Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
21/06/2024, 23:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
78e6fd0466502819354abeb112f759194b93e219062293f70b5f7e44e3247627.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
- Target 78e6fd0466502819354abeb112f759194b93e219062293f70b5f7e44e3247627.exe
- Size 207KB
- Sample240621-25fjbsvbna
- SHA256 78e6fd0466502819354abeb112f759194b93e219062293f70b5f7e44e3247627
- MD5 ba89a4d6e782122ac5e82edfd8533cf7
- SHA1 db50aadf1732ef56f1d50047e66d7c3ec7ef5baa
- SHA512 c83875f26cf70b30d217ab611ff3defdeb2721e890494e36caa2fed7c5b3dd9b035488489da34c6f91833167ce23c28df05a2bad6b763e2956e6a7d23bf36639
- SSDEEP 1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+C2HVM1p6TQpCih2Qk:PhOm2sI93UufdC67ciJTU2HVS64hs
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2412-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2868-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/848-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2176-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-318-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-334-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-344-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1240-358-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1076-362-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-370-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-380-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-401-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-415-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-441-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-449-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-470-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-497-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1440-505-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-527-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-545-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-552-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-608-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2124-749-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-775-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-849-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-1674-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/2412-8-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4060-7-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/116-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2960-60-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2084-95-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4528-210-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1572-253-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2540-261-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4512-260-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2868-257-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2324-247-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3516-230-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2748-223-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4568-220-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4600-203-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/764-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3892-185-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1120-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4116-168-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4880-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2412-268-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4828-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4372-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3964-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2632-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2712-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