Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
20/06/2024, 22:41
Behavioral task
behavioral1
Sample
61d50e263389fd156d9152230bda8f684fac503d07473ba025d12856139c4fcb.exe
Resource
win7-20240611-en
6 signatures
150 seconds
General
- Target 61d50e263389fd156d9152230bda8f684fac503d07473ba025d12856139c4fcb.exe
- Size 84KB
- Sample240620-2mb37avdnn
- SHA256 61d50e263389fd156d9152230bda8f684fac503d07473ba025d12856139c4fcb
- MD5 691982066e9582b22ac19cbe2da84e13
- SHA1 49da94839ea8a7e62b2e897863096b5b9c35be7a
- SHA512 866fcb2f899374d2ed94b572d420781bcf2ee1df9224e084100a9456c677585bc89f657abbf1d59f7ddc26f329a7642ff4bbcdbed201bb911f405e79eaaedc9f
- SSDEEP 1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6TQpCiho:zhOmTsF93UYfwC6GIoutiTU2HVS64ho
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/220-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/376-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2656-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2576-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1032-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/532-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4676-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2292-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4172-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/368-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2592-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2164-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1664-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4652-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1048-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2112-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1988-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4152-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2820-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1072-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1376-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1376-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3928-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3880-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/940-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4152-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2660-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1756-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2132-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1064-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1956-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3660-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1596-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4276-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4276-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3796-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2928-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-497-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3232-611-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-627-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/220-1-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/376-4-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0008000000022f51-5.dat UPX behavioral2/files/0x000900000002340c-8.dat UPX behavioral2/memory/376-9-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023413-11.dat UPX behavioral2/memory/4860-16-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2656-18-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023414-19.dat