Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 03:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e605a840e9062aa8ec172917fe66a1000d44301e8f973793cd3070e16a4f01ae.exe
Resource
win7-20240611-en
6 signatures
150 seconds
General
-
Target
e605a840e9062aa8ec172917fe66a1000d44301e8f973793cd3070e16a4f01ae.exe
-
Size
182KB
-
MD5
155a905fc8fe8762b335e24c0d61dd23
-
SHA1
6502533920875ac598b1f675c9515fe7ee1a4c2f
-
SHA256
e605a840e9062aa8ec172917fe66a1000d44301e8f973793cd3070e16a4f01ae
-
SHA512
36847ee2c05f6e868be51e033c7704f0709890f1a852a3b731a2c061218e0264429967dbe39ad0bc43541565df5692c244c58a24112047c57c2f0f224e593737
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+IJPhbMZ:PhOm2sI93UufdC67ciJTm5hIZ
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/1656-0-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1692-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2644-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1856-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2488-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2412-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/344-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1592-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/804-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1396-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/684-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-332-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-346-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-359-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-385-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-399-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon behavioral1/memory/2624-400-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2772-464-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/924-537-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-589-0x00000000001C0000-0x00000000001E9000-memory.dmp family_blackmoon behavioral1/memory/2956-624-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1916-716-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-723-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-756-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/484-782-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/288-791-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-1168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
Processes:
resource yara_rule behavioral1/memory/1656-0-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2856-8-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1692-21-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2856-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3000-36-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2644-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1856-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2488-54-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2428-73-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2576-71-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2412-88-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2896-90-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2184-107-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