Analysis
- max time kernel
149s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
22/06/2024, 05:02
Behavioral task
behavioral1
Sample
f90fb5487b0894912c43c2eca5c4f4ffffd3ee0b8364575ede82c18d7ca5ca19.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
- Target f90fb5487b0894912c43c2eca5c4f4ffffd3ee0b8364575ede82c18d7ca5ca19.exe
- Size 63KB
- Sample240622-fpj1xstbpp
- SHA256 f90fb5487b0894912c43c2eca5c4f4ffffd3ee0b8364575ede82c18d7ca5ca19
- MD5 9763fac4b0ae21af5f0ebc0077921551
- SHA1 9f81890318f3b731b11b14c7d73e1cbdad44ac68
- SHA512 4a8ff57705cc55418ff07547fe53ff1138d65d074cdc90dcd162895033bc2bf5a2b197139e7ad9d03602a69801a9ebe4ec20eccf6d6c6a76dc17175c0f3c328d
- SSDEEP 1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+EMdb46k:zhOmTsF93UYfwC6GIoutiTWMdbBk
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/740-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3388-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4492-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2820-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2496-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/900-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1196-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2152-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2576-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3372-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1636-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1552-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4272-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/324-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/760-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3104-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2132-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4044-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4588-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2896-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1560-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/764-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4036-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2152-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3736-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2804-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1220-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2852-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2488-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3880-515-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-540-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4444-650-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1580-724-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1068-862-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/740-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x00060000000232a4-3.dat UPX behavioral2/memory/740-5-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023410-11.dat UPX behavioral2/files/0x0007000000023411-18.dat UPX behavioral2/memory/4780-22-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023412-25.dat UPX behavioral2/memory/1604-30-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023413-29.dat UPX behavioral2/memory/3388-21-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4492-12-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002340f-10.dat UPX behavioral2/memory/4668-8-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2820-36-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023414-34.dat