UPX behavioral2/memory/2576-24-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023416-23.dat UPX behavioral2/files/0x0007000000023417-28.dat UPX behavioral2/memory/552-30-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2288-31-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023418-35.dat UPX behavioral2/memory/3776-38-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023419-39.dat UPX behavioral2/files/0x000700000002341a-43.dat UPX behavioral2/memory/1032-46-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4852-45-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341b-49.dat UPX behavioral2/memory/1032-50-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341c-55.dat UPX behavioral2/memory/532-57-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341d-59.dat UPX behavioral2/files/0x000700000002341e-63.dat UPX behavioral2/memory/4816-65-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4676-66-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341f-69.dat UPX behavioral2/files/0x0007000000023420-73.dat UPX behavioral2/memory/2292-75-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5060-77-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023421-79.dat UPX behavioral2/files/0x0007000000023422-83.dat UPX behavioral2/memory/4432-85-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023423-88.dat UPX behavioral2/files/0x0007000000023424-93.dat UPX behavioral2/memory/4172-95-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023425-97.dat UPX behavioral2/memory/368-99-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023426-103.dat UPX behavioral2/files/0x0007000000023427-106.dat UPX behavioral2/files/0x0007000000023428-110.dat UPX behavioral2/memory/2592-111-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023429-115.dat UPX behavioral2/memory/1356-117-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5036-118-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342a-121.dat UPX behavioral2/files/0x000700000002342b-126.dat UPX behavioral2/memory/2164-125-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342c-131.dat UPX behavioral2/memory/1664-130-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4652-135-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342d-136.dat UPX behavioral2/memory/1048-140-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0008000000023410-141.dat UPX behavioral2/memory/2112-145-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342e-146.dat UPX behavioral2/memory/1988-149-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342f-152.dat UPX behavioral2/files/0x0007000000023430-155.dat UPX behavioral2/memory/4940-159-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4940-162-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4152-164-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 376 bhnhht.exe 4860 vvvvv.exe 2656 1lxrllx.exe 2576 bnnnnn.exe 552 1pppp.exe 2288 9rlfllf.exe 3776 llffxrr.exe 4852 hbhnbh.exe 1032 xxrffxf.exe 1416 rfrxxff.exe 532 hnnnnn.exe 4816 jpvvp.exe 4676 fffffff.exe 2292 flffffl.exe 5060 nhnntb.exe 4432 vddjj.exe 1164 xxllxff.exe 368 rrlffll.exe 4172 hnbhbh.exe 4740 ddjvj.exe 4868 jjddj.exe 2592 lxffxxr.exe 1356 3xrxrxx.exe 5036 hbhttb.exe 2164 vjppp.exe 1664 jdddd.exe 4652 lfrlffx.exe 1048 tthtnn.exe 2112 5lxxxlf.exe 1988 bbbbbh.exe 4836 ttbbnt.exe 4276 ddvvj.exe 4940 ffxxxxf.exe 4152 5bhbht.exe 3048 djpdv.exe 4948 ddpjd.exe 2820 3xrlfxr.exe 2660 flrlfxr.exe 3320 5bttnh.exe 1008 7hnnhh.exe 1072 vpvjp.exe 3956 dppjv.exe 1056 3xfrrll.exe 4956 fllfxrx.exe 1812 ntbtnn.exe 1376 3bhhhn.exe 460 vppdp.exe 1492 jpppj.exe 1632 frlfrll.exe 4608 lfrrlrr.exe 228 hbttnn.exe 1404 nhttnt.exe 376 9dvvd.exe 3096 vpdvp.exe 4492 xrrrrxx.exe 4220 llffxxr.exe 1068 hnhhhh.exe 1620 hntbtt.exe 2496 vjppp.exe 920 vvvpj.exe 4968 fxlfffr.exe 3324 lxfllll.exe 4852 9nhnnn.exe 3716 3bhhbh.exe -