1620-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/344-143-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1592-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2752-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2912-192-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2940-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/804-210-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1396-213-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1664-235-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/684-261-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2988-263-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1948-279-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2176-319-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2572-332-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2640-333-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2812-346-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2584-359-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2548-366-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2300-385-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2412-386-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2624-400-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2100-425-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2772-457-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2772-464-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/924-537-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2308-557-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/600-570-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2660-617-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2416-643-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2452-662-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2432-670-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1892-683-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1516-707-0x0000000000220000-0x0000000000249000-memory.dmp UPX behavioral1/memory/1916-716-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2252-723-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1556-742-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2756-749-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2768-757-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2064-770-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/288-784-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/288-791-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/3064-835-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2816-854-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2816-861-0x0000000000230000-0x0000000000259000-memory.dmp UPX behavioral1/memory/2512-916-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2668-936-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2396-955-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1016-981-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/1888-1000-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2748-1051-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral1/memory/2052-1088-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
lflfrxf.exepjjpv.exejjvvp.exehhbtth.exe1xxrlfx.exennnhth.exedjpjp.exerxrfxxr.exennhnbn.exerxlllff.exelrxxxxx.exepjjvj.exevjvdj.exenthnhb.exehntnnn.exe9lxfxff.exenhbnhn.exeddjvv.exefrrfxfx.exenhthbh.exe3pppj.exe5rxfxrl.exeppvpp.exerlfxffr.exeflxlffr.exehhnhnh.exevvvjv.exennnbnt.exedjpjp.exellxfflf.exevjppv.exeflrlxxx.exenthhbt.exeppdjv.exepjjjv.exerxrrflr.exe3hhthb.exejjddj.exepjjdj.exefffxrlx.exehthtbh.exedvpvd.exevvjjj.exelrrlrll.exehtnhhn.exejddjd.exepdvdp.exefrlfflr.exe7tnnth.exentnhhb.exevjvpd.exexlrrrll.exetbhbbh.exehhnnnn.exevdjjv.exellfxrfr.exennbbhh.exejdvpp.exevvjjd.exellrrxfl.exexxflxxr.exenbnhtt.exebhhtth.exevdvpp.exepid process 2856 lflfrxf.exe 1692 pjjpv.exe 3000 jjvvp.exe 2644 hhbtth.exe 2488 1xxrlfx.exe 1856 nnnhth.exe 2576 djpjp.exe 2428 rxrfxxr.exe 2412 nnhnbn.exe 2896 rxlllff.exe 2184 lrxxxxx.exe 316 pjjvj.exe 796 vjvdj.exe 1620 nthnhb.exe 1984 hntnnn.exe 344 9lxfxff.exe 1592 nhbnhn.exe 1552 ddjvv.exe 2752 frrfxfx.exe 2704 nhthbh.exe 2912 3pppj.exe 2940 5rxfxrl.exe 804 ppvpp.exe 1396 rlfxffr.exe 2760 flxlffr.exe 1664 hhnhnh.exe 1920 vvvjv.exe 2820 nnnbnt.exe 684 djpjp.exe 2988 llxfflf.exe 1948 vjppv.exe 600 flrlxxx.exe 2164 nthhbt.exe 2984 ppdjv.exe 2848 pjjjv.exe 2460 rxrrflr.exe 2968 3hhthb.exe 2176 jjddj.exe 2572 pjjdj.exe 2640 fffxrlx.exe 2812 hthtbh.exe 2504 dvpvd.exe 2496 vvjjj.exe 2584 lrrlrll.exe 2548 htnhhn.exe 2492 jddjd.exe 2300 pdvdp.exe 2412 frlfflr.exe 1032 7tnnth.exe 2624 ntnhhb.exe 1912 vjvpd.exe 608 xlrrrll.exe 1864 tbhbbh.exe 2100 hhnnnn.exe 1708 vdjjv.exe 2608 llfxrfr.exe 2604 nnbbhh.exe 1592 jdvpp.exe 2772 vvjjd.exe 2740 llrrxfl.exe 2924 xxflxxr.exe 1348 nbnhtt.exe 2860 bhhtth.exe 940 vdvpp.exe -
Processes:
resource yara_rule behavioral1/memory/1656-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1856-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2488-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/344-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1592-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/804-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1396-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/684-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-319-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-332-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-333-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-346-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-359-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-366-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-385-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2412-386-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-400-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-425-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-457-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2772-464-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/924-537-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2308-557-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/600-570-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-617-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-643-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-662-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