Analysis
-
max time kernel
150s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 01:12
Behavioral task
behavioral1
Sample
a9eb7cba84ab4c0aeceedb7886ccda1041ead0bd39fe3215c2830d12c83094dc.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
a9eb7cba84ab4c0aeceedb7886ccda1041ead0bd39fe3215c2830d12c83094dc.exe
-
Size
185KB
-
MD5
6375ba3cac7ddae754678c391448b2a4
-
SHA1
a54e29a955ca2a5a29a6a458d61c4c33e0334b0d
-
SHA256
a9eb7cba84ab4c0aeceedb7886ccda1041ead0bd39fe3215c2830d12c83094dc
-
SHA512
c3e43cd85cc4ef8223e1bd50cbf793b2883d63ec81c6f982c42a14f8b157652e020953e7b26d448a5b2a1afb4f6e359517923890c916473f82b912edb105219e
-
SSDEEP
3072:chOmTsF93UYfwC6GIout5pi8rY9AABa1U+a88Xu3VodyikZfhnJtJI+i:ccm4FmowdHoS5ddWX+afdlkpPtJIv
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1148-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/232-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1772-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2736-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3336-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4260-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2924-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2980-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2496-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1036-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/384-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4092-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1044-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4060-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/748-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3092-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3788-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2324-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2672-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1104-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1944-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1180-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1552-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2104-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/908-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4108-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4916-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3632-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4444-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3340-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/764-482-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-517-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3084-535-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-555-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/908-577-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-615-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1404-626-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1688-630-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2164-663-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-723-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4092-736-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1932-760-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4200-798-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/712-816-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2748-854-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2308-916-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-959-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1148-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1148-7-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\fffxrlf.exe