Analysis
- max time kernel
150s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
19/06/2024, 04:33
Behavioral task
behavioral1
Sample
e85a85f4d37c26e72371b8ef84bb21b3a9553b91a627f13fa328e3ab09445aa0.exe
Resource
win7-20240611-en
6 signatures
150 seconds
General
- Target e85a85f4d37c26e72371b8ef84bb21b3a9553b91a627f13fa328e3ab09445aa0.exe
- Size 63KB
- Sample240619-e6n6jatfqd
- SHA256 e85a85f4d37c26e72371b8ef84bb21b3a9553b91a627f13fa328e3ab09445aa0
- MD5 3eae9a59788a73a79fc2a2a7158cae24
- SHA1 ce7a002e05bdbdad2220c5067bfc065c33d614ce
- SHA512 5912db18dcd71b2cfb895fcc8b4b830d184d1d30ceda7aa8f78e10c2a4a37c84637cf0ddae0c3eaaa960076c8d73c03c1b00106af2d338f788b4167b289ef276
- SSDEEP 1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+EMdbSd:zhOmTsF93UYfwC6GIoutiTWMdbo
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4284-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1772-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/892-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2412-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2548-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2060-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3688-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2456-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3864-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/740-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1372-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1636-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/508-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2532-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1864-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3348-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3896-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4064-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4472-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1740-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1108-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1720-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3528-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3344-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1200-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3968-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/508-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4696-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4572-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/232-406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4648-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-513-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-552-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3972-629-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-710-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1472-764-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/4284-1-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000022fd0-3.dat UPX behavioral2/memory/1772-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4956-9-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000900000002343b-8.dat UPX behavioral2/files/0x0007000000023442-11.dat UPX behavioral2/memory/4956-15-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/892-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023443-19.dat UPX behavioral2/memory/2412-22-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023444-24.dat UPX behavioral2/files/0x0007000000023445-28.dat UPX