-668-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2432-670-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1892-683-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-716-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-723-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-742-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-749-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-757-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/288-784-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/288-791-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/980-822-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3064-835-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-854-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-916-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-936-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-955-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-981-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-1000-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-1051-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-1088-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e605a840e9062aa8ec172917fe66a1000d44301e8f973793cd3070e16a4f01ae.exelflfrxf.exepjjpv.exejjvvp.exehhbtth.exe1xxrlfx.exennnhth.exedjpjp.exerxrfxxr.exennhnbn.exerxlllff.exelrxxxxx.exepjjvj.exevjvdj.exenthnhb.exehntnnn.exedescription pid process target process PID 1656 wrote to memory of 2856 1656 e605a840e9062aa8ec172917fe66a1000d44301e8f973793cd3070e16a4f01ae.exe lflfrxf.exe PID 1656 wrote to memory of 2856 1656 e605a840e9062aa8ec172917fe66a1000d44301e8f973793cd3070e16a4f01ae.exe lflfrxf.exe PID 1656 wrote to memory of 2856 1656 e605a840e9062aa8ec172917fe66a1000d44301e8f973793cd3070e16a4f01ae.exe lflfrxf.exe PID 1656 wrote to memory of 2856 1656 e605a840e9062aa8ec172917fe66a1000d44301e8f973793cd3070e16a4f01ae.exe lflfrxf.exe PID 2856 wrote to memory of 1692 2856 lflfrxf.exe pjjpv.exe PID 2856 wrote to memory of 1692 2856 lflfrxf.exe pjjpv.exe PID 2856 wrote to memory of 1692 2856 lflfrxf.exe pjjpv.exe PID 2856 wrote to memory of 1692 2856 lflfrxf.exe pjjpv.exe PID 1692 wrote to memory of 3000 1692 pjjpv.exe jjvvp.exe PID 1692 wrote to memory of 3000 1692 pjjpv.exe jjvvp.exe PID 1692 wrote to memory of 3000 1692 pjjpv.exe jjvvp.exe PID 1692 wrote to memory of 3000 1692 pjjpv.exe jjvvp.exe PID 3000 wrote to memory of 2644 3000 jjvvp.exe hhbtth.exe PID 3000 wrote to memory of 2644 3000 jjvvp.exe hhbtth.exe PID 3000 wrote to memory of 2644 3000 jjvvp.exe hhbtth.exe PID 3000 wrote to memory of 2644 3000 jjvvp.exe hhbtth.exe PID 2644 wrote to memory of 2488 2644 hhbtth.exe 1xxrlfx.exe PID 2644 wrote to memory of 2488 2644 hhbtth.exe 1xxrlfx.exe PID 2644 wrote to memory of 2488 2644 hhbtth.exe 1xxrlfx.exe PID 2644 wrote to memory of 2488 2644 hhbtth.exe 1xxrlfx.exe PID 2488 wrote to memory of 1856 2488 1xxrlfx.exe nnnhth.exe PID 2488 wrote to memory of 1856 2488 1xxrlfx.exe nnnhth.exe PID 2488 wrote to memory of 1856 2488 1xxrlfx.exe nnnhth.exe PID 2488 wrote to memory of 1856 2488 1xxrlfx.exe nnnhth.exe PID 1856 wrote to memory of 2576 1856 nnnhth.exe djpjp.exe PID 1856 wrote to memory of 2576 1856 