UPX behavioral2/memory/4364-12-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/232-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\tbnhtt.exe UPX \??\c:\hbthbt.exe UPX C:\1ppvj.exe UPX behavioral2/memory/1772-32-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4944-26-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\rlfxrrl.exe UPX behavioral2/memory/3260-37-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2736-22-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ppvjd.exe UPX \??\c:\lxrlxrl.exe UPX behavioral2/memory/4260-43-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\3ddpj.exe UPX behavioral2/memory/3336-52-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\djjdp.exe UPX behavioral2/memory/4260-48-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\thhbbt.exe UPX behavioral2/memory/2924-61-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bnbtnh.exe UPX behavioral2/memory/3252-66-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\pvpjv.exe UPX behavioral2/memory/2980-73-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\ffrxxrf.exe UPX behavioral2/memory/3244-78-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3700-80-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\bthbnh.exe UPX C:\9jpdp.exe UPX behavioral2/memory/5068-90-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4056-96-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xlfxrlf.exe UPX \??\c:\7hbbtn.exe UPX C:\bnnnhb.exe UPX behavioral2/memory/2496-108-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1036-102-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\1dvpj.exe UPX C:\xlfxrfr.exe UPX behavioral2/memory/384-117-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4092-124-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\nnnhnh.exe UPX C:\1jjvp.exe UPX behavioral2/memory/2008-130-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xlxfxlx.exe UPX behavioral2/memory/1044-136-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4060-139-0x0000000000400000-0x0000000000427000-memory.dmp UPX \??\c:\nhnhbb.exe UPX behavioral2/memory/748-147-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vjjvv.exe UPX C:\vpjdj.exe UPX behavioral2/memory/4536-158-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\xxxrfrl.exe UPX \??\c:\nbtnbh.exe UPX behavioral2/memory/2644-165-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3092-167-0x0000000000400000-0x0000000000427000-memory.dmp UPX C:\vvjpj.exe UPX C:\lrxrlff.exe UPX C:\nbnhhh.exe UPX C:\dpjdv.exe UPX behavioral2/memory/3788-188-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2324-204-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2672-212-0x0000000000400000-0x0000000000427000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