behavioral2/memory/3212-29-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023446-33.dat UPX behavioral2/memory/1488-37-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4908-35-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023447-39.dat UPX behavioral2/files/0x0007000000023448-43.dat UPX behavioral2/memory/2400-44-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002344a-48.dat UPX behavioral2/memory/1884-49-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002344b-53.dat UPX behavioral2/files/0x000700000002344c-58.dat UPX behavioral2/memory/4384-57-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002344d-62.dat UPX behavioral2/memory/5044-63-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002344e-67.dat UPX behavioral2/memory/2548-68-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2060-70-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002344f-73.dat UPX behavioral2/memory/2060-74-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023450-78.dat UPX behavioral2/memory/3500-79-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3688-86-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3292-87-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023451-84.dat UPX behavioral2/files/0x0007000000023452-89.dat UPX behavioral2/files/0x0007000000023453-93.dat UPX behavioral2/files/0x0007000000023454-97.dat UPX behavioral2/memory/2456-98-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023455-102.dat UPX behavioral2/memory/3616-103-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023456-107.dat UPX behavioral2/memory/3864-108-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023457-112.dat UPX behavioral2/memory/740-117-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023458-116.dat UPX behavioral2/files/0x0007000000023459-121.dat UPX behavioral2/memory/1372-126-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002345a-125.dat UPX behavioral2/memory/2348-130-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002345b-132.dat UPX behavioral2/memory/1636-133-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002345c-136.dat UPX behavioral2/memory/1636-138-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002345d-141.dat UPX behavioral2/memory/4936-142-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002345e-146.dat UPX behavioral2/memory/876-149-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002345f-151.dat UPX behavioral2/files/0x0007000000023460-155.dat UPX behavioral2/memory/508-159-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2532-164-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1864-167-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 1772 dvpdd.exe 4956 rlrlllr.exe 892 3tbbhn.exe 2412 bhbnhb.exe 3212 9djdd.exe 4908 5xfrffx.exe 1488 7xlfrlr.exe 2400 hbbtnh.exe 1884 jvjjv.exe 2856 fxfrllf.exe 4384 rxllxlx.exe 5044 nhbhtn.exe 2548 ddjvp.exe 2060 jpjdv.exe 3500 lxxlxrl.exe 3688 ntnnnt.exe 3292 jjjvp.exe 1800 5dddj.exe 2456 xrxllfr.exe 3616 hbnbhn.exe 3864 jdjdd.exe 404 xrxlxff.exe 740 rxlfxxr.exe 2980 7nnhbt.exe 1372 bhnhtn.exe 2348 pvpjd.exe 1636 fxflfff.exe 4936 nbthtn.exe 1500 3btnbt.exe 876 dvvpd.exe 4160 vjpdv.exe 508 llrrxrx.exe 4532 xrxrlxr.exe 2532 1tttnn.exe 1864 dvdjj.exe 3552 xlfxfrx.exe 1852 frrlxrf.exe 3892 bnnbhb.exe 3348 vpvpj.exe 3652 vpdvd.exe 2944 ffxrrxr.exe 2168 3nnnbn.exe 3896 htbthb.exe 4560 jvpdv.exe 4064 vjvjj.exe 1548 rrlxxfl.exe 4472 3tnnbt.exe 1632 vjdvj.exe 1664 pjjjv.exe 1740 rlxlfxr.exe 1780 xrrfxrl.exe 1696 htbttn.exe 1440 pjvpp.exe 1108 9ffrxrf.exe 3388 5frlxrf.exe 1720 btbhhb.exe 4616 nnbnhb.exe 3528 ppjdj.exe 1920 lffrfxl.exe 1728 fflxfxr.exe 2848 1ttnbb.exe 2572 jvvjd.exe 3672 ffxfflr.exe 4940 frlxlfx.exe -