nnnhth.exe djpjp.exe PID 1856 wrote to memory of 2576 1856 nnnhth.exe djpjp.exe PID 1856 wrote to memory of 2576 1856 nnnhth.exe djpjp.exe PID 2576 wrote to memory of 2428 2576 djpjp.exe rxrfxxr.exe PID 2576 wrote to memory of 2428 2576 djpjp.exe rxrfxxr.exe PID 2576 wrote to memory of 2428 2576 djpjp.exe rxrfxxr.exe PID 2576 wrote to memory of 2428 2576 djpjp.exe rxrfxxr.exe PID 2428 wrote to memory of 2412 2428 rxrfxxr.exe nnhnbn.exe PID 2428 wrote to memory of 2412 2428 rxrfxxr.exe nnhnbn.exe PID 2428 wrote to memory of 2412 2428 rxrfxxr.exe nnhnbn.exe PID 2428 wrote to memory of 2412 2428 rxrfxxr.exe nnhnbn.exe PID 2412 wrote to memory of 2896 2412 nnhnbn.exe rxlllff.exe PID 2412 wrote to memory of 2896 2412 nnhnbn.exe rxlllff.exe PID 2412 wrote to memory of 2896 2412 nnhnbn.exe rxlllff.exe PID 2412 wrote to memory of 2896 2412 nnhnbn.exe rxlllff.exe PID 2896 wrote to memory of 2184 2896 rxlllff.exe lrxxxxx.exe PID 2896 wrote to memory of 2184 2896 rxlllff.exe lrxxxxx.exe PID 2896 wrote to memory of 2184 2896 rxlllff.exe lrxxxxx.exe PID 2896 wrote to memory of 2184 2896 rxlllff.exe lrxxxxx.exe PID 2184 wrote to memory of 316 2184 lrxxxxx.exe pjjvj.exe PID 2184 wrote to memory of 316 2184 lrxxxxx.exe pjjvj.exe PID 2184 wrote to memory of 316 2184 lrxxxxx.exe pjjvj.exe PID 2184 wrote to memory of 316 2184 lrxxxxx.exe pjjvj.exe PID 316 wrote to memory of 796 316 pjjvj.exe vjvdj.exe PID 316 wrote to memory of 796 316 pjjvj.exe vjvdj.exe PID 316 wrote to memory of 796 316 pjjvj.exe vjvdj.exe PID 316 wrote to memory of 796 316 pjjvj.exe vjvdj.exe PID 796 wrote to memory of 1620 796 vjvdj.exe nthnhb.exe PID 796 wrote to memory of 1620 796 vjvdj.exe nthnhb.exe PID 796 wrote to memory of 1620 796 vjvdj.exe nthnhb.exe PID 796 wrote to memory of 1620 796 vjvdj.exe nthnhb.exe PID 1620 wrote to memory of 1984 1620 nthnhb.exe hntnnn.exe PID 1620 wrote to memory of 1984 1620 nthnhb.exe hntnnn.exe PID 1620 wrote to memory of 1984 1620 nthnhb.exe hntnnn.exe PID 1620 wrote to memory of 1984 1620 nthnhb.exe hntnnn.exe PID 1984 wrote to memory of 344 1984 hntnnn.exe 9lxfxff.exe PID 1984 wrote to memory of 344 1984 hntnnn.exe 9lxfxff.exe PID 1984 wrote to memory of 344 1984 hntnnn.exe 9lxfxff.exe PID 1984 wrote to memory of 344 1984 hntnnn.exe 9lxfxff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e605a840e9062aa8ec172917fe66a1000d44301e8f973793cd3070e16a4f01ae.exe"C:\Users\Admin\AppData\Local\Temp\e605a840e9062aa8ec172917fe66a1000d44301e8f973793cd3070e16a4f01ae.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\lflfrxf.exec:\lflfrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjjpv.exec:\pjjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjvvp.exec:\jjvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhbtth.exec:\hhbtth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1xxrlfx.exec:\1xxrlfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnnhth.exec:\nnnhth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djpjp.exec:\djpjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxrfxxr.exec:\rxrfxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnhnbn.exec:\nnhnbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxlllff.exec:\rxlllff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjjvj.exec:\pjjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjvdj.exec:\vjvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nthnhb.exec:\nthnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hntnnn.exec:\hntnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9lxfxff.exec:\9lxfxff.exe17⤵
