Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 20:50
Behavioral task
behavioral1
Sample
406aa985efb3a630109d6274a4f64f957988ad874e2d816af0405e31a05c27af.exe
Resource
win7-20240419-en
6 signatures
150 seconds
General
-
Target
406aa985efb3a630109d6274a4f64f957988ad874e2d816af0405e31a05c27af.exe
-
Size
158KB
-
MD5
fe4afb4103b3bcb481ada6ea0ce5bd08
-
SHA1
028e2d6929de4db61b7cf3b66eac283e23b76c94
-
SHA256
406aa985efb3a630109d6274a4f64f957988ad874e2d816af0405e31a05c27af
-
SHA512
492e98be0c46f52e0977c31e7fd191cf63ef05f201ef0abcc9f187f4ef977e9a66f1abcda333478c8826b9768a306f8fbd73ca014c021ceeeee147d6ce946056
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH4oGPwJwJE21rn:kcm4FmowdHoSphraHcpOFltH4oGPjJEY
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
Processes:
resource yara_rule behavioral1/memory/2088-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/316-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1560-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1040-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/828-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-579-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2280-1018-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1756-1079-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1056-1340-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2672-1266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-1098-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/380-1011-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2596-974-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1048-968-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-853-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-721-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/340-700-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1292-631-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1232-478-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-464-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-302-0x00000000771E0000-0x00000000772FF000-memory.dmp family_blackmoon behavioral1/memory/2896-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1332-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1932-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2088-12-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\3nntth.exe UPX behavioral1/memory/2860-54-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\hhhnht.exe UPX \??\c:\7llxxfr.exe UPX behavioral1/memory/2608-120-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xxrrlrf.exe UPX \??\c:\bhnhbt.exe UPX behavioral1/memory/1968-153-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\xrrlrll.exe UPX behavioral1/memory/316-179-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\dpvvp.exe UPX \??\c:\lllrlxr.exe UPX behavioral1/memory/1560-211-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\3frlflr.exe UPX C:\bbhhbn.exe UPX \??