ppvjd.exefffxrlf.exetbnhtt.exehbthbt.exe1ppvj.exerlfxrrl.exelxrlxrl.exe3ddpj.exedjjdp.exethhbbt.exebnbtnh.exepvpjv.exeffrxxrf.exebthbnh.exe9jpdp.exexlfxrlf.exe7hbbtn.exebnnnhb.exe1dvpj.exexlfxrfr.exennnhnh.exe1jjvp.exexlxfxlx.exenhnhbb.exevjjvv.exevpjdj.exexxxrfrl.exenbtnbh.exevvjpj.exelrxrlff.exenbnhhh.exedpjdv.exelrxrlll.exerrrrrrr.exebnnbtt.exejdjpd.exelfllfff.exehhtnbh.exehhbtbb.exedvjvv.exepddvd.exellfxllf.exe7rxfrrl.exebhnhbb.exejpjdp.exe9vddd.exe7llfrrr.exenhhtnt.exe5ppjj.exexrxxxxx.exetnnhnh.exebbnhtt.exejddvp.exevpdvv.exexrllxxr.exerfllfff.exebtbttb.exevjppp.exepdjdp.exexrlfffl.exerlrlfxx.exenhnnhh.exeppppp.exe5dvpd.exepid process 4364 ppvjd.exe 232 fffxrlf.exe 2736 tbnhtt.exe 4944 hbthbt.exe 1772 1ppvj.exe 3260 rlfxrrl.exe 4260 lxrlxrl.exe 3336 3ddpj.exe 2924 djjdp.exe 3252 thhbbt.exe 2980 bnbtnh.exe 3244 pvpjv.exe 3700 ffrxxrf.exe 5068 bthbnh.exe 4056 9jpdp.exe 1036 xlfxrlf.exe 4560 7hbbtn.exe 2496 bnnnhb.exe 384 1dvpj.exe 4092 xlfxrfr.exe 2008 nnnhnh.exe 1044 1jjvp.exe 4060 xlxfxlx.exe 748 nhnhbb.exe 1676 vjjvv.exe 4536 vpjdj.exe 2644 xxxrfrl.exe 3092 nbtnbh.exe 964 vvjpj.exe 3104 lrxrlff.exe 3788 nbnhhh.exe 4396 dpjdv.exe 4824 lrxrlll.exe 216 rrrrrrr.exe 4916 bnnbtt.exe 2324 jdjpd.exe 4076 lfllfff.exe 2584 hhtnbh.exe 2672 hhbtbb.exe 3328 dvjvv.exe 1104 pddvd.exe 3748 llfxllf.exe 4252 7rxfrrl.exe 1680 bhnhbb.exe 4992 jpjdp.exe 1944 9vddd.exe 4896 7llfrrr.exe 2188 nhhtnt.exe 4736 5ppjj.exe 2216 xrxxxxx.exe 1180 tnnhnh.exe 3016 bbnhtt.exe 404 jddvp.exe 2980 vpdvv.exe 1552 xrllxxr.exe 3304 rfllfff.exe 5052 btbttb.exe 1028 vjppp.exe 4920 pdjdp.exe 2104 xrlfffl.exe 908 rlrlfxx.exe 396 nhnnhh.exe 3512 ppppp.exe 3592 5dvpd.exe -
Processes:
resource yara_rule behavioral2/memory/1148-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1148-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fffxrlf.exe upx behavioral2/memory/4364-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/232-13-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tbnhtt.exe upx \??\c:\hbthbt.exe upx C:\1ppvj.exe upx behavioral2/memory/1772-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4944-26-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rlfxrrl.exe upx behavioral2/memory/3260-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2736-22-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppvjd.exe upx \??\c:\lxrlxrl.exe upx behavioral2/memory/4260-43-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3ddpj.exe upx behavioral2/memory/3336-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djjdp.exe upx behavioral2/memory/4260-48-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thhbbt.exe upx behavioral2/memory/2924-61-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnbtnh.exe upx behavioral2/memory/3252-66-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pvpjv.exe upx behavioral2/memory/2980-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffrxxrf.exe upx behavioral2/memory/3244-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3700-80-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bthbnh.exe upx C:\9jpdp.exe upx behavioral2/memory/5068-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4056-96-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlfxrlf.exe upx \??