resource yara_rule behavioral2/memory/4284-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000022fd0-3.dat upx behavioral2/memory/1772-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4956-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000900000002343b-8.dat upx behavioral2/files/0x0007000000023442-11.dat upx behavioral2/memory/4956-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/892-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023443-19.dat upx behavioral2/memory/2412-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023444-24.dat upx behavioral2/files/0x0007000000023445-28.dat upx behavioral2/memory/3212-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023446-33.dat upx behavioral2/memory/1488-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4908-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023447-39.dat upx behavioral2/files/0x0007000000023448-43.dat upx behavioral2/memory/2400-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344a-48.dat upx behavioral2/memory/1884-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344b-53.dat upx behavioral2/files/0x000700000002344c-58.dat upx behavioral2/memory/4384-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344d-62.dat upx behavioral2/memory/5044-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344e-67.dat upx behavioral2/memory/2548-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2060-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344f-73.dat upx behavioral2/memory/2060-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023450-78.dat upx behavioral2/memory/3500-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3688-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3292-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023451-84.dat upx behavioral2/files/0x0007000000023452-89.dat upx behavioral2/files/0x0007000000023453-93.dat upx behavioral2/files/0x0007000000023454-97.dat upx behavioral2/memory/2456-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023455-102.dat upx behavioral2/memory/3616-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023456-107.dat upx behavioral2/memory/3864-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023457-112.dat upx behavioral2/memory/740-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023458-116.dat upx behavioral2/files/0x0007000000023459-121.dat upx behavioral2/memory/1372-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345a-125.dat upx behavioral2/memory/2348-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345b-132.dat upx behavioral2/memory/1636-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345c-136.dat upx behavioral2/memory/1636-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345d-141.dat upx behavioral2/memory/4936-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345e-146.dat upx behavioral2/memory/876-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345f-151.dat upx behavioral2/files/0x0007000000023460-155.dat upx behavioral2/memory/508-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2532-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1864-167-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4284 wrote to memory of 1772 4284 e85a85f4d37c26e72371b8ef84bb21b3a9553b91a627f13fa328e3ab09445aa0.exe 82 PID 4284 wrote to memory of 1772 4284 e85a85f4d37c26e72371b8ef84bb21b3a9553b91a627f13fa328e3ab09445aa0.exe 