\c:\hhttnt.exe UPX behavioral1/memory/1040-376-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2512-425-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/828-437-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2692-527-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2992-540-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1976-579-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1952-643-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2704-701-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2280-1018-0x0000000000220000-0x0000000000247000-memory.dmp UPX behavioral1/memory/2100-1434-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2772-1409-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2056-1391-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1056-1340-0x00000000003C0000-0x00000000003E7000-memory.dmp UPX behavioral1/memory/1772-1279-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2672-1266-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/808-1253-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1780-1233-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2032-1202-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2236-1158-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1804-1145-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2720-1132-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1712-1117-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/3060-1098-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2596-974-0x00000000002B0000-0x00000000002D7000-memory.dmp UPX behavioral1/memory/1048-968-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2616-954-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2596-927-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2676-890-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2720-853-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2056-834-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1984-785-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1764-747-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2648-728-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2288-721-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2288-714-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/340-700-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/340-693-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2000-674-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1292-631-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2664-592-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1976-571-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1232-478-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2296-464-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2452-445-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1612-406-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/1612-400-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral1/memory/2564-355-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
7rlfxrx.exeflrfxfx.exe3nntth.exevjvpj.exejpjjd.exelrxrxlf.exehhhnht.exe1pdpp.exevpjvj.exe7llxxfr.exe7llrllf.exenbnhbb.exedpdvj.exexxrrlrf.exebhnhbt.exepdjvd.exe5vjdd.exexrrlrll.exentnthb.exe3hbbtb.exedpvvp.exexxfrrfx.exelllrlxr.exehnbbbn.exe3frlflr.exe7nnttb.exebbhhbn.exepvjjv.exelllfrfl.exefllxfll.exetttnht.exehhttnt.exevvvjj.exe9fflxll.exexxrxflx.exe9nbnhh.exejddjd.exevvppd.exefllflrr.exenhntth.exenttntn.exeddjdj.exelflxrxf.exexxlrxfr.exenntbnh.exehhbhbn.exejvjvp.exexrrrfrx.exelxlflrx.exehthntn.exetnbnth.exepvddv.exevjdvv.exeffxrrxr.exefllffrr.exetbtnth.exejjdpj.exe3dppv.exexxrfrxl.exe3fxlflx.exe3ntbnh.exenhhnht.exe1vvvp.exelrxxrll.exepid