Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 03:36
Behavioral task
behavioral1
Sample
dd73cc5c7dd9033a05824b9c8051c5bbdd392e2a0dd91ce8abe58e9b7fb1c09e.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
dd73cc5c7dd9033a05824b9c8051c5bbdd392e2a0dd91ce8abe58e9b7fb1c09e.exe
-
Size
278KB
-
MD5
f0fcb407497b426a1ea1224396bd91f7
-
SHA1
9163ad8a769d62a5bd9dff788cb279e462a3e9a0
-
SHA256
dd73cc5c7dd9033a05824b9c8051c5bbdd392e2a0dd91ce8abe58e9b7fb1c09e
-
SHA512
22fcee6488dc19a87137bacad96ee87015478252542ebefe05608b0122dc52454683a52d4a57d441384c26c5386743c871b1504ada31bedd86f640f2fe191769
-
SSDEEP
6144:7cm4FmowdHoSoXSBcm4Vcm4FmowdHoSphra+cm4FMhraHcpOaKHpg:B4wFHoSoXW434wFHoS3eg4aeFaKHpg
Malware Config
Signatures
-
Detect Blackmoon payload 61 IoCs
Processes:
resource yara_rule behavioral1/memory/2664-8-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2664-7-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2520-19-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2480-29-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2612-48-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2536-40-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2528-60-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1652-69-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2404-77-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2964-88-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2964-80-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1900-99-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1560-108-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1560-106-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2296-110-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1360-121-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2296-118-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1360-128-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1536-137-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1296-146-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1296-148-0x0000000000220000-0x000000000026D000-memory.dmp family_blackmoon behavioral1/memory/1712-158-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1176-169-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1348-178-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2640-189-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/3068-191-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/3068-200-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2044-210-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2512-219-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2512-220-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2976-230-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2228-232-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2976-229-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2228-239-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2228-241-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/360-251-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/964-262-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/960-271-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/960-281-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2228-280-0x0000000000220000-0x000000000026D000-memory.dmp family_blackmoon