UPX behavioral2/memory/3776-37-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023415-39.dat UPX behavioral2/memory/2496-41-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023416-45.dat UPX behavioral2/memory/2496-49-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/900-47-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023417-50.dat UPX behavioral2/files/0x0007000000023418-54.dat UPX behavioral2/memory/4932-57-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023419-59.dat UPX behavioral2/files/0x000700000002341a-63.dat UPX behavioral2/files/0x000700000002341b-67.dat UPX behavioral2/memory/3996-69-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341c-72.dat UPX behavioral2/files/0x000700000002341d-77.dat UPX behavioral2/memory/624-75-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341e-81.dat UPX behavioral2/memory/5036-84-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1196-83-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002341f-87.dat UPX behavioral2/memory/5036-88-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023420-92.dat UPX behavioral2/memory/4784-93-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023421-97.dat UPX behavioral2/files/0x0007000000023422-101.dat UPX behavioral2/memory/2152-102-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2576-105-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023423-108.dat UPX behavioral2/memory/5096-110-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023424-112.dat UPX behavioral2/files/0x0007000000023425-116.dat UPX behavioral2/files/0x0007000000023426-120.dat UPX behavioral2/files/0x0007000000023427-124.dat UPX behavioral2/files/0x0007000000023428-129.dat UPX behavioral2/memory/3212-132-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5052-130-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023429-134.dat UPX behavioral2/files/0x000700000002342a-138.dat UPX behavioral2/memory/1528-139-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4620-141-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342c-144.dat UPX behavioral2/files/0x000700000002342d-149.dat UPX behavioral2/memory/3372-148-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002342e-153.dat UPX behavioral2/memory/1636-159-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4968-158-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1552-162-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4272-166-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3540-173-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 4668 xrllfff.exe 4492 thhhbt.exe 4780 hbnhbb.exe 3388 djvpj.exe 1604 dvpjv.exe 3776 rffxllf.exe 2820 ththbh.exe 2496 jddvv.exe 900 rlrfxxr.exe 1584 9xlfffl.exe 4932 thhbtt.exe 4392 pvppj.exe 3996 9vdvp.exe 4472 3flfllx.exe 624 hbttnb.exe 1196 hhnntt.exe 5036 5pdvp.exe 4784 vpjdv.exe 1800 lxxlfxx.exe 2152 hbbbtt.exe 2576 hnnnnn.exe 5096 jjjjp.exe 1032 1dddd.exe 1732 rffxrrx.exe 2888 hnbtnh.exe 5052 tnnhtb.exe 3212 jvddv.exe 1528 5pvpj.exe 4620 7lrlfxr.exe 3372 nbnnhb.exe 2636 1pjdp.exe 1636 ffxrllf.exe 4968 5ffrlff.exe 1552 rfrxrfr.exe 4272 hnnhtn.exe 2476 fxlfrlf.exe 3780 lfrlxrl.exe 3540 nbhbbb.exe 4372 hbbtbb.exe 3612 jvjpj.exe 324 9jdvp.exe 2228 frrrlll.exe 760 lxrlxxr.exe 3104 bhtnbt.exe 4952 tnnbnh.exe 1468 pddvd.exe 4432 nhnnhh.exe 2132 7hhhbt.exe 3172 7djvv.exe 4044 5fxrxxl.exe 3144 lffxxrx.exe 4588 bntnbn.exe 1984 vpdpj.exe 2896 lrrfxxr.exe 2156 3lrlxrl.exe 5108 nbbtnh.exe 4628 hnthhb.exe 852 dddjj.exe 4336 llfxlrr.exe 4584 nhnbhb.exe 3672 dddvv.exe 2400 rllffff.exe 4296 hhttnn.exe 4676 9hhbtt.exe -