resource yara_rule behavioral2/memory/220-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/376-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022f51-5.dat upx behavioral2/files/0x000900000002340c-8.dat upx behavioral2/memory/376-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023413-11.dat upx behavioral2/memory/4860-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2656-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023414-19.dat upx behavioral2/memory/2576-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-23.dat upx behavioral2/files/0x0007000000023417-28.dat upx behavioral2/memory/552-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2288-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023418-35.dat upx behavioral2/memory/3776-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023419-39.dat upx behavioral2/files/0x000700000002341a-43.dat upx behavioral2/memory/1032-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4852-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341b-49.dat upx behavioral2/memory/1032-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341c-55.dat upx behavioral2/memory/532-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341d-59.dat upx behavioral2/files/0x000700000002341e-63.dat upx behavioral2/memory/4816-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4676-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341f-69.dat upx behavioral2/files/0x0007000000023420-73.dat upx behavioral2/memory/2292-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5060-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-79.dat upx behavioral2/files/0x0007000000023422-83.dat upx behavioral2/memory/4432-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-88.dat upx behavioral2/files/0x0007000000023424-93.dat upx behavioral2/memory/4172-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-97.dat upx behavioral2/memory/368-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-103.dat upx behavioral2/files/0x0007000000023427-106.dat upx behavioral2/files/0x0007000000023428-110.dat upx behavioral2/memory/2592-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023429-115.dat upx behavioral2/memory/1356-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5036-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-121.dat upx behavioral2/files/0x000700000002342b-126.dat upx behavioral2/memory/2164-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342c-131.dat upx behavioral2/memory/1664-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4652-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-136.dat upx behavioral2/memory/1048-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023410-141.dat upx behavioral2/memory/2112-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342e-146.dat upx behavioral2/memory/1988-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342f-152.dat upx behavioral2/files/0x0007000000023430-155.dat upx behavioral2/memory/4940-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4940-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4152-164-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 220 wrote to memory of 376 220 61d50e263389fd156d9152230bda8f684fac503d07473ba025d12856139c4fcb.exe 