behavioral1/memory/1488-293-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/560-303-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1644-311-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/892-313-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2772-331-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1508-339-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2948-346-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2832-355-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2496-363-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2560-371-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2788-386-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2396-393-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2292-408-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1724-416-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1656-418-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1724-425-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1612-434-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1612-441-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/436-557-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1736-589-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1996-606-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2664-8-0x0000000000400000-0x000000000044D000-memory.dmp UPX \??\c:\2600880.exe UPX C:\vpjpd.exe UPX behavioral1/memory/2520-19-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\7bhttb.exe UPX behavioral1/memory/2480-29-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral1/memory/2536-38-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\6202408.exe UPX C:\e88484.exe UPX behavioral1/memory/2612-48-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral1/memory/2536-40-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral1/memory/2528-50-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\444460.exe UPX behavioral1/memory/2528-60-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral1/memory/2404-70-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral1/memory/1652-69-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\5nhnhh.exe UPX behavioral1/memory/2404-77-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral1/memory/2964-88-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\hbnbht.exe UPX behavioral1/memory/2964-80-0x0000000000400000-0x000000000044D000-memory.dmp UPX \??\c:\fflxllx.exe UPX C:\8882686.exe UPX behavioral1/memory/1900-97-0x00000000003B0000-0x00000000003FD000-memory.dmp UPX behavioral1/memory/1900-99-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral1/memory/1560-108-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\84686.exe UPX behavioral1/memory/2296-110-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral1/memory/2296-117-0x0000000000400000-0x000000000044D000-memory.dmp UPX \??\c:\vvvdj.exe UPX behavioral1/memory/1360-121-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral1/memory/2296-118-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\8206dv.exe UPX behavioral1/memory/1360-128-0x0000000000400000-0x000000000044D000-memory.dmp UPX \??\c:\22402.exe UPX behavioral1/memory/1536-137-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral1/memory/1296-146-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral1/memory/1712-149-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\88028.exe UPX \??