82 PID 4284 wrote to memory of 1772 4284 e85a85f4d37c26e72371b8ef84bb21b3a9553b91a627f13fa328e3ab09445aa0.exe 82 PID 1772 wrote to memory of 4956 1772 dvpdd.exe 83 PID 1772 wrote to memory of 4956 1772 dvpdd.exe 83 PID 1772 wrote to memory of 4956 1772 dvpdd.exe 83 PID 4956 wrote to memory of 892 4956 rlrlllr.exe 84 PID 4956 wrote to memory of 892 4956 rlrlllr.exe 84 PID 4956 wrote to memory of 892 4956 rlrlllr.exe 84 PID 892 wrote to memory of 2412 892 3tbbhn.exe 85 PID 892 wrote to memory of 2412 892 3tbbhn.exe 85 PID 892 wrote to memory of 2412 892 3tbbhn.exe 85 PID 2412 wrote to memory of 3212 2412 bhbnhb.exe 86 PID 2412 wrote to memory of 3212 2412 bhbnhb.exe 86 PID 2412 wrote to memory of 3212 2412 bhbnhb.exe 86 PID 3212 wrote to memory of 4908 3212 9djdd.exe 87 PID 3212 wrote to memory of 4908 3212 9djdd.exe 87 PID 3212 wrote to memory of 4908 3212 9djdd.exe 87 PID 4908 wrote to memory of 1488 4908 5xfrffx.exe 88 PID 4908 wrote to memory of 1488 4908 5xfrffx.exe 88 PID 4908 wrote to memory of 1488 4908 5xfrffx.exe 88 PID 1488 wrote to memory of 2400 1488 7xlfrlr.exe 89 PID 1488 wrote to memory of 2400 1488 7xlfrlr.exe 89 PID 1488 wrote to memory of 2400 1488 7xlfrlr.exe 89 PID 2400 wrote to memory of 1884 2400 hbbtnh.exe 90 PID 2400 wrote to memory of 1884 2400 hbbtnh.exe 90 PID 2400 wrote to memory of 1884 2400 hbbtnh.exe 90 PID 1884 wrote to memory of 2856 1884 jvjjv.exe 91 PID 1884 wrote to memory of 2856 1884 jvjjv.exe 91 PID 1884 wrote to memory of 2856 1884 jvjjv.exe 91 PID 2856 wrote to memory of 4384 2856 fxfrllf.exe 92 PID 2856 wrote to memory of 4384 2856 fxfrllf.exe 92 PID 2856 wrote to memory of 4384 2856 fxfrllf.exe 92 PID 4384 wrote to memory of 5044 4384 rxllxlx.exe 93 PID 4384 wrote to memory of 5044 4384 rxllxlx.exe 93 PID 4384 wrote to memory of 5044 4384 rxllxlx.exe 93 PID 5044 wrote to memory of 2548 5044 nhbhtn.exe 94 PID 5044 wrote to memory of 2548 5044 nhbhtn.exe 94 PID 5044 wrote to memory of 2548 5044 nhbhtn.exe 94 PID 2548 wrote to memory of 2060 2548 ddjvp.exe 95 PID 2548 wrote to memory of 2060 2548 ddjvp.exe 95 PID 2548 wrote to memory of 2060 2548 ddjvp.exe 95 PID 2060 wrote to memory of 3500 2060 jpjdv.exe 96 PID 2060 wrote to memory of 3500 2060 jpjdv.exe 96 PID 2060 wrote to memory of 3500 2060 jpjdv.exe 96 PID 3500 wrote to memory of 3688 3500 lxxlxrl.exe 97 PID 3500 wrote to memory of 3688 3500 lxxlxrl.exe 97 PID 3500 wrote to memory of 3688 3500 lxxlxrl.exe 97 PID 3688 wrote to memory of 3292 3688 ntnnnt.exe 98 PID 3688 wrote to memory of 3292 3688 ntnnnt.exe 98 PID 3688 wrote to memory of 3292 3688 ntnnnt.exe 98 PID 3292 wrote to memory of 1800 3292 jjjvp.exe 99 PID 3292 wrote to memory of 1800 3292 jjjvp.exe 99 PID 3292 wrote to memory of 1800 3292 jjjvp.exe 99 PID 1800 wrote to memory of 2456 1800 5dddj.exe 100 PID 1800 wrote to memory of 2456 1800 5dddj.exe 100 PID 1800 wrote to memory of 2456 1800 5dddj.exe 100 PID 2456 wrote to memory of 3616 2456 xrxllfr.exe 101 PID 2456 wrote to memory of 3616 2456 xrxllfr.exe 101 PID 2456 wrote to memory of 3616 2456 xrxllfr.exe 101 PID 3616 wrote to memory of 3864 3616 hbnbhn.exe 102 PID 3616 wrote to memory of 3864 3616 hbnbhn.exe 102 PID 3616 wrote to memory of 3864 3616 hbnbhn.exe 102 PID 3864 wrote to memory of 404 3864 