\c:\7hbbtn.exe upx C:\bnnnhb.exe upx behavioral2/memory/2496-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1036-102-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1dvpj.exe upx C:\xlfxrfr.exe upx behavioral2/memory/384-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4092-124-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnnhnh.exe upx C:\1jjvp.exe upx behavioral2/memory/2008-130-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlxfxlx.exe upx behavioral2/memory/1044-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4060-139-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhnhbb.exe upx behavioral2/memory/748-147-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjjvv.exe upx C:\vpjdj.exe upx behavioral2/memory/4536-158-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxxrfrl.exe upx \??\c:\nbtnbh.exe upx behavioral2/memory/2644-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3092-167-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvjpj.exe upx C:\lrxrlff.exe upx C:\nbnhhh.exe upx C:\dpjdv.exe upx behavioral2/memory/3788-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2324-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2672-212-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a9eb7cba84ab4c0aeceedb7886ccda1041ead0bd39fe3215c2830d12c83094dc.exeppvjd.exefffxrlf.exetbnhtt.exehbthbt.exe1ppvj.exerlfxrrl.exelxrlxrl.exe3ddpj.exedjjdp.exethhbbt.exebnbtnh.exepvpjv.exeffrxxrf.exebthbnh.exe9jpdp.exexlfxrlf.exe7hbbtn.exebnnnhb.exe1dvpj.exexlfxrfr.exennnhnh.exedescription pid process target process PID 1148 wrote to memory of 4364 1148 a9eb7cba84ab4c0aeceedb7886ccda1041ead0bd39fe3215c2830d12c83094dc.exe ppvjd.exe PID 1148 wrote to memory of 4364 1148 a9eb7cba84ab4c0aeceedb7886ccda1041ead0bd39fe3215c2830d12c83094dc.exe ppvjd.exe PID 1148 wrote to memory of 4364 1148 a9eb7cba84ab4c0aeceedb7886ccda1041ead0bd39fe3215c2830d12c83094dc.exe ppvjd.exe PID 4364 wrote to memory of 232 4364 ppvjd.exe fffxrlf.exe PID 4364 wrote to memory of 232 4364 ppvjd.exe fffxrlf.exe PID 4364 wrote to memory of 232 4364 ppvjd.exe fffxrlf.exe PID 232 wrote to memory of 2736 232 fffxrlf.exe tbnhtt.exe PID 232 wrote to memory of 2736 232 fffxrlf.exe tbnhtt.exe PID 232 wrote to memory of 2736 232 fffxrlf.exe tbnhtt.exe PID 2736 wrote to memory of 4944 2736 tbnhtt.exe hbthbt.exe PID 2736 wrote to memory of 4944 2736 tbnhtt.exe hbthbt.exe PID 2736 wrote to memory of 4944 2736 tbnhtt.exe hbthbt.exe PID 4944 wrote to memory of 1772 4944 hbthbt.exe 1ppvj.exe PID 4944 wrote to memory of 1772 4944 hbthbt.exe 1ppvj.exe PID 4944 wrote to memory of 1772 4944 hbthbt.exe 1ppvj.exe PID 1772 wrote to memory of 3260 1772 1ppvj.exe rlfxrrl.exe PID 1772 wrote to memory of 3260 1772 1ppvj.exe rlfxrrl.exe PID 1772 wrote to memory of 3260 1772 1ppvj.exe rlfxrrl.exe PID 3260 wrote to memory of 4260 3260 rlfxrrl.exe lxrlxrl.exe PID 3260 wrote to memory of 4260 3260 rlfxrrl.exe lxrlxrl.exe PID 3260 wrote to memory of 4260 3260 rlfxrrl.exe lxrlxrl.exe PID 4260 wrote to memory of 3336 4260 lxrlxrl.exe 3ddpj.exe PID 4260 wrote to memory of 3336 4260 lxrlxrl.exe 3ddpj.exe PID 4260 wrote to memory of 3336 4260 lxrlxrl.exe 3ddpj.exe PID 3336 wrote to memory of 2924 3336 3ddpj.exe djjdp.exe PID 3336 wrote to memory of 2924 3336 3ddpj.exe djjdp.exe