\c:\484400.exe UPX behavioral1/memory/1712-158-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\82644.exe UPX behavioral1/memory/1176-169-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral1/memory/1348-170-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral1/memory/1348-178-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral1/memory/2640-180-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\646602.exe UPX C:\9xllrrx.exe UPX behavioral1/memory/2640-189-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral1/memory/3068-191-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral1/memory/3068-200-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\jjppj.exe UPX behavioral1/memory/2044-210-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\48204.exe UPX \??\c:\dvpdj.exe UPX behavioral1/memory/2512-220-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral1/memory/2976-230-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral1/memory/2228-232-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\ntbnnb.exe UPX behavioral1/memory/2228-239-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\42222.exe UPX behavioral1/memory/2228-241-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral1/memory/360-251-0x0000000000400000-0x000000000044D000-memory.dmp UPX C:\4644602.exe UPX -
Executes dropped EXE 64 IoCs
Processes:
2600880.exevpjpd.exe7bhttb.exe6202408.exee88484.exe444460.exe5nhnhh.exefflxllx.exehbnbht.exe8882686.exe84686.exevvvdj.exe8206dv.exe22402.exe88028.exe484400.exe82644.exe646602.exe9xllrrx.exejjppj.exe48204.exedvpdj.exentbnnb.exe42222.exe4644602.exejppvp.exe6824064.exeg2808.exe046606.exe3flfxrx.exe8246402.exebbhnht.exe20008.exeu284682.exetnhnht.exe1rxrrff.exeffrfxlf.exexxrxllf.exellxrxlx.exe6824626.exeflrlxlr.exeffffxxf.exe88864.exe0480446.exebtnbnb.exeddddj.exebhbnbh.exe226442.exeg8804.exebbbtnn.exe60428.exe6042088.exelxrrlrf.exehbtbhn.exe4800628.exejdjjv.exe64846.exe8808024.exebhhbbh.exehhbhtb.exefxrrrll.exepdpdj.exe40842.exe86408.exepid process 2520 2600880.exe 2480 vpjpd.exe 2536 7bhttb.exe 2612 6202408.exe 2528 e88484.exe 1652 444460.exe 2404 5nhnhh.exe 2964 fflxllx.exe 1900 hbnbht.exe 1560 8882686.exe 2296 84686.exe 1360 vvvdj.exe 1536 8206dv.exe 1296 22402.exe 1712 88028.exe 1176 484400.exe 1348 82644.exe 2640 646602.exe 3068 9xllrrx.exe 2044 jjppj.exe 2512 48204.exe 2976 dvpdj.exe 2228 ntbnnb.exe 360 42222.exe 964 4644602.exe 2072 jppvp.exe 960 6824064.exe 1488 g2808.exe 560 046606.exe 1644 3flfxrx.exe 892 8246402.exe 2772 bbhnht.exe 1508 20008.exe 2948 u284682.exe 2832 tnhnht.exe 2496 1rxrrff.exe 2560 ffrfxlf.exe 2500 xxrxllf.exe 2788 llxrxlx.exe 2396 6824626.exe 1364 flrlxlr.exe 2292 ffffxxf.exe 1656 88864.exe 1724 0480446.exe 1880 btnbnb.exe 1612 ddddj.exe 1512 bhbnbh.exe 1528 226442.exe 1220 g8804.exe 1908 bbbtnn.exe 2580 60428.exe 2644 6042088.exe 2628 lxrrlrf.exe 2428 hbtbhn.exe 2648 4800628.exe 3052 jdjjv.exe 3032 64846.exe 1112 8808024.exe 2268 bhhbbh.exe 2856 hhbhtb.exe 436 fxrrrll.exe 1688 pdpdj.exe 2016 40842.exe 964 86408.exe -
Processes:
resource yara_rule behavioral1/memory/2664-1-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2664-8-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2520-11-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\2600880.exe upx behavioral1/memory/2520-14-0x0000000001B90000-0x0000000001BDD000-memory.dmp upx C:\vpjpd.exe upx behavioral1/memory/2480-21-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2520-19-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2520-18-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\7bhttb.exe upx behavioral1/memory/2480-31-0x0000000000230000-0x000000000027D000-memory.dmp upx behavioral1/memory/2480-29-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2536-38-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\6202408.exe upx C:\e88484.exe upx