process 2088 7rlfxrx.exe 2408 flrfxfx.exe 2340 3nntth.exe 2656 vjvpj.exe 2860 jpjjd.exe 2764 lrxrxlf.exe 2544 hhhnht.exe 2680 1pdpp.exe 2524 vpjvj.exe 2984 7llxxfr.exe 2164 7llrllf.exe 2496 nbnhbb.exe 2608 dpdvj.exe 2028 xxrrlrf.exe 1308 bhnhbt.exe 1968 pdjvd.exe 2932 5vjdd.exe 1932 xrrlrll.exe 316 ntnthb.exe 2272 3hbbtb.exe 1748 dpvvp.exe 2812 xxfrrfx.exe 1560 lllrlxr.exe 2824 hnbbbn.exe 1312 3frlflr.exe 3032 7nnttb.exe 2876 bbhhbn.exe 1332 pvjjv.exe 1988 lllfrfl.exe 840 fllxfll.exe 3028 tttnht.exe 1504 hhttnt.exe 2396 vvvjj.exe 1652 9fflxll.exe 2896 xxrxflx.exe 1712 9nbnhh.exe 2832 jddjd.exe 3008 vvppd.exe 2724 fllflrr.exe 2760 nhntth.exe 2780 nttntn.exe 2684 ddjdj.exe 2564 lflxrxf.exe 2584 xxlrxfr.exe 2104 nntbnh.exe 1040 hhbhbn.exe 2856 jvjvp.exe 1244 xrrrfrx.exe 2508 lxlflrx.exe 1612 hthntn.exe 2708 tnbnth.exe 1308 pvddv.exe 2512 vjdvv.exe 2704 ffxrrxr.exe 828 fllffrr.exe 1912 tbtnth.exe 2452 jjdpj.exe 292 3dppv.exe 1908 xxrfrxl.exe 2296 3fxlflx.exe 1232 3ntbnh.exe 1276 nhhnht.exe 2824 1vvvp.exe 876 lrxxrll.exe -
Processes:
resource yara_rule behavioral1/memory/2088-12-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3nntth.exe upx behavioral1/memory/2860-54-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hhhnht.exe upx \??\c:\7llxxfr.exe upx behavioral1/memory/2608-120-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxrrlrf.exe upx \??\c:\bhnhbt.exe upx behavioral1/memory/1968-153-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xrrlrll.exe upx behavioral1/memory/316-179-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dpvvp.exe upx \??\c:\lllrlxr.exe upx behavioral1/memory/1560-211-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3frlflr.exe upx C:\bbhhbn.exe upx \??\c:\hhttnt.exe upx behavioral1/memory/1040-376-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2512-425-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/828-437-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2692-527-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2992-540-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1976-579-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1952-643-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-701-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2280-1018-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2100-1434-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-1409-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2056-1391-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1056-1340-0x00000000003C0000-0x00000000003E7000-memory.dmp upx behavioral1/memory/1772-1279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2672-1266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/808-1253-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1780-1233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2032-1202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2236-1158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1804-1145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2720-1132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1712-1117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3060-1098-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2596-974-0x00000000002B0000-0x00000000002D7000-memory.dmp