82 PID 220 wrote to memory of 376 220 61d50e263389fd156d9152230bda8f684fac503d07473ba025d12856139c4fcb.exe 82 PID 220 wrote to memory of 376 220 61d50e263389fd156d9152230bda8f684fac503d07473ba025d12856139c4fcb.exe 82 PID 376 wrote to memory of 4860 376 bhnhht.exe 83 PID 376 wrote to memory of 4860 376 bhnhht.exe 83 PID 376 wrote to memory of 4860 376 bhnhht.exe 83 PID 4860 wrote to memory of 2656 4860 vvvvv.exe 84 PID 4860 wrote to memory of 2656 4860 vvvvv.exe 84 PID 4860 wrote to memory of 2656 4860 vvvvv.exe 84 PID 2656 wrote to memory of 2576 2656 1lxrllx.exe 85 PID 2656 wrote to memory of 2576 2656 1lxrllx.exe 85 PID 2656 wrote to memory of 2576 2656 1lxrllx.exe 85 PID 2576 wrote to memory of 552 2576 bnnnnn.exe 86 PID 2576 wrote to memory of 552 2576 bnnnnn.exe 86 PID 2576 wrote to memory of 552 2576 bnnnnn.exe 86 PID 552 wrote to memory of 2288 552 1pppp.exe 87 PID 552 wrote to memory of 2288 552 1pppp.exe 87 PID 552 wrote to memory of 2288 552 1pppp.exe 87 PID 2288 wrote to memory of 3776 2288 9rlfllf.exe 88 PID 2288 wrote to memory of 3776 2288 9rlfllf.exe 88 PID 2288 wrote to memory of 3776 2288 9rlfllf.exe 88 PID 3776 wrote to memory of 4852 3776 llffxrr.exe 89 PID 3776 wrote to memory of 4852 3776 llffxrr.exe 89 PID 3776 wrote to memory of 4852 3776 llffxrr.exe 89 PID 4852 wrote to memory of 1032 4852 hbhnbh.exe 90 PID 4852 wrote to memory of 1032 4852 hbhnbh.exe 90 PID 4852 wrote to memory of 1032 4852 hbhnbh.exe 90 PID 1032 wrote to memory of 1416 1032 xxrffxf.exe 91 PID 1032 wrote to memory of 1416 1032 xxrffxf.exe 91 PID 1032 wrote to memory of 1416 1032 xxrffxf.exe 91 PID 1416 wrote to memory of 532 1416 rfrxxff.exe 92 PID 1416 wrote to memory of 532 1416 rfrxxff.exe 92 PID 1416 wrote to memory of 532 1416 rfrxxff.exe 92 PID 532 wrote to memory of 4816 532 hnnnnn.exe 94 PID 532 wrote to memory of 4816 532 hnnnnn.exe 94 PID 532 wrote to memory of 4816 532 hnnnnn.exe 94 PID 4816 wrote to memory of 4676 4816 jpvvp.exe 95 PID 4816 wrote to memory of 4676 4816 jpvvp.exe 95 PID 4816 wrote to memory of 4676 4816 jpvvp.exe 95 PID 4676 wrote to memory of 2292 4676 fffffff.exe 96 PID 4676 wrote to memory of 2292 4676 fffffff.exe 96 PID 4676 wrote to memory of 2292 4676 fffffff.exe 96 PID 2292 wrote to memory of 5060 2292 flffffl.exe 97 PID 2292 wrote to memory of 5060 2292 flffffl.exe 97 PID 2292 wrote to memory of 5060 2292 flffffl.exe 97 PID 5060 wrote to memory of 4432 5060 nhnntb.exe 98 PID 5060 wrote to memory of 4432 5060 nhnntb.exe 98 PID 5060 wrote to memory of 4432 5060 nhnntb.exe 98 PID 4432 wrote to memory of 1164 4432 vddjj.exe 99 PID 4432 wrote to memory of 1164 4432 vddjj.exe 99 PID 4432 wrote to memory of 1164 4432 vddjj.exe 99 PID 1164 wrote to memory of 368 1164 xxllxff.exe 100 PID 1164 wrote to memory of 368 1164 xxllxff.exe 100 PID 1164 wrote to memory of 368 1164 xxllxff.exe 100 PID 368 wrote to memory of 4172 368 rrlffll.exe 101 PID 368 wrote to memory of 4172 368 rrlffll.exe 101 PID 368 wrote to memory of 4172 368 rrlffll.exe 101 PID 4172 wrote to memory of 4740 4172 hnbhbh.exe 102 PID 4172 wrote to memory of 4740 4172 hnbhbh.exe 102 PID 4172 wrote to memory of 4740 4172 hnbhbh.exe 102 PID 4740 wrote to memory of 4868 4740 ddjvj.exe 103 PID 4740 wrote to memory of 4868 4740 ddjvj.exe 103 PID 4740 wrote to memory of 4868 4740 ddjvj.exe 103 PID 4868 wrote to memory of 2592 4868 