behavioral1/memory/2612-48-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2536-40-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2528-50-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2528-54-0x0000000000220000-0x000000000026D000-memory.dmp upx C:\444460.exe upx behavioral1/memory/2528-60-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2404-70-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1652-69-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\5nhnhh.exe upx behavioral1/memory/2404-77-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2964-88-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\hbnbht.exe upx behavioral1/memory/2964-80-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\fflxllx.exe upx behavioral1/memory/1900-92-0x00000000003B0000-0x00000000003FD000-memory.dmp upx C:\8882686.exe upx behavioral1/memory/1900-97-0x00000000003B0000-0x00000000003FD000-memory.dmp upx behavioral1/memory/1900-99-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1560-108-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\84686.exe upx behavioral1/memory/2296-110-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2296-113-0x0000000000220000-0x000000000026D000-memory.dmp upx behavioral1/memory/2296-117-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\vvvdj.exe upx behavioral1/memory/1360-121-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2296-118-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\8206dv.exe upx behavioral1/memory/1360-128-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\22402.exe upx behavioral1/memory/1536-137-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1296-146-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1712-149-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\88028.exe upx behavioral1/memory/1712-156-0x0000000000220000-0x000000000026D000-memory.dmp upx \??\c:\484400.exe upx behavioral1/memory/1712-158-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\82644.exe upx behavioral1/memory/1176-169-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1348-170-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1348-178-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2640-180-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\646602.exe upx behavioral1/memory/2640-188-0x0000000000260000-0x00000000002AD000-memory.dmp upx C:\9xllrrx.exe upx behavioral1/memory/2640-189-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/3068-191-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/3068-195-0x0000000000220000-0x000000000026D000-memory.dmp upx behavioral1/memory/3068-200-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\jjppj.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dd73cc5c7dd9033a05824b9c8051c5bbdd392e2a0dd91ce8abe58e9b7fb1c09e.exe2600880.exevpjpd.exe7bhttb.exe6202408.exee88484.exe444460.exe5nhnhh.exefflxllx.exehbnbht.exe8882686.exe84686.exevvvdj.exe8206dv.exe22402.exe88028.exedescription pid process target process PID 2664 wrote to memory of 2520 2664 dd73cc5c7dd9033a05824b9c8051c5bbdd392e2a0dd91ce8abe58e9b7fb1c09e.exe 2600880.exe PID 2664 wrote to memory of 2520 2664 dd73cc5c7dd9033a05824b9c8051c5bbdd392e2a0dd91ce8abe58e9b7fb1c09e.exe 2600880.exe PID 2664 wrote to memory of 2520 2664 dd73cc5c7dd9033a05824b9c8051c5bbdd392e2a0dd91ce8abe58e9b7fb1c09e.exe 2600880.exe PID 2664 wrote to memory of 2520 2664 dd73cc5c7dd9033a05824b9c8051c5bbdd392e2a0dd91ce8abe58e9b7fb1c09e.exe 2600880.exe PID 2520 wrote to memory of 2480 2520 2600880.exe vpjpd.exe PID 2520 wrote to memory of 2480 2520 2600880.exe