4004-270-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4752-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3928-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/848-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3568-77-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4520-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2000-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2224-43-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2176-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4776-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1668-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4468-283-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2696-287-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2696-291-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2548-303-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4852-308-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3452-318-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4088-322-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5088-323-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2808-327-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3024-334-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/816-344-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1240-354-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1240-358-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1076-362-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3912-370-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1888-376-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1888-380-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1016-399-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4888-401-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1428-404-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/468-415-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4724-431-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3704-441-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4572-445-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4572-449-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4100-459-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5104-470-0x0000000000400000-0x0000000000429000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 2412 lrllfxx.exe 1668 xxfxxxr.exe 116 3thbhb.exe 4776 tnhbhh.exe 748 vvddv.exe 2176 lfrlfff.exe 2224 xxfxfxr.exe 2000 hhhbbt.exe 2960 bbhbbb.exe 2420 vvdvp.exe 4520 vddvv.exe 3568 rlxflxx.exe 848 xrrfxrl.exe 3928 tntnhh.exe 2084 hbtbtb.exe 4752 pvpjj.exe 2712 ppvpj.exe 2632 llxrxxf.exe 3964 llfxrfx.exe 4372 tntnnt.exe 4728 bnbtnn.exe 3508 jjjjj.exe 4828 9vdpj.exe 1592 xrrxllx.exe 4880 7ffxrlf.exe 5100 btttnn.exe 2844 htttnn.exe 4116 7pddv.exe 1120 vdjdv.exe 1544 rllfrrf.exe 3892 xrrrxrx.exe 1464 nntntt.exe 2392 nhhbtn.exe 764 jjvpp.exe 4040 lxfrllf.exe 4600 xffxrrl.exe 3832 hhnnbh.exe 4528 bbbbbh.exe 1428 dpdpd.exe 3408 jjvpp.exe 4568 dddvd.exe 2748 frfxrrl.exe 4552 fxrrrrf.exe 3516 nntttt.exe 4312 hhnhbb.exe 4176 jpddv.exe 4160 pjpjd.exe 4492 fflfxxx.exe 2324 rlffxrr.exe 644 7ntnnn.exe 1572 tbnhbb.exe 2868 pjpjj.exe 464 7vdvp.exe 2540 rxfxrlf.exe 2412 vjjdv.exe 4004 ffxrrrx.exe 1216 htttnn.exe 4764 nhnhbb.exe 4468 dvjjd.exe 228 3dvpj.exe 2696 flfxllf.exe 3052 9bbbbb.exe 1220 jjpjp.exe 2420 xrrlfrl.exe -