jjddj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\61d50e263389fd156d9152230bda8f684fac503d07473ba025d12856139c4fcb.exe"C:\Users\Admin\AppData\Local\Temp\61d50e263389fd156d9152230bda8f684fac503d07473ba025d12856139c4fcb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\bhnhht.exec:\bhnhht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\vvvvv.exec:\vvvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\1lxrllx.exec:\1lxrllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\bnnnnn.exec:\bnnnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\1pppp.exec:\1pppp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\9rlfllf.exec:\9rlfllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\llffxrr.exec:\llffxrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\hbhnbh.exec:\hbhnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\xxrffxf.exec:\xxrffxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\rfrxxff.exec:\rfrxxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\hnnnnn.exec:\hnnnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\jpvvp.exec:\jpvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\fffffff.exec:\fffffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\flffffl.exec:\flffffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\nhnntb.exec:\nhnntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\vddjj.exec:\vddjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\xxllxff.exec:\xxllxff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\rrlffll.exec:\rrlffll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\hnbhbh.exec:\hnbhbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\ddjvj.exec:\ddjvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\jjddj.exec:\jjddj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\lxffxxr.exec:\lxffxxr.exe23⤵
- Executes dropped EXE
PID:2592 -
\??\c:\3xrxrxx.exec:\3xrxrxx.exe24⤵
- Executes dropped EXE
PID:1356 -
\??\c:\hbhttb.exec:\hbhttb.exe25⤵
- Executes dropped EXE
PID:5036 -
\??\c:\vjppp.exec:\vjppp.exe26⤵
- Executes dropped EXE
PID:2164 -
\??\c:\jdddd.exec:\jdddd.exe27⤵
- Executes dropped EXE
PID:1664 -
\??\c:\lfrlffx.exec:\lfrlffx.exe28⤵
- Executes dropped EXE
PID:4652 -
\??\c:\tthtnn.exec:\tthtnn.exe29⤵
- Executes dropped EXE
PID:1048 -
\??\c:\5lxxxlf.exec:\5lxxxlf.exe30⤵
- Executes dropped EXE
PID:2112 -
\??\c:\bbbbbh.exec:\bbbbbh.exe31⤵
- Executes dropped EXE
PID:1988 -
\??\c:\ttbbnt.exec:\ttbbnt.exe32⤵
- Executes dropped EXE
PID:4836 -
\??\c:\ddvvj.exec:\ddvvj.exe33⤵
- Executes dropped EXE
PID:4276 -
\??\c:\ffxxxxf.exec:\ffxxxxf.exe34⤵
- Executes dropped EXE
PID:4940 -
\??\c:\5bhbht.exec:\5bhbht.exe35⤵
- Executes dropped EXE
PID:4152 -
\??\c:\djpdv.exec:\djpdv.exe36⤵
- Executes dropped EXE
PID:3048 -
\??\c:\ddpjd.exec:\ddpjd.exe37⤵
- Executes dropped EXE
PID:4948 -
\??\c:\3xrlfxr.exec:\3xrlfxr.exe38⤵
- Executes dropped EXE
PID:2820 -
\??\c:\flrlfxr.exec:\flrlfxr.exe39⤵
- Executes dropped EXE
PID:2660 -
\??\c:\5bttnh.exec:\5bttnh.exe40⤵
- Executes dropped EXE
PID:3320 -
\??\c:\7hnnhh.exec:\7hnnhh.exe41⤵
- Executes dropped EXE
PID:1008 -
\??\c:\vpvjp.exec:\vpvjp.exe42⤵
- Executes dropped EXE
PID:1072 -
\??\c:\dppjv.exec:\dppjv.exe43⤵
- Executes dropped EXE
PID:3956 -
\??\c:\3xfrrll.exec:\3xfrrll.exe44⤵
- Executes dropped EXE
PID:1056 -
\??\c:\fllfxrx.exec:\fllfxrx.exe45⤵
- Executes dropped EXE
PID:4956 -
\??\c:\ntbtnn.exec:\ntbtnn.exe46⤵
- Executes dropped EXE
PID:1812 -
\??\c:\3bhhhn.exec:\3bhhhn.exe47⤵
- Executes dropped EXE
PID:1376 -
\??\c:\vppdp.exec:\vppdp.exe48⤵
- Executes dropped EXE
PID:460 -
\??\c:\jpppj.exec:\jpppj.exe49⤵
- Executes dropped EXE
PID:1492 -
\??\c:\frlfrll.exec:\frlfrll.exe50⤵
- Executes dropped EXE
PID:1632 -
\??\c:\lfrrlrr.exec:\lfrrlrr.exe51⤵
- Executes dropped EXE