PID 3336 wrote to memory of 2924 3336 3ddpj.exe djjdp.exe PID 2924 wrote to memory of 3252 2924 djjdp.exe thhbbt.exe PID 2924 wrote to memory of 3252 2924 djjdp.exe thhbbt.exe PID 2924 wrote to memory of 3252 2924 djjdp.exe thhbbt.exe PID 3252 wrote to memory of 2980 3252 thhbbt.exe bnbtnh.exe PID 3252 wrote to memory of 2980 3252 thhbbt.exe bnbtnh.exe PID 3252 wrote to memory of 2980 3252 thhbbt.exe bnbtnh.exe PID 2980 wrote to memory of 3244 2980 bnbtnh.exe pvpjv.exe PID 2980 wrote to memory of 3244 2980 bnbtnh.exe pvpjv.exe PID 2980 wrote to memory of 3244 2980 bnbtnh.exe pvpjv.exe PID 3244 wrote to memory of 3700 3244 pvpjv.exe ffrxxrf.exe PID 3244 wrote to memory of 3700 3244 pvpjv.exe ffrxxrf.exe PID 3244 wrote to memory of 3700 3244 pvpjv.exe ffrxxrf.exe PID 3700 wrote to memory of 5068 3700 ffrxxrf.exe bthbnh.exe PID 3700 wrote to memory of 5068 3700 ffrxxrf.exe bthbnh.exe PID 3700 wrote to memory of 5068 3700 ffrxxrf.exe bthbnh.exe PID 5068 wrote to memory of 4056 5068 bthbnh.exe 9jpdp.exe PID 5068 wrote to memory of 4056 5068 bthbnh.exe 9jpdp.exe PID 5068 wrote to memory of 4056 5068 bthbnh.exe 9jpdp.exe PID 4056 wrote to memory of 1036 4056 9jpdp.exe xlfxrlf.exe PID 4056 wrote to memory of 1036 4056 9jpdp.exe xlfxrlf.exe PID 4056 wrote to memory of 1036 4056 9jpdp.exe xlfxrlf.exe PID 1036 wrote to memory of 4560 1036 xlfxrlf.exe 7hbbtn.exe PID 1036 wrote to memory of 4560 1036 xlfxrlf.exe 7hbbtn.exe PID 1036 wrote to memory of 4560 1036 xlfxrlf.exe 7hbbtn.exe PID 4560 wrote to memory of 2496 4560 7hbbtn.exe bnnnhb.exe PID 4560 wrote to memory of 2496 4560 7hbbtn.exe bnnnhb.exe PID 4560 wrote to memory of 2496 4560 7hbbtn.exe bnnnhb.exe PID 2496 wrote to memory of 384 2496 bnnnhb.exe 1dvpj.exe PID 2496 wrote to memory of 384 2496 bnnnhb.exe 1dvpj.exe PID 2496 wrote to memory of 384 2496 bnnnhb.exe 1dvpj.exe PID 384 wrote to memory of 4092 384 1dvpj.exe xlfxrfr.exe PID 384 wrote to memory of 4092 384 1dvpj.exe xlfxrfr.exe PID 384 wrote to memory of 4092 384 1dvpj.exe xlfxrfr.exe PID 4092 wrote to memory of 2008 4092 xlfxrfr.exe nnnhnh.exe PID 4092 wrote to memory of 2008 4092 xlfxrfr.exe nnnhnh.exe PID 4092 wrote to memory of 2008 4092 xlfxrfr.exe nnnhnh.exe PID 2008 wrote to memory of 1044 2008 nnnhnh.exe 1jjvp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9eb7cba84ab4c0aeceedb7886ccda1041ead0bd39fe3215c2830d12c83094dc.exe"C:\Users\Admin\AppData\Local\Temp\a9eb7cba84ab4c0aeceedb7886ccda1041ead0bd39fe3215c2830d12c83094dc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\ppvjd.exec:\ppvjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fffxrlf.exec:\fffxrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbnhtt.exec:\tbnhtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbthbt.exec:\hbthbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1ppvj.exec:\1ppvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxrlxrl.exec:\lxrlxrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3ddpj.exec:\3ddpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djjdp.exec:\djjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thhbbt.exec:\thhbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnbtnh.exec:\bnbtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvpjv.exec:\pvpjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffrxxrf.exec:\ffrxxrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bthbnh.exec:\bthbnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9jpdp.exec:\9jpdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7hbbtn.exec:\7hbbtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnnnhb.exec:\bnnnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1dvpj.exec:\1dvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlfxrfr.exec:\xlfxrfr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnnhnh.exec:\nnnhnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1jjvp.exec:\1jjvp.exe23⤵
- Executes dropped EXE
-
\??\c:\xlxfxlx.exec:\xlxfxlx.exe24⤵
- Executes dropped EXE
-
\??\c:\nhnhbb.exec:\nhnhbb.exe25⤵
- Executes dropped EXE
-
\??\c:\vjjvv.exec:\vjjvv.exe26⤵
- Executes dropped EXE
-
\??\c:\vpjdj.exec:\vpjdj.exe27⤵
- Executes dropped EXE
-
\??\c:\xxxrfrl.exec:\xxxrfrl.exe28⤵
- Executes dropped EXE
-
\??\c:\nbtnbh.exec:\nbtnbh.exe29⤵
- Executes dropped EXE
-
\??\c:\vvjpj.exec:\vvjpj.exe30⤵
- Executes dropped EXE
-
\??\c:\lrxrlff.exec:\lrxrlff.exe31⤵
- Executes dropped EXE
-
\??\c:\nbnhhh.exec:\nbnhhh.exe32⤵
- Executes dropped EXE
-
\??\c:\dpjdv.exec:\dpjdv.exe33⤵
- Executes dropped EXE
-
\??\c:\lrxrlll.exec:\lrxrlll.exe34⤵
- Executes dropped EXE
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe35⤵
- Executes dropped EXE
-
\??\c:\bnnbtt.exec:\bnnbtt.exe36⤵
- Executes dropped EXE
-
\??\c:\jdjpd.exec:\jdjpd.exe37⤵
- Executes dropped EXE
-
\??\c:\lfllfff.exec:\lfllfff.exe38⤵
- Executes dropped EXE
-
\??\c:\hhtnbh.exec:\hhtnbh.exe39⤵
- Executes dropped EXE
-
\??\c:\hhbtbb.exec:\hhbtbb.exe40⤵
- Executes dropped EXE
-
\??\c:\dvjvv.exec:\dvjvv.exe41⤵
- Executes dropped EXE
-
\??\c:\pddvd.exec:\pddvd.exe42⤵
- Executes dropped EXE
-
\??\c:\llfxllf.exec:\llfxllf.exe43⤵
- Executes dropped EXE
-
\??\c:\7rxfrrl.exec:\7rxfrrl.exe44⤵
- Executes dropped EXE
-
\??\c:\bhnhbb.exec:\bhnhbb.exe45⤵
- Executes dropped EXE
-
\??\c:\jpjdp.exec:\jpjdp.exe46⤵
- Executes dropped EXE
-
\??\c:\9vddd.exec:\9vddd.exe47⤵
- Executes dropped EXE
-
\??\c:\7llfrrr.exec:\7llfrrr.exe48⤵
- Executes dropped EXE
-
\??\c:\nhhtnt.exec:\nhhtnt.exe49⤵
- Executes dropped EXE
-
\??\c:\5ppjj.exec:\5ppjj.exe50⤵
- Executes dropped EXE
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe51⤵
- Executes dropped EXE
-
\??\c:\tnnhnh.exec:\tnnhnh.exe52⤵
- Executes dropped EXE
-
\??\c:\bbnhtt.exec:\bbnhtt.exe53⤵
- Executes dropped EXE
-
\??\c:\jddvp.exec:\jddvp.exe54⤵
- Executes dropped EXE
-
\??\c:\vpdvv.exec:\vpdvv.exe55⤵
- Executes dropped EXE
-
\??\c:\xrllxxr.exec:\xrllxxr.exe56⤵
- Executes dropped EXE
-
\??\c:\rfllfff.exec:\rfllfff.exe57⤵
- Executes dropped EXE
-
\??\c:\btbttb.exec:\btbttb.exe58⤵
- Executes dropped EXE
-
\??\c:\vjppp.exec:\vjppp.exe59⤵
- Executes dropped EXE
-
\??\c:\pdjdp.exec:\pdjdp.exe60⤵
- Executes dropped EXE
-
\??\c:\xrlfffl.exec:\xrlfffl.exe61⤵
- Executes dropped EXE
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe62⤵
- Executes dropped EXE
-
\??\c:\nhnnhh.exec:\nhnnhh.exe63⤵
- Executes dropped EXE
-
\??\c:\ppppp.exec:\ppppp.exe64⤵
- Executes dropped EXE
-
\??\c:\5dvpd.exec:\5dvpd.exe65⤵
- Executes dropped EXE
-
\??\c:\xlrrlrr.exec:\xlrrlrr.exe66⤵
-
