec:\ddppv.exe89⤵PID:3116
-
\??\c:\jjdpj.exec:\jjdpj.exe90⤵PID:4076
-
\??\c:\5bhnhh.exec:\5bhnhh.exe91⤵PID:2184
-
\??\c:\5htnhb.exec:\5htnhb.exe92⤵PID:1564
-
\??\c:\tntnhb.exec:\tntnhb.exe93⤵PID:4224
-
\??\c:\fllfxrr.exec:\fllfxrr.exe94⤵PID:2696
-
\??\c:\fxrlfff.exec:\fxrlfff.exe95⤵PID:3384
-
\??\c:\ppddv.exec:\ppddv.exe96⤵PID:2940
-
\??\c:\pddvp.exec:\pddvp.exe97⤵PID:3744
-
\??\c:\vpjdd.exec:\vpjdd.exe98⤵PID:2280
-
\??\c:\nttbnn.exec:\nttbnn.exe99⤵PID:2648
-
\??\c:\nntnhb.exec:\nntnhb.exe100⤵PID:1016
-
\??\c:\3xfrlfx.exec:\3xfrlfx.exe101⤵PID:4556
-
\??\c:\xrflffx.exec:\xrflffx.exe102⤵PID:1320
-
\??\c:\flrrrll.exec:\flrrrll.exe103⤵PID:2080
-
\??\c:\vvvvp.exec:\vvvvp.exe104⤵PID:4364
-
\??\c:\jdvvd.exec:\jdvvd.exe105⤵PID:1812
-
\??\c:\bttttt.exec:\bttttt.exe106⤵PID:4608
-
\??\c:\hnthnt.exec:\hnthnt.exe107⤵PID:4536
-
\??\c:\xrxrxrl.exec:\xrxrxrl.exe108⤵PID:3956
-
\??\c:\9llllfl.exec:\9llllfl.exe109⤵PID:3112
-
\??\c:\ffrrrrl.exec:\ffrrrrl.exe110⤵PID:1980
-
\??\c:\7pvvv.exec:\7pvvv.exe111⤵PID:2644
-
\??\c:\5jdpp.exec:\5jdpp.exe112⤵PID:4892
-
\??\c:\3hthbh.exec:\3hthbh.exe113⤵PID:1344
-
\??\c:\9htnhh.exec:\9htnhh.exe114⤵PID:3772
-
\??\c:\jdppj.exec:\jdppj.exe115⤵PID:1544
-
\??\c:\jdppp.exec:\jdppp.exe116⤵PID:3824
-
\??\c:\9dddv.exec:\9dddv.exe117⤵PID:4664
-
\??\c:\ddvdd.exec:\ddvdd.exe118⤵PID:1404
-
\??\c:\jpjjp.exec:\jpjjp.exe119⤵PID:3836
-
\??\c:\3jddv.exec:\3jddv.exe120⤵PID:3196
-
\??\c:\pvpvp.exec:\pvpvp.exe121⤵PID:2688
-
\??\c:\nhttth.exec:\nhttth.exe122⤵PID:3208
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-