- Executes dropped EXE
-
\??\c:\nhbnhn.exec:\nhbnhn.exe18⤵
- Executes dropped EXE
-
\??\c:\ddjvv.exec:\ddjvv.exe19⤵
- Executes dropped EXE
-
\??\c:\frrfxfx.exec:\frrfxfx.exe20⤵
- Executes dropped EXE
-
\??\c:\nhthbh.exec:\nhthbh.exe21⤵
- Executes dropped EXE
-
\??\c:\3pppj.exec:\3pppj.exe22⤵
- Executes dropped EXE
-
\??\c:\5rxfxrl.exec:\5rxfxrl.exe23⤵
- Executes dropped EXE
-
\??\c:\ppvpp.exec:\ppvpp.exe24⤵
- Executes dropped EXE
-
\??\c:\rlfxffr.exec:\rlfxffr.exe25⤵
- Executes dropped EXE
-
\??\c:\flxlffr.exec:\flxlffr.exe26⤵
- Executes dropped EXE
-
\??\c:\hhnhnh.exec:\hhnhnh.exe27⤵
- Executes dropped EXE
-
\??\c:\vvvjv.exec:\vvvjv.exe28⤵
- Executes dropped EXE
-
\??\c:\nnnbnt.exec:\nnnbnt.exe29⤵
- Executes dropped EXE
-
\??\c:\djpjp.exec:\djpjp.exe30⤵
- Executes dropped EXE
-
\??\c:\llxfflf.exec:\llxfflf.exe31⤵
- Executes dropped EXE
-
\??\c:\vjppv.exec:\vjppv.exe32⤵
- Executes dropped EXE
-
\??\c:\flrlxxx.exec:\flrlxxx.exe33⤵
- Executes dropped EXE
-
\??\c:\nthhbt.exec:\nthhbt.exe34⤵
- Executes dropped EXE
-
\??\c:\ppdjv.exec:\ppdjv.exe35⤵
- Executes dropped EXE
-
\??\c:\pjjjv.exec:\pjjjv.exe36⤵
- Executes dropped EXE
-
\??\c:\rxrrflr.exec:\rxrrflr.exe37⤵
- Executes dropped EXE
-
\??\c:\3hhthb.exec:\3hhthb.exe38⤵
- Executes dropped EXE
-
\??\c:\jjddj.exec:\jjddj.exe39⤵
- Executes dropped EXE
-
\??\c:\pjjdj.exec:\pjjdj.exe40⤵
- Executes dropped EXE
-
\??\c:\fffxrlx.exec:\fffxrlx.exe41⤵
- Executes dropped EXE
-
\??\c:\hthtbh.exec:\hthtbh.exe42⤵
- Executes dropped EXE
-
\??\c:\dvpvd.exec:\dvpvd.exe43⤵
- Executes dropped EXE
-
\??\c:\vvjjj.exec:\vvjjj.exe44⤵
- Executes dropped EXE
-
\??\c:\lrrlrll.exec:\lrrlrll.exe45⤵
- Executes dropped EXE
-
\??\c:\htnhhn.exec:\htnhhn.exe46⤵
- Executes dropped EXE
-
\??\c:\jddjd.exec:\jddjd.exe47⤵
- Executes dropped EXE
-
\??\c:\pdvdp.exec:\pdvdp.exe48⤵
- Executes dropped EXE
-
\??\c:\frlfflr.exec:\frlfflr.exe49⤵
- Executes dropped EXE
-
\??\c:\7tnnth.exec:\7tnnth.exe50⤵
- Executes dropped EXE
-
\??\c:\ntnhhb.exec:\ntnhhb.exe51⤵
- Executes dropped EXE
-
\??\c:\vjvpd.exec:\vjvpd.exe52⤵
- Executes dropped EXE
-
\??\c:\xlrrrll.exec:\xlrrrll.exe53⤵
- Executes dropped EXE
-
\??\c:\tbhbbh.exec:\tbhbbh.exe54⤵
- Executes dropped EXE
-
\??\c:\hhnnnn.exec:\hhnnnn.exe55⤵
- Executes dropped EXE
-
\??\c:\vdjjv.exec:\vdjjv.exe56⤵
- Executes dropped EXE
-
\??\c:\llfxrfr.exec:\llfxrfr.exe57⤵
- Executes dropped EXE
-
\??\c:\nnbbhh.exec:\nnbbhh.exe58⤵
- Executes dropped EXE
-
\??\c:\jdvpp.exec:\jdvpp.exe59⤵
- Executes dropped EXE
-
\??\c:\vvjjd.exec:\vvjjd.exe60⤵
- Executes dropped EXE
-
\??\c:\llrrxfl.exec:\llrrxfl.exe61⤵
- Executes dropped EXE
-
\??\c:\xxflxxr.exec:\xxflxxr.exe62⤵
- Executes dropped EXE
-
\??\c:\nbnhtt.exec:\nbnhtt.exe63⤵
- Executes dropped EXE
-
\??\c:\bhhtth.exec:\bhhtth.exe64⤵
- Executes dropped EXE
-
\??\c:\vdvpp.exec:\vdvpp.exe65⤵
- Executes dropped EXE
-
\??\c:\pdvpj.exec:\pdvpj.exe66⤵
-
\??\c:\flrrfxf.exec:\flrrfxf.exe67⤵