resource yara_rule behavioral2/memory/740-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00060000000232a4-3.dat upx behavioral2/memory/740-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023410-11.dat upx behavioral2/files/0x0007000000023411-18.dat upx behavioral2/memory/4780-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023412-25.dat upx behavioral2/memory/1604-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023413-29.dat upx behavioral2/memory/3388-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4492-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340f-10.dat upx behavioral2/memory/4668-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2820-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023414-34.dat upx behavioral2/memory/3776-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023415-39.dat upx behavioral2/memory/2496-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-45.dat upx behavioral2/memory/2496-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/900-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023417-50.dat upx behavioral2/files/0x0007000000023418-54.dat upx behavioral2/memory/4932-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023419-59.dat upx behavioral2/files/0x000700000002341a-63.dat upx behavioral2/files/0x000700000002341b-67.dat upx behavioral2/memory/3996-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341c-72.dat upx behavioral2/files/0x000700000002341d-77.dat upx behavioral2/memory/624-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341e-81.dat upx behavioral2/memory/5036-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1196-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341f-87.dat upx behavioral2/memory/5036-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-92.dat upx behavioral2/memory/4784-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-97.dat upx behavioral2/files/0x0007000000023422-101.dat upx behavioral2/memory/2152-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2576-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-108.dat upx behavioral2/memory/5096-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-112.dat upx behavioral2/files/0x0007000000023425-116.dat upx behavioral2/files/0x0007000000023426-120.dat upx behavioral2/files/0x0007000000023427-124.dat upx behavioral2/files/0x0007000000023428-129.dat upx behavioral2/memory/3212-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5052-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023429-134.dat upx behavioral2/files/0x000700000002342a-138.dat upx behavioral2/memory/1528-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4620-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342c-144.dat upx behavioral2/files/0x000700000002342d-149.dat upx behavioral2/memory/3372-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342e-153.dat upx behavioral2/memory/1636-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4968-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1552-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4272-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3540-173-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 740 wrote to memory of 4668 740 f90fb5487b0894912c43c2eca5c4f4ffffd3ee0b8364575ede82c18d7ca5ca19.exe 81 PID 740 wrote to memory of 4668 740 f90fb5487b0894912c43c2eca5c4f4ffffd3ee0b8364575ede82c18d7ca5ca19.exe 81 PID 740 wrote to