PID:4608 -
\??\c:\hbttnn.exec:\hbttnn.exe52⤵
- Executes dropped EXE
PID:228 -
\??\c:\nhttnt.exec:\nhttnt.exe53⤵
- Executes dropped EXE
PID:1404 -
\??\c:\9dvvd.exec:\9dvvd.exe54⤵
- Executes dropped EXE
PID:376 -
\??\c:\vpdvp.exec:\vpdvp.exe55⤵
- Executes dropped EXE
PID:3096 -
\??\c:\xrrrrxx.exec:\xrrrrxx.exe56⤵
- Executes dropped EXE
PID:4492 -
\??\c:\llffxxr.exec:\llffxxr.exe57⤵
- Executes dropped EXE
PID:4220 -
\??\c:\hnhhhh.exec:\hnhhhh.exe58⤵
- Executes dropped EXE
PID:1068 -
\??\c:\hntbtt.exec:\hntbtt.exe59⤵
- Executes dropped EXE
PID:1620 -
\??\c:\vjppp.exec:\vjppp.exe60⤵
- Executes dropped EXE
PID:2496 -
\??\c:\vvvpj.exec:\vvvpj.exe61⤵
- Executes dropped EXE
PID:920 -
\??\c:\fxlfffr.exec:\fxlfffr.exe62⤵
- Executes dropped EXE
PID:4968 -
\??\c:\lxfllll.exec:\lxfllll.exe63⤵
- Executes dropped EXE
PID:3324 -
\??\c:\9nhnnn.exec:\9nhnnn.exe64⤵
- Executes dropped EXE
PID:4852 -
\??\c:\3bhhbh.exec:\3bhhbh.exe65⤵
- Executes dropped EXE
PID:3716 -
\??\c:\jjjpp.exec:\jjjpp.exe66⤵PID:1420
-
\??\c:\5pvpp.exec:\5pvpp.exe67⤵PID:2988
-
\??\c:\flfxxll.exec:\flfxxll.exe68⤵PID:2284
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe69⤵PID:2868
-
\??\c:\hbnthh.exec:\hbnthh.exe70⤵PID:4816
-
\??\c:\vvddd.exec:\vvddd.exe71⤵PID:436
-
\??\c:\9dvvd.exec:\9dvvd.exe72⤵PID:4792
-
\??\c:\xxxxflx.exec:\xxxxflx.exe73⤵PID:5032
-
\??\c:\xrxxxxf.exec:\xrxxxxf.exe74⤵PID:3712
-
\??\c:\9bhbtb.exec:\9bhbtb.exe75⤵PID:3236
-
\??\c:\htbbtb.exec:\htbbtb.exe76⤵PID:4668
-
\??\c:\ddpvv.exec:\ddpvv.exe77⤵PID:4396
-
\??\c:\jpvpj.exec:\jpvpj.exe78⤵PID:4624
-
\??\c:\fffffll.exec:\fffffll.exe79⤵PID:3928
-
\??\c:\xxllllr.exec:\xxllllr.exe80⤵PID:2088
-
\??\c:\btnhhh.exec:\btnhhh.exe81⤵PID:3880
-
\??\c:\pdjjd.exec:\pdjjd.exe82⤵PID:2488
-
\??\c:\dddvv.exec:\dddvv.exe83⤵PID:4184
-
\??\c:\9rrlrxr.exec:\9rrlrxr.exe84⤵PID:560
-
\??\c:\flrxrfr.exec:\flrxrfr.exe85⤵PID:1412
-
\??\c:\nntthh.exec:\nntthh.exe86⤵PID:4456
-
\??\c:\vjvvp.exec:\vjvvp.exe87⤵PID:2180
-
\??\c:\pdvvp.exec:\pdvvp.exe88⤵PID:1612
-
\??\c:\frxxxlf.exec:\frxxxlf.exe89⤵PID:2376
-
\??\c:\xfrllll.exec:\xfrllll.exe90⤵PID:4260
-
\??\c:\nnbthh.exec:\nnbthh.exe91⤵PID:3012
-
\??\c:\bnbbtb.exec:\bnbbtb.exe92⤵PID:2396
-
\??\c:\nhnhhh.exec:\nhnhhh.exe93⤵PID:2192
-
\??\c:\ppppp.exec:\ppppp.exe94⤵PID:4932
-
\??\c:\ddddv.exec:\ddddv.exe95⤵PID:2216
-
\??\c:\ffllxxl.exec:\ffllxxl.exe96⤵PID:2112
-
\??\c:\xrffxxx.exec:\xrffxxx.exe97⤵PID:940
-
\??\c:\bbtttb.exec:\bbtttb.exe98⤵PID:3296
-
\??\c:\bnhhnh.exec:\bnhhnh.exe99⤵PID:2644
-
\??\c:\jddvv.exec:\jddvv.exe100⤵PID:4804
-
\??\c:\jdjjd.exec:\jdjjd.exe101⤵PID:1924
-
\??\c:\rrxrrff.exec:\rrxrrff.exe102⤵PID:5064
-
\??\c:\frlrrxx.exec:\frlrrxx.exe103⤵PID:4152
-
\??\c:\bbnbbt.exec:\bbnbbt.exe104⤵PID:3048
-
\??\c:\tnhnnh.exec:\tnhnnh.exe105⤵PID:4948
-
\??\c:\vvddp.exec:\vvddp.exe106⤵PID:2820
-
\??\c:\ppdvp.exec:\ppdvp.exe107⤵PID:2660
-
\??\c:\flrlfrx.exec:\flrlfrx.exe108⤵PID:2604
-
\??\c:\3rfxxrl.exec:\3rfxxrl.exe109⤵PID:1756
-
\??\c:\nhbtnb.exec:\nhbtnb.exe110⤵PID:1072
-
\??\c:\dpjdv.exec:\dpjdv.exe111⤵PID:2096
-
\??\c:\dvdpj.exec:\dvdpj.exe112⤵PID:1056
-
\??\c:\nttbbh.exec:\nttbbh.exe113⤵PID:4956
-
\??\c:\htnnth.exec:\htnnth.exe114⤵PID:1812
-
\??\c:\djjpd.exec:\djjpd.exe115⤵PID:756
-
\??\c:\fllffxx.exec:\fllffxx.exe116⤵PID:460
-
\??\c:\lflrrff.exec:\lflrrff.exe117⤵PID:4404
-
\??\c:\bbthtn.exec:\bbthtn.exe118⤵PID:4412
-
\??\c:\vjdpd.exec:\vjdpd.exe119⤵PID:4608
-
\??\c:\7vdpj.exec:\7vdpj.exe120⤵PID:228
-
\??\c:\fxrlffx.exec:\fxrlffx.exe121⤵PID:3144
-
\??\c:\9bnntt.exec:\9bnntt.exe122⤵PID:4980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-