upx behavioral1/memory/1048-968-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2616-954-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2596-927-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-890-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2720-853-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2056-834-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1984-785-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1764-747-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2648-728-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2288-721-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2288-714-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/340-700-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/340-693-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2000-674-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1292-631-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2664-592-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1976-571-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1232-478-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2296-464-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2452-445-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1612-406-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1612-400-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2564-355-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
406aa985efb3a630109d6274a4f64f957988ad874e2d816af0405e31a05c27af.exe7rlfxrx.exeflrfxfx.exe3nntth.exevjvpj.exejpjjd.exelrxrxlf.exehhhnht.exe1pdpp.exevpjvj.exe7llxxfr.exe7llrllf.exenbnhbb.exedpdvj.exexxrrlrf.exebhnhbt.exedescription pid process target process PID 2436 wrote to memory of 2088 2436 406aa985efb3a630109d6274a4f64f957988ad874e2d816af0405e31a05c27af.exe 7rlfxrx.exe PID 2436 wrote to memory of 2088 2436 406aa985efb3a630109d6274a4f64f957988ad874e2d816af0405e31a05c27af.exe 7rlfxrx.exe PID 2436 wrote to memory of 2088 2436 406aa985efb3a630109d6274a4f64f957988ad874e2d816af0405e31a05c27af.exe 7rlfxrx.exe PID 2436 wrote to memory of 2088 2436 406aa985efb3a630109d6274a4f64f957988ad874e2d816af0405e31a05c27af.exe 7rlfxrx.exe PID 2088 wrote to memory of 2408 2088 7rlfxrx.exe flrfxfx.exe PID 2088 wrote to memory of 2408 2088 7rlfxrx.exe flrfxfx.exe PID 2088 wrote to memory of 2408 2088 7rlfxrx.exe flrfxfx.exe PID 2088 wrote to memory of 2408 2088 7rlfxrx.exe flrfxfx.exe PID 2408 wrote to memory of 2340 2408 flrfxfx.exe 3nntth.exe PID 2408 wrote to memory of 2340 2408 flrfxfx.exe 3nntth.exe PID 2408 wrote to memory of 2340 2408 flrfxfx.exe 3nntth.exe PID 2408 wrote to memory of 2340 2408 flrfxfx.exe 3nntth.exe PID 2340 wrote to memory of 2656 2340 3nntth.exe vjvpj.exe PID 2340 wrote to memory of 2656 2340 3nntth.exe vjvpj.exe PID 2340 wrote to memory of 2656 2340 3nntth.exe vjvpj.exe PID 2340 wrote to memory of 2656 2340 3nntth.exe vjvpj.exe PID 2656 wrote to memory of 2860 2656 vjvpj.exe jpjjd.exe PID 2656 wrote to memory of 2860 2656 vjvpj.exe jpjjd.exe PID 2656 wrote to memory of 2860 2656 vjvpj.exe jpjjd.exe PID 2656 wrote to memory of 2860 2656 vjvpj.exe jpjjd.exe PID 2860 wrote to memory of 2764 2860 jpjjd.exe lrxrxlf.exe PID 2860 wrote to memory of 2764 2860 jpjjd.exe lrxrxlf.exe PID 2860 