memory of 4668 740 f90fb5487b0894912c43c2eca5c4f4ffffd3ee0b8364575ede82c18d7ca5ca19.exe 81 PID 4668 wrote to memory of 4492 4668 xrllfff.exe 82 PID 4668 wrote to memory of 4492 4668 xrllfff.exe 82 PID 4668 wrote to memory of 4492 4668 xrllfff.exe 82 PID 4492 wrote to memory of 4780 4492 thhhbt.exe 83 PID 4492 wrote to memory of 4780 4492 thhhbt.exe 83 PID 4492 wrote to memory of 4780 4492 thhhbt.exe 83 PID 4780 wrote to memory of 3388 4780 hbnhbb.exe 84 PID 4780 wrote to memory of 3388 4780 hbnhbb.exe 84 PID 4780 wrote to memory of 3388 4780 hbnhbb.exe 84 PID 3388 wrote to memory of 1604 3388 djvpj.exe 85 PID 3388 wrote to memory of 1604 3388 djvpj.exe 85 PID 3388 wrote to memory of 1604 3388 djvpj.exe 85 PID 1604 wrote to memory of 3776 1604 dvpjv.exe 86 PID 1604 wrote to memory of 3776 1604 dvpjv.exe 86 PID 1604 wrote to memory of 3776 1604 dvpjv.exe 86 PID 3776 wrote to memory of 2820 3776 rffxllf.exe 87 PID 3776 wrote to memory of 2820 3776 rffxllf.exe 87 PID 3776 wrote to memory of 2820 3776 rffxllf.exe 87 PID 2820 wrote to memory of 2496 2820 ththbh.exe 88 PID 2820 wrote to memory of 2496 2820 ththbh.exe 88 PID 2820 wrote to memory of 2496 2820 ththbh.exe 88 PID 2496 wrote to memory of 900 2496 jddvv.exe 89 PID 2496 wrote to memory of 900 2496 jddvv.exe 89 PID 2496 wrote to memory of 900 2496 jddvv.exe 89 PID 900 wrote to memory of 1584 900 rlrfxxr.exe 90 PID 900 wrote to memory of 1584 900 rlrfxxr.exe 90 PID 900 wrote to memory of 1584 900 rlrfxxr.exe 90 PID 1584 wrote to memory of 4932 1584 9xlfffl.exe 91 PID 1584 wrote to memory of 4932 1584 9xlfffl.exe 91 PID 1584 wrote to memory of 4932 1584 9xlfffl.exe 91 PID 4932 wrote to memory of 4392 4932 thhbtt.exe 92 PID 4932 wrote to memory of 4392 4932 thhbtt.exe 92 PID 4932 wrote to memory of 4392 4932 thhbtt.exe 92 PID 4392 wrote to memory of 3996 4392 pvppj.exe 93 PID 4392 wrote to memory of 3996 4392 pvppj.exe 93 PID 4392 wrote to memory of 3996 4392 pvppj.exe 93 PID 3996 wrote to memory of 4472 3996 9vdvp.exe 94 PID 3996 wrote to memory of 4472 3996 9vdvp.exe 94 PID 3996 wrote to memory of 4472 3996 9vdvp.exe 94 PID 4472 wrote to memory of 624 4472 3flfllx.exe 95 PID 4472 wrote to memory of 624 4472 3flfllx.exe 95 PID 4472 wrote to memory of 624 4472 3flfllx.exe 95 PID 624 wrote to memory of 1196 624 hbttnb.exe 96 PID 624 wrote to memory of 1196 624 hbttnb.exe 96 PID 624 wrote to memory of 1196 624 hbttnb.exe 96 PID 1196 wrote to memory of 5036 1196 hhnntt.exe 97 PID 1196 wrote to memory of 5036 1196 hhnntt.exe 97 PID 1196 wrote to memory of 5036 1196 hhnntt.exe 97 PID 5036 wrote to memory of 4784 5036 5pdvp.exe 98 PID 5036 wrote to memory of 4784 5036 5pdvp.exe 98 PID 5036 wrote to memory of 4784 5036 5pdvp.exe 98 PID 4784 wrote to memory of 1800 4784 vpjdv.exe 99 PID 4784 wrote to memory of 1800 4784 vpjdv.exe 99 PID 4784 wrote to memory of 1800 4784 vpjdv.exe 99 PID 1800 wrote to memory of 2152 1800 lxxlfxx.exe 100 PID 1800 wrote to memory of 2152 1800 lxxlfxx.exe 100 PID 1800 wrote to memory of 2152 1800 lxxlfxx.exe 100 PID 2152 wrote to memory of 2576 2152 hbbbtt.exe 101 PID 2152 wrote to memory of 2576 2152 hbbbtt.exe 101 PID 2152 wrote to memory of 2576 2152 hbbbtt.exe 101 PID 2576 wrote to memory of 5096 2576 hnnnnn.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\f90fb5487b0894912c43c2eca5c4f4ffffd3ee0b8364575ede82c18d7ca5ca19.exe"C:\Users\Admin\AppData\Local\Temp\f90fb5487b0894912c43c2eca5c4f4ffffd3ee0b8364575ede82c18d7ca5ca19.