vpjpd.exe PID 2520 wrote to memory of 2480 2520 2600880.exe vpjpd.exe PID 2520 wrote to memory of 2480 2520 2600880.exe vpjpd.exe PID 2480 wrote to memory of 2536 2480 vpjpd.exe 7bhttb.exe PID 2480 wrote to memory of 2536 2480 vpjpd.exe 7bhttb.exe PID 2480 wrote to memory of 2536 2480 vpjpd.exe 7bhttb.exe PID 2480 wrote to memory of 2536 2480 vpjpd.exe 7bhttb.exe PID 2536 wrote to memory of 2612 2536 7bhttb.exe 6202408.exe PID 2536 wrote to memory of 2612 2536 7bhttb.exe 6202408.exe PID 2536 wrote to memory of 2612 2536 7bhttb.exe 6202408.exe PID 2536 wrote to memory of 2612 2536 7bhttb.exe 6202408.exe PID 2612 wrote to memory of 2528 2612 6202408.exe e88484.exe PID 2612 wrote to memory of 2528 2612 6202408.exe e88484.exe PID 2612 wrote to memory of 2528 2612 6202408.exe e88484.exe PID 2612 wrote to memory of 2528 2612 6202408.exe e88484.exe PID 2528 wrote to memory of 1652 2528 e88484.exe 444460.exe PID 2528 wrote to memory of 1652 2528 e88484.exe 444460.exe PID 2528 wrote to memory of 1652 2528 e88484.exe 444460.exe PID 2528 wrote to memory of 1652 2528 e88484.exe 444460.exe PID 1652 wrote to memory of 2404 1652 444460.exe 5nhnhh.exe PID 1652 wrote to memory of 2404 1652 444460.exe 5nhnhh.exe PID 1652 wrote to memory of 2404 1652 444460.exe 5nhnhh.exe PID 1652 wrote to memory of 2404 1652 444460.exe 5nhnhh.exe PID 2404 wrote to memory of 2964 2404 5nhnhh.exe fflxllx.exe PID 2404 wrote to memory of 2964 2404 5nhnhh.exe fflxllx.exe PID 2404 wrote to memory of 2964 2404 5nhnhh.exe fflxllx.exe PID 2404 wrote to memory of 2964 2404 5nhnhh.exe fflxllx.exe PID 2964 wrote to memory of 1900 2964 fflxllx.exe hbnbht.exe PID 2964 wrote to memory of 1900 2964 fflxllx.exe hbnbht.exe PID 2964 wrote to memory of 1900 2964 fflxllx.exe hbnbht.exe PID 2964 wrote to memory of 1900 2964 fflxllx.exe hbnbht.exe PID 1900 wrote to memory of 1560 1900 hbnbht.exe 8882686.exe PID 1900 wrote to memory of 1560 1900 hbnbht.exe 8882686.exe PID 1900 wrote to memory of 1560 1900 hbnbht.exe 8882686.exe PID 1900 wrote to memory of 1560 1900 hbnbht.exe 8882686.exe PID 1560 wrote to memory of 2296 1560 8882686.exe 84686.exe PID 1560 wrote to memory of 2296 1560 8882686.exe 84686.exe PID 1560 wrote to memory of 2296 1560 8882686.exe 84686.exe PID 1560 wrote to memory of 2296 1560 8882686.exe 84686.exe PID 2296 wrote to memory of 1360 2296 84686.exe vvvdj.exe PID 2296 wrote to memory of 1360 2296 84686.exe vvvdj.exe PID 2296 wrote to memory of 1360 2296 84686.exe vvvdj.exe PID 2296 wrote to memory of 1360 2296 84686.exe vvvdj.exe PID 1360 wrote to memory of 1536 1360 vvvdj.exe 8206dv.exe PID 1360 wrote to memory of 1536 1360 vvvdj.exe 8206dv.exe PID 1360 wrote to memory of 1536 1360 vvvdj.exe 8206dv.exe PID 1360 wrote to memory of 1536 1360 vvvdj.exe 8206dv.exe PID 1536 wrote to memory of 1296 1536 8206dv.exe 22402.exe PID 1536 wrote to memory of 1296 1536 8206dv.exe 22402.exe PID 1536 wrote to memory of 1296 1536 8206dv.exe 22402.exe PID 1536 wrote to memory of 1296 1536 8206dv.exe 22402.exe PID 1296 wrote to memory of 1712 1296 22402.exe 88028.exe PID 1296 wrote to memory of 1712 1296 22402.exe 88028.exe PID 1296 wrote to memory of 1712 1296 22402.exe 88028.exe PID 1296 wrote to memory of 1712 1296 22402.exe 88028.exe PID 1712 wrote to memory of 1176 1712 88028.exe 484400.exe PID 1712 wrote to memory of 1176 1712 88028.exe 484400.exe PID 1712 wrote to memory of 1176 1712 88028.exe 484400.exe PID 1712 wrote to memory of 1176 1712 88028.exe 484400.