resource yara_rule behavioral2/memory/2412-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2868-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3928-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/848-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2176-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-318-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-323-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-334-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/816-344-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-354-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1240-358-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1076-362-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-370-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-376-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-380-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-399-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-401-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1428-404-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-415-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-431-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-441-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-445-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-449-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-459-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-470-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4060 wrote to memory of 2412 4060 78e6fd0466502819354abeb112f759194b93e219062293f70b5f7e44e3247627.exe 136 PID 4060 wrote to memory of 2412 4060 78e6fd0466502819354abeb112f759194b93e219062293f70b5f7e44e3247627.exe 136 PID 4060 wrote to memory of 2412 4060 78e6fd0466502819354abeb112f759194b93e219062293f70b5f7e44e3247627.exe 136 PID 2412 wrote to memory of 1668 2412 lrllfxx.exe 82 PID 2412 wrote to memory of 1668 2412 lrllfxx.exe 82 PID 2412 wrote to memory of 1668 2412 lrllfxx.exe 82 PID 1668 wrote to memory of 116 1668 xxfxxxr.exe 83 PID 1668 wrote to memory of 116 1668 xxfxxxr.exe 83 PID 1668 wrote to memory of 116 1668 xxfxxxr.exe 83 PID 116 wrote to memory of 4776 116 3thbhb.exe 84 PID 116 wrote to memory of 4776 116 3thbhb.exe 84 PID 116 wrote to memory of 4776 116 3thbhb.exe 84 PID 4776 wrote to memory of 748 4776 tnhbhh.exe 85 PID 4776 wrote to memory of 748 4776 tnhbhh.exe 85 PID 4776 wrote to memory of 748 4776 tnhbhh.exe 85 PID 748 wrote to memory of 2176 748 vvddv.exe 86 PID 748 wrote to memory of 2176 748 vvddv.exe 86 PID 748 wrote to memory of 2176 748 vvddv.exe 86 PID 2176 wrote to memory of 2224 2176 lfrlfff.exe 87 PID 2176 wrote to memory of 2224 2176 lfrlfff.exe 87 PID 2176 wrote to memory of 2224 2176 lfrlfff.exe 87 PID 2224 wrote to memory of 2000 2224 xxfxfxr.exe 88 PID 2224 wrote to memory of 2000 2224 xxfxfxr.exe 88 PID 2224 wrote to memory of 2000 2224 xxfxfxr.exe 88 PID 2000 wrote to memory of 2960 2000 hhhbbt.exe 89 PID 2000 wrote to memory of 2960 2000 hhhbbt.exe 89 PID 2000 wrote to memory of 2960 2000 hhhbbt.exe 89 PID 2960 wrote to memory of 2420 2960 bbhbbb.exe 145 PID 2960 wrote to memory of 2420 2960 bbhbbb.exe 145 PID 2960 wrote to memory of 2420 2960 bbhbbb.exe 145 PID 2420 wrote to memory of 4520 2420 vvdvp.exe 91 PID 2420 wrote to memory of 4520 2420 vvdvp.exe 91 PID 2420 wrote to memory of 4520 2420 vvdvp.exe 91 PID 4520 wrote to memory of 3568 4520 vddvv.exe 92 PID 4520 wrote to memory of 3568 4520 vddvv.exe 92 PID 4520 wrote to memory of 3568 4520 vddvv.exe 92 PID 3568 wrote to memory of 848 3568 rlxflxx.exe 93 PID 3568 wrote to memory of 848 3568 rlxflxx.exe 93 PID 3568 wrote to memory of 848 3568 rlxflxx.exe 93 PID 848 wrote to memory of 3928 848 xrrfxrl.exe 94 PID 848 wrote to memory of 3928 848 xrrfxrl.exe 94 PID 848 wrote to memory of 3928 848 xrrfxrl.exe 94 PID 3928 wrote to memory of 2084 3928 tntnhh.exe 95 PID 3928 wrote to memory of 2084 3928 tntnhh.exe 95 PID 3928 wrote to memory of 2084 3928 tntnhh.exe 95 PID 2084 wrote to memory of 4752 2084 hbtbtb.exe 96 PID 2084 wrote to memory of 4752 2084 hbtbtb.exe 96 PID 2084 wrote to memory of 4752 2084 hbtbtb.exe 96 PID 4752 wrote to memory of 2712 4752 pvpjj.exe 97 PID 4752 wrote to memory of 2712 4752 pvpjj.exe 97 PID 4752 wrote to memory of 2712 4752 pvpjj.exe 97 PID 2712 wrote to memory of 2632 2712 ppvpj.exe 98 PID 2712 wrote to memory of 2632 2712 ppvpj.exe 98 PID 2712 wrote to memory of 2632 2712 ppvpj.exe 98 PID 2632 wrote to memory of 3964 2632 llxrxxf.exe 99 PID 2632 wrote to memory of 3964 2632 llxrxxf.exe 99 PID 2632 wrote to memory of 3964 2632 llxrxxf.exe 99 PID 3964 wrote to memory of 4372 3964 llfxrfx.exe 100 PID 3964 wrote to memory of 4372 3964 llfxrfx.exe 100 PID 3964 wrote to memory of 4372 3964 llfxrfx.exe 100 PID 4372 wrote to memory of 4728 4372 tntnnt.exe 101 PID 4372 wrote to memory of 4728 4372 tntnnt.exe 101 PID 4372 wrote to memory of 4728 4372 tntnnt.exe 101 PID 4728 wrote to memory of 3508 4728 bnbtnn.