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\xrllfff.exec:\xrllfff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\thhhbt.exec:\thhhbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\hbnhbb.exec:\hbnhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\djvpj.exec:\djvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\dvpjv.exec:\dvpjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\rffxllf.exec:\rffxllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\ththbh.exec:\ththbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\jddvv.exec:\jddvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\rlrfxxr.exec:\rlrfxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\9xlfffl.exec:\9xlfffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\thhbtt.exec:\thhbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\pvppj.exec:\pvppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\9vdvp.exec:\9vdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\3flfllx.exec:\3flfllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\hbttnb.exec:\hbttnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\hhnntt.exec:\hhnntt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\5pdvp.exec:\5pdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\vpjdv.exec:\vpjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\lxxlfxx.exec:\lxxlfxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\hbbbtt.exec:\hbbbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\hnnnnn.exec:\hnnnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\jjjjp.exec:\jjjjp.exe23⤵
- Executes dropped EXE
PID:5096 -
\??\c:\1dddd.exec:\1dddd.exe24⤵
- Executes dropped EXE
PID:1032 -
\??\c:\rffxrrx.exec:\rffxrrx.exe25⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hnbtnh.exec:\hnbtnh.exe26⤵
- Executes dropped EXE
PID:2888 -
\??\c:\tnnhtb.exec:\tnnhtb.exe27⤵
- Executes dropped EXE
PID:5052 -
\??\c:\jvddv.exec:\jvddv.exe28⤵
- Executes dropped EXE
PID:3212 -
\??\c:\5pvpj.exec:\5pvpj.exe29⤵
- Executes dropped EXE
PID:1528 -
\??\c:\7lrlfxr.exec:\7lrlfxr.exe30⤵
- Executes dropped EXE
PID:4620 -
\??\c:\nbnnhb.exec:\nbnnhb.exe31⤵
- Executes dropped EXE
PID:3372 -
\??\c:\1pjdp.exec:\1pjdp.exe32⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ffxrllf.exec:\ffxrllf.exe33⤵
- Executes dropped EXE
PID:1636 -
\??\c:\5ffrlff.exec:\5ffrlff.exe34⤵
- Executes dropped EXE
PID:4968 -
\??\c:\rfrxrfr.exec:\rfrxrfr.exe35⤵
- Executes dropped EXE
PID:1552 -
\??\c:\hnnhtn.exec:\hnnhtn.exe36⤵
- Executes dropped EXE
PID:4272 -
\??\c:\fxlfrlf.exec:\fxlfrlf.exe37⤵
- Executes dropped EXE
PID:2476 -
\??\c:\lfrlxrl.exec:\lfrlxrl.exe38⤵
- Executes dropped EXE
PID:3780 -
\??\c:\nbhbbb.exec:\nbhbbb.exe39⤵
- Executes dropped EXE
PID:3540 -
\??\c:\hbbtbb.exec:\hbbtbb.exe40⤵
- Executes dropped EXE
PID:4372 -
\??\c:\jvjpj.exec:\jvjpj.exe41⤵
- Executes dropped EXE
PID:3612 -
\??\c:\9jdvp.exec:\9jdvp.exe42⤵
- Executes dropped EXE
PID:324 -
\??\c:\frrrlll.exec:\frrrlll.exe43⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lxrlxxr.exec:\lxrlxxr.exe44⤵
- Executes dropped EXE
PID:760 -
\??\c:\bhtnbt.exec:\bhtnbt.exe45⤵
- Executes dropped EXE
PID:3104 -
\??\c:\tnnbnh.exec:\tnnbnh.exe46⤵
- Executes dropped EXE
PID:4952 -
\??\c:\pddvd.exec:\pddvd.exe47⤵
- Executes dropped EXE
PID:1468 -
\??\c:\nhnnhh.exec:\nhnnhh.exe48⤵
- Executes dropped EXE
PID:4432 -
\??\c:\7hhhbt.exec:\7hhhbt.exe49⤵
- Executes dropped EXE
PID:2132 -
\??\c:\7djvv.exec:\7djvv.exe50⤵
- Executes dropped EXE
PID:3172 -
\??\c:\5fxrxxl.exec:\5fxrxxl.exe51⤵
- Executes dropped EXE
PID:4044 -