jdjdd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\e85a85f4d37c26e72371b8ef84bb21b3a9553b91a627f13fa328e3ab09445aa0.exe"C:\Users\Admin\AppData\Local\Temp\e85a85f4d37c26e72371b8ef84bb21b3a9553b91a627f13fa328e3ab09445aa0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\dvpdd.exec:\dvpdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\rlrlllr.exec:\rlrlllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\3tbbhn.exec:\3tbbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\bhbnhb.exec:\bhbnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\9djdd.exec:\9djdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\5xfrffx.exec:\5xfrffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\7xlfrlr.exec:\7xlfrlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\hbbtnh.exec:\hbbtnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\jvjjv.exec:\jvjjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\fxfrllf.exec:\fxfrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\rxllxlx.exec:\rxllxlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\nhbhtn.exec:\nhbhtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\ddjvp.exec:\ddjvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\jpjdv.exec:\jpjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\lxxlxrl.exec:\lxxlxrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\ntnnnt.exec:\ntnnnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\jjjvp.exec:\jjjvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\5dddj.exec:\5dddj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\xrxllfr.exec:\xrxllfr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\hbnbhn.exec:\hbnbhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\jdjdd.exec:\jdjdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\xrxlxff.exec:\xrxlxff.exe23⤵
- Executes dropped EXE
PID:404 -
\??\c:\rxlfxxr.exec:\rxlfxxr.exe24⤵
- Executes dropped EXE
PID:740 -
\??\c:\7nnhbt.exec:\7nnhbt.exe25⤵
- Executes dropped EXE
PID:2980 -
\??\c:\bhnhtn.exec:\bhnhtn.exe26⤵
- Executes dropped EXE
PID:1372 -
\??\c:\pvpjd.exec:\pvpjd.exe27⤵
- Executes dropped EXE
PID:2348 -
\??\c:\fxflfff.exec:\fxflfff.exe28⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nbthtn.exec:\nbthtn.exe29⤵
- Executes dropped EXE
PID:4936 -
\??\c:\3btnbt.exec:\3btnbt.exe30⤵
- Executes dropped EXE
PID:1500 -
\??\c:\dvvpd.exec:\dvvpd.exe31⤵
- Executes dropped EXE
PID:876 -
\??\c:\vjpdv.exec:\vjpdv.exe32⤵
- Executes dropped EXE
PID:4160 -
\??\c:\llrrxrx.exec:\llrrxrx.exe33⤵
- Executes dropped EXE
PID:508 -
\??\c:\xrxrlxr.exec:\xrxrlxr.exe34⤵
- Executes dropped EXE
PID:4532 -
\??\c:\1tttnn.exec:\1tttnn.exe35⤵
- Executes dropped EXE
PID:2532 -
\??\c:\dvdjj.exec:\dvdjj.exe36⤵
- Executes dropped EXE
PID:1864 -
\??\c:\xlfxfrx.exec:\xlfxfrx.exe37⤵
- Executes dropped EXE
PID:3552 -
\??\c:\frrlxrf.exec:\frrlxrf.exe38⤵
- Executes dropped EXE
PID:1852 -
\??\c:\bnnbhb.exec:\bnnbhb.exe39⤵
- Executes dropped EXE
PID:3892 -
\??\c:\vpvpj.exec:\vpvpj.exe40⤵
- Executes dropped EXE
PID:3348 -
\??\c:\vpdvd.exec:\vpdvd.exe41⤵
- Executes dropped EXE
PID:3652 -
\??\c:\ffxrrxr.exec:\ffxrrxr.exe42⤵
- Executes dropped EXE
PID:2944 -
\??\c:\3nnnbn.exec:\3nnnbn.exe43⤵
- Executes dropped EXE
PID:2168 -
\??\c:\htbthb.exec:\htbthb.exe44⤵
- Executes dropped EXE
PID:3896 -
\??\c:\jvpdv.exec:\jvpdv.exe45⤵
- Executes dropped EXE
PID:4560 -
\??\c:\vjvjj.exec:\vjvjj.exe46⤵
- Executes dropped EXE
PID:4064 -
\??\c:\rrlxxfl.exec:\rrlxxfl.exe47⤵
- Executes dropped EXE
PID:1548 -
\??\c:\3tnnbt.exec:\3tnnbt.exe48⤵
- Executes dropped EXE
PID:4472 -
\??\c:\vjdvj.exec:\vjdvj.exe49⤵
- Executes dropped EXE
PID:1632 -
\??\c:\pjjjv.exec:\pjjjv.exe50⤵
- Executes dropped EXE
PID:1664 -
\??\c:\rlxlfxr.exec:\rlxlfxr.exe51⤵
- Executes dropped EXE
PID:1740 -