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\78e6fd0466502819354abeb112f759194b93e219062293f70b5f7e44e3247627.exe"C:\Users\Admin\AppData\Local\Temp\78e6fd0466502819354abeb112f759194b93e219062293f70b5f7e44e3247627.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\lrllfxx.exec:\lrllfxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\xxfxxxr.exec:\xxfxxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\3thbhb.exec:\3thbhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\tnhbhh.exec:\tnhbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\vvddv.exec:\vvddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\lfrlfff.exec:\lfrlfff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\xxfxfxr.exec:\xxfxfxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\hhhbbt.exec:\hhhbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\bbhbbb.exec:\bbhbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\vvdvp.exec:\vvdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\vddvv.exec:\vddvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\rlxflxx.exec:\rlxflxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\xrrfxrl.exec:\xrrfxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\tntnhh.exec:\tntnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\hbtbtb.exec:\hbtbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\pvpjj.exec:\pvpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\ppvpj.exec:\ppvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\llxrxxf.exec:\llxrxxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\llfxrfx.exec:\llfxrfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\tntnnt.exec:\tntnnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\bnbtnn.exec:\bnbtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\jjjjj.exec:\jjjjj.exe23⤵
- Executes dropped EXE
PID:3508 -
\??\c:\9vdpj.exec:\9vdpj.exe24⤵
- Executes dropped EXE
PID:4828 -
\??\c:\xrrxllx.exec:\xrrxllx.exe25⤵
- Executes dropped EXE
PID:1592 -
\??\c:\7ffxrlf.exec:\7ffxrlf.exe26⤵
- Executes dropped EXE
PID:4880 -
\??\c:\btttnn.exec:\btttnn.exe27⤵
- Executes dropped EXE
PID:5100 -
\??\c:\htttnn.exec:\htttnn.exe28⤵
- Executes dropped EXE
PID:2844 -
\??\c:\7pddv.exec:\7pddv.exe29⤵
- Executes dropped EXE
PID:4116 -
\??\c:\vdjdv.exec:\vdjdv.exe30⤵
- Executes dropped EXE
PID:1120 -
\??\c:\rllfrrf.exec:\rllfrrf.exe31⤵
- Executes dropped EXE
PID:1544 -
\??\c:\xrrrxrx.exec:\xrrrxrx.exe32⤵
- Executes dropped EXE
PID:3892 -
\??\c:\nntntt.exec:\nntntt.exe33⤵
- Executes dropped EXE
PID:1464 -
\??\c:\nhhbtn.exec:\nhhbtn.exe34⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jjvpp.exec:\jjvpp.exe35⤵
- Executes dropped EXE
PID:764 -
\??\c:\lxfrllf.exec:\lxfrllf.exe36⤵
- Executes dropped EXE
PID:4040 -
\??\c:\xffxrrl.exec:\xffxrrl.exe37⤵
- Executes dropped EXE
PID:4600 -
\??\c:\hhnnbh.exec:\hhnnbh.exe38⤵
- Executes dropped EXE
PID:3832 -
\??\c:\bbbbbh.exec:\bbbbbh.exe39⤵
- Executes dropped EXE
PID:4528 -
\??\c:\dpdpd.exec:\dpdpd.exe40⤵
- Executes dropped EXE
PID:1428 -
\??\c:\jjvpp.exec:\jjvpp.exe41⤵
- Executes dropped EXE
PID:3408 -
\??\c:\dddvd.exec:\dddvd.exe42⤵
- Executes dropped EXE
PID:4568 -
\??\c:\frfxrrl.exec:\frfxrrl.exe43⤵
- Executes dropped EXE
PID:2748 -
\??\c:\fxrrrrf.exec:\fxrrrrf.exe44⤵
- Executes dropped EXE
PID:4552 -
\??\c:\nntttt.exec:\nntttt.exe45⤵
- Executes dropped EXE
PID:3516 -
\??\c:\hhnhbb.exec:\hhnhbb.exe46⤵