\??\c:\lffxxrx.exec:\lffxxrx.exe52⤵
- Executes dropped EXE
PID:3144 -
\??\c:\bntnbn.exec:\bntnbn.exe53⤵
- Executes dropped EXE
PID:4588 -
\??\c:\vpdpj.exec:\vpdpj.exe54⤵
- Executes dropped EXE
PID:1984 -
\??\c:\lrrfxxr.exec:\lrrfxxr.exe55⤵
- Executes dropped EXE
PID:2896 -
\??\c:\3lrlxrl.exec:\3lrlxrl.exe56⤵
- Executes dropped EXE
PID:2156 -
\??\c:\nbbtnh.exec:\nbbtnh.exe57⤵
- Executes dropped EXE
PID:5108 -
\??\c:\hnthhb.exec:\hnthhb.exe58⤵
- Executes dropped EXE
PID:4628 -
\??\c:\dddjj.exec:\dddjj.exe59⤵
- Executes dropped EXE
PID:852 -
\??\c:\llfxlrr.exec:\llfxlrr.exe60⤵
- Executes dropped EXE
PID:4336 -
\??\c:\nhnbhb.exec:\nhnbhb.exe61⤵
- Executes dropped EXE
PID:4584 -
\??\c:\dddvv.exec:\dddvv.exe62⤵
- Executes dropped EXE
PID:3672 -
\??\c:\rllffff.exec:\rllffff.exe63⤵
- Executes dropped EXE
PID:2400 -
\??\c:\hhttnn.exec:\hhttnn.exe64⤵
- Executes dropped EXE
PID:4296 -
\??\c:\9hhbtt.exec:\9hhbtt.exe65⤵
- Executes dropped EXE
PID:4676 -
\??\c:\9pppp.exec:\9pppp.exe66⤵PID:3056
-
\??\c:\btbtnn.exec:\btbtnn.exe67⤵PID:4136
-
\??\c:\5pdvv.exec:\5pdvv.exe68⤵PID:1560
-
\??\c:\7rlfffx.exec:\7rlfffx.exe69⤵PID:2676
-
\??\c:\tbbtnh.exec:\tbbtnh.exe70⤵PID:3796
-
\??\c:\thhbnn.exec:\thhbnn.exe71⤵PID:2544
-
\??\c:\dvvjd.exec:\dvvjd.exe72⤵PID:3628
-
\??\c:\rflfxrl.exec:\rflfxrl.exe73⤵PID:5076
-
\??\c:\lfxxrrl.exec:\lfxxrrl.exe74⤵PID:1424
-
\??\c:\nbbthh.exec:\nbbthh.exe75⤵PID:224
-
\??\c:\jdvpd.exec:\jdvpd.exe76⤵PID:3720
-
\??\c:\lffxrxf.exec:\lffxrxf.exe77⤵PID:5012
-
\??\c:\lxfrrlr.exec:\lxfrrlr.exe78⤵PID:2440
-
\??\c:\hhbbbb.exec:\hhbbbb.exe79⤵PID:5068
-
\??\c:\tnbtnn.exec:\tnbtnn.exe80⤵PID:764
-
\??\c:\vpdvp.exec:\vpdvp.exe81⤵PID:884
-
\??\c:\fxxrllr.exec:\fxxrllr.exe82⤵PID:1048
-
\??\c:\dvjjd.exec:\dvjjd.exe83⤵PID:1720
-
\??\c:\xrrrfrl.exec:\xrrrfrl.exe84⤵PID:4680
-
\??\c:\hhhbtb.exec:\hhhbtb.exe85⤵PID:2272
-
\??\c:\djpjv.exec:\djpjv.exe86⤵PID:440
-
\??\c:\3djdp.exec:\3djdp.exe87⤵PID:4036
-
\??\c:\frxfrrl.exec:\frxfrrl.exe88⤵PID:3680
-
\??\c:\xlfxffl.exec:\xlfxffl.exe89⤵PID:2152
-
\??\c:\tnbbhb.exec:\tnbbhb.exe90⤵PID:3264
-
\??\c:\vpjdv.exec:\vpjdv.exe91⤵PID:540
-
\??\c:\jppvp.exec:\jppvp.exe92⤵PID:1220
-
\??\c:\pvpdj.exec:\pvpdj.exe93⤵PID:1752
-
\??\c:\rfrllfx.exec:\rfrllfx.exe94⤵PID:2640
-
\??\c:\bbtnhb.exec:\bbtnhb.exe95⤵PID:3916
-
\??\c:\bnbbbb.exec:\bnbbbb.exe96⤵PID:4380
-
\??\c:\pdpjv.exec:\pdpjv.exe97⤵PID:708
-
\??\c:\rlfrlfx.exec:\rlfrlfx.exe98⤵PID:3140
-
\??\c:\xrrrllf.exec:\xrrrllf.exe99⤵PID:2328
-
\??\c:\lrxrlxx.exec:\lrxrlxx.exe100⤵PID:2572
-
\??\c:\nbhhnt.exec:\nbhhnt.exe101⤵PID:4856
-
\??\c:\dvdvd.exec:\dvdvd.exe102⤵PID:3340
-
\??\c:\frlfffl.exec:\frlfffl.exe103⤵PID:3372
-
\??\c:\xrrlfrf.exec:\xrrlfrf.exe104⤵PID:3344
-
\??\c:\1nhbbt.exec:\1nhbbt.exe105⤵PID:4636
-
\??\c:\bbtnbb.exec:\bbtnbb.exe106⤵PID:1636
-
\??\c:\jvpjd.exec:\jvpjd.exe107⤵PID:4360
-
\??\c:\lrlfrlr.exec:\lrlfrlr.exe108⤵PID:1848
-
\??\c:\rrlrrrl.exec:\rrlrrrl.exe109⤵PID:860
-
\??\c:\bttnhh.exec:\bttnhh.exe110⤵PID:3504
-
\??\c:\1btntn.exec:\1btntn.exe111⤵PID:1816
-
\??\c:\jddvp.exec:\jddvp.exe112⤵PID:3736
-
\??\c:\jdpjv.exec:\jdpjv.exe113⤵PID:1356
-
\??\c:\rlrrlrx.exec:\rlrrlrx.exe114⤵PID:3612
-
\??\c:\bbnnhh.exec:\bbnnhh.exe115⤵PID:4988
-
\??\c:\tnntnh.exec:\tnntnh.exe116⤵PID:2304
-
\??\c:\bntntn.exec:\bntntn.exe117⤵PID:4232
-
\??\c:\dvjjp.exec:\dvjjp.exe118⤵PID:3624
-
\??\c:\7vvpd.exec:\7vvpd.exe119⤵PID:4684
-
\??\c:\1rxxxrx.exec:\1rxxxrx.exe120⤵PID:3640
-
\??\c:\hnnbtt.exec:\hnnbtt.exe121⤵PID:3080
-
\??\c:\htttnn.exec:\htttnn.exe122⤵PID:2648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-