\??\c:\hbttnb.exec:\hbttnb.exe67⤵
-
\??\c:\hhntbb.exec:\hhntbb.exe68⤵
-
\??\c:\jppjd.exec:\jppjd.exe69⤵
-
\??\c:\jvjjv.exec:\jvjjv.exe70⤵
-
\??\c:\rflxxxl.exec:\rflxxxl.exe71⤵
-
\??\c:\ffxrffx.exec:\ffxrffx.exe72⤵
-
\??\c:\thtnhh.exec:\thtnhh.exe73⤵
-
\??\c:\pjjvp.exec:\pjjvp.exe74⤵
-
\??\c:\vdpjd.exec:\vdpjd.exe75⤵
-
\??\c:\tnnhtb.exec:\tnnhtb.exe76⤵
-
\??\c:\nhtbth.exec:\nhtbth.exe77⤵
-
\??\c:\5djdv.exec:\5djdv.exe78⤵
-
\??\c:\pdjdv.exec:\pdjdv.exe79⤵
-
\??\c:\rffxxxf.exec:\rffxxxf.exe80⤵
-
\??\c:\htbtnb.exec:\htbtnb.exe81⤵
-
\??\c:\hnbnhh.exec:\hnbnhh.exe82⤵
-
\??\c:\vpjpj.exec:\vpjpj.exe83⤵
-
\??\c:\jvdvp.exec:\jvdvp.exe84⤵
-
\??\c:\rxxlrrf.exec:\rxxlrrf.exe85⤵
-
\??\c:\1nttnt.exec:\1nttnt.exe86⤵
-
\??\c:\nhthhh.exec:\nhthhh.exe87⤵
-
\??\c:\dpvpd.exec:\dpvpd.exe88⤵
-
\??\c:\fxrlfxx.exec:\fxrlfxx.exe89⤵
-
\??\c:\hbtnhh.exec:\hbtnhh.exe90⤵
-
\??\c:\1hhbtt.exec:\1hhbtt.exe91⤵
-
\??\c:\vppvj.exec:\vppvj.exe92⤵
-
\??\c:\llrlfff.exec:\llrlfff.exe93⤵
-
\??\c:\bhhnhb.exec:\bhhnhb.exe94⤵
-
\??\c:\jvpjd.exec:\jvpjd.exe95⤵
-
\??\c:\7dvpp.exec:\7dvpp.exe96⤵
-
\??\c:\rlxlfll.exec:\rlxlfll.exe97⤵
-
\??\c:\nthtnh.exec:\nthtnh.exe98⤵
-
\??\c:\9hnbnh.exec:\9hnbnh.exe99⤵
-
\??\c:\vpjdp.exec:\vpjdp.exe100⤵
-
\??\c:\lrrxxff.exec:\lrrxxff.exe101⤵
-
\??\c:\1hbbtt.exec:\1hbbtt.exe102⤵
-
\??\c:\9jvpd.exec:\9jvpd.exe103⤵
-
\??\c:\pddvv.exec:\pddvv.exe104⤵
-
\??\c:\rlfxfxr.exec:\rlfxfxr.exe105⤵
-
\??\c:\htbttb.exec:\htbttb.exe106⤵
-
\??\c:\pppjd.exec:\pppjd.exe107⤵
-
\??\c:\jjvjp.exec:\jjvjp.exe108⤵
-
\??\c:\flffrrf.exec:\flffrrf.exe109⤵
-
\??\c:\hhbhnb.exec:\hhbhnb.exe110⤵
-
\??\c:\btbbth.exec:\btbbth.exe111⤵
-
\??\c:\ddppv.exec:\ddppv.exe112⤵
-
\??\c:\flrrlrl.exec:\flrrlrl.exe113⤵
-
\??\c:\3rllfff.exec:\3rllfff.exe114⤵
-
\??\c:\bnbtnh.exec:\bnbtnh.exe115⤵
-
\??\c:\tttnhb.exec:\tttnhb.exe116⤵
-
\??\c:\jvppj.exec:\jvppj.exe117⤵
-
\??\c:\fxxrrlf.exec:\fxxrrlf.exe118⤵
-
\??\c:\tnnhbb.exec:\tnnhbb.exe119⤵
-
\??\c:\dvvdv.exec:\dvvdv.exe120⤵
-
\??\c:\5vvpp.exec:\5vvpp.exe121⤵
-
\??\c:\rfxrrrx.exec:\rfxrrrx.exe122⤵
-
\??\c:\3rrlfxr.exec:\3rrlfxr.exe123⤵
-
\??\c:\bnhthb.exec:\bnhthb.exe124⤵
-
\??\c:\bhtttb.exec:\bhtttb.exe125⤵
-
\??\c:\pjppv.exec:\pjppv.exe126⤵
-
\??\c:\pdjvj.exec:\pdjvj.exe127⤵
-
\??\c:\flrlxxr.exec:\flrlxxr.exe128⤵
-
\??\c:\hhbbth.exec:\hhbbth.exe129⤵
-
\??\c:\7hhbnn.exec:\7hhbnn.exe130⤵
-
\??\c:\jjvdp.exec:\jjvdp.exe131⤵
-
\??\c:\7dvvp.exec:\7dvvp.exe132⤵
-
\??\c:\rlfxllf.exec:\rlfxllf.exe133⤵
-
\??\c:\7rfxrrl.exec:\7rfxrrl.exe134⤵
-
\??\c:\7tnttt.exec:\7tnttt.exe135⤵
-
\??\c:\ttttnn.exec:\ttttnn.exe136⤵
-
\??\c:\vvjdp.exec:\vvjdp.exe137⤵
-
\??\c:\3ddjp.exec:\3ddjp.exe138⤵
-
\??\c:\rrfxxlf.exec:\rrfxxlf.exe139⤵
-
\??\c:\5lffllr.exec:\5lffllr.exe140⤵
-
\??\c:\bnnhbt.exec:\bnnhbt.exe141⤵
-
\??\c:\jvddd.exec:\jvddd.exe142⤵
-
\??\c:\vjpdd.exec:\vjpdd.exe143⤵
-
\??\c:\7rlrxfl.exec:\7rlrxfl.exe144⤵
-
\??\c:\xfllrfl.exec:\xfllrfl.exe145⤵
-
\??\c:\nnttbb.exec:\nnttbb.exe146⤵
-
\??\c:\bttbth.exec:\bttbth.exe147⤵
-
\??\c:\jpvpj.exec:\jpvpj.exe148⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe149⤵
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe150⤵
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe151⤵
-
\??\c:\nhhhnt.exec:\nhhhnt.exe152⤵
-
\??\c:\1hnhbb.exec:\1hnhbb.exe153⤵
-
\??\c:\ddvpd.exec:\ddvpd.exe154⤵