wrote to memory of 2764 2860 jpjjd.exe lrxrxlf.exe PID 2860 wrote to memory of 2764 2860 jpjjd.exe lrxrxlf.exe PID 2764 wrote to memory of 2544 2764 lrxrxlf.exe hhhnht.exe PID 2764 wrote to memory of 2544 2764 lrxrxlf.exe hhhnht.exe PID 2764 wrote to memory of 2544 2764 lrxrxlf.exe hhhnht.exe PID 2764 wrote to memory of 2544 2764 lrxrxlf.exe hhhnht.exe PID 2544 wrote to memory of 2680 2544 hhhnht.exe 1pdpp.exe PID 2544 wrote to memory of 2680 2544 hhhnht.exe 1pdpp.exe PID 2544 wrote to memory of 2680 2544 hhhnht.exe 1pdpp.exe PID 2544 wrote to memory of 2680 2544 hhhnht.exe 1pdpp.exe PID 2680 wrote to memory of 2524 2680 1pdpp.exe hbntnb.exe PID 2680 wrote to memory of 2524 2680 1pdpp.exe hbntnb.exe PID 2680 wrote to memory of 2524 2680 1pdpp.exe hbntnb.exe PID 2680 wrote to memory of 2524 2680 1pdpp.exe hbntnb.exe PID 2524 wrote to memory of 2984 2524 vpjvj.exe 7llxxfr.exe PID 2524 wrote to memory of 2984 2524 vpjvj.exe 7llxxfr.exe PID 2524 wrote to memory of 2984 2524 vpjvj.exe 7llxxfr.exe PID 2524 wrote to memory of 2984 2524 vpjvj.exe 7llxxfr.exe PID 2984 wrote to memory of 2164 2984 7llxxfr.exe 7llrllf.exe PID 2984 wrote to memory of 2164 2984 7llxxfr.exe 7llrllf.exe PID 2984 wrote to memory of 2164 2984 7llxxfr.exe 7llrllf.exe PID 2984 wrote to memory of 2164 2984 7llxxfr.exe 7llrllf.exe PID 2164 wrote to memory of 2496 2164 7llrllf.exe nbnhbb.exe PID 2164 wrote to memory of 2496 2164 7llrllf.exe nbnhbb.exe PID 2164 wrote to memory of 2496 2164 7llrllf.exe nbnhbb.exe PID 2164 wrote to memory of 2496 2164 7llrllf.exe nbnhbb.exe PID 2496 wrote to memory of 2608 2496 nbnhbb.exe dpdvj.exe PID 2496 wrote to memory of 2608 2496 nbnhbb.exe dpdvj.exe PID 2496 wrote to memory of 2608 2496 nbnhbb.exe dpdvj.exe PID 2496 wrote to memory of 2608 2496 nbnhbb.exe dpdvj.exe PID 2608 wrote to memory of 2028 2608 dpdvj.exe xxrrlrf.exe PID 2608 wrote to memory of 2028 2608 dpdvj.exe xxrrlrf.exe PID 2608 wrote to memory of 2028 2608 dpdvj.exe xxrrlrf.exe PID 2608 wrote to memory of 2028 2608 dpdvj.exe xxrrlrf.exe PID 2028 wrote to memory of 1308 2028 xxrrlrf.exe PID 2028 wrote to memory of 1308 2028 xxrrlrf.exe PID 2028 wrote to memory of 1308 2028 xxrrlrf.exe PID 2028 wrote to memory of 1308 2028 xxrrlrf.exe PID 1308 wrote to memory of 1968 1308 bhnhbt.exe pdjvd.exe PID 1308 wrote to memory of 1968 1308 bhnhbt.exe pdjvd.exe PID 1308 wrote to memory of 1968 1308 bhnhbt.exe pdjvd.exe PID 1308 wrote to memory of 1968 1308 bhnhbt.exe pdjvd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\406aa985efb3a630109d6274a4f64f957988ad874e2d816af0405e31a05c27af.exe"C:\Users\Admin\AppData\Local\Temp\406aa985efb3a630109d6274a4f64f957988ad874e2d816af0405e31a05c27af.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\7rlfxrx.exec:\7rlfxrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flrfxfx.exec:\flrfxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3nntth.exec:\3nntth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjvpj.exec:\vjvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpjjd.exec:\jpjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrxrxlf.exec:\lrxrxlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhnht.exec:\hhhnht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1pdpp.exec:\1pdpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjvj.exec:\vpjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7llxxfr.exec:\7llxxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7llrllf.exec:\7llrllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbnhbb.exec:\nbnhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpdvj.exec:\dpdvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxrrlrf.exec:\xxrrlrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhnhbt.exec:\bhnhbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdjvd.exec:\pdjvd.exe17⤵
- Executes dropped EXE
-
\??\c:\5vjdd.exec:\5vjdd.exe18⤵
- Executes dropped EXE
-
\??\c:\xrrlrll.exec:\xrrlrll.exe19⤵
- Executes dropped EXE
-
\??\c:\ntnthb.exec:\ntnthb.exe20⤵
- Executes dropped EXE
-
\??\c:\3hbbtb.exec:\3hbbtb.exe21⤵
- Executes dropped EXE
-
\??\c:\dpvvp.exec:\dpvvp.exe22⤵
- Executes dropped EXE
-
\??\c:\xxfrrfx.exec:\xxfrrfx.exe23⤵
- Executes dropped EXE
-
\??\c:\lllrlxr.exec:\lllrlxr.exe24⤵
- Executes dropped EXE
-
\??\c:\hnbbbn.exec:\hnbbbn.exe25⤵
- Executes dropped EXE
-
\??\c:\3frlflr.exec:\3frlflr.exe26⤵
- Executes dropped EXE
-
\??\c:\7nnttb.exec:\7nnttb.exe27⤵
- Executes dropped EXE
-
\??\c:\bbhhbn.exec:\bbhhbn.exe28⤵
- Executes dropped EXE
-
\??\c:\pvjjv.exec:\pvjjv.exe29⤵
- Executes dropped EXE
-
\??\c:\lllfrfl.exec:\lllfrfl.exe30⤵
- Executes dropped EXE
-
\??\c:\fllxfll.exec:\fllxfll.exe31⤵
- Executes dropped EXE
-
\??\c:\tttnht.exec:\tttnht.exe32⤵
- Executes dropped EXE
-
\??\c:\hhttnt.exec:\hhttnt.exe33⤵
- Executes dropped EXE
-
\??\c:\vvvjj.exec:\vvvjj.exe34⤵
- Executes dropped EXE
-
\??\c:\9fflxll.exec:\9fflxll.exe35⤵
- Executes dropped EXE
-
\??\c:\xxrxflx.exec:\xxrxflx.exe36⤵
- Executes dropped EXE
-
\??\c:\1nhhht.exec:\1nhhht.exe37⤵
-
\??\c:\9nbnhh.exec:\9nbnhh.exe38⤵
- Executes dropped EXE
-
\??\c:\jddjd.exec:\jddjd.exe39⤵
- Executes dropped EXE
-
\??\c:\vvppd.exec:\vvppd.exe40⤵
- Executes dropped EXE
-
\??\c:\fllflrr.exec:\fllflrr.exe41⤵
- Executes dropped EXE
-
\??\c:\nhntth.exec:\nhntth.exe42⤵
- Executes dropped EXE
-
\??\c:\nttntn.exec:\nttntn.exe43⤵
- Executes dropped EXE
-
\??\c:\ddjdj.exec:\ddjdj.exe44⤵
- Executes dropped EXE
-
\??\c:\lflxrxf.exec:\lflxrxf.exe45⤵
- Executes dropped EXE
-
\??\c:\xxlrxfr.exec:\xxlrxfr.exe46⤵
- Executes dropped EXE
-
\??\c:\nntbnh.exec:\nntbnh.exe47⤵
- Executes dropped EXE
-
\??\c:\hhbhbn.exec:\hhbhbn.exe48⤵
- Executes dropped EXE
-
\??\c:\jvjvp.exec:\jvjvp.exe49⤵
- Executes dropped EXE
-
\??\c:\xrrrfrx.exec:\xrrrfrx.exe50⤵
- Executes dropped EXE
-
\??\c:\lxlflrx.exec:\lxlflrx.exe51⤵
- Executes dropped EXE
-
\??\c:\hthntn.exec:\hthntn.exe52⤵
- Executes dropped EXE
-
\??\c:\tnbnth.exec:\tnbnth.exe53⤵
- Executes dropped EXE
-
\??\c:\pvddv.exec:\pvddv.exe54⤵
- Executes dropped EXE
-
\??\c:\vjdvv.exec:\vjdvv.exe55⤵
- Executes dropped EXE
-
\??\c:\ffxrrxr.exec:\ffxrrxr.exe56⤵
- Executes dropped EXE
-
\??\c:\fllffrr.exec:\fllffrr.exe57⤵
- Executes dropped EXE
-
\??\c:\tbtnth.exec:\tbtnth.exe58⤵
- Executes dropped EXE
-
\??\c:\jjdpj.exec:\jjdpj.exe59⤵
- Executes dropped EXE
-
\??\c:\3dppv.exec:\3dppv.exe60⤵
- Executes dropped EXE
-
\??\c:\xxrfrxl.exec:\xxrfrxl.exe61⤵
- Executes dropped EXE
-
\??\c:\3fxlflx.exec:\3fxlflx.exe62⤵
- Executes dropped EXE
-
\??\c:\3ntbnh.exec:\3ntbnh.exe63⤵
- Executes dropped EXE
-
\??\c:\nhhnht.exec:\nhhnht.exe64⤵