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd73cc5c7dd9033a05824b9c8051c5bbdd392e2a0dd91ce8abe58e9b7fb1c09e.exe"C:\Users\Admin\AppData\Local\Temp\dd73cc5c7dd9033a05824b9c8051c5bbdd392e2a0dd91ce8abe58e9b7fb1c09e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\2600880.exec:\2600880.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjpd.exec:\vpjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7bhttb.exec:\7bhttb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\6202408.exec:\6202408.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\e88484.exec:\e88484.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\444460.exec:\444460.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5nhnhh.exec:\5nhnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fflxllx.exec:\fflxllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbnbht.exec:\hbnbht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\8882686.exec:\8882686.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\84686.exec:\84686.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvvdj.exec:\vvvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\8206dv.exec:\8206dv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\22402.exec:\22402.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\88028.exec:\88028.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\484400.exec:\484400.exe17⤵
- Executes dropped EXE
-
\??\c:\82644.exec:\82644.exe18⤵
- Executes dropped EXE
-
\??\c:\646602.exec:\646602.exe19⤵
- Executes dropped EXE
-
\??\c:\9xllrrx.exec:\9xllrrx.exe20⤵
- Executes dropped EXE
-
\??\c:\jjppj.exec:\jjppj.exe21⤵
- Executes dropped EXE
-
\??\c:\48204.exec:\48204.exe22⤵
- Executes dropped EXE
-
\??\c:\dvpdj.exec:\dvpdj.exe23⤵
- Executes dropped EXE
-
\??\c:\ntbnnb.exec:\ntbnnb.exe24⤵
- Executes dropped EXE
-
\??\c:\42222.exec:\42222.exe25⤵
- Executes dropped EXE
-
\??\c:\4644602.exec:\4644602.exe26⤵
- Executes dropped EXE
-
\??\c:\jppvp.exec:\jppvp.exe27⤵
- Executes dropped EXE
-
\??\c:\6824064.exec:\6824064.exe28⤵
- Executes dropped EXE
-
\??\c:\g2808.exec:\g2808.exe29⤵
- Executes dropped EXE
-
\??\c:\046606.exec:\046606.exe30⤵
- Executes dropped EXE
-
\??\c:\3flfxrx.exec:\3flfxrx.exe31⤵
- Executes dropped EXE
-
\??\c:\8246402.exec:\8246402.exe32⤵
- Executes dropped EXE
-
\??\c:\bbhnht.exec:\bbhnht.exe33⤵
- Executes dropped EXE
-
\??\c:\20008.exec:\20008.exe34⤵
- Executes dropped EXE
-
\??\c:\u284682.exec:\u284682.exe35⤵
- Executes dropped EXE
-
\??\c:\tnhnht.exec:\tnhnht.exe36⤵
- Executes dropped EXE
-
\??\c:\1rxrrff.exec:\1rxrrff.exe37⤵
- Executes dropped EXE
-
\??\c:\ffrfxlf.exec:\ffrfxlf.exe38⤵
- Executes dropped EXE
-
\??\c:\xxrxllf.exec:\xxrxllf.exe39⤵
- Executes dropped EXE
-
\??\c:\llxrxlx.exec:\llxrxlx.exe40⤵
- Executes dropped EXE
-
\??\c:\6824626.exec:\6824626.exe41⤵
- Executes dropped EXE
-
\??\c:\flrlxlr.exec:\flrlxlr.exe42⤵
- Executes dropped EXE
-
\??\c:\ffffxxf.exec:\ffffxxf.exe43⤵
- Executes dropped EXE
-
\??\c:\88864.exec:\88864.exe44⤵
- Executes dropped EXE
-
\??\c:\0480446.exec:\0480446.exe45⤵
- Executes dropped EXE
-
\??\c:\btnbnb.exec:\btnbnb.exe46⤵
- Executes dropped EXE
-
\??\c:\ddddj.exec:\ddddj.exe47⤵
- Executes dropped EXE
-
\??\c:\bhbnbh.exec:\bhbnbh.exe48⤵
- Executes dropped EXE
-
\??\c:\226442.exec:\226442.exe49⤵
- Executes dropped EXE
-
\??\c:\g8804.exec:\g8804.exe50⤵
- Executes dropped EXE
-
\??\c:\bbbtnn.exec:\bbbtnn.exe51⤵
- Executes dropped EXE
-
\??\c:\60428.exec:\60428.exe52⤵
- Executes dropped EXE
-
\??\c:\6042088.exec:\6042088.exe53⤵
- Executes dropped EXE
-
\??\c:\lxrrlrf.exec:\lxrrlrf.exe54⤵
- Executes dropped EXE
-
\??\c:\hbtbhn.exec:\hbtbhn.exe55⤵