\??\c:\xrrfxrl.exec:\xrrfxrl.exe52⤵
- Executes dropped EXE
PID:1780 -
\??\c:\htbttn.exec:\htbttn.exe53⤵
- Executes dropped EXE
PID:1696 -
\??\c:\pjvpp.exec:\pjvpp.exe54⤵
- Executes dropped EXE
PID:1440 -
\??\c:\9ffrxrf.exec:\9ffrxrf.exe55⤵
- Executes dropped EXE
PID:1108 -
\??\c:\5frlxrf.exec:\5frlxrf.exe56⤵
- Executes dropped EXE
PID:3388 -
\??\c:\btbhhb.exec:\btbhhb.exe57⤵
- Executes dropped EXE
PID:1720 -
\??\c:\nnbnhb.exec:\nnbnhb.exe58⤵
- Executes dropped EXE
PID:4616 -
\??\c:\ppjdj.exec:\ppjdj.exe59⤵
- Executes dropped EXE
PID:3528 -
\??\c:\lffrfxl.exec:\lffrfxl.exe60⤵
- Executes dropped EXE
PID:1920 -
\??\c:\fflxfxr.exec:\fflxfxr.exe61⤵
- Executes dropped EXE
PID:1728 -
\??\c:\1ttnbb.exec:\1ttnbb.exe62⤵
- Executes dropped EXE
PID:2848 -
\??\c:\jvvjd.exec:\jvvjd.exe63⤵
- Executes dropped EXE
PID:2572 -
\??\c:\ffxfflr.exec:\ffxfflr.exe64⤵
- Executes dropped EXE
PID:3672 -
\??\c:\frlxlfx.exec:\frlxlfx.exe65⤵
- Executes dropped EXE
PID:4940 -
\??\c:\7thttn.exec:\7thttn.exe66⤵PID:3344
-
\??\c:\9ttbtn.exec:\9ttbtn.exe67⤵PID:1428
-
\??\c:\dpjvv.exec:\dpjvv.exe68⤵PID:4552
-
\??\c:\rfrrfrf.exec:\rfrrfrf.exe69⤵PID:1588
-
\??\c:\5nbnnh.exec:\5nbnnh.exe70⤵PID:2372
-
\??\c:\hhnhbb.exec:\hhnhbb.exe71⤵PID:4864
-
\??\c:\pvjvj.exec:\pvjvj.exe72⤵PID:1924
-
\??\c:\xrxxxrl.exec:\xrxxxrl.exe73⤵PID:4592
-
\??\c:\3tthhb.exec:\3tthhb.exe74⤵PID:4028
-
\??\c:\dpdvd.exec:\dpdvd.exe75⤵PID:4268
-
\??\c:\rflfrxr.exec:\rflfrxr.exe76⤵PID:3616
-
\??\c:\1tnhbt.exec:\1tnhbt.exe77⤵PID:4048
-
\??\c:\7hhnbb.exec:\7hhnbb.exe78⤵PID:4444
-
\??\c:\dppdp.exec:\dppdp.exe79⤵PID:1996
-
\??\c:\ppvdj.exec:\ppvdj.exe80⤵PID:3928
-
\??\c:\3lfrffl.exec:\3lfrffl.exe81⤵PID:4764
-
\??\c:\xxxlxxr.exec:\xxxlxxr.exe82⤵PID:3964
-
\??\c:\hnnhtn.exec:\hnnhtn.exe83⤵PID:4868
-
\??\c:\3djpv.exec:\3djpv.exe84⤵PID:4600
-
\??\c:\jvvpv.exec:\jvvpv.exe85⤵PID:764
-
\??\c:\xlfrrxf.exec:\xlfrrxf.exe86⤵PID:1200
-
\??\c:\frlfrfx.exec:\frlfrfx.exe87⤵PID:648
-
\??\c:\btbnhh.exec:\btbnhh.exe88⤵PID:1184
-
\??\c:\3nbhtn.exec:\3nbhtn.exe89⤵PID:1500
-
\??\c:\vdddp.exec:\vdddp.exe90⤵PID:3968
-
\??\c:\llxrlfx.exec:\llxrlfx.exe91⤵PID:3260
-
\??\c:\7xfflfl.exec:\7xfflfl.exe92⤵PID:3060
-
\??\c:\hhbbtn.exec:\hhbbtn.exe93⤵PID:508
-
\??\c:\tbnntt.exec:\tbnntt.exe94⤵PID:392
-
\??\c:\jppdp.exec:\jppdp.exe95⤵PID:4532
-
\??\c:\vpjdv.exec:\vpjdv.exe96⤵PID:2424
-
\??\c:\frfxxlf.exec:\frfxxlf.exe97⤵PID:5028
-
\??\c:\btbbnn.exec:\btbbnn.exe98⤵PID:4088
-
\??\c:\nbtttt.exec:\nbtttt.exe99⤵PID:4168
-
\??\c:\pdjpv.exec:\pdjpv.exe100⤵PID:3436
-
\??\c:\vpvjp.exec:\vpvjp.exe101⤵PID:4620
-
\??\c:\xllffxr.exec:\xllffxr.exe102⤵PID:812
-
\??\c:\fxrlfxx.exec:\fxrlfxx.exe103⤵PID:1296
-
\??\c:\nhhbnn.exec:\nhhbnn.exe104⤵PID:2836
-
\??\c:\tnbthb.exec:\tnbthb.exe105⤵PID:2216
-
\??\c:\jppjd.exec:\jppjd.exe106⤵PID:4696
-
\??\c:\jvpdv.exec:\jvpdv.exe107⤵PID:4484
-
\??\c:\rfxllrx.exec:\rfxllrx.exe108⤵PID:1220
-
\??\c:\nnnthn.exec:\nnnthn.exe109⤵PID:4860
-
\??\c:\bhbntn.exec:\bhbntn.exe110⤵PID:4976
-
\??\c:\vjdpd.exec:\vjdpd.exe111⤵PID:1740
-
\??\c:\pdpvj.exec:\pdpvj.exe112⤵PID:1776
-
\??\c:\1lflfxl.exec:\1lflfxl.exe113⤵PID:4820
-
\??\c:\bnbtnh.exec:\bnbtnh.exe114⤵PID:3628
-
\??\c:\thbtnh.exec:\thbtnh.exe115⤵PID:3212
-
\??\c:\pvjdp.exec:\pvjdp.exe116⤵PID:1916
-
\??\c:\7dpdj.exec:\7dpdj.exe117⤵PID:3720
-
\??\c:\3lfrflf.exec:\3lfrflf.exe118⤵PID:3740
-
\??\c:\5hhbbn.exec:\5hhbbn.exe119⤵PID:3248
-
\??\c:\nnnbnn.exec:\nnnbnn.exe120⤵PID:3528
-
\??\c:\ttbnbt.exec:\ttbnbt.exe121⤵PID:1920
-
\??\c:\jdvpp.exec:\jdvpp.exe122⤵PID:1992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-