- Executes dropped EXE
PID:4312 -
\??\c:\jpddv.exec:\jpddv.exe47⤵
- Executes dropped EXE
PID:4176 -
\??\c:\pjpjd.exec:\pjpjd.exe48⤵
- Executes dropped EXE
PID:4160 -
\??\c:\fflfxxx.exec:\fflfxxx.exe49⤵
- Executes dropped EXE
PID:4492 -
\??\c:\rlffxrr.exec:\rlffxrr.exe50⤵
- Executes dropped EXE
PID:2324 -
\??\c:\7ntnnn.exec:\7ntnnn.exe51⤵
- Executes dropped EXE
PID:644 -
\??\c:\tbnhbb.exec:\tbnhbb.exe52⤵
- Executes dropped EXE
PID:1572 -
\??\c:\pjpjj.exec:\pjpjj.exe53⤵
- Executes dropped EXE
PID:2868 -
\??\c:\7vdvp.exec:\7vdvp.exe54⤵
- Executes dropped EXE
PID:464 -
\??\c:\rxfxrlf.exec:\rxfxrlf.exe55⤵
- Executes dropped EXE
PID:2540 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe56⤵PID:4512
-
\??\c:\vjjdv.exec:\vjjdv.exe57⤵
- Executes dropped EXE
PID:2412 -
\??\c:\ffxrrrx.exec:\ffxrrrx.exe58⤵
- Executes dropped EXE
PID:4004 -
\??\c:\htttnn.exec:\htttnn.exe59⤵
- Executes dropped EXE
PID:1216 -
\??\c:\nhnhbb.exec:\nhnhbb.exe60⤵
- Executes dropped EXE
PID:4764 -
\??\c:\dvjjd.exec:\dvjjd.exe61⤵
- Executes dropped EXE
PID:4468 -
\??\c:\3dvpj.exec:\3dvpj.exe62⤵
- Executes dropped EXE
PID:228 -
\??\c:\flfxllf.exec:\flfxllf.exe63⤵
- Executes dropped EXE
PID:2696 -
\??\c:\9bbbbb.exec:\9bbbbb.exe64⤵
- Executes dropped EXE
PID:3052 -
\??\c:\jjpjp.exec:\jjpjp.exe65⤵
- Executes dropped EXE
PID:1220 -
\??\c:\xrrlfrl.exec:\xrrlfrl.exe66⤵
- Executes dropped EXE
PID:2420 -
\??\c:\tntnhh.exec:\tntnhh.exe67⤵PID:2548
-
\??\c:\ntnnnn.exec:\ntnnnn.exe68⤵PID:1676
-
\??\c:\vjjdp.exec:\vjjdp.exe69⤵PID:4852
-
\??\c:\lxxrlxx.exec:\lxxrlxx.exe70⤵PID:772
-
\??\c:\lxffxxx.exec:\lxffxxx.exe71⤵PID:3452
-
\??\c:\pdvpj.exec:\pdvpj.exe72⤵PID:4088
-
\??\c:\dvdvp.exec:\dvdvp.exe73⤵PID:5088
-
\??\c:\5rxlfxx.exec:\5rxlfxx.exe74⤵PID:2808
-
\??\c:\vvpdv.exec:\vvpdv.exe75⤵PID:3024
-
\??\c:\vvjjd.exec:\vvjjd.exe76⤵PID:2448
-
\??\c:\nbnhhn.exec:\nbnhhn.exe77⤵PID:3668
-
\??\c:\pdpdj.exec:\pdpdj.exe78⤵PID:816
-
\??\c:\nbnhhb.exec:\nbnhhb.exe79⤵PID:1580
-
\??\c:\dpvjv.exec:\dpvjv.exe80⤵PID:1616
-
\??\c:\xflxlfx.exec:\xflxlfx.exe81⤵PID:1000
-
\??\c:\9nbbtn.exec:\9nbbtn.exe82⤵PID:1240
-
\??\c:\xrxrxrx.exec:\xrxrxrx.exe83⤵PID:1076
-
\??\c:\7hthbb.exec:\7hthbb.exe84⤵PID:1396
-
\??\c:\bhhbnh.exec:\bhhbnh.exe85⤵PID:2072
-
\??\c:\tbbttt.exec:\tbbttt.exe86⤵PID:3912
-
\??\c:\dpjdd.exec:\dpjdd.exe87⤵PID:3892
-
\??\c:\jppjd.exec:\jppjd.exe88⤵PID:1888
-
\??\c:\nhnhbt.exec:\nhnhbt.exe89⤵PID:1104
-
\??\c:\jdjdp.exec:\jdjdp.exe90⤵PID:4660
-
\??\c:\dpvdv.exec:\dpvdv.exe91⤵PID:3252
-
\??\c:\5lrfrlx.exec:\5lrfrlx.exe92⤵PID:3844
-
\??\c:\5xfxrxr.exec:\5xfxrxr.exe93⤵PID:4640
-
\??\c:\htbbtt.exec:\htbbtt.exe94⤵PID:1016
-
\??\c:\jpvvp.exec:\jpvvp.exe95⤵PID:4888
-
\??\c:\vpvpd.exec:\vpvpd.exe96⤵PID:1428
-
\??\c:\lfxrfxr.exec:\lfxrfxr.exe97⤵PID:3408
-
\??\c:\7bbbnh.exec:\7bbbnh.exe98⤵PID:468
-
\??\c:\bhhtnh.exec:\bhhtnh.exe99⤵PID:2748
-
\??\c:\vvddj.exec:\vvddj.exe100⤵PID:4020
-
\??\c:\9rrfrxr.exec:\9rrfrxr.exe101⤵PID:2524
-
\??\c:\nbbbhb.exec:\nbbbhb.exe102⤵PID:1192
-
\??\c:\btbthb.exec:\btbthb.exe103⤵PID:4064
-
\??\c:\1bhnth.exec:\1bhnth.exe104⤵PID:4724
-
\??\c:\dppdd.exec:\dppdd.exe105⤵PID:1504
-
\??\c:\lxfxlff.exec:\lxfxlff.exe106⤵PID:3704
-
\??\c:\xflfxrl.exec:\xflfxrl.exe107⤵PID:1920
-
\??\c:\nhthbh.exec:\nhthbh.exe108⤵PID:4572
-
\??\c:\pdjvj.exec:\pdjvj.exe109⤵PID:1256
-
\??\c:\ffrlrrf.exec:\ffrlrrf.exe110⤵PID:1996
-
\??\c:\lffxrlf.exec:\lffxrlf.exe111⤵PID:2836
-
\??\c:\nbhhtn.exec:\nbhhtn.exe112⤵PID:4100
-
\??\c:\7tnbnh.exec:\7tnbnh.exe113⤵PID:2764
-
\??\c:\jvvpv.exec:\jvvpv.exe114⤵PID:1740
-
\??\c:\rlfxrxr.exec:\rlfxrxr.exe115⤵PID:5104
-
\??\c:\xllfxfx.exec:\xllfxfx.exe116⤵PID:3688
-
\??\c:\bnhthb.exec:\bnhthb.exe117⤵PID:4060
-
\??\c:\jpvpd.exec:\jpvpd.exe118⤵PID:4436
-
\??\c:\1vppj.exec:\1vppj.exe119⤵PID:2968
-
\??\c:\flffrlx.exec:\flffrlx.exe120⤵PID:3128
-
\??\c:\llfffff.exec:\llfffff.exe121⤵PID:208
-
\??\c:\7hhnhb.exec:\7hhnhb.exe122⤵PID:2412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-