- Executes dropped EXE
-
\??\c:\4800628.exec:\4800628.exe56⤵
- Executes dropped EXE
-
\??\c:\jdjjv.exec:\jdjjv.exe57⤵
- Executes dropped EXE
-
\??\c:\64846.exec:\64846.exe58⤵
- Executes dropped EXE
-
\??\c:\8808024.exec:\8808024.exe59⤵
- Executes dropped EXE
-
\??\c:\bhhbbh.exec:\bhhbbh.exe60⤵
- Executes dropped EXE
-
\??\c:\hhbhtb.exec:\hhbhtb.exe61⤵
- Executes dropped EXE
-
\??\c:\fxrrrll.exec:\fxrrrll.exe62⤵
- Executes dropped EXE
-
\??\c:\pdpdj.exec:\pdpdj.exe63⤵
- Executes dropped EXE
-
\??\c:\40842.exec:\40842.exe64⤵
- Executes dropped EXE
-
\??\c:\86408.exec:\86408.exe65⤵
- Executes dropped EXE
-
\??\c:\vjjjv.exec:\vjjjv.exe66⤵
-
\??\c:\5jdjp.exec:\5jdjp.exe67⤵
-
\??\c:\vdjvd.exec:\vdjvd.exe68⤵
-
\??\c:\vpjpd.exec:\vpjpd.exe69⤵
-
\??\c:\80624.exec:\80624.exe70⤵
-
\??\c:\g0206.exec:\g0206.exe71⤵
-
\??\c:\tntttt.exec:\tntttt.exe72⤵
-
\??\c:\nhbhtt.exec:\nhbhtt.exe73⤵
-
\??\c:\ddpdd.exec:\ddpdd.exe74⤵
-
\??\c:\tnbbnt.exec:\tnbbnt.exe75⤵
-
\??\c:\nhhnbh.exec:\nhhnbh.exe76⤵
-
\??\c:\8264248.exec:\8264248.exe77⤵
-
\??\c:\3btnth.exec:\3btnth.exe78⤵
-
\??\c:\hhbhnh.exec:\hhbhnh.exe79⤵
-
\??\c:\tnhnbb.exec:\tnhnbb.exe80⤵
-
\??\c:\jdjvd.exec:\jdjvd.exe81⤵
-
\??\c:\fxrxllr.exec:\fxrxllr.exe82⤵
-
\??\c:\620640.exec:\620640.exe83⤵
-
\??\c:\xrflrrl.exec:\xrflrrl.exe84⤵
-
\??\c:\5pdjj.exec:\5pdjj.exe85⤵
-
\??\c:\8806224.exec:\8806224.exe86⤵
-
\??\c:\42622.exec:\42622.exe87⤵
-
\??\c:\88880.exec:\88880.exe88⤵
-
\??\c:\604284.exec:\604284.exe89⤵
-
\??\c:\4866408.exec:\4866408.exe90⤵
-
\??\c:\lfxflrf.exec:\lfxflrf.exe91⤵
-
\??\c:\008484.exec:\008484.exe92⤵
-
\??\c:\48680.exec:\48680.exe93⤵
-
\??\c:\k48068.exec:\k48068.exe94⤵
-
\??\c:\0462002.exec:\0462002.exe95⤵
-
\??\c:\llrrfff.exec:\llrrfff.exe96⤵
-
\??\c:\dvdpp.exec:\dvdpp.exe97⤵
-
\??\c:\4828024.exec:\4828024.exe98⤵
-
\??\c:\i268620.exec:\i268620.exe99⤵
-
\??\c:\lfffflx.exec:\lfffflx.exe100⤵
-
\??\c:\4024868.exec:\4024868.exe101⤵
-
\??\c:\hnnbhb.exec:\hnnbhb.exe102⤵
-
\??\c:\vpdjp.exec:\vpdjp.exe103⤵
-
\??\c:\htbnnb.exec:\htbnnb.exe104⤵
-
\??\c:\pvvdp.exec:\pvvdp.exe105⤵
-
\??\c:\djpvj.exec:\djpvj.exe106⤵
-
\??\c:\26846.exec:\26846.exe107⤵
-
\??\c:\5dppv.exec:\5dppv.exe108⤵
-
\??\c:\xrrrflr.exec:\xrrrflr.exe109⤵
-
\??\c:\3dvpp.exec:\3dvpp.exe110⤵
-
\??\c:\htbhhn.exec:\htbhhn.exe111⤵
-
\??\c:\26880.exec:\26880.exe112⤵
-
\??\c:\3bbnbb.exec:\3bbnbb.exe113⤵
-
\??\c:\9rllrxl.exec:\9rllrxl.exe114⤵
-
\??\c:\48204.exec:\48204.exe115⤵
-
\??\c:\220028.exec:\220028.exe116⤵
-
\??\c:\q08422.exec:\q08422.exe117⤵
-
\??\c:\666608.exec:\666608.exe118⤵
-
\??\c:\btnntb.exec:\btnntb.exe119⤵
-
\??\c:\04468.exec:\04468.exe120⤵
-
\??\c:\04868.exec:\04868.exe121⤵
-
\??\c:\jjjdp.exec:\jjjdp.exe122⤵
-
\??\c:\w68464.exec:\w68464.exe123⤵
-
\??\c:\hbbnbt.exec:\hbbnbt.exe124⤵
-
\??\c:\6264846.exec:\6264846.exe125⤵
-
\??\c:\64224.exec:\64224.exe126⤵
-
\??\c:\s2840.exec:\s2840.exe127⤵
-
\??\c:\448284.exec:\448284.exe128⤵
-
\??\c:\1fllrxx.exec:\1fllrxx.exe129⤵
-
\??\c:\hhtbhn.exec:\hhtbhn.exe130⤵
-
\??\c:\i266428.exec:\i266428.exe131⤵
-
\??\c:\xfllxfl.exec:\xfllxfl.exe132⤵
-
\??\c:\q48424.exec:\q48424.exe133⤵
-
\??\c:\480644.exec:\480644.exe134⤵
-
\??\c:\8480848.exec:\8480848.exe135⤵
-
\??\c:\26002.exec:\26002.exe136⤵
-
\??\c:\00408.exec:\00408.exe137⤵
-
\??\c:\44024.exec:\44024.exe138⤵
-
\??\c:\88068.exec:\88068.exe139⤵
-
\??\c:\82624.exec:\82624.exe140⤵
-
\??\c:\nhbhht.exec:\nhbhht.exe141⤵
-
\??\c:\086288.exec:\086288.exe142⤵
-
\??\c:\2640242.exec:\2640242.exe143⤵
-
\??\c:\26280.exec:\26280.exe144⤵
-
\??\c:\nntbtb.exec:\nntbtb.exe145⤵
-
\??\c:\3jddj.exec:\3jddj.exe146⤵