-
\??\c:\tbtnht.exec:\tbtnht.exe68⤵
-
\??\c:\bhnhtt.exec:\bhnhtt.exe69⤵
-
\??\c:\jjpvp.exec:\jjpvp.exe70⤵
-
\??\c:\rxrrfxl.exec:\rxrrfxl.exe71⤵
-
\??\c:\xrrfxlr.exec:\xrrfxlr.exe72⤵
-
\??\c:\bnbhnb.exec:\bnbhnb.exe73⤵
-
\??\c:\hhhnhn.exec:\hhhnhn.exe74⤵
-
\??\c:\jvppv.exec:\jvppv.exe75⤵
-
\??\c:\lffllxx.exec:\lffllxx.exe76⤵
-
\??\c:\nnthbn.exec:\nnthbn.exe77⤵
-
\??\c:\nnhnbh.exec:\nnhnbh.exe78⤵
-
\??\c:\pdjdv.exec:\pdjdv.exe79⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe80⤵
-
\??\c:\frrxflf.exec:\frrxflf.exe81⤵
-
\??\c:\thnnnn.exec:\thnnnn.exe82⤵
-
\??\c:\vdpdd.exec:\vdpdd.exe83⤵
-
\??\c:\dvpvj.exec:\dvpvj.exe84⤵
-
\??\c:\llrflxf.exec:\llrflxf.exe85⤵
-
\??\c:\bhnbhb.exec:\bhnbhb.exe86⤵
-
\??\c:\vdddv.exec:\vdddv.exe87⤵
-
\??\c:\5flfffl.exec:\5flfffl.exe88⤵
-
\??\c:\htnbbh.exec:\htnbbh.exe89⤵
-
\??\c:\tbbtht.exec:\tbbtht.exe90⤵
-
\??\c:\vvppd.exec:\vvppd.exe91⤵
-
\??\c:\llrxlfl.exec:\llrxlfl.exe92⤵
-
\??\c:\lfrrflx.exec:\lfrrflx.exe93⤵
-
\??\c:\3nnhnn.exec:\3nnhnn.exe94⤵
-
\??\c:\bbhnhb.exec:\bbhnhb.exe95⤵
-
\??\c:\pdjvj.exec:\pdjvj.exe96⤵
-
\??\c:\xfrfxll.exec:\xfrfxll.exe97⤵
-
\??\c:\hnbbhh.exec:\hnbbhh.exe98⤵
-
\??\c:\tbnbhb.exec:\tbnbhb.exe99⤵
-
\??\c:\jjvpd.exec:\jjvpd.exe100⤵
-
\??\c:\xrrllfr.exec:\xrrllfr.exe101⤵
-
\??\c:\3tthbb.exec:\3tthbb.exe102⤵
-
\??\c:\jjdpd.exec:\jjdpd.exe103⤵
-
\??\c:\djdvp.exec:\djdvp.exe104⤵
-
\??\c:\xxfxlll.exec:\xxfxlll.exe105⤵
-
\??\c:\btbnhn.exec:\btbnhn.exe106⤵
-
\??\c:\pjvdp.exec:\pjvdp.exe107⤵
-
\??\c:\fxlrxlr.exec:\fxlrxlr.exe108⤵
-
\??\c:\hbbtbb.exec:\hbbtbb.exe109⤵
-
\??\c:\bbtbnn.exec:\bbtbnn.exe110⤵
-
\??\c:\pvvjd.exec:\pvvjd.exe111⤵
-
\??\c:\lfxrxll.exec:\lfxrxll.exe112⤵
-
\??\c:\rrffrlx.exec:\rrffrlx.exe113⤵
-
\??\c:\hnthbh.exec:\hnthbh.exe114⤵
-
\??\c:\dvpdj.exec:\dvpdj.exe115⤵
-
\??\c:\jjpvj.exec:\jjpvj.exe116⤵
-
\??\c:\3rlflll.exec:\3rlflll.exe117⤵
-
\??\c:\lrrxrxr.exec:\lrrxrxr.exe118⤵
-
\??\c:\7tnbth.exec:\7tnbth.exe119⤵
-
\??\c:\jpjvv.exec:\jpjvv.exe120⤵
-
\??\c:\ddvpd.exec:\ddvpd.exe121⤵
-
\??\c:\rxrxrfl.exec:\rxrxrfl.exe122⤵
-
\??\c:\tbthbt.exec:\tbthbt.exe123⤵
-
\??\c:\3tthnn.exec:\3tthnn.exe124⤵
-
\??\c:\jdpdv.exec:\jdpdv.exe125⤵
-
\??\c:\pddjd.exec:\pddjd.exe126⤵
-
\??\c:\xxxlflf.exec:\xxxlflf.exe127⤵
-
\??\c:\tthbnh.exec:\tthbnh.exe128⤵
-
\??\c:\pppdd.exec:\pppdd.exe129⤵
-
\??\c:\jjpjj.exec:\jjpjj.exe130⤵
-
\??\c:\xxxfrxl.exec:\xxxfrxl.exe131⤵
-
\??\c:\bhnnnn.exec:\bhnnnn.exe132⤵
-
\??\c:\hnhbbt.exec:\hnhbbt.exe133⤵
-
\??\c:\vjppd.exec:\vjppd.exe134⤵
-
\??\c:\nhhnht.exec:\nhhnht.exe135⤵
-
\??\c:\dpjjd.exec:\dpjjd.exe136⤵
-
\??\c:\jpdvj.exec:\jpdvj.exe137⤵
-
\??\c:\rrxlrlf.exec:\rrxlrlf.exe138⤵
-
\??\c:\1thtbh.exec:\1thtbh.exe139⤵
-
\??\c:\tnbnnt.exec:\tnbnnt.exe140⤵
-
\??\c:\vvpdv.exec:\vvpdv.exe141⤵
-
\??\c:\lrrrrfl.exec:\lrrrrfl.exe142⤵
-
\??\c:\rxfrrlf.exec:\rxfrrlf.exe143⤵
-
\??\c:\tttthh.exec:\tttthh.exe144⤵
-
\??\c:\nnhbbh.exec:\nnhbbh.exe145⤵
-
\??\c:\3jdpv.exec:\3jdpv.exe146⤵
-
\??\c:\fflxrxr.exec:\fflxrxr.exe147⤵
-
\??\c:\lffrffl.exec:\lffrffl.exe148⤵
-
\??\c:\tnhnbb.exec:\tnhnbb.exe149⤵
-
\??\c:\vjdvp.exec:\vjdvp.exe150⤵
-
\??\c:\ddjpv.exec:\ddjpv.exe151⤵
-
\??\c:\ffxlflx.exec:\ffxlflx.exe152⤵
-
\??\c:\7hhnhb.exec:\7hhnhb.exe153⤵
-
\??\c:\htbthh.exec:\htbthh.exe154⤵
-