-
\??\c:\jppjv.exec:\jppjv.exe155⤵
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe156⤵
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe157⤵
-
\??\c:\nbbbtt.exec:\nbbbtt.exe158⤵
-
\??\c:\bttnhh.exec:\bttnhh.exe159⤵
-
\??\c:\jpdvp.exec:\jpdvp.exe160⤵
-
\??\c:\rlfxlff.exec:\rlfxlff.exe161⤵
-
\??\c:\rfflllf.exec:\rfflllf.exe162⤵
-
\??\c:\nttbnt.exec:\nttbnt.exe163⤵
-
\??\c:\bbnhbb.exec:\bbnhbb.exe164⤵
-
\??\c:\pjvpd.exec:\pjvpd.exe165⤵
-
\??\c:\vpjvp.exec:\vpjvp.exe166⤵
-
\??\c:\5tnthn.exec:\5tnthn.exe167⤵
-
\??\c:\bnbtbb.exec:\bnbtbb.exe168⤵
-
\??\c:\9jpdj.exec:\9jpdj.exe169⤵
-
\??\c:\ffrlfxr.exec:\ffrlfxr.exe170⤵
-
\??\c:\btbhnt.exec:\btbhnt.exe171⤵
-
\??\c:\dddvj.exec:\dddvj.exe172⤵
-
\??\c:\7dvpj.exec:\7dvpj.exe173⤵
-
\??\c:\lrrlflf.exec:\lrrlflf.exe174⤵
-
\??\c:\nhbtnh.exec:\nhbtnh.exe175⤵
-
\??\c:\pdpvp.exec:\pdpvp.exe176⤵
-
\??\c:\djddp.exec:\djddp.exe177⤵
-
\??\c:\lxllfrl.exec:\lxllfrl.exe178⤵
-
\??\c:\5rlxrrx.exec:\5rlxrrx.exe179⤵
-
\??\c:\nbbbtt.exec:\nbbbtt.exe180⤵
-
\??\c:\hbthbh.exec:\hbthbh.exe181⤵
-
\??\c:\7pjdj.exec:\7pjdj.exe182⤵
-
\??\c:\vdjdj.exec:\vdjdj.exe183⤵
-
\??\c:\fxfrrlf.exec:\fxfrrlf.exe184⤵
-
\??\c:\hnthtn.exec:\hnthtn.exe185⤵
-
\??\c:\bhtbbn.exec:\bhtbbn.exe186⤵
-
\??\c:\7dddv.exec:\7dddv.exe187⤵
-
\??\c:\xflllrr.exec:\xflllrr.exe188⤵
-
\??\c:\hnhbbt.exec:\hnhbbt.exe189⤵
-
\??\c:\9bbtnh.exec:\9bbtnh.exe190⤵
-
\??\c:\vddjv.exec:\vddjv.exe191⤵
-
\??\c:\flxrllf.exec:\flxrllf.exe192⤵
-
\??\c:\9hhbhn.exec:\9hhbhn.exe193⤵
-
\??\c:\thbtnh.exec:\thbtnh.exe194⤵
-
\??\c:\jddvp.exec:\jddvp.exe195⤵
-
\??\c:\vvppd.exec:\vvppd.exe196⤵
-
\??\c:\7xrrlfx.exec:\7xrrlfx.exe197⤵
-
\??\c:\thhntn.exec:\thhntn.exe198⤵
-
\??\c:\bbtthh.exec:\bbtthh.exe199⤵
-
\??\c:\jpjjd.exec:\jpjjd.exe200⤵
-
\??\c:\9pvpj.exec:\9pvpj.exe201⤵
-
\??\c:\llfxrxx.exec:\llfxrxx.exe202⤵
-
\??\c:\xrlxrrl.exec:\xrlxrrl.exe203⤵
-
\??\c:\hbbnth.exec:\hbbnth.exe204⤵
-
\??\c:\jvvvv.exec:\jvvvv.exe205⤵
-
\??\c:\ppjjv.exec:\ppjjv.exe206⤵
-
\??\c:\3ffxrrr.exec:\3ffxrrr.exe207⤵
-
\??\c:\flxxxxx.exec:\flxxxxx.exe208⤵
-
\??\c:\btbtnn.exec:\btbtnn.exe209⤵
-
\??\c:\vvjdv.exec:\vvjdv.exe210⤵
-
\??\c:\pdddp.exec:\pdddp.exe211⤵
-
\??\c:\lfffrrl.exec:\lfffrrl.exe212⤵
-
\??\c:\bthhhh.exec:\bthhhh.exe213⤵
-
\??\c:\hhhbbb.exec:\hhhbbb.exe214⤵
-
\??\c:\pvddv.exec:\pvddv.exe215⤵
-
\??\c:\3jjjj.exec:\3jjjj.exe216⤵
-
\??\c:\rfllfff.exec:\rfllfff.exe217⤵
-
\??\c:\ntnhbb.exec:\ntnhbb.exe218⤵
-
\??\c:\hbhbtb.exec:\hbhbtb.exe219⤵
-
\??\c:\ddddj.exec:\ddddj.exe220⤵
-
\??\c:\7frlrrx.exec:\7frlrrx.exe221⤵
-
\??\c:\xlrlllf.exec:\xlrlllf.exe222⤵
-
\??\c:\tnnnth.exec:\tnnnth.exe223⤵
-
\??\c:\tnbbtn.exec:\tnbbtn.exe224⤵
-
\??\c:\djjdv.exec:\djjdv.exe225⤵
-
\??\c:\rlrlflf.exec:\rlrlflf.exe226⤵
-
\??\c:\tnhbtt.exec:\tnhbtt.exe227⤵
-
\??\c:\hbhtbn.exec:\hbhtbn.exe228⤵
-
\??\c:\vvvpd.exec:\vvvpd.exe229⤵
-
\??\c:\dvpdj.exec:\dvpdj.exe230⤵
-
\??\c:\xrrllll.exec:\xrrllll.exe231⤵
-
\??\c:\bttbtn.exec:\bttbtn.exe232⤵
-
\??\c:\nhnnht.exec:\nhnnht.exe233⤵
-
\??\c:\3dvvp.exec:\3dvvp.exe234⤵
-
\??\c:\lxlffxx.exec:\lxlffxx.exe235⤵
-
\??\c:\lrrlfrf.exec:\lrrlfrf.exe236⤵
-
\??\c:\hnnhtn.exec:\hnnhtn.exe237⤵
-
\??\c:\bbtthh.exec:\bbtthh.exe238⤵
-
\??\c:\dddvd.exec:\dddvd.exe239⤵
-
\??\c:\fxxxlrr.exec:\fxxxlrr.exe240⤵
-
\??\c:\fxrrlxr.exec:\fxrrlxr.exe241⤵