- Executes dropped EXE
-
\??\c:\1vvvp.exec:\1vvvp.exe65⤵
- Executes dropped EXE
-
\??\c:\lrxxrll.exec:\lrxxrll.exe66⤵
- Executes dropped EXE
-
\??\c:\rrxlrxx.exec:\rrxlrxx.exe67⤵
-
\??\c:\lfrfrrf.exec:\lfrfrrf.exe68⤵
-
\??\c:\nhbhth.exec:\nhbhth.exe69⤵
-
\??\c:\bbnhtb.exec:\bbnhtb.exe70⤵
-
\??\c:\3pvvv.exec:\3pvvv.exe71⤵
-
\??\c:\9vvdv.exec:\9vvdv.exe72⤵
-
\??\c:\xrllllf.exec:\xrllllf.exe73⤵
-
\??\c:\1lrxlxr.exec:\1lrxlxr.exe74⤵
-
\??\c:\htnbhh.exec:\htnbhh.exe75⤵
-
\??\c:\9nbhbn.exec:\9nbhbn.exe76⤵
-
\??\c:\5vvpv.exec:\5vvpv.exe77⤵
-
\??\c:\xrlrrrx.exec:\xrlrrrx.exe78⤵
-
\??\c:\9frlllf.exec:\9frlllf.exe79⤵
-
\??\c:\tttnhb.exec:\tttnhb.exe80⤵
-
\??\c:\thntth.exec:\thntth.exe81⤵
-
\??\c:\vdjdv.exec:\vdjdv.exe82⤵
-
\??\c:\djvpj.exec:\djvpj.exe83⤵
-
\??\c:\xfxxxff.exec:\xfxxxff.exe84⤵
-
\??\c:\1bnhtb.exec:\1bnhtb.exe85⤵
-
\??\c:\tbbnbt.exec:\tbbnbt.exe86⤵
-
\??\c:\pdpdd.exec:\pdpdd.exe87⤵
-
\??\c:\pppvj.exec:\pppvj.exe88⤵
-
\??\c:\ffrlrfl.exec:\ffrlrfl.exe89⤵
-
\??\c:\xxflrxx.exec:\xxflrxx.exe90⤵
-
\??\c:\hhnhbb.exec:\hhnhbb.exe91⤵
-
\??\c:\vdvdd.exec:\vdvdd.exe92⤵
-
\??\c:\vpdjp.exec:\vpdjp.exe93⤵
-
\??\c:\lfrlxrf.exec:\lfrlxrf.exe94⤵
-
\??\c:\rlffxfr.exec:\rlffxfr.exe95⤵
-
\??\c:\ttbnth.exec:\ttbnth.exe96⤵
-
\??\c:\btnthh.exec:\btnthh.exe97⤵
-
\??\c:\jdvvd.exec:\jdvvd.exe98⤵
-
\??\c:\jjvvd.exec:\jjvvd.exe99⤵
-
\??\c:\frflxxl.exec:\frflxxl.exe100⤵
-
\??\c:\9rxxfff.exec:\9rxxfff.exe101⤵
-
\??\c:\5tnhnt.exec:\5tnhnt.exe102⤵
-
\??\c:\5btnbn.exec:\5btnbn.exe103⤵
-
\??\c:\tbhhtt.exec:\tbhhtt.exe104⤵
-
\??\c:\dpvjv.exec:\dpvjv.exe105⤵
-
\??\c:\dppvp.exec:\dppvp.exe106⤵
-
\??\c:\rlrfrxf.exec:\rlrfrxf.exe107⤵
-
\??\c:\lrlfxrx.exec:\lrlfxrx.exe108⤵
-
\??\c:\bnbtbh.exec:\bnbtbh.exe109⤵
-
\??\c:\bhtbbb.exec:\bhtbbb.exe110⤵
-
\??\c:\5pjpj.exec:\5pjpj.exe111⤵
-
\??\c:\7jvdd.exec:\7jvdd.exe112⤵
-
\??\c:\5xfrrfl.exec:\5xfrrfl.exe113⤵
-
\??\c:\rlllrxl.exec:\rlllrxl.exe114⤵
-
\??\c:\bhnttn.exec:\bhnttn.exe115⤵
-
\??\c:\bbhtnh.exec:\bbhtnh.exe116⤵
-
\??\c:\vdjvv.exec:\vdjvv.exe117⤵
-
\??\c:\5jjdv.exec:\5jjdv.exe118⤵
-
\??\c:\1llllrf.exec:\1llllrf.exe119⤵
-
\??\c:\5ffxrfl.exec:\5ffxrfl.exe120⤵
-
\??\c:\btbtth.exec:\btbtth.exe121⤵
-
\??\c:\hnhtnb.exec:\hnhtnb.exe122⤵
-
\??\c:\hnhnnt.exec:\hnhnnt.exe123⤵
-
\??\c:\jvjdp.exec:\jvjdp.exe124⤵
-
\??\c:\vvppj.exec:\vvppj.exe125⤵
-
\??\c:\lffrrfx.exec:\lffrrfx.exe126⤵
-
\??\c:\frlxfff.exec:\frlxfff.exe127⤵
-
\??\c:\hbhthn.exec:\hbhthn.exe128⤵
-
\??\c:\9nnhbb.exec:\9nnhbb.exe129⤵
-
\??\c:\ddvjd.exec:\ddvjd.exe130⤵
-
\??\c:\pjjpp.exec:\pjjpp.exe131⤵
-
\??\c:\rfrrlll.exec:\rfrrlll.exe132⤵
-
\??\c:\htnhnn.exec:\htnhnn.exe133⤵
-
\??\c:\hnhnhn.exec:\hnhnhn.exe134⤵
-
\??\c:\tntnnt.exec:\tntnnt.exe135⤵
-
\??\c:\djvdd.exec:\djvdd.exe136⤵
-
\??\c:\xrxxfrf.exec:\xrxxfrf.exe137⤵
-
\??\c:\rrxffxf.exec:\rrxffxf.exe138⤵
-
\??\c:\bbhbhh.exec:\bbhbhh.exe139⤵
-
\??\c:\tttbtb.exec:\tttbtb.exe140⤵
-
\??\c:\pvjvd.exec:\pvjvd.exe141⤵
-
\??\c:\vpjvj.exec:\vpjvj.exe142⤵
-
\??\c:\jpvpv.exec:\jpvpv.exe143⤵
-
\??\c:\lxlllrx.exec:\lxlllrx.exe144⤵
-
\??\c:\bbnntt.exec:\bbnntt.exe145⤵
-
\??\c:\btnntb.exec:\btnntb.exe146⤵
-
\??\c:\bnttbb.exec:\bnttbb.exe147⤵
-
\??\c:\jpvjj.exec:\jpvjj.exe148⤵
-
\??\c:\5ppjp.exec:\5ppjp.exe149⤵
-
\??\c:\1rrrffl.exec:\1rrrffl.exe150⤵
-
\??\c:\ffxlrxl.exec:\ffxlrxl.exe151⤵
-
\??\c:\hbtthh.exec:\hbtthh.exe152⤵
-