-
\??\c:\nnttnt.exec:\nnttnt.exe147⤵
-
\??\c:\6028002.exec:\6028002.exe148⤵
-
\??\c:\nnbbtb.exec:\nnbbtb.exe149⤵
-
\??\c:\22446.exec:\22446.exe150⤵
-
\??\c:\tnhtnt.exec:\tnhtnt.exe151⤵
-
\??\c:\42622.exec:\42622.exe152⤵
-
\??\c:\dddjd.exec:\dddjd.exe153⤵
-
\??\c:\00408.exec:\00408.exe154⤵
-
\??\c:\2662860.exec:\2662860.exe155⤵
-
\??\c:\i606884.exec:\i606884.exe156⤵
-
\??\c:\040628.exec:\040628.exe157⤵
-
\??\c:\7pvvd.exec:\7pvvd.exe158⤵
-
\??\c:\260446.exec:\260446.exe159⤵
-
\??\c:\8264620.exec:\8264620.exe160⤵
-
\??\c:\g2468.exec:\g2468.exe161⤵
-
\??\c:\bbbtnh.exec:\bbbtnh.exe162⤵
-
\??\c:\nnbhtt.exec:\nnbhtt.exe163⤵
-
\??\c:\g0802.exec:\g0802.exe164⤵
-
\??\c:\3lxllrl.exec:\3lxllrl.exe165⤵
-
\??\c:\642840.exec:\642840.exe166⤵
-
\??\c:\i020084.exec:\i020084.exe167⤵
-
\??\c:\ddpdj.exec:\ddpdj.exe168⤵
-
\??\c:\0420244.exec:\0420244.exe169⤵
-
\??\c:\0824422.exec:\0824422.exe170⤵
-
\??\c:\266206.exec:\266206.exe171⤵
-
\??\c:\248608.exec:\248608.exe172⤵
-
\??\c:\xxlrlrf.exec:\xxlrlrf.exe173⤵
-
\??\c:\ppjpd.exec:\ppjpd.exe174⤵
-
\??\c:\60286.exec:\60286.exe175⤵
-
\??\c:\0028024.exec:\0028024.exe176⤵
-
\??\c:\lfrrxxr.exec:\lfrrxxr.exe177⤵
-
\??\c:\88040.exec:\88040.exe178⤵
-
\??\c:\406244.exec:\406244.exe179⤵
-
\??\c:\88648.exec:\88648.exe180⤵
-
\??\c:\484066.exec:\484066.exe181⤵
-
\??\c:\3nttnn.exec:\3nttnn.exe182⤵
-
\??\c:\640022.exec:\640022.exe183⤵
-
\??\c:\8488482.exec:\8488482.exe184⤵
-
\??\c:\vdpjd.exec:\vdpjd.exe185⤵
-
\??\c:\hhnbnt.exec:\hhnbnt.exe186⤵
-
\??\c:\u066228.exec:\u066228.exe187⤵
-
\??\c:\pvjjp.exec:\pvjjp.exe188⤵
-
\??\c:\7nhtnt.exec:\7nhtnt.exe189⤵
-
\??\c:\hbntbb.exec:\hbntbb.exe190⤵
-
\??\c:\4806846.exec:\4806846.exe191⤵
-
\??\c:\u640886.exec:\u640886.exe192⤵
-
\??\c:\868460.exec:\868460.exe193⤵
-
\??\c:\1xflfll.exec:\1xflfll.exe194⤵
-
\??\c:\ppddd.exec:\ppddd.exe195⤵
-
\??\c:\jpjjp.exec:\jpjjp.exe196⤵
-
\??\c:\fflxllx.exec:\fflxllx.exe197⤵
-
\??\c:\8262446.exec:\8262446.exe198⤵
-
\??\c:\tnhnbb.exec:\tnhnbb.exe199⤵
-
\??\c:\448462.exec:\448462.exe200⤵
-
\??\c:\g8246.exec:\g8246.exe201⤵
-
\??\c:\flfrffr.exec:\flfrffr.exe202⤵
-
\??\c:\rlxfxfl.exec:\rlxfxfl.exe203⤵
-
\??\c:\xlxfrrf.exec:\xlxfrrf.exe204⤵
-
\??\c:\268240.exec:\268240.exe205⤵
-
\??\c:\6022002.exec:\6022002.exe206⤵
-
\??\c:\btnhnb.exec:\btnhnb.exe207⤵
-
\??\c:\i808888.exec:\i808888.exe208⤵
-
\??\c:\nhbhtt.exec:\nhbhtt.exe209⤵
-
\??\c:\w06004.exec:\w06004.exe210⤵
-
\??\c:\60008.exec:\60008.exe211⤵
-
\??\c:\1tbhnb.exec:\1tbhnb.exe212⤵
-
\??\c:\lrffflr.exec:\lrffflr.exe213⤵
-
\??\c:\4244662.exec:\4244662.exe214⤵
-
\??\c:\8224086.exec:\8224086.exe215⤵
-
\??\c:\044622.exec:\044622.exe216⤵
-
\??\c:\jdjvv.exec:\jdjvv.exe217⤵
-
\??\c:\4884064.exec:\4884064.exe218⤵
-
\??\c:\6266866.exec:\6266866.exe219⤵
-
\??\c:\m0228.exec:\m0228.exe220⤵
-
\??\c:\hnhhth.exec:\hnhhth.exe221⤵
-
\??\c:\tnbhnn.exec:\tnbhnn.exe222⤵
-
\??\c:\646244.exec:\646244.exe223⤵
-
\??\c:\3tntbn.exec:\3tntbn.exe224⤵
-
\??\c:\nhbntb.exec:\nhbntb.exe225⤵
-
\??\c:\04624.exec:\04624.exe226⤵
-
\??\c:\5tnbhb.exec:\5tnbhb.exe227⤵
-
\??\c:\htnbnh.exec:\htnbnh.exe228⤵
-
\??\c:\e68406.exec:\e68406.exe229⤵
-
\??\c:\frrxlff.exec:\frrxlff.exe230⤵
-
\??\c:\5vdvp.exec:\5vdvp.exe231⤵
-
\??\c:\0868024.exec:\0868024.exe232⤵
-
\??\c:\28225l.exec:\28225l.exe233⤵
-
\??\c:\9httbb.exec:\9httbb.exe234⤵
-
\??\c:\dvpvj.exec:\dvpvj.exe235⤵
-
\??\c:\c284266.exec:\c284266.exe236⤵
-
\??\c:\bhbnnb.exec:\bhbnnb.exe237⤵
-
\??\c:\nhtnbb.exec:\nhtnbb.exe238⤵
-
\??\c:\82442.exec:\82442.exe239⤵
-
\??\c:\4806224.exec:\4806224.exe240⤵
-
\??\c:\hhbthn.exec:\hhbthn.exe241⤵