\??\c:\ddjpd.exec:\ddjpd.exe155⤵
-
\??\c:\vjpjv.exec:\vjpjv.exe156⤵
-
\??\c:\fflrlfx.exec:\fflrlfx.exe157⤵
-
\??\c:\bthntb.exec:\bthntb.exe158⤵
-
\??\c:\nhbhbh.exec:\nhbhbh.exe159⤵
-
\??\c:\jjjpd.exec:\jjjpd.exe160⤵
-
\??\c:\pvpdj.exec:\pvpdj.exe161⤵
-
\??\c:\fxxfrxx.exec:\fxxfrxx.exe162⤵
-
\??\c:\7xxxxlx.exec:\7xxxxlx.exe163⤵
-
\??\c:\btntbn.exec:\btntbn.exe164⤵
-
\??\c:\dpjpd.exec:\dpjpd.exe165⤵
-
\??\c:\vvpdj.exec:\vvpdj.exe166⤵
-
\??\c:\fffxxxl.exec:\fffxxxl.exe167⤵
-
\??\c:\5nnnnh.exec:\5nnnnh.exe168⤵
-
\??\c:\1nhnbt.exec:\1nhnbt.exe169⤵
-
\??\c:\pjjpd.exec:\pjjpd.exe170⤵
-
\??\c:\vdjpd.exec:\vdjpd.exe171⤵
-
\??\c:\rxxlxrr.exec:\rxxlxrr.exe172⤵
-
\??\c:\lflrrlf.exec:\lflrrlf.exe173⤵
-
\??\c:\tnnbhn.exec:\tnnbhn.exe174⤵
-
\??\c:\tnthtb.exec:\tnthtb.exe175⤵
-
\??\c:\3pppj.exec:\3pppj.exe176⤵
-
\??\c:\xrffxrx.exec:\xrffxrx.exe177⤵
-
\??\c:\xxxxllx.exec:\xxxxllx.exe178⤵
-
\??\c:\hnbhbn.exec:\hnbhbn.exe179⤵
-
\??\c:\dpjdp.exec:\dpjdp.exe180⤵
-
\??\c:\jppjj.exec:\jppjj.exe181⤵
-
\??\c:\3rlxlrf.exec:\3rlxlrf.exe182⤵
-
\??\c:\thtbnb.exec:\thtbnb.exe183⤵
-
\??\c:\tbbbnh.exec:\tbbbnh.exe184⤵
-
\??\c:\jvvdp.exec:\jvvdp.exe185⤵
-
\??\c:\jjppv.exec:\jjppv.exe186⤵
-
\??\c:\fllxfxx.exec:\fllxfxx.exe187⤵
-
\??\c:\bbtthb.exec:\bbtthb.exe188⤵
-
\??\c:\vjjjp.exec:\vjjjp.exe189⤵
-
\??\c:\7ddpp.exec:\7ddpp.exe190⤵
-
\??\c:\rxxflxx.exec:\rxxflxx.exe191⤵
-
\??\c:\llfxlrf.exec:\llfxlrf.exe192⤵
-
\??\c:\bttbtt.exec:\bttbtt.exe193⤵
-
\??\c:\7hbhnt.exec:\7hbhnt.exe194⤵
-
\??\c:\vjppj.exec:\vjppj.exe195⤵
-
\??\c:\9vvpp.exec:\9vvpp.exe196⤵
-
\??\c:\xxxrfrr.exec:\xxxrfrr.exe197⤵
-
\??\c:\1lrflxx.exec:\1lrflxx.exe198⤵
-
\??\c:\ttnthb.exec:\ttnthb.exe199⤵
-
\??\c:\hhthth.exec:\hhthth.exe200⤵
-
\??\c:\ppdpv.exec:\ppdpv.exe201⤵
-
\??\c:\fxlfxxf.exec:\fxlfxxf.exe202⤵
-
\??\c:\thhbhh.exec:\thhbhh.exe203⤵
-
\??\c:\thhtnb.exec:\thhtnb.exe204⤵
-
\??\c:\vvvpj.exec:\vvvpj.exe205⤵
-
\??\c:\jjvvv.exec:\jjvvv.exe206⤵
-
\??\c:\rrxxlrl.exec:\rrxxlrl.exe207⤵
-
\??\c:\xlxxffl.exec:\xlxxffl.exe208⤵
-
\??\c:\htbbnt.exec:\htbbnt.exe209⤵
-
\??\c:\5djdj.exec:\5djdj.exe210⤵
-
\??\c:\jpddd.exec:\jpddd.exe211⤵
-
\??\c:\flfxxxx.exec:\flfxxxx.exe212⤵
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe213⤵
-
\??\c:\thhhbb.exec:\thhhbb.exe214⤵
-
\??\c:\jdvpd.exec:\jdvpd.exe215⤵
-
\??\c:\rrrfrrf.exec:\rrrfrrf.exe216⤵
-
\??\c:\rxlrxrx.exec:\rxlrxrx.exe217⤵
-
\??\c:\thnnnn.exec:\thnnnn.exe218⤵
-
\??\c:\jjvpp.exec:\jjvpp.exe219⤵
-
\??\c:\vddpd.exec:\vddpd.exe220⤵
-
\??\c:\lrfrlff.exec:\lrfrlff.exe221⤵
-
\??\c:\rxrfrxf.exec:\rxrfrxf.exe222⤵
-
\??\c:\9hbbbt.exec:\9hbbbt.exe223⤵
-
\??\c:\5thbhh.exec:\5thbhh.exe224⤵
-
\??\c:\vvpvp.exec:\vvpvp.exe225⤵
-
\??\c:\rrfflxr.exec:\rrfflxr.exe226⤵
-
\??\c:\lxxflll.exec:\lxxflll.exe227⤵
-
\??\c:\tbbhhh.exec:\tbbhhh.exe228⤵
-
\??\c:\dpddj.exec:\dpddj.exe229⤵
-
\??\c:\xlrlrll.exec:\xlrlrll.exe230⤵
-
\??\c:\hhhnhb.exec:\hhhnhb.exe231⤵
-
\??\c:\bbtbtt.exec:\bbtbtt.exe232⤵
-
\??\c:\vvvjd.exec:\vvvjd.exe233⤵
-
\??\c:\lrflflx.exec:\lrflflx.exe234⤵
-
\??\c:\rlrrxxx.exec:\rlrrxxx.exe235⤵
-
\??\c:\nthhtn.exec:\nthhtn.exe236⤵
-
\??\c:\jjvdv.exec:\jjvdv.exe237⤵
-
\??\c:\flfxxll.exec:\flfxxll.exe238⤵
-
\??\c:\xlxxffx.exec:\xlxxffx.exe239⤵
-
\??\c:\bnnbhh.exec:\bnnbhh.exe240⤵
-
\??\c:\pdppv.exec:\pdppv.exe241⤵