\??\c:\7btthh.exec:\7btthh.exe153⤵
-
\??\c:\vvvjj.exec:\vvvjj.exe154⤵
-
\??\c:\ddvvj.exec:\ddvvj.exe155⤵
-
\??\c:\3jddj.exec:\3jddj.exe156⤵
-
\??\c:\xrfrxxl.exec:\xrfrxxl.exe157⤵
-
\??\c:\ffrxlrf.exec:\ffrxlrf.exe158⤵
-
\??\c:\5tnnth.exec:\5tnnth.exe159⤵
-
\??\c:\hbttnn.exec:\hbttnn.exe160⤵
-
\??\c:\bnnbnb.exec:\bnnbnb.exe161⤵
-
\??\c:\jjdjd.exec:\jjdjd.exe162⤵
-
\??\c:\5dppv.exec:\5dppv.exe163⤵
-
\??\c:\7xfrlff.exec:\7xfrlff.exe164⤵
-
\??\c:\5xrlxfr.exec:\5xrlxfr.exe165⤵
-
\??\c:\ttnbhh.exec:\ttnbhh.exe166⤵
-
\??\c:\tnbhth.exec:\tnbhth.exe167⤵
-
\??\c:\dvpdj.exec:\dvpdj.exe168⤵
-
\??\c:\dpvjd.exec:\dpvjd.exe169⤵
-
\??\c:\xxrflxl.exec:\xxrflxl.exe170⤵
-
\??\c:\lllxlxf.exec:\lllxlxf.exe171⤵
-
\??\c:\nhbtbh.exec:\nhbtbh.exe172⤵
-
\??\c:\5nthbb.exec:\5nthbb.exe173⤵
-
\??\c:\vpddp.exec:\vpddp.exe174⤵
-
\??\c:\9ppjp.exec:\9ppjp.exe175⤵
-
\??\c:\rlfxlrr.exec:\rlfxlrr.exe176⤵
-
\??\c:\rlrxrxl.exec:\rlrxrxl.exe177⤵
-
\??\c:\xxlrlrl.exec:\xxlrlrl.exe178⤵
-
\??\c:\bnbhbb.exec:\bnbhbb.exe179⤵
-
\??\c:\ttnbnn.exec:\ttnbnn.exe180⤵
-
\??\c:\jjppp.exec:\jjppp.exe181⤵
-
\??\c:\flrxfxx.exec:\flrxfxx.exe182⤵
-
\??\c:\9hhbhb.exec:\9hhbhb.exe183⤵
-
\??\c:\hhbntt.exec:\hhbntt.exe184⤵
-
\??\c:\dvpdd.exec:\dvpdd.exe185⤵
-
\??\c:\dpdvv.exec:\dpdvv.exe186⤵
-
\??\c:\xfrlrrx.exec:\xfrlrrx.exe187⤵
-
\??\c:\xxllxlr.exec:\xxllxlr.exe188⤵
-
\??\c:\nhtbnb.exec:\nhtbnb.exe189⤵
-
\??\c:\5hbhht.exec:\5hbhht.exe190⤵
-
\??\c:\jpdvd.exec:\jpdvd.exe191⤵
-
\??\c:\dpdjv.exec:\dpdjv.exe192⤵
-
\??\c:\xxrrllf.exec:\xxrrllf.exe193⤵
-
\??\c:\fxffrrf.exec:\fxffrrf.exe194⤵
-
\??\c:\bbtbht.exec:\bbtbht.exe195⤵
-
\??\c:\9tthhh.exec:\9tthhh.exe196⤵
-
\??\c:\dvppd.exec:\dvppd.exe197⤵
-
\??\c:\ffrlffr.exec:\ffrlffr.exe198⤵
-
\??\c:\9rfrxrx.exec:\9rfrxrx.exe199⤵
-
\??\c:\nbhbnn.exec:\nbhbnn.exe200⤵
-
\??\c:\tnbttb.exec:\tnbttb.exe201⤵
-
\??\c:\jvjdj.exec:\jvjdj.exe202⤵
-
\??\c:\jjvdp.exec:\jjvdp.exe203⤵
-
\??\c:\fxlrxrf.exec:\fxlrxrf.exe204⤵
-
\??\c:\llxfxfx.exec:\llxfxfx.exe205⤵
-
\??\c:\bthhtn.exec:\bthhtn.exe206⤵
-
\??\c:\bnbhtb.exec:\bnbhtb.exe207⤵
-
\??\c:\bhtttn.exec:\bhtttn.exe208⤵
-
\??\c:\vppvp.exec:\vppvp.exe209⤵
-
\??\c:\7vjpv.exec:\7vjpv.exe210⤵
-
\??\c:\1rfflxf.exec:\1rfflxf.exe211⤵
-
\??\c:\lflflxr.exec:\lflflxr.exe212⤵
-
\??\c:\nthhnn.exec:\nthhnn.exe213⤵
-
\??\c:\dpdvv.exec:\dpdvv.exe214⤵
-
\??\c:\vvjdp.exec:\vvjdp.exe215⤵
-
\??\c:\flflflr.exec:\flflflr.exe216⤵
-
\??\c:\frlfrrf.exec:\frlfrrf.exe217⤵
-
\??\c:\nbtbnt.exec:\nbtbnt.exe218⤵
-
\??\c:\htnhbt.exec:\htnhbt.exe219⤵
-
\??\c:\djdvv.exec:\djdvv.exe220⤵
-
\??\c:\jppdd.exec:\jppdd.exe221⤵
-
\??\c:\lfllflf.exec:\lfllflf.exe222⤵
-
\??\c:\xfxfrfx.exec:\xfxfrfx.exe223⤵
-
\??\c:\ntbhth.exec:\ntbhth.exe224⤵
-
\??\c:\nhhhnt.exec:\nhhhnt.exe225⤵
-
\??\c:\vjpdj.exec:\vjpdj.exe226⤵
-
\??\c:\9dpdd.exec:\9dpdd.exe227⤵
-
\??\c:\rxxllrx.exec:\rxxllrx.exe228⤵
-
\??\c:\llxllff.exec:\llxllff.exe229⤵
-
\??\c:\flxxlfl.exec:\flxxlfl.exe230⤵
-
\??\c:\bhbhnh.exec:\bhbhnh.exe231⤵
-
\??\c:\nbtbnh.exec:\nbtbnh.exe232⤵
-
\??\c:\9jdjv.exec:\9jdjv.exe233⤵
-
\??\c:\lrfrlff.exec:\lrfrlff.exe234⤵
-
\??\c:\rfflfrl.exec:\rfflfrl.exe235⤵
-
\??\c:\ththnh.exec:\ththnh.exe236⤵
-
\??\c:\nbbhht.exec:\nbbhht.exe237⤵
-
\??\c:\pjpdd.exec:\pjpdd.exe238⤵
-
\??\c:\dpjjp.exec:\dpjjp.exe239⤵
-
\??\c:\xfrflff.exec:\xfrflff.exe240⤵
-
